(a) Process and systems requirements.

(1) A national bank or Federal savings association must have a rigorous process for assessing its overall capital adequacy in relation to its risk profile and a comprehensive strategy for maintaining an appropriate level of capital.

(2) The systems and processes used by a national bank or Federal savings association for risk-based capital purposes under this subpart must be consistent with the national bank's or Federal savings association's internal risk management processes and management information reporting systems.

(3) Each national bank or Federal savings association must have an appropriate infrastructure with risk measurement and management processes that meet the qualification requirements of this section and are appropriate given the national bank's or Federal savings association's size and level of complexity. Regardless of whether the systems and models that generate the risk parameters necessary for calculating a national bank's or Federal savings association's risk-based capital requirements are located at any affiliate of the national bank or Federal savings association, the national bank or Federal savings association itself must ensure that the risk parameters and reference data used to determine its risk-based capital requirements are representative of long run experience with respect to its own credit risk and operational risk exposures.

(b) Risk rating and segmentation systems for wholesale and retail exposures.

(1)

(i) A national bank or Federal savings association must have an internal risk rating and segmentation system that accurately, reliably, and meaningfully differentiates among degrees of credit risk for the national bank's or Federal savings association's wholesale and retail exposures. When assigning an internal risk rating, a national bank or Federal savings association may consider a third-party assessment of credit risk, provided that the national bank's or Federal savings association's internal risk rating assignment does not rely solely on the external assessment.

(ii) If a national bank or Federal savings association uses multiple rating or segmentation systems, the national bank's or Federal savings association's rationale for assigning an obligor or exposure to a particular system must be documented and applied in a manner that best reflects the obligor's or exposure's level of risk. A national bank or Federal savings association must not inappropriately allocate obligors or exposures across systems to minimize regulatory capital requirements.

(iii) In assigning ratings to wholesale obligors and exposures, including loss severity ratings grades to wholesale exposures, and assigning retail exposures to retail segments, a national bank or Federal savings association must use all relevant and material information and ensure that the information is current.

(iv) When assigning an obligor to a PD rating or retail exposure to a PD segment, a national bank or Federal savings association must assess the obligor or retail borrower's ability and willingness to contractually perform, taking a conservative view of projected information.

(2) For wholesale exposures:

(i) A national bank or Federal savings association must have an internal risk rating system that accurately and reliably assigns each obligor to a single rating grade (reflecting the obligor's likelihood of default). A national bank or Federal savings association may elect, however, not to assign to a rating grade an obligor to whom the national bank or Federal savings association extends credit based solely on the financial strength of a guarantor, provided that all of the national bank's or Federal savings association's exposures to the obligor are fully covered by eligible guarantees, the national bank or Federal savings association applies the PD substitution approach in §3.134(c)(1) to all exposures to that obligor, and the national bank or Federal savings association immediately assigns the obligor to a rating grade if a guarantee can no longer be recognized under this part. The national bank's or Federal savings association's wholesale obligor rating system must have at least seven discrete rating grades for non-defaulted obligors and at least one rating grade for defaulted obligors.

(ii) Unless the national bank or Federal savings association has chosen to directly assign LGD estimates to each wholesale exposure, the national bank or Federal savings association must have an internal risk rating system that accurately and reliably assigns each wholesale exposure to a loss severity rating grade (reflecting the national bank's or Federal savings association's estimate of the LGD of the exposure). A national bank or Federal savings association employing loss severity rating grades must have a sufficiently granular loss severity grading system to avoid grouping together exposures with widely ranging LGDs.

(iii) A national bank or Federal savings association must have an effective process to obtain and update in a timely manner relevant and material information on obligor and exposure characteristics that affect PD, LGD and EAD.

(3) For retail exposures:

(i) A national bank or Federal savings association must have an internal system that groups retail exposures into the appropriate retail exposure subcategory and groups the retail exposures in each retail exposure subcategory into separate segments with homogeneous risk characteristics that provide a meaningful differentiation of risk. The national bank's or Federal savings association's system must identify and group in separate segments by subcategories exposures identified in §3.131(c)(2)(ii) and (iii).

(ii) A national bank or Federal savings association must have an internal system that captures all relevant exposure risk characteristics, including borrower credit score, product and collateral types, as well as exposure delinquencies, and must consider cross-collateral provisions, where present.

