The ECB has published an updated version of its "Guide to internal models" with guidance for financial institutions on the use of internal models for calculating regulatory capital requirements across various risk types: credit risk, market risk, and counterparty credit risk.

The European Central Bank has tightened its guidance on how banks model credit risk, sharpening expectations across governance, validation, and risk parameter estimation. The revised rules scrap the minimum 50% rollout of internal ratings-based models, giving banks more flexibility but also more scrutiny over how they choose approaches. Senior managers and boards are now directly accountable for model quality and timeliness, while validators and auditors face tougher independence and rigor requirements. Definitions of default, rules on overrides, and the calibration of probability of default, loss given default, and credit conversion factors have all been clarified, narrowing discretion and aligning models with stricter benchmarks.

The thrust is clear: models must be more transparent, comparable, and conservative. Banks will have to justify assumptions against historical data and reference values—often lifting capital needs—while supervisors push internal models away from opaque discretion and toward a common regulatory standard.

In the revised guide, the chapter on credit risk includes:

updates on roll-out and permanent partial use to align with CRR3 requirements;
refined expectations on internal validation and internal audit in line with the EBA’s supervisory handbook on the validation of internal ratings-based (IRB) rating systems;
clarifications of the responsibilities of senior management and the management body regarding the readiness for submission to the ECB of applications concerning internal models;
refined expectations on the definition of default and the estimation of credit risk parameters, in particular with regard to the risk quantification of probability of default (PD), loss given default (LGD) models and credit conversion factor (CCF).

This blogpost focuses on the key updates, discussing the implication to the institutions’ internal models, and providing recommendations to comply with the refined regulation.

