9. Regulatory Framework

Almost every number a bank treasury produces, from the capital ratio to the liquidity buffer to a single derivative trade, ends up in front of a regulator. This chapter explains where those rules come from (the Basel standards and their regional implementations), how liquidity is regulated, how banks report to supervisors and what data quality supervisors demand, and the conduct rules (AML, sanctions, market abuse, trade reporting and record-keeping) that apply to treasury activity. For engineers, regulation explains why systems need versioned rule sets, attribute-level lineage, strict reporting deadlines and immutable audit trails, and why getting them wrong leads to fines, capital add-ons and, in the worst cases, the loss of a licence.

<a id="91-basel-accords"></a>

9.1 Basel Accords

This subchapter follows the international capital standards from their origins in 1988 to the 2017 finalisation package, explains the three-pillar structure that organizes them, and shows how the EU, the US and the UK turn non-binding Basel standards into enforceable law.

Evolution from Basel I to Basel III

Why it matters. Banks compete across borders. If one country lets its banks hold less capital, those banks can lend more cheaply and win business, and regulators elsewhere come under pressure to relax their own rules: a "race to the bottom". The Basel Committee on Banking Supervision (BCBS) was created to set common minimum standards so that banks compete on service and efficiency rather than on how thin their safety margin is. Each version of the Basel Accord was a response to weaknesses exposed by a crisis, so knowing the history explains why today's rules look the way they do.

The Basel Committee. The BCBS was founded in 1974 by the central bank governors of the G10 countries after the failure of Bankhaus Herstatt in Germany. Herstatt was closed mid-day while its counterparties had already paid Deutsche Marks and were still waiting for US dollars, which also gave its name to settlement risk (Chapter 2.1). The Committee is hosted by the Bank for International Settlements (BIS) in Basel and today includes authorities from 28 jurisdictions. Its standards have no legal force: they apply only once each jurisdiction writes them into its own law (see Regional Implementations below). The Committee checks how faithfully members do this through its Regulatory Consistency Assessment Programme (RCAP).

Timeline.

 1974  BCBS founded after Herstatt failure
   |
 1988  Basel I       Credit risk only; 8% capital / RWA; 5 broad risk weight buckets
   |
 1996  Market Risk Amendment   Trading book capital; banks may use internal VaR models
   |
 2004  Basel II      Three pillars; risk-sensitive credit weights (ratings, IRB models);
   |                 operational risk capital; supervisory review; disclosure
   |
 2009  Basel 2.5     Post-crisis patch to the trading book: stressed VaR,
   |                 incremental risk charge, tougher securitisation rules
   |
 2010  Basel III     More and better capital (CET1), buffers, leverage ratio,
   |                 first global liquidity standards (LCR, NSFR)
   |
 2017  Basel III     "Finalising post-crisis reforms": output floor, revised standardized
       final         approaches, limits on internal models, new CVA and op risk frameworks
                     (see next topic)

What each accord changed.

Accord	Problem it addressed	Key features	Weakness later exposed
Basel I (1988)	Falling capital levels at internationally active banks in the 1980s debt crisis	Capital at least 8% of RWA, Tier 1 at least 4%; risk weights 0%, 10%, 20%, 50%, 100% by broad counterparty type (OECD government, bank, mortgage, corporate)	Not risk-sensitive: an AAA corporate and a near-bankrupt corporate both weighted 100%, so banks kept the risky loans and securitized the safe ones (regulatory arbitrage)
Market Risk Amendment (1996)	Rapid growth of trading books	Capital for market risk; first use of internal models (VaR) for regulatory capital	VaR at 99%/10 days on calm data underestimated tail risk
Basel II (2004)	Basel I arbitrage	Pillar 1 (credit, market, operational risk), Pillar 2 (supervisory review), Pillar 3 (disclosure); standardized approach based on external ratings; internal ratings-based (IRB) approach	Capital quality too low; procyclical; trading book and securitisation risk underestimated; no liquidity or leverage limits
Basel 2.5 (2009)	Trading book losses in 2007-2008	Stressed VaR, incremental risk charge, comprehensive risk measure for correlation trading	Patchwork, not a redesign (later replaced by FRTB)
Basel III (2010)	Global financial crisis	CET1 minimum 4.5%, Tier 1 6%, total 8%; capital conservation and countercyclical buffers; G-SIB surcharges; 3% leverage ratio; LCR and NSFR	Large variation in RWA between banks using internal models for similar portfolios

Quality and quantity of capital. Under Basel I, only half of the 8% had to be Tier 1, and Tier 1 could include hybrid instruments, so a bank could meet the rules with common equity of about 2% of RWA. Many banks that failed in 2008 reported Tier 1 ratios above 8% while their loss-absorbing common equity was a fraction of that. Basel III made common equity Tier 1 (CET1) the core requirement and added buffers on top (Chapter 7.2):

  Minimum common equity in % of RWA
  Basel I / II     ~2.0%   (implicit: half of the 4% Tier 1 minimum)
  Basel III         4.5%   CET1 minimum
                  + 2.5%   capital conservation buffer
                  = 7.0%   before countercyclical, systemic and Pillar 2 add-ons

Example: one portfolio under three regimes (EUR millions).

  Exposure                     Amount   Basel I RW   Basel II SA RW   Basel III final SA RW
  ---------------------------------------------------------------------------------------
  Loan to AAA-rated corporate    100       100%           20%               20%
  Loan to unrated corporate      100       100%          100%              100%
  Residential mortgage, LTV 70%  100        50%           35%               30%
  AA-rated sovereign bond        100         0%            0%                0%
  ---------------------------------------------------------------------------------------
  Credit RWA                               250            155               150

  Capital required
    Basel I     total 8% x 250 = 20.0     of which common equity as low as ~2% x 250 = 5.0
    Basel II    total 8% x 155 = 12.4     of which common equity as low as ~2% x 155 = 3.1
                (plus a new operational risk charge)
    Basel III   CET1 (4.5% + 2.5%) x 150 = 10.5;  total capital incl. buffer 10.5% x 150 = 15.75

Basel II made the weights more risk-sensitive, which cut RWA for safe exposures. Basel III kept that sensitivity but more than tripled the common equity required for the same RWA.

Analogy. The Basel Accords are like successive versions of a building code. The first version said "every building needs walls of a certain thickness". Later versions differentiate by earthquake zone (risk sensitivity), then, after a disaster, demand better materials (CET1), fire exits (liquidity rules) and a backup check that does not depend on the architect's own calculations (the leverage ratio and the output floor).

Key takeaways

• The BCBS sets global minimum standards; they become binding only through national or regional law.
• Basel I (1988) introduced the 8% of RWA minimum but was not risk-sensitive, which encouraged regulatory arbitrage.
• Basel II (2004) introduced the three pillars, rating-based and model-based (IRB) risk weights and operational risk capital.
• Basel III (2010) raised the quality and quantity of capital, added buffers, the leverage ratio and the first global liquidity standards.
• Each revision answered a specific crisis, so the rules are best understood together with the failures that prompted them.

🧪 Practice

1. Beginner: Name the crisis or event that triggered each of: the creation of the BCBS, Basel 2.5, and Basel III.
2. Intermediate: In the example portfolio, replace the AAA corporate loan with a loan to a corporate rated BBB (Basel II and Basel III standardized risk weight 100%). Recompute credit RWA under all three regimes and explain why the Basel I figure does not change.
3. Interview: "Why did Basel II not prevent the 2008 crisis, even though many failing banks reported capital ratios above the minimum?" Hint: consider the quality of capital counted as Tier 1, trading book and securitisation risk weights relying on ratings and calm-period VaR, procyclicality of risk-sensitive weights, the absence of leverage and liquidity requirements, and off-balance-sheet vehicles.