(iii) The national bank or Federal savings association must review and, if appropriate, update assignments of individual retail exposures to segments and the loss characteristics and delinquency status of each identified risk segment. These reviews must occur whenever the national bank or Federal savings association receives new material information, but generally no less frequently than quarterly, and, in all cases, at least annually.

(4) The national bank's or Federal savings association's internal risk rating policy for wholesale exposures must describe the national bank's or Federal savings association's rating philosophy (that is, must describe how wholesale obligor rating assignments are affected by the national bank's or Federal savings association's choice of the range of economic, business, and industry conditions that are considered in the obligor rating process).

(5) The national bank's or Federal savings association's internal risk rating system for wholesale exposures must provide for the review and update (as appropriate) of each obligor rating and (if applicable) each loss severity rating whenever the national bank or Federal savings association obtains relevant and material information on the obligor or exposure that affects PD, LGD and EAD, but no less frequently than annually.

(c) Quantification of risk parameters for wholesale and retail exposures.

(1) The national bank or Federal savings association must have a comprehensive risk parameter quantification process that produces accurate, timely, and reliable estimates of the risk parameters on a consistent basis for the national bank's or Federal savings association's wholesale and retail exposures.

(2) A national bank's or Federal savings association's estimates of PD, LGD, and EAD must incorporate all relevant, material, and available data that is reflective of the national bank's or Federal savings association's actual wholesale and retail exposures and of sufficient quality to support the determination of risk-based capital requirements for the exposures. In particular, the population of exposures in the data used for estimation purposes, the lending standards in use when the data were generated, and other relevant characteristics, should closely match or be comparable to the national bank's or Federal savings association's exposures and standards. In addition, a national bank or Federal savings association must:

(i) Demonstrate that its estimates are representative of long run experience, including periods of economic downturn conditions, whether internal or external data are used;

(ii) Take into account any changes in lending practice or the process for pursuing recoveries over the observation period;

(iii) Promptly reflect technical advances, new data, and other information as they become available;

(iv) Demonstrate that the data used to estimate risk parameters support the accuracy and robustness of those estimates; and

(v) Demonstrate that its estimation technique performs well in out-of-sample tests whenever possible.

(3) The national bank's or Federal savings association's risk parameter quantification process must produce appropriately conservative risk parameter estimates where the national bank or Federal savings association has limited relevant data, and any adjustments that are part of the quantification process must not result in a pattern of bias toward lower risk parameter estimates.

(4) The national bank's or Federal savings association's risk parameter estimation process should not rely on the possibility of U.S. government financial assistance, except for the financial assistance that the U.S. government has a legally binding commitment to provide.

(5) The national bank or Federal savings association must be able to demonstrate which variables have been found to be statistically significant with regard to EAD. The national bank's or Federal savings association's EAD estimates must reflect its specific policies and strategies with regard to account management, including account monitoring and payment processing, and its ability and willingness to prevent further drawdowns in circumstances short of payment default. The national bank or Federal savings association must have adequate systems and procedures in place to monitor current outstanding amounts against committed lines, and changes in outstanding amounts per obligor and obligor rating grade and per retail segment. The national bank or Federal savings association must be able to monitor outstanding amounts on a daily basis.

(6) At a minimum, PD estimates for wholesale obligors and retail segments must be based on at least five years of default data. LGD estimates for wholesale exposures must be based on at least seven years of loss severity data, and LGD estimates for retail segments must be based on at least five years of loss severity data. EAD estimates for wholesale exposures must be based on at least seven years of exposure amount data, and EAD estimates for retail segments must be based on at least five years of exposure amount data. If the national bank or Federal savings association has relevant and material reference data that span a longer period of time than the minimum time periods specified above, the national bank or Federal savings association must incorporate such data in its estimates, provided that it does not place undue weight on periods of favorable or benign economic conditions relative to periods of economic downturn conditions.

(7) Default, loss severity, and exposure amount data must include periods of economic downturn conditions, or the national bank or Federal savings association must adjust its estimates of risk parameters to compensate for the lack of data from periods of economic downturn conditions.

(8) The national bank's or Federal savings association's PD, LGD, and EAD estimates must be based on the definition of default in §3.101.