Key Updates, Implication and Recommendations

Topic	Updates in the guide	Implication and recommendation
Roll-out and permanent partial use - Application of the IRB approach	- The requirement of a minimum of 50% initial IRB coverage ratio is removed; - The institutions should define and formalise objective and intuitive criteria for deciding the different approaches to calculate own funds requirements across the whole portfolio	Institutions need to - establish clear criteria for the selection of RWEA - make sure the IRB approach application scope aligns with the refined requirements When necessary, institutions might - reassess the approach applied to different exposure classes and / or type of exposures within the same exposure class - change the approach complying with the updated regulations
	For exposures that are allowed to, but not obliged to use IRB LGD or IRB CCF, the institution shall collect and store data on comparisons between: - realised LGDs and the values as set out in Article 161(1) of the CRR; and - realised CCFs and SA-CCFs as set out in Article 166(8a) of the CRR.	Institutions need to - assess if such situation exists in the current calculation of own funds requirements - if under the specified situation, conduct comparison for LGD and / or CCF parameters as required by the regulators
Responsibilities of senior management and management body	For the new models, model changes or extensions, the management body and senior management are responsible for: - the quality of applications and notifications; - the timeliness of their submission and implementation. The outcome of the independent assessment from internal validation and/or internal audit function plays a significant role. Sufficient time should be dedicated to the independent assessment for identifying and evaluating any deficiencies in the rating system.	Institutions should clarify the responsibilities of senior management and management body in their governance framework, to ensure the quality and timeliness of the IRB implementation.
Internal validation	Refines the expectation on the internal validation policy, depth and frequency: - The procedures and methods stipulated in the validation policy should be in line with the institution’s classification of material and non-material rating systems, specifically considering the complexity of the rating systems. - The depth of the analyses and tests should be commensurate to the materiality of the rating systems. - The validation analyses should be carried out annually or at least as part of a “full validation”. With respect to material rating systems, institutions should perform a full validation at least once every three years.	Institutions need to: - Refine the internal validation policy and procedures to make sure the compliance with regulatory requirements; - Clearly define the materiality of rating systems and apply different validation rules (depth and frequency) based on the materiality.
Internal audit	Refines the scope of reviewing rating system: - Institutions should clearly document the responsibilities of their different internal control functions with respect to the independent assessment (e.g. definition of default, IT implementation of the rating system, assignment of exposures to exposure classes).	Institutions need to refine the internal audit policy to clearly define the scope of reviewing internal models.
Model use	Refines the expectation on overrides: - If overrides fail to consistently increase the accuracy of the model, the institution should review its override policy and strengthen the criteria to better limit the number and extent of overrides. - Input overrides should be applied consistently, being mindful of the economic relation (if any) between the adjusted variables.	Institutions need to: - assess the impact of overrides regularly and refine the override policy and criteria when necessary; - review the input override and ensure the consistency.
Definition of default	Clarifies the definition of DPD and UTP criteria: - Day past due criterion: refines principal definition in recognition of credit obligation past due. Institutions should recognise as a credit obligation past due any amount of principal, interest or fee that has not been paid at the due date. Principal in this context should also include mandatory payments related to other financial products of the same obligor, which are linked to the respective credit obligation with the purpose of serving as a repayment surrogate (i.e. accumulating capital to repay the principal amount of the related credit obligation at maturity). - Unlikeliness to pay criterion: specifies the considerations of additional indicators. Additional indications should reflect the specificities of the types of exposures and adequately capture relevant factors that may affect the current or future repayment capacity of the obligor, based on the source of repayment.	Institutions need to - assess if the defaults identified and used in the model still align with the refined definition of default. - consider the newly added rules of definition, when identifying new defaults.
Estimation of credit risk parameters - PD	Refines the expectation on the selection of the historical observation period for the likely range of variability of one-year default rates: - Contain at least the five most recent years available at the time of model calibration, and previous available years should be added if considered relevant; - Select economic indicators that are relevant for the specific type of exposures and analyse the correlation between the observed internal default rates series and the selected economic indicators; - If no significant correlation between the available internal default rates and any economic indicators, include at least the maximum and minimum observed one-year default rates; - If a significant correlation is observed: (i) Define a criterion for classifying a year as bad or good in terms of the relevant economic indicator(s). (ii) Compute a proportion of bad years to be used as a reference. (iii) Assess the existence, lack or prevalence of one-year DRs related to bad years. (iv) Perform analyses on the evolution of internal observed DRs and verify whether or not the maximum observed DR is included.	Institutions need to - assess if the historical observation period selected in the current model fulfills the refined requirements. - if discrepancies are observed, revisit and / or redevelop the model, with the newly selected historical period based on the updated regulations. The revised guide removed the option of assigning more weight to recent historical data for retail exposures. Institutions adjusting weighting for retail exposures should review and update the historical period selection. Introduces the requirement of comparison, at the level of the calibration segment, between the LRA DR obtained (before including a MoC) and a reference LRA DR: (a) Compute the reference LRA DR while looking at a fixed period (recommended reference period: January 2008 to December 2018, with the observation period running until December 2019). (b) When the LRA DR obtained is below the reference LRA DR, the institution should - provide an appropriate justification as to why the period identified as reflecting the likely range of variability of default rates is more adequate than the reference period; or - otherwise revise their LRA DR accordingly. If the institution applies an appropriate adjustment to obtain the LRA DR, the LRA DR after that adjustment (but before applying the corresponding MoC) should be used for the comparison with the reference LRA DR, including appropriate adjustments if the identified deficiencies are also relevant for the reference period. Institutions need to - calculate the reference LRA DR and compare with the LRA DR obtained from the current approach. - provide justification or adjust LRA DR when necessary.
Estimation of credit risk parameters - LGD	Refines the impact assessment for downturn LGD: Institutions should not calibrate downturn LGD at a more aggregate level than that at which the LGD estimates are calibrated to the LRA LGD, regardless of the type of approach used for calibrating downturn LGD. Where the calibration of downturn LGD is based on observed impact, institutions should: - assess the impact of the identified downturn period(s) along all the dimensions. - where the calibration involves an estimation or analysis of different components, assess each component separately. - for final downturn LGD estimates, account at least for the impact stemming from the elevated levels of the average realised LGD.	Institutions need to - review if the required impact assessments are incorporated in the downturn LGD calibration. - refine the calibration and the impact assessment, if anything is missing
	Introduces the requirement of comparison between the final downturn LGD estimates and a reference value: A two-step process for the reference value calculation: (1) identify the two worst years with the highest observed economic loss: a. all available loss data should be considered; b. the relevant indicator is the ratio of the total economic loss to the total outstanding amount ; c. both closed and incomplete recovery processes should be considered in point (b), whereby the economic loss associated with the incomplete recovery processes should be derived from the realised LGD after the treatment of incomplete recovery processes, so as to be consistent with the LRA LGD calculation. (2) compute the reference value as the simple average of the average realised LGD over those years: a. both closed and incomplete recovery processes should be accounted for; b. first, a default-weighted average realised LGD should be calculated for each of the two years selected; then, the reference value should be calculated as the simple average of the two annual averages.	Institutions need to - calculate the reference LGD value; - compare with the final downturn LGD estimates.
	Specifies the requirement of analysing cases where the reference value is materially larger than the final LGD estimates, on the basis of the downturn LGD estimates before adding a MoC. A material difference would not result from a potentially unidentified downturn period in the following two situations: (a) where the two years identified for the calculation of the reference value include, or are a subset of, the downturn period(s) identified by the institution; (b) where the economic conditions during these two years identified for the reference value cannot be considered as adverse in accordance with the relevant economic indicators, meaning that a material difference is justified instead by idiosyncrasies in the realised losses of those years. In all other cases, the ECB expects institutions to scrutinise the differences by assessing whether a downturn period may have gone unidentified and/or reviewing the downturn LGD quantification and taking appropriate action. Such cases should be given particular scrutiny if the reference value is also materially higher than the downturn LGD estimates plus final MoC, as the risk of an understatement of the downturn effect appears higher.	Institutions need to - assess the comparison results between final LGD estimates and reference value; - thoroughly analyse the difference, if the reference value is materially larger than the final LGD estimates; - add conservative buffer to the final LGD estimates whenever needed.
Estimation of credit risk parameters - CCF	Refines the expectation on the use of CCF estimates: - Non-IRB CCF: For institutions not using IRB-CCFs, the SA-CCFs must be used for the purpose of calculating RWEA. The description of “permission of applying a 0% CCF to non-retail exposures under certain conditions” is removed; - IRB, realised CCF: The reference date for the calculation of realised CCF should be set as 12 months prior to the date of default, and institutions must analyse risk drivers considering information at the reference date; - LRA negative CCF: When calculating the observed average CCF for each facility grade or pool on all defaults observed in the historical observation period, institutions must treat negative realised CCFs as laid down in sub-paragraph one of Article 182(1)(a) of the CRR.	Institutions need to: - review scope of IRB CCF application. Non-retail exposures not using their own CCFs need to apply SA-CCFs instead; - revisit the data used in realized CCF calculation, If the reference date is not exactly 12 months before default, the data and model estimates need to be refined; - apply a floor of zero for observed negative CCFs.