Basel III Endgame / Basel IV

Why it matters. After 2010, supervisors found that banks using internal models produced very different risk weights for similar portfolios: in BCBS benchmarking exercises, the same hypothetical portfolio could produce RWA that differed by a factor of two or more across banks. If capital depends more on the model than on the risk, capital ratios cannot be compared and lose credibility. The December 2017 package, officially "Basel III: Finalising post-crisis reforms", aims to restore trust in RWA. It is the largest change to how RWA is calculated since Basel II, and it changes the systems of every bank.

Names. The package has several names, which can be confusing:

Name	Who uses it
Basel III: Finalising post-crisis reforms / Basel III final	BCBS (official)
Basel IV	Industry and consultants, especially in Europe, to stress the size of the impact
Basel III endgame	United States
Basel 3.1	United Kingdom
CRR3 / CRD6	EU legal texts that implement it

What it contains.

Component	Change	Main effect
Output floor	Total RWA at least 72.5% of RWA under standardized approaches (Chapter 7.2)	Caps the benefit of internal models; bites for low-risk portfolios such as prime mortgages
Revised standardized credit risk approach	More granular weights: mortgages by loan-to-value, corporates by rating with a separate treatment for unrated investment-grade corporates, specialised lending, a due diligence requirement on external ratings	Standardized RWA becomes more risk-sensitive and more data-hungry (LTV, property values, revenue)
Constraints on IRB	Advanced IRB no longer allowed for large corporates (revenue above EUR 500m) or for banks and other financial institutions; no IRB for equity; floors on PD, LGD and CCF inputs	Less variation between banks' models
CVA risk framework	Internal model approach removed; basic (BA-CVA) and standardized (SA-CVA) approaches	Derivatives desks need sensitivity-based CVA capital
Operational risk	All earlier approaches, including internal models (AMA), replaced by a single standardized measurement approach (SMA)	Op risk capital depends on business size and, optionally, loss history
Leverage ratio	G-SIB leverage buffer of 50% of the G-SIB risk-based surcharge; revised exposure measure	Large banks face a higher non-risk-based floor
Market risk (FRTB)	Finalised separately in 2016 and revised in 2019; implemented together with this package	New standardized and internal model approaches with Expected Shortfall (Chapter 8.1) and desk-level model approval

Operational risk under the SMA. The new approach shows the general design philosophy: a simple, standardized formula, with limited room for bank-specific inputs.

  Business Indicator (BI)  ~ size of business: interest, leases and dividends component
                             + services component (fees, other income/expenses)
                             + financial component (trading and banking book P&L)

  BI Component (BIC)       = 12% of BI up to EUR 1bn
                           + 15% of BI between EUR 1bn and 30bn
                           + 18% of BI above EUR 30bn

  Loss Component (LC)      = 15 x average annual operational losses over 10 years

  Internal Loss Multiplier = ln( e - 1 + (LC / BIC)^0.8 )      (jurisdictions may set ILM = 1)

  Op risk capital          = BIC x ILM            Op risk RWA = 12.5 x capital

Example. A bank has a Business Indicator of EUR 3bn and average annual operational losses of EUR 40m.

  BIC = 12% x 1,000 + 15% x 2,000          = 120 + 300 = EUR 420m
  LC  = 15 x 40                            = EUR 600m
  LC / BIC = 1.4286;   (1.4286)^0.8        = 1.3302
  ILM = ln(1.7183 + 1.3302) = ln(3.0485)   = 1.1146

  Capital with ILM:       420 x 1.1146 = EUR 468.1m   ->  RWA = EUR 5,851m
  Capital with ILM = 1:   EUR 420.0m                  ->  RWA = EUR 5,250m   (EU choice)

A bank whose historical losses are high relative to its size pays more capital, but the effect is dampened by the logarithm and the 0.8 exponent. The EU, the UK and the US proposal set the ILM to 1, so in those jurisdictions only business size matters.

Implementation status. The BCBS set 1 January 2023 as the start date (after a one-year delay due to COVID-19), with the output floor phased in to 72.5% by 2028. Jurisdictions have moved at different speeds, and dates have shifted several times, so always check the current legal texts.

Jurisdiction	Legal vehicle	Start of application	Notes
EU	CRR3 (Regulation (EU) 2024/1623) and CRD6 (Directive (EU) 2024/1619)	1 January 2025	Output floor phased in from 50% (2025) to 72.5% (2030), some transitional arrangements until 2032; FRTB capital requirements postponed, at the time of writing, to 1 January 2027
UK	PRA rules ("Basel 3.1")	Postponed to 1 January 2027	Transitional period ending in 2030
US	2023 proposal by the Federal Reserve, OCC and FDIC	Not finalised at the time of writing	The 2023 proposal applied to banks above USD 100bn and removed internal credit models entirely; the agencies have signalled a revised proposal with a lower capital impact
Others	Canada, Australia, Japan, Switzerland and others	Mostly 2023 to 2025	Several adopted the package close to the BCBS timeline

Analogy. If internal models are self-assessed tax returns, the output floor is a minimum tax: you may use deductions, but you cannot pay less than 72.5% of what the simple official calculation would give.

Key takeaways

• The 2017 package targets the variability of RWA from internal models; it is called Basel IV, Basel III endgame or Basel 3.1 depending on the region.
• The output floor, IRB constraints and input floors limit model benefits; standardized approaches become more granular.
• Operational risk moves to a single standardized approach based on the Business Indicator; CVA internal models are removed.
• Implementation dates differ by jurisdiction and have moved repeatedly, so systems must support parallel rule sets and phase-in parameters.

🧪 Practice

1. Beginner: List four components of the 2017 Basel III finalisation package and state in one sentence what problem each addresses.
2. Intermediate: Compute the SMA operational risk capital and RWA for a bank with a Business Indicator of EUR 1.5bn and average annual losses of EUR 10m, first with the ILM formula and then with ILM = 1. Which is lower, and why?
3. Interview: "Your bank uses IRB models for most portfolios. What changes in the RWA system to support the output floor?" Hint: every exposure needs a standardized RWA calculated in parallel (dual stack), including data the IRB process never needed (LTV, external ratings, revenue); the floor applies at total RWA level and to a phase-in percentage that changes over time; consider reconciliation between the two stacks, performance, and explaining floor impact by portfolio.

Pillar 1, 2 and 3

Why it matters. A single formula cannot capture every risk a bank faces. Some risks are hard to standardize (interest rate risk in the banking book, concentration risk, business model risk), and some weaknesses only show up in governance and controls rather than in numbers. Basel II therefore organized regulation into three complementary pillars: a formula-based minimum, supervisory judgment on top of it, and market discipline through public disclosure. The structure still frames all capital and liquidity regulation.

                       +------------------------------------------+
                       |        Safety and soundness of banks      |
                       +-------------+--------------+-------------+
                       |  PILLAR 1   |   PILLAR 2   |  PILLAR 3   |
                       |  Minimum    |  Supervisory |  Market     |
                       |  require-   |  review      |  discipline |
                       |  ments      |              |             |
                       |             |  Bank:       |  Public     |
                       |  Credit     |  ICAAP,      |  disclosure |
                       |  Market     |  ILAAP       |  of capital,|
                       |  Operational|  Supervisor: |  RWA,       |
                       |  CVA        |  SREP -> P2R,|  liquidity, |
                       |  Leverage   |  P2G, other  |  risk       |
                       |  LCR / NSFR |  measures    |  profile    |
                       +-------------+--------------+-------------+

Pillar 1: minimum requirements. Formula-based requirements that every bank in scope must meet at all times: the minimum capital ratios on RWA for credit, counterparty, market, CVA and operational risk; the leverage ratio; large exposure limits; and the LCR and NSFR (Chapter 9.2). Pillar 1 is objective and comparable, but it is calibrated for an average bank.

Pillar 2: supervisory review. Pillar 2 covers what Pillar 1 misses.