(9) If a national bank or Federal savings association uses internal data obtained prior to becoming subject to this subpart E or external data to arrive at PD, LGD, or EAD estimates, the national bank or Federal savings association must demonstrate to the OCC that the national bank or Federal savings association has made appropriate adjustments if necessary to be consistent with the definition of default in §3.101. Internal data obtained after the national bank or Federal savings association becomes subject to this subpart E must be consistent with the definition of default in §3.101.

(10) The national bank or Federal savings association must review and update (as appropriate) its risk parameters and its risk parameter quantification process at least annually.

(11) The national bank or Federal savings association must, at least annually, conduct a comprehensive review and analysis of reference data to determine relevance of the reference data to the national bank's or Federal savings association's exposures, quality of reference data to support PD, LGD, and EAD estimates, and consistency of reference data to the definition of default in §3.101.

(d) Counterparty credit risk model. A national bank or Federal savings association must obtain the prior written approval of the OCC under §3.132 to use the internal models methodology for counterparty credit risk and the advanced CVA approach for the CVA capital requirement.

(e) Double default treatment. A national bank or Federal savings association must obtain the prior written approval of the OCC under §3.135 to use the double default treatment.

(f) Equity exposures model. A national bank or Federal savings association must obtain the prior written approval of the OCC under §3.153 to use the internal models approach for equity exposures.

(g) Operational risk.

(1) Operational risk management processes. A national bank or Federal savings association must:

(i) Have an operational risk management function that:

(A) Is independent of business line management; and

(B) Is responsible for designing, implementing, and overseeing the national bank's or Federal savings association's operational risk data and assessment systems, operational risk quantification systems, and related processes;

(ii) Have and document a process (which must capture business environment and internal control factors affecting the national bank's or Federal savings association's operational risk profile) to identify, measure, monitor, and control operational risk in the national bank's or Federal savings association's products, activities, processes, and systems; and

(iii) Report operational risk exposures, operational loss events, and other relevant operational risk information to business unit management, senior management, and the board of directors (or a designated committee of the board).

(2) Operational risk data and assessment systems. A national bank or Federal savings association must have operational risk data and assessment systems that capture operational risks to which the national bank or Federal savings association is exposed. The national bank's or Federal savings association's operational risk data and assessment systems must:

(i) Be structured in a manner consistent with the national bank's or Federal savings association's current business activities, risk profile, technological processes, and risk management processes; and

(ii) Include credible, transparent, systematic, and verifiable processes that incorporate the following elements on an ongoing basis:

(A) Internal operational loss event data. The national bank or Federal savings association must have a systematic process for capturing and using internal operational loss event data in its operational risk data and assessment systems.

(1) The national bank's or Federal savings association's operational risk data and assessment systems must include a historical observation period of at least five years for internal operational loss event data (or such shorter period approved by the OCC to address transitional situations, such as integrating a new business line).

(2) The national bank or Federal savings association must be able to map its internal operational loss event data into the seven operational loss event type categories.

(3) The national bank or Federal savings association may refrain from collecting internal operational loss event data for individual operational losses below established dollar threshold amounts if the national bank or Federal savings association can demonstrate to the satisfaction of the OCC that the thresholds are reasonable, do not exclude important internal operational loss event data, and permit the national bank or Federal savings association to capture substantially all the dollar value of the national bank's or Federal savings association's operational losses.

(B) External operational loss event data. The national bank or Federal savings association must have a systematic process for determining its methodologies for incorporating external operational loss event data into its operational risk data and assessment systems.

(C) Scenario analysis. The national bank or Federal savings association must have a systematic process for determining its methodologies for incorporating scenario analysis into its operational risk data and assessment systems.

(D) Business environment and internal control factors. The national bank or Federal savings association must incorporate business environment and internal control factors into its operational risk data and assessment systems. The national bank or Federal savings association must also periodically compare the results of its prior business environment and internal control factor assessments against its actual operational losses incurred in the intervening period.

(3) Operational risk quantification systems.