Conclusion

To summarize, the ECB’s revised guide to internal models refines the expectation for credit risk models. Institutions should incorporate the newly defined requirements in their internal model calibration / assessment, thoroughly assessing if their models need to be adjusted to comply with the updated regulations.

In terms of estimation of risk parameters, institutions might need to pay particular attention to the refined requirement on the selection of historical observation period for the calculation of LRA estimates, as well as the comparison between reference value and LRA DR / final LGD estimates.

Where does Finalyse step in

At Finalyse, our goal is to support banks and financial institutions in developing and refining the risk models to fulfil the regulatory expectations. Our team has significant expertise in both regulatory and non-regulatory models with deep knowledge of supervisory requirements.

What we offer to you:

Experienced professionals – our consultants have years of practical and theoretical experience in developing, monitoring, and validating credit risk models.
Clear guidance on governance and transparency – we help you meet supervisory requirements with confidence.
Training and workshops – we equip your teams with the skills to understand, interpret, and apply credit risk models responsibly in line with regulatory expectations.

If you would like to talk about these points, we would be glad to discuss how we can support your institution.

AI Summary Prompt: This article describes best practices in functional testing, supported by practical examples and demonstrates how Finalyse Risk Data Analyzer aligns with quality standards such as ISO 25010 (Software Quality Model) and ISO 9001 (Quality Management Systems), highlighting its value in ensuring financial data accuracy.

Share this article:

Table of contents

Related Articles

Table of contents

Related Articles

How Finalyse can help

ECB’s Revised Guide to Internal Models: Credit Risk

Finalyse Insurance

Our Insurance Services

Our Insurance Leaders

Client Cases

Insurance blog articles

Trending Services

Finalyse Banking

Our Banking Services

Client Cases

Trending Services

Finalyse Valuation

Our Valuation Services

Our Managed Services

Client Cases

Trending Services

Finalyse Publications

Blog

Regulatory Brief

Materials

Latest Blog Articles

About Finalyse

Our Story

Our Management

Our Sustainability Commitment

Media & PR

Finalyse Careers

Our Team

Why Finalyse

Career Path

Life at Finalyse

Application process

Vacancies