• The bank's own assessment. The bank must run an Internal Capital Adequacy Assessment Process (ICAAP, Chapter 7.2) and an Internal Liquidity Adequacy Assessment Process (ILAAP, Chapter 9.2), in which it identifies all material risks, measures them with its own methods and shows that it holds enough capital and liquidity.
• The supervisor's review. In the EU this is the Supervisory Review and Evaluation Process (SREP). The supervisor scores four elements, usually from 1 (low risk) to 4 (high risk): business model viability, internal governance and risk management, risks to capital, and risks to liquidity and funding. The outcome is a set of measures:
  • Pillar 2 Requirement (P2R): binding additional capital for risks not covered or underestimated by Pillar 1, for example IRRBB (Chapter 6.2), credit concentration or pension risk.
  • Pillar 2 Guidance (P2G): a non-binding expectation of additional capital to cover stress test outcomes.
  • Qualitative and liquidity measures: for example, remediation of control weaknesses, restrictions on business, or bank-specific liquidity requirements.

EU terminology for the resulting stack, in total capital terms:

  Pillar 1 minimum (8%) + P2R                 = TSCR  (Total SREP Capital Requirement)
  TSCR + combined buffer requirement          = OCR   (Overall Capital Requirement)
  OCR + P2G                                   = overall supervisory expectation

Pillar 3: market discipline. Banks must publish standardized disclosures so that investors, depositors and analysts can compare risk profiles and penalize weak banks through higher funding costs. The BCBS defines templates with fixed formats, implemented in the EU through Part Eight of the CRR and EBA technical standards. Examples:

Template	Content	Typical frequency for a large bank
KM1	Key metrics: own funds, RWA, capital ratios, leverage ratio, LCR, NSFR	Quarterly
OV1	Overview of RWA by risk type and approach	Quarterly
CC1 / CC2	Composition of regulatory capital and reconciliation to the published balance sheet	Semi-annual / annual
LIQ1 / LIQ2	LCR and NSFR components	Quarterly / semi-annual
LR1 to LR3	Leverage ratio exposure measure	Quarterly to annual
IRRBB1	Changes in EVE and NII under the standard shock scenarios (Chapter 6.2)	Annual

Under CRR3, the EBA also collects the disclosures of EU banks on a central data hub, so that they can be compared in one place.

Example: from SREP to the requirement a bank manages against. A bank receives a P2R of 2.25% and a P2G of 1.25%; its combined buffer requirement is 4.0%.

  Pillar 1 total capital                         8.00%
  P2R                                          + 2.25%
  TSCR                                         = 10.25%
  Combined buffer requirement                  + 4.00%
  OCR                                          = 14.25%   breach of buffers => MDA restrictions
  P2G                                          + 1.25%
  Supervisory expectation                      = 15.50%
  Management buffer (bank's risk appetite)     + 1.50%
  Internal target                              = 17.00%   total capital / RWA

The same RWA, own funds and ratios appear in COREP (supervisor), in Pillar 3 (public) and in the ICAAP (internal). If they differ without explanation, supervisors and analysts will ask why, so all three must come from the same reconciled data (see Chapter 9.3).

Analogy. Pillar 1 is the driving test everyone must pass, Pillar 2 is the instructor watching how you actually drive and adding conditions to your licence, and Pillar 3 is the public rating on a ride-hailing app that lets passengers choose who to ride with.

Key takeaways

• Pillar 1 sets formula-based minimum requirements; Pillar 2 adds bank-specific requirements from supervisory review; Pillar 3 requires public disclosure.
• In the EU, the SREP results in P2R (binding), P2G (expectation) and qualitative measures; TSCR and OCR describe the resulting stack.
• ICAAP and ILAAP are the bank's own Pillar 2 assessments of capital and liquidity.
• Pillar 3 templates are standardized and must be consistent with supervisory reporting and financial statements.

🧪 Practice

1. Beginner: Assign each item to Pillar 1, 2 or 3: the LCR minimum; a capital add-on for IRRBB; publication of the KM1 template; the leverage ratio; a supervisory finding on weak model governance.
2. Intermediate: A bank has P2R of 3.0%, a combined buffer requirement of 3.5%, P2G of 1.0% and total RWA of EUR 40bn. Compute TSCR, OCR and the total capital needed to meet the supervisory expectation, in percent and in EUR.
3. Interview: "The CET1 ratio in our Pillar 3 report differs from the one in COREP by 5 basis points. How would you find out why?" Hint: compare reference dates, scope of consolidation, version of the data snapshot, inclusion of interim profits, transitional vs fully loaded figures and manual adjustments; the long-term fix is generating both from one controlled data set.

Regional Implementations (CRR/CRD, US Rules)

Why it matters. A bank never applies "Basel" directly; it applies the law of the jurisdictions in which it operates. A group with entities in Frankfurt, London and New York must meet three different rule sets that share a Basel core but differ in scope, timing, calibration and reporting. For engineers, this means rule engines with jurisdiction-specific parameters, multiple reporting outputs from the same positions, and careful tracking of which legal entity holds which trade.

From standard to law.

   BCBS standard (not binding)
          |
          +---------------------+---------------------+
          v                     v                     v
   EU                       US                     UK
   Regulation (CRR)         Rules by Federal       PRA Rulebook and
   + Directive (CRD)        Reserve, OCC, FDIC     retained/onshored law
   + EBA technical          in 12 CFR, adopted     + PRA supervisory
     standards (RTS/ITS)      after public           statements
   + EBA guidelines           comment
          |                     |                     |
   Supervised by ECB/SSM    Fed (holding cos),     PRA (prudential)
   (significant banks)      OCC (national banks),  and FCA (conduct)
   and national authorities FDIC (state non-member)

European Union.

• CRR (Capital Requirements Regulation) is directly applicable in every member state without national transposition. It contains the Pillar 1 rules, liquidity ratios, leverage, large exposures, reporting and disclosure.
• CRD (Capital Requirements Directive) must be transposed into national law. It covers licensing, governance, remuneration, Pillar 2 and SREP, and most capital buffers, where national flexibility is needed.
• Versions: CRR/CRD IV (2013, Basel III), CRR2/CRD5 (2019: NSFR, binding leverage ratio, SA-CCR, TLAC), CRR3/CRD6 (2024: Basel III finalisation).
• Single rulebook: the European Banking Authority (EBA) writes binding technical standards (RTS and ITS, adopted by the Commission), guidelines and Q&As that detail the rules. The ECB supervises significant banks directly under the Single Supervisory Mechanism (SSM); national authorities supervise smaller banks.
• Notable EU deviations from Basel: the SME and infrastructure supporting factors that reduce RWA for those loans, exemptions from CVA capital for certain corporate and sovereign counterparties, transitional treatment of unrated corporates and low-risk mortgages under the output floor, and Level 1 HQLA status for extremely high quality covered bonds.

United States.

• Rules are issued jointly by the Federal Reserve (bank holding companies and state member banks), the OCC (national banks) and the FDIC (state non-member banks), through notice-and-comment rulemaking, and are codified in the Code of Federal Regulations (for example Regulation Q, 12 CFR Part 217, for the Fed).
• Tailoring (2019): requirements depend on the category of the banking organization:

Category	Scope	Examples of requirements
I	US G-SIBs	Full requirements, G-SIB surcharge, enhanced supplementary leverage ratio, full daily LCR and NSFR
II	At least USD 700bn total assets or USD 75bn cross-jurisdictional activity	Full LCR/NSFR, advanced approaches
III	At least USD 250bn, or high nonbank assets, short-term wholesale funding or off-balance sheet exposure	Full or reduced LCR/NSFR depending on short-term wholesale funding
IV	USD 100bn to 250bn	Reduced or no LCR/NSFR, less frequent stress testing

• US-specific features: the Collins Amendment floor (risk-based ratios are the lower of the standardized and advanced approach results, so standardized RWA is often binding); the stress capital buffer (SCB), derived from the Federal Reserve's annual stress test, which replaces the fixed capital conservation buffer for large banks and is at least 2.5%; and the supplementary leverage ratio. Foreign banks with large US operations must hold them in an intermediate holding company (IHC) subject to US rules.

United Kingdom. After Brexit, EU rules were onshored and are progressively replaced by PRA rules. The PRA implements Basel 3.1 with its own calibration and timetable, and applies a simpler regime for small domestic banks.

Example: the same group, three rule sets. A European banking group has its parent in Germany, a branch in London and a US IHC.

Topic	EU parent (CRR/CRD)	UK operations (PRA)	US IHC (Fed rules)
Capital rules	CRR3	PRA rules (Basel 3.1 from 2027)	Regulation Q, US Category depends on IHC size
Capital buffer	Capital conservation buffer 2.5%	Capital conservation buffer 2.5%	Stress capital buffer, at least 2.5%
Liquidity ratio	EU LCR Delegated Regulation; NSFR in CRR	PRA LCR and NSFR rules	US LCR / NSFR, depending on Category
Main liquidity report	COREP LCR templates, ALMM	PRA returns	FR 2052a
Supervisor	ECB (SSM)	PRA	Federal Reserve

A UK branch of an EU bank is not a separate legal entity, so it is supervised mainly by the home authority with PRA oversight, while a UK subsidiary would need its own capital and liquidity. The difference between branch and subsidiary is often the first question when mapping which rules apply to a trade.

Analogy. Basel is like a model recipe published by a culinary association. Every country's kitchen cooks it, but each changes the quantities, substitutes local ingredients and serves it at a different time, and the health inspector checks against the local version, not the original.

Key takeaways

• Basel standards become binding only through regional or national law; the version that applies depends on the legal entity.
• In the EU, the CRR is directly applicable, the CRD is transposed nationally, and EBA technical standards add detail.
• In the US, the Fed, OCC and FDIC issue the rules; tailoring categories, the Collins floor and the stress capital buffer are distinctive features.
• Jurisdictions deviate from Basel in scope, calibration and timing, so systems need jurisdiction-specific, versioned parameters.

🧪 Practice

1. Beginner: Explain the practical difference between an EU regulation and an EU directive, and give one example of each in banking regulation.
2. Intermediate: A US bank holding company has USD 300bn of total assets and USD 20bn of cross-jurisdictional activity. Which tailoring category is it most likely in, and how would your answer change if its total assets were USD 750bn?
3. Interview: "Design the rules configuration for an RWA engine used by entities in the EU, UK and US." Hint: separate the calculation logic from jurisdiction parameters (risk weights, floors, phase-in percentages); version rules by effective date and jurisdiction; resolve the applicable rule set from the legal entity booking the exposure; support parallel runs for rule changes; and make every result explainable with the rule version that produced it.

<a id="92-liquidity-regulation"></a>

9.2 Liquidity Regulation

Before 2008 there was no global liquidity standard, and several banks with adequate capital failed because they ran out of cash. This subchapter covers the two Basel III ratios that fixed this (the LCR for 30-day stress, the NSFR for structural funding) and the supervisory tools around them: EU monitoring metrics, the bank's own liquidity assessment (ILAAP) and intraday liquidity monitoring. The underlying concepts (HQLA, run-off, survival horizon, intraday flows) are introduced in Chapter 5. This subchapter focuses on the regulatory rules and reporting.

Liquidity Coverage Ratio (LCR)

Why it matters. Northern Rock (2007) and Lehman Brothers (2008) showed that a bank can be solvent on paper and still fail within days when depositors and wholesale lenders withdraw funding. Supervisors wanted every bank to be able to survive a severe but plausible stress on its own for long enough (30 days) for management and the authorities to react, without relying on the central bank. The LCR makes that a hard, comparable requirement.

Definition.

                    Stock of HQLA
  LCR  =  -----------------------------------------   >=  100%
           Total net cash outflows over next 30 days

  Net cash outflows = Outflows - min( Inflows, 75% x Outflows )

• Numerator: HQLA after haircuts and caps (Chapter 5.4).
• Denominator: contractual and contingent cash flows over a 30-calendar-day stress, each multiplied by a regulatory run-off rate (outflows) or inflow rate.
• Inflow cap: inflows can offset at most 75% of outflows, so every bank must hold HQLA of at least 25% of its stressed outflows, whatever its expected inflows.
• Scenario: the regulatory stress combines a bank-specific shock (for example a three-notch downgrade) with a market-wide shock: partial loss of retail deposits, loss of unsecured wholesale funding, loss of secured funding except against high-quality collateral, collateral calls on downgrade, and drawdowns of committed facilities.

Selected Basel run-off and inflow rates.

Item	Rate
Stable retail deposits (insured, established relationship)	5% (3% in some jurisdictions)
Less stable retail deposits	10% or higher
Operational deposits (clearing, custody, cash management)	25%
Non-operational deposits from non-financial corporates, sovereigns	40% (20% if fully insured)
Unsecured wholesale funding from financial institutions	100%
Secured funding backed by Level 1 assets or with the central bank	0%
Secured funding backed by Level 2A / other assets	15% / 25-100%
Undrawn committed credit facilities to non-financial corporates	10%
Undrawn committed liquidity facilities to non-financial corporates	30%
Additional collateral needed after a three-notch downgrade	100% of the amount
Inflows from performing loans to non-financial counterparties	50%
Inflows from financial institutions	100%
Reverse repo inflows backed by Level 1 collateral	0% (the collateral is assumed to be rolled over)

Example (EUR millions). The bank uses the HQLA stock from Chapter 5.4 (EUR 13,550m).

  Outflows                                   Balance   Run-off    Outflow
  ------------------------------------------------------------------------
  Stable retail deposits                      20,000      5%        1,000
  Less stable retail deposits                  8,000     10%          800
  Operational corporate deposits               6,000     25%        1,500
  Non-operational corporate deposits           5,000     40%        2,000
  Unsecured funding from banks and funds       5,000    100%        5,000
  Undrawn credit facilities (corporates)      10,000     10%        1,000
  Undrawn liquidity facilities (corporates)    2,000     30%          600
  Net derivative outflows                        300    100%          300
  ------------------------------------------------------------------------
  Total outflows                                                   12,200

  Inflows (contractual, within 30 days)
  Loans to corporates maturing                 2,400     50%        1,200
  Interbank placements maturing                1,500    100%        1,500
  Reverse repos on Level 1 collateral          1,000      0%            0
  ------------------------------------------------------------------------
  Total inflows                                                     2,700
  Cap: 75% x 12,200 = 9,150  -> not binding

  Net cash outflows = 12,200 - 2,700 = 9,500
  LCR = 13,550 / 9,500 = 142.6%

The largest single driver is the EUR 5,000m of funding from financial institutions, which is assumed to leave in full. Replacing it with term funding of more than 30 days would reduce net outflows by EUR 5bn and raise the LCR to 13,550 / 4,500 = 301%. Treasuries therefore manage the maturity of wholesale funding very actively around the 30-day point.

Regulatory practice.

• Phase-in: 60% in 2015, rising to 100% by 2019 under Basel (the EU applied 100% from 2018).
• Usability: HQLA are meant to be used in stress; a bank may fall below 100% in a stress, but must notify the supervisor immediately and present a plan to restore the ratio.
• Currencies: the LCR is a single-currency-equivalent ratio, but banks must also monitor it in each significant currency (in the EU, any currency representing at least 5% of total liabilities), because HQLA in EUR do not help if the stress is a run on USD funding and the FX swap market is dysfunctional.
• Reporting: monthly in the EU (COREP LCR templates, Chapter 9.3), daily for the largest US banks via FR 2052a; quarterly public disclosure (Pillar 3 LIQ1).
• Regional differences: the EU LCR is set out in a Commission Delegated Regulation; the US LCR adds a "peak day" test that captures the largest cumulative net outflow on any day within the 30 days, not just at day 30, and applies reduced versions to smaller categories.

Analogy. The LCR is like a rule that every household must keep enough cash and easily sold savings to pay a month of bills, assuming the main earner loses their job, the overdraft is cancelled and only half the money owed to them arrives.

Key takeaways

• LCR = HQLA / net stressed outflows over 30 days, at least 100%.
• Run-off rates depend on how stable the funding source is: retail deposits are assumed to be sticky, wholesale funding from financial institutions not at all.
• Inflows are capped at 75% of outflows; HQLA can be used in stress, with notification to the supervisor.
• Banks monitor the LCR daily and by significant currency, even when they report it monthly.

🧪 Practice

1. Beginner: Compute the LCR of a bank with HQLA of EUR 5bn, stressed outflows of EUR 6bn and stressed inflows of EUR 2bn.
2. Intermediate: In the example, stressed inflows rise to EUR 10,000m because a large block of interbank placements now matures within 30 days (HQLA unchanged). Apply the inflow cap and compute the new LCR. Why does the regulation limit the benefit?
3. Interview: "Our LCR moved from 145% to 128% overnight. How would you explain the change to the treasurer by 9 am?" Hint: build an LCR movement analysis by component (HQLA, each outflow and inflow category), then drill down to the largest position changes; check for maturities entering the 30-day window, reclassification of deposits, changes in HQLA eligibility or encumbrance, and data issues such as missing feeds defaulting to the most punitive treatment.

Net Stable Funding Ratio (NSFR)

Why it matters. The LCR protects against a 30-day stress, but a bank could still fund long-term mortgages with funding that rolls over every 31 days and meet the LCR. That maturity mismatch is a structural vulnerability: when markets close for longer, refinancing fails. The NSFR requires long-term, illiquid assets to be funded by stable sources over a one-year horizon, limiting excessive maturity transformation.

Definition.

                Available Stable Funding (ASF)
  NSFR  =  ---------------------------------------   >=  100%
                Required Stable Funding (RSF)

  ASF = sum of liabilities and capital x ASF factor (how stable is this funding over 1 year?)
  RSF = sum of assets and off-balance items x RSF factor (how much of this needs stable funding?)

Selected Basel factors.

Available stable funding	ASF factor	Required stable funding	RSF factor
Regulatory capital; liabilities with maturity of 1 year or more	100%	Cash, central bank reserves	0%
Stable retail deposits	95%	Unencumbered Level 1 securities	5%
Less stable retail deposits	90%	Unencumbered Level 2A assets	15%
Deposits from non-financial corporates below 1 year; operational deposits	50%	Loans to financial institutions below 6 months (unsecured)	15%
Funding from financial institutions below 6 months	0%	Level 2B assets; loans to non-financial corporates below 1 year	50%
Other liabilities (for example derivative liabilities net of collateral)	0%	Residential mortgages of 1 year or more, risk weight up to 35%	65%
		Other performing loans of 1 year or more, risk weight above 35%	85%
		Fixed assets, non-performing loans, assets encumbered for 1 year or more	100%
		Undrawn committed credit and liquidity facilities	5%

Example (EUR millions). The same bank as in the LCR example.

  Available stable funding              Amount   ASF factor      ASF
  -------------------------------------------------------------------
  Regulatory capital                     6,000     100%        6,000
  Senior bonds, maturity > 1 year       10,000     100%       10,000
  Stable retail deposits                20,000      95%       19,000
  Less stable retail deposits            8,000      90%        7,200
  Corporate deposits (< 1 year)         11,000      50%        5,500
  Funding from financial inst. (< 6m)    5,000       0%            0
  Other liabilities                      6,500       0%            0
  -------------------------------------------------------------------
  Total                                 66,500                47,700

  Required stable funding               Amount   RSF factor      RSF
  -------------------------------------------------------------------
  Cash and central bank reserves         4,000       0%            0
  Level 1 government bonds               6,000       5%          300
  Level 2A covered bonds                 3,000      15%          450
  Level 2B corporate bonds               2,000      50%        1,000
  Loans to banks (< 6 months)            1,500      15%          225
  Corporate loans (< 1 year)             4,000      50%        2,000
  Residential mortgages (RW <= 35%)     30,000      65%       19,500
  Corporate loans (> 1 year)            12,000      85%       10,200
  Fixed and other assets                 2,000     100%        2,000
  -------------------------------------------------------------------
  On-balance total                      66,500                35,675
  Undrawn committed facilities          12,000       5%          600
  -------------------------------------------------------------------
  Total RSF                                                   36,275

  NSFR = 47,700 / 36,275 = 131.5%

Mortgages and long-term corporate loans account for over 80% of the RSF, and retail deposits for over half of the ASF. This is typical of a retail bank: the NSFR rewards deposit franchises and penalizes funding long assets with short-term wholesale money.

Regulatory practice.

• Basel published the final standard in 2014; it became binding in the EU in June 2021 (CRR2) and in the US in July 2021 for the larger categories.
• Derivatives: net derivative assets require 100% RSF, net derivative liabilities provide no ASF, and a 5% RSF add-on applies to gross derivative liabilities, so derivatives-heavy treasuries feel the NSFR.
• Interdependent assets and liabilities (for example pass-through funding for some promotional loans) can be given 0% factors in some jurisdictions.
• Reporting: quarterly in the EU (COREP NSFR templates), with semi-annual public disclosure (LIQ2).
• Management use: treasury computes the NSFR impact of new products and funding plans (Chapter 7.1) and includes it in funds transfer pricing (Chapter 6.4) as a liquidity cost for long-term assets.

Analogy. The NSFR is like a rule that you may only buy a house with a long-term mortgage, not with a credit card you hope to refinance every month.

Key takeaways

• NSFR = available stable funding / required stable funding over a one-year horizon, at least 100%.
• ASF factors reward capital, long-term funding and retail deposits; short-term funding from financial institutions counts for nothing.
• RSF factors grow with the illiquidity and maturity of assets; HQLA need little stable funding, long loans a lot.
• The NSFR complements the LCR: one targets a 30-day stress, the other structural maturity mismatch.

🧪 Practice

1. Beginner: For each item, say whether it adds to ASF or RSF and give its factor: EUR 100m of 5-year senior bonds issued; EUR 100m of stable retail deposits; EUR 100m of unencumbered Level 1 bonds held.
2. Intermediate: In the example, the bank replaces EUR 5,000m of short-term funding from financial institutions with 2-year senior bonds and uses the cash to grant additional long-term corporate loans. Compute the new NSFR. What happens to the LCR from the previous topic?
3. Interview: "The business wants to launch a 10-year fixed-rate loan product. How would treasury assess its NSFR impact, and how should that show up in pricing?" Hint: RSF factor of the loan by risk weight and maturity, the stable funding needed to keep the ratio above the internal target, the cost of that funding over the curve, and passing it through FTP as a term liquidity premium.

Additional Liquidity Monitoring Metrics (ALMM)

Why it matters. The LCR and NSFR compress a bank's liquidity profile into two ratios. A supervisor also wants to see the details behind them: when cash flows fall due, which counterparties and products the bank depends on, how much it pays for funding and how easily it can roll it over. In the EU, the Additional Liquidity Monitoring Metrics provide this information in a standard format, monthly for most banks. They have no minimum threshold but are used heavily in SREP and in early warning.

The ALMM templates (EU).

Template	Content	What the supervisor looks for
C 66.01 Maturity ladder	Contractual outflows, inflows and counterbalancing capacity in time buckets from overnight to more than 5 years	When the cumulative gap turns negative; how much cash can be generated from assets and in which time bucket
C 67.00 Concentration of funding by counterparty	Top 10 counterparties or groups providing funding above 1% of total liabilities	Dependency on a few large depositors or lenders
C 68.00 Concentration of funding by product type	Funding by product (retail, wholesale unsecured, secured, by maturity) above 1% of liabilities	Reliance on one product, for example short-term commercial paper
C 69.00 Prices for various lengths of funding	Average volume and spread paid on new funding by maturity	Rising funding costs as an early warning of stress
C 70.00 Roll-over of funding	Daily maturing, rolled-over and new funding over the month, by maturity	Falling roll-over rates (lenders not renewing)
C 71.00 Concentration of counterbalancing capacity	Top 10 holdings of liquid assets or liquidity lines by issuer or counterparty	Whether the liquidity buffer depends on one issuer or one central bank line

Smaller and non-complex institutions report less frequently (quarterly), in line with proportionality.

Example: a simplified maturity ladder (EUR millions).

  Time bucket          Outflows   Inflows   Net flow   Cumulative   Counterbalancing   Cumulative gap
                                                        net flow     capacity (cum.)    incl. capacity
  ---------------------------------------------------------------------------------------------------
  Overnight              -1,800       900       -900        -900          13,000             12,100
  > 1 day to 7 days      -2,600       700     -1,900      -2,800          13,200             10,400
  > 7 days to 1 month    -4,100     1,200     -2,900      -5,700          13,550              7,850
  > 1 to 3 months        -5,200     2,300     -2,900      -8,600          13,800              5,200
  > 3 to 6 months        -4,500     2,800     -1,700     -10,300          14,000              3,700
  > 6 to 12 months       -6,200     3,100     -3,100     -13,400          14,000                600
  > 1 to 2 years         -7,000     4,500     -2,500     -15,900          14,000             -1,900  <--

Unlike the LCR, the maturity ladder uses contractual flows without behavioural run-off assumptions, and counterbalancing capacity is the cash the bank can generate from unencumbered assets and committed lines by each date. In the example, contractual outflows exhaust the liquidity buffer between one and two years. This is not a breach of any limit, but a supervisor would ask how the bank expects to refinance in that period (funding plan, deposit stability).

Engineering view. ALMM templates are produced from the same cash flow engine as the internal maturity ladder (Chapter 5.2), but with regulatory definitions: contractual maturity, specific buckets, counterparty grouping by legal group (requiring a reliable group hierarchy from reference data), and product classification rules. Concentration templates need consistent counterparty identifiers, typically the LEI, across all funding systems.

Analogy. If the LCR is a doctor's single blood pressure reading, the ALMM is the full blood test panel: no single value decides the diagnosis, but together they reveal problems early.

Key takeaways

• ALMM are EU supervisory templates that give the detail behind the LCR and NSFR, usually reported monthly.
• They cover the contractual maturity ladder, funding concentration by counterparty and product, funding prices, roll-over and concentration of counterbalancing capacity.
• There are no minimum thresholds, but supervisors use the metrics in SREP and for early warning.
• They require consistent counterparty, group and product reference data across funding systems.

🧪 Practice

1. Beginner: Which ALMM template would show that a bank's three largest depositors provide 12% of its funding?
2. Intermediate: In the maturity ladder example, by how much would counterbalancing capacity have to increase, or contractual outflows in the "> 1 to 2 years" bucket decrease, for the cumulative gap to remain positive through two years?
3. Interview: "The concentration of funding template groups counterparties by legal group, but our deposit system only stores the account holder. How would you produce it?" Hint: map account holders to LEIs and legal entity hierarchies from a golden source of counterparty reference data; handle unmapped customers; snapshot the hierarchy as of the reporting date; and reconcile totals with the balance sheet.

ILAAP

Why it matters. Regulatory ratios use standard assumptions that cannot reflect each bank's business model. A bank with large USD funding needs, a big custody business or heavy collateral exposure to derivatives has risks the LCR captures only roughly. The Internal Liquidity Adequacy Assessment Process (ILAAP) requires the bank itself to identify, measure, manage and monitor its liquidity and funding risks, and to state formally that its liquidity is adequate. It is the liquidity counterpart of the ICAAP (Chapter 7.2) and a key input to the supervisor's Pillar 2 review.

What an ILAAP contains. In the EU it is required by Article 86 of the CRD and detailed by EBA guidelines and, for significant banks, the ECB Guide to the ILAAP.

  +---------------------------------------------------------------------------+
  |  Liquidity Adequacy Statement (LAS)  - signed by the management body      |
  +---------------------------------------------------------------------------+
  |  Governance       | Risk appetite      | Risk identification | Stress     |
  |  roles, ALCO,     | survival horizon,  | inventory of all    | testing    |
  |  three lines of   | LCR / NSFR targets,| liquidity risks:    | idiosyn-   |
  |  defence, policies| limits (Ch. 8.4)   | intraday, FX,       | cratic,    |
  |                   |                    | collateral, ...     | market,    |
  |                   |                    |                     | combined   |
  +-------------------+--------------------+---------------------+------------+
  |  Liquidity buffer and collateral (Ch. 5.4) | Funding plan (Ch. 7.1)        |
  |  Contingency funding plan (Ch. 5.4)        | FTP (Ch. 6.4)                 |
  |  Data, models, validation, internal audit                                  |
  +---------------------------------------------------------------------------+

• Liquidity Adequacy Statement: a short statement by the board, backed by evidence, that the bank's liquidity is adequate, and an assessment of the main risks.
• Internal stress testing: bank-specific scenarios, assumptions and horizons, often longer and more severe than the LCR, and covering intraday and currency stress. Typical internal metric: the survival horizon (Chapter 5.2).
• Integration ("use test"): the ILAAP must actually be used in management decisions (limits, FTP, funding plan, new products), not produced only for the supervisor.
• Annual cycle: the bank submits its ILAAP package once a year; the supervisor assesses it in the SREP liquidity element and may impose qualitative measures or specific liquidity requirements, such as a higher minimum LCR or a minimum survival period.

Example: internal stress results in an ILAAP (EUR millions).

  Scenario                          Horizon    Cumulative       Liquidity buffer    Survival
                                               net outflow      after haircuts       horizon
  ----------------------------------------------------------------------------------------------
  Idiosyncratic (downgrade, run)    90 days      -11,200            13,100           > 90 days
  Market-wide (repo market stress)  90 days       -8,700            11,400           > 90 days
  Combined, severe                  90 days      -14,300            12,600             61 days
  ----------------------------------------------------------------------------------------------
  Risk appetite: survival horizon >= 60 days in the combined scenario      -> met, headroom 1 day

The LAS would note that the combined scenario is close to the risk appetite and describe the actions planned (for example lengthening wholesale funding by EUR 2bn), while the supervisor would challenge the assumptions behind the 61 days, for example deposit run-off rates and the haircuts on the buffer.

Analogy. The LCR is the national driving test; the ILAAP is the transport company's own safety case for its fleet: its routes, its vehicles, its weather and its emergency plan, signed by the director who is accountable for it.

Key takeaways

• The ILAAP is the bank's own assessment of liquidity and funding risk, required under Pillar 2.
• It covers governance, risk appetite, identification of all liquidity risks, internal stress testing, buffers, funding plan, contingency planning and FTP.
• The management body signs a Liquidity Adequacy Statement; the ILAAP must be used in actual decisions.
• Supervisors assess it in the SREP and can impose bank-specific liquidity requirements.

🧪 Practice

1. Beginner: Name four building blocks of an ILAAP and explain how the ILAAP differs from the LCR.
2. Intermediate: A bank's combined stress scenario shows a cumulative net outflow of EUR 9bn at day 60 and EUR 12bn at day 90, against a buffer after haircuts of EUR 10.5bn. What is the survival horizon (assume linear outflows between the points)? Does it meet a 60-day appetite, and which two actions could treasury propose?
3. Interview: "The supervisor says our ILAAP stress testing is not used in management decisions. What evidence and system changes would address that?" Hint: link stress results to limits and early-warning indicators, FTP liquidity charges, funding plan targets and new product approvals; run stress metrics daily rather than annually; and document decisions where stress results changed an outcome.

BCBS 248 Intraday Monitoring

Why it matters. The LCR measures liquidity at day 30, and banks also manage end-of-day balances, but payments settle in real time (Chapter 2.2). A bank that cannot fund its payments during the day delays them, which pushes the liquidity shortage onto its counterparties and can spread through the payment system. In April 2013 the Basel Committee published BCBS 248, Monitoring tools for intraday liquidity management, so that supervisors could see how banks use intraday liquidity and how they would cope under stress. The operational side of intraday monitoring is covered in Chapter 5.3; this topic covers the regulatory reporting framework.

The monitoring tools. The tools are not ratios with minimums; they are measures reported to the supervisor (monthly in the Basel design), and each applies to a specific type of bank.

Group	Tool	Applies to
A (all reporting banks)	A(i) Daily maximum intraday liquidity usage: the largest negative (and positive) net cumulative position of payments during the day	All
	A(ii) Available intraday liquidity at the start of the business day: central bank reserves, collateral eligible for intraday credit, unused credit lines	All
	A(iii) Total payments sent and received	All
	A(iv) Time-specific obligations that must settle by a certain time (for example CLS pay-ins, margin calls)	All
B (correspondent banking providers)	B(i) Value of payments made on behalf of correspondent banking customers	Banks providing correspondent services
	B(ii) Intraday credit lines extended to customers, and their peak usage	Banks providing correspondent services
C (direct participants)	C(i) Intraday throughput: share of payments settled by each hour of the day	Direct participants in payment systems

Stress scenarios. Banks must also assess the tools under four stresses: the bank's own financial stress (counterparties delay payments to it), a counterparty's stress (a major counterparty stops paying), a customer bank's stress (a correspondent customer stops paying while the bank keeps making its payments), and a market-wide credit or liquidity stress (the value of collateral for intraday credit falls).

Reporting. For each tool and each relevant currency and payment system, the bank reports monthly figures derived from daily data, for example the largest, second largest and third largest daily values in the month and the monthly average. Supervisors implement the framework differently: some collect the templates directly, others review intraday metrics as part of the ILAAP and SREP (Pillar 2).

Example: deriving the monthly report for tool A(i) (EUR millions). From 21 business days of data on the bank's EUR central bank account:

  Daily maximum negative net cumulative position (sorted)
    -1,640  (15th, quarter-end tax payments and securities settlement)
    -1,410  (CLS pay-in day with large USD/EUR volume)
    -1,180
    -1,050 ... (17 further days between -420 and -1,000)

  Monthly report, tool A(i), EUR, TARGET2
    Largest negative position         -1,640
    Second largest                    -1,410
    Third largest                     -1,180
    Average of daily maxima             -760

  Tool A(ii): available intraday liquidity at start of day, average   2,050
    -> peak usage of 1,640 used 80% of available intraday liquidity on the worst day

Example: throughput (tool C(i)).

  Time      Cumulative % of daily payment value sent
  08:00          8%
  10:00         27%
  12:00         51%
  14:00         70%
  16:00         88%
  18:00        100%

If throughput at 12:00 falls from around 50% to 30% over several months, the bank may be delaying payments to save liquidity, which supervisors and payment system operators watch closely.

Engineering view. The tools require timestamped settlement data for every payment on every account at central banks and correspondents, mapped to currencies and payment systems, plus the start-of-day collateral position. Banks build a time-series store of intraday account movements fed from RTGS statements (for example camt.053 and camt.054 messages, Chapter 12.2) and internal payment engines, and reconcile them to the end-of-day balance.

Analogy. BCBS 248 is like a regulator asking a delivery company not just whether all parcels were delivered by the end of the day, but at what hours, how close the vans came to running out of fuel, and what would happen if a main depot closed.

Key takeaways

• BCBS 248 (2013) defines monitoring tools, not minimum ratios, for intraday liquidity.
• Group A tools apply to all banks (peak usage, available liquidity, total payments, time-specific obligations); B to correspondent banks; C (throughput) to direct participants.
• Banks report monthly statistics such as the three largest daily values and averages, and assess the tools under four stress scenarios.
• Implementation requires timestamped payment and account data across all currencies and payment systems.

🧪 Practice

1. Beginner: Which BCBS 248 tool would show that a bank sends most of its payments late in the day?
2. Intermediate: On its worst day, a bank's peak net cumulative outflow was EUR 2.1bn against available intraday liquidity of EUR 2.4bn. Under a market-wide stress, the value of collateral for intraday credit falls by 15% (the collateral provides EUR 1.6bn of the EUR 2.4bn). Does the bank still cover its peak usage?
3. Interview: "Design a pipeline that produces BCBS 248 metrics for 12 currencies and 9 payment systems." Hint: ingest settlement timestamps from RTGS and correspondent statements, normalize to a common event model with account, currency and system; compute net cumulative positions by time; handle late or missing statements and time zones; store daily results for monthly aggregation; and reconcile to end-of-day balances.

<a id="93-regulatory-reporting"></a>

9.3 Regulatory Reporting

Regulation is enforced through data: supervisors see a bank mainly through the reports it submits. This subchapter covers the main EU and US reporting frameworks, the technical formats in which reports are exchanged, and the data lineage and risk data aggregation principles (BCBS 239) that make reported numbers trustworthy. For many engineers in banks, regulatory reporting is where treasury data ends up and where every data defect becomes visible.

COREP and FINREP

Why it matters. Before 2014, each EU country had its own reporting formats, so supervisors could not compare banks across borders, and groups had to produce different reports for each subsidiary. With a single rulebook (Chapter 9.1), the EU also introduced uniform supervisory reporting: COREP (Common Reporting) for prudential data and FINREP (Financial Reporting) for accounting data. They are defined in an implementing technical standard (ITS) on supervisory reporting drafted by the EBA and adopted by the Commission (Implementing Regulation (EU) 2021/451, replaced from 2025 by a new ITS reflecting CRR3), and they are the backbone of how the ECB and national authorities monitor EU banks.

What they contain.

Framework	Purpose	Selected templates	Frequency
COREP: own funds and requirements	Capital adequacy	C 01.00 own funds, C 02.00 own funds requirements, C 03.00 capital ratios, C 07.00 credit risk (standardized), C 08 credit risk (IRB), C 16.00 operational risk, market risk and CVA templates	Quarterly
COREP: large exposures	Concentration of exposures to single clients and groups	C 26 to C 29	Quarterly
COREP: leverage	Leverage ratio and exposure measure	C 40 to C 48 (calculation in C 47.00)	Quarterly
COREP: liquidity	LCR, NSFR, ALMM	LCR C 72 to C 76; NSFR C 80, C 81, C 84; ALMM C 66 to C 71 (Chapter 9.2)	LCR and ALMM monthly, NSFR quarterly
FINREP	Balance sheet, P&L and breakdowns on an IFRS (or national GAAP) basis	F 01 balance sheet, F 02 P&L, F 18 performing and non-performing exposures, F 40 group structure	Quarterly, some annual

Remittance deadlines are fixed in the ITS. For quarterly reports, they are 12 May, 11 August, 11 November and 11 February; monthly liquidity reports are due 15 calendar days after the reference date. The bank submits to its national competent authority, which forwards data to the ECB and EBA.

Scope of consolidation. COREP uses the prudential scope of consolidation (banking group, excluding insurance subsidiaries and some special purpose entities), while the published financial statements use the accounting scope. FINREP is reported on the prudential scope. Reconciling the two scopes is a recurring source of differences.

How a COREP report is produced.

  Source systems              Calculation engines             Reporting layer
  ------------------          ---------------------           ------------------------
  Loans, deposits      ---->  RWA engine (credit, CCR)  --+
  Treasury (Murex,     ---->  Market risk / CVA engine   --+-->  Regulatory data  --> Templates
   Calypso...)                Liquidity engine (LCR,     --+     warehouse            (COREP/FINREP)
  General ledger       ---->   NSFR, ALMM)                 |     (reconciled to GL)        |
  Reference data       ---->  Own funds calculation     --+                               v
  (counterparties,                                                                Validation rules
   ratings, collateral)                                                           (EBA + national)
                                                                                         |
                                                                                         v
                                                                                 XBRL / xBRL-CSV
                                                                                 file -> supervisor

Example: linking FINREP and COREP (EUR millions).

  FINREP F 01.03 Total equity (accounting, prudential scope)          7,050
  - Interim profit not yet eligible (no verified audit)                (300)
  - Proposed dividends                                                 (150)
  - AT1 instruments classified as equity in accounting                 (500)
  - Intangible assets and goodwill (net of deferred tax)               (180)
  - Deferred tax assets relying on future profitability                 (70)
  - Prudential filters and other deductions (e.g. AVA, own credit)      (50)
  ----------------------------------------------------------------------------
  COREP C 01.00 Common Equity Tier 1                                  5,800
  COREP C 02.00 Total risk exposure amount (RWA)                     46,000
  COREP C 03.00 CET1 ratio                                            12.61%

Supervisors and auditors expect this bridge to be explainable line by line. A frequent finding is that the regulatory report uses a different data snapshot from the accounts, so the bridge contains an unexplained residual.

Validation rules. The EBA publishes thousands of validation rules: for example, that a total equals the sum of its components, that a ratio in C 03.00 equals capital from C 01.00 divided by RWA from C 02.00, or that a value in one template matches another. A file with blocking validation errors is rejected; non-blocking warnings must be explained.

Analogy. COREP and FINREP are like a standardized medical record format that every hospital in the EU must use: the doctor can compare patients from different hospitals immediately, but every hospital has to map its own notes into the official boxes.

Key takeaways

• COREP covers prudential data (capital, large exposures, leverage, liquidity); FINREP covers accounting data on the prudential scope.
• Both are defined in EU implementing technical standards with fixed templates, frequencies and remittance dates.
• Reports are produced from calculation engines and a regulatory data layer reconciled to the general ledger, and checked with EBA validation rules.
• The bridge from accounting equity to regulatory capital and the consistency across templates are key points of supervisory scrutiny.

🧪 Practice

1. Beginner: Which framework (COREP or FINREP) contains: the LCR; non-performing exposures; the CET1 ratio; the income statement?
2. Intermediate: In the example, the auditors verify the interim profit of EUR 300m and the bank decides to include it in CET1 net of the proposed dividend already deducted. Recompute CET1 and the CET1 ratio.
3. Interview: "Five days before the COREP deadline, an EBA validation rule fails because the sum of exposure classes in C 07.00 does not match the total in C 02.00. How would you approach it?" Hint: identify which side changed since the last successful run, compare at exposure level between the two templates' data sources, check for exposures falling into no exposure class (classification gaps), rounding and FX conversion; fix at source rather than with a manual adjustment, and document any adjustment that remains.

FR 2052a and US Reporting

Why it matters. US supervisors took a different approach to liquidity reporting after 2008. Instead of collecting computed ratios in fixed templates, the Federal Reserve collects granular, product-level cash flow data from large banks, often daily, and computes the LCR and its own stress analyses itself. This report, the FR 2052a Complex Institution Liquidity Monitoring Report, is the core of US liquidity supervision. Any bank with a significant US presence, including foreign banks through their US intermediate holding company, has to build it.

Structure of the FR 2052a.

  FR 2052a
  |
  +-- Inflows     Assets (I.A)  Unsecured (I.U)  Secured (I.S)  Other (I.O)
  |
  +-- Outflows    Deposits (O.D)  Wholesale (O.W)  Secured (O.S)  Other (O.O)
  |
  +-- Supplemental   Derivatives and collateral (S.DC)  LRM (S.L)  Balance sheet (S.B)
                     Informational (S.I)  Foreign exchange (S.FX)

  Each row = one combination of:
    reporting entity | product | currency | counterparty type | collateral class |
    maturity bucket  | flags (insured, operational, forward start, ...) | amount (+ market value)

• Granularity: each product code is defined precisely (for example transactional deposit accounts, operational balances, repos by collateral class), so the Fed can apply its own run-off assumptions.
• Maturity buckets: daily buckets for the first 60 days, then progressively wider buckets up to more than 5 years. This is what lets the Fed apply the US LCR "peak day" test.
• Frequency: daily for the largest firms (Category I and II, and Category III firms with high short-term wholesale funding), monthly for other firms in scope, with short submission lags set out in the report instructions.
• Use: the LCR and NSFR, horizontal comparisons across banks, and ad hoc stress analysis, for example during the March 2023 regional bank stress.

Example: a few FR 2052a rows (simplified, USD millions).

Table	Product	Counterparty	Collateral class	Maturity bucket	Insured	Amount
O.D	Transactional accounts	Retail	n/a	Open	FDIC	12,400
O.D	Non-transactional relationship accounts	Non-financial corporate	n/a	Open	Uninsured	6,800
O.S	Repo	Non-bank financial	Level 1 (US Treasuries)	Day 1	n/a	3,200
I.A	Unencumbered assets	n/a	Level 1 (US Treasuries)	Open	n/a	9,500
O.W	Unsecured wholesale funding	Bank	n/a	Day 15	n/a	750

Every row must be traceable to source positions. The Fed checks consistency of FR 2052a with the published LCR disclosure and with other reports, and runs validation edits on each submission.

Other US reports relevant to treasury.

Report	Filer	Content
FR Y-9C	Bank holding companies	Consolidated balance sheet, income statement and regulatory capital
FFIEC 031 / 041 (Call Report)	Insured banks	Bank-level financial and capital data, published by the FFIEC
FFIEC 101	Advanced approaches banks	Detailed risk-based capital data
FR Y-14A / Q / M	Banks in the Fed's stress test	Granular portfolio, loan and position data for stress testing and the stress capital buffer
FR Y-15	Large holding companies	Systemic risk indicators used for G-SIB scores and tailoring categories
FFIEC 009	Banks with foreign exposure	Country risk exposures

EU vs US approach.

Aspect	EU (COREP liquidity)	US (FR 2052a)
What is reported	Pre-computed regulatory categories in templates	Granular product-level cash flows
Who computes the LCR	The bank, in the template	The bank (for compliance) and the Fed (from the data)
Frequency	Monthly	Daily for the largest firms, monthly for others
Change management	Template changes with new ITS releases	Instruction updates to product definitions and flags

Analogy. COREP is like handing in your tax return with the totals already calculated; FR 2052a is like handing over every receipt sorted by type, so the tax office can do the calculation itself and run any "what if" it likes.

Key takeaways

• FR 2052a is the Federal Reserve's granular liquidity report, filed daily by the largest firms and monthly by others.
• It is organized into inflow, outflow and supplemental tables, with rows defined by product, counterparty, collateral, maturity bucket and flags.
• The Fed uses it to monitor the LCR and NSFR and to run its own stress analyses.
• Other key US reports include FR Y-9C, the Call Report, FFIEC 101, FR Y-14 and FR Y-15.

🧪 Practice

1. Beginner: Explain the main difference between how the EU and the US collect liquidity data from banks.
2. Intermediate: A USD 500m term deposit from a non-financial corporate matures in 12 days and USD 300m of it is expected to be rolled over. How would it appear in the FR 2052a, and why does the report not ask for the expected roll-over?
3. Interview: "We file FR 2052a daily and the deadline is in four hours. One source system's feed has not arrived. What do you do?" Hint: follow a documented fallback (for example prior-day positions adjusted for known maturities) with explicit approvals; quantify materiality; flag the estimate in internal records; resubmit if needed and notify the supervisor according to policy; and fix the root cause with monitoring of feed timeliness.

Reporting Taxonomies (XBRL, DPM)

Why it matters. A regulatory report with thousands of cells, sent by thousands of banks, cannot be processed as PDFs or spreadsheets. Supervisors need a machine-readable format with an unambiguous definition of every data point, so that values can be validated automatically and compared across banks and over time. The EU uses the Data Point Model (DPM) to define the meaning of each cell and XBRL as the exchange format. Engineers who build reporting pipelines work directly with these artefacts.

DPM: the dictionary. The DPM describes each reported value as a combination of a metric and a set of dimensions, independently of the template layout.

  Template view (what a human sees)            DPM view (what a machine sees)
  ---------------------------------            ------------------------------------------------
  C 07.00, exposure class "Corporates",        Metric:     Exposure value (monetary, instant)
  row "Total exposures",                       Dimensions: Approach     = Standardized
  column "Exposure