(i) The national bank's or Federal savings association's operational risk quantification systems:

(A) Must generate estimates of the national bank's or Federal savings association's operational risk exposure using its operational risk data and assessment systems;

(B) Must employ a unit of measure that is appropriate for the national bank's or Federal savings association's range of business activities and the variety of operational loss events to which it is exposed, and that does not combine business activities or operational loss events with demonstrably different risk profiles within the same loss distribution;

(C) Must include a credible, transparent, systematic, and verifiable approach for weighting each of the four elements, described in paragraph (g)(2)(ii) of this section, that a national bank or Federal savings association is required to incorporate into its operational risk data and assessment systems;

(D) May use internal estimates of dependence among operational losses across and within units of measure if the national bank or Federal savings association can demonstrate to the satisfaction of the OCC that its process for estimating dependence is sound, robust to a variety of scenarios, and implemented with integrity, and allows for uncertainty surrounding the estimates. If the national bank or Federal savings association has not made such a demonstration, it must sum operational risk exposure estimates across units of measure to calculate its total operational risk exposure; and

(E) Must be reviewed and updated (as appropriate) whenever the national bank or Federal savings association becomes aware of information that may have a material effect on the national bank's or Federal savings association's estimate of operational risk exposure, but the review and update must occur no less frequently than annually.

(ii) With the prior written approval of the OCC, a national bank or Federal savings association may generate an estimate of its operational risk exposure using an alternative approach to that specified in paragraph (g)(3)(i) of this section. A national bank or Federal savings association proposing to use such an alternative operational risk quantification system must submit a proposal to the OCC. In determining whether to approve a national bank's or Federal savings association's proposal to use an alternative operational risk quantification system, the OCC will consider the following principles:

(A) Use of the alternative operational risk quantification system will be allowed only on an exception basis, considering the size, complexity, and risk profile of the national bank or Federal savings association;

(B) The national bank or Federal savings association must demonstrate that its estimate of its operational risk exposure generated under the alternative operational risk quantification system is appropriate and can be supported empirically; and

(C) A national bank or Federal savings association must not use an allocation of operational risk capital requirements that includes entities other than depository institutions or the benefits of diversification across entities.

(h) Data management and maintenance.

(1) A national bank or Federal savings association must have data management and maintenance systems that adequately support all aspects of its advanced systems and the timely and accurate reporting of risk-based capital requirements.

(2) A national bank or Federal savings association must retain data using an electronic format that allows timely retrieval of data for analysis, validation, reporting, and disclosure purposes.

(3) A national bank or Federal savings association must retain sufficient data elements related to key risk drivers to permit adequate monitoring, validation, and refinement of its advanced systems.

(i) Control, oversight, and validation mechanisms.

(1) The national bank's or Federal savings association's senior management must ensure that all components of the national bank's or Federal savings association's advanced systems function effectively and comply with the qualification requirements in this section.

(2) The national bank's or Federal savings association's board of directors (or a designated committee of the board) must at least annually review the effectiveness of, and approve, the national bank's or Federal savings association's advanced systems.

(3) A national bank or Federal savings association must have an effective system of controls and oversight that:

(i) Ensures ongoing compliance with the qualification requirements in this section;

(ii) Maintains the integrity, reliability, and accuracy of the national bank's or Federal savings association's advanced systems; and

(iii) Includes adequate governance and project management processes.

(4) The national bank or Federal savings association must validate, on an ongoing basis, its advanced systems. The national bank's or Federal savings association's validation process must be independent of the advanced systems' development, implementation, and operation, or the validation process must be subjected to an independent review of its adequacy and effectiveness. Validation must include:

(i) An evaluation of the conceptual soundness of (including developmental evidence supporting) the advanced systems;

(ii) An ongoing monitoring process that includes verification of processes and benchmarking; and

(iii) An outcomes analysis process that includes backtesting.

(5) The national bank or Federal savings association must have an internal audit function or equivalent function that is independent of business-line management that at least annually:

(i) Reviews the national bank's or Federal savings association's advanced systems and associated operations, including the operations of its credit function and estimations of PD, LGD, and EAD;

(ii) Assesses the effectiveness of the controls supporting the national bank's or Federal savings association's advanced systems; and

(iii) Documents and reports its findings to the national bank's or Federal savings association's board of directors (or a committee thereof).

(6) The national bank or Federal savings association must periodically stress test its advanced systems. The stress testing must include a consideration of how economic cycles, especially downturns, affect risk-based capital requirements (including migration across rating grades and segments and the credit risk mitigation benefits of double default treatment).

(j) Documentation. The national bank or Federal savings association must adequately document all material aspects of its advanced systems.

[78 FR 62157, 62273, Oct. 11, 2013, as amended at 80 FR 41415, July 15, 2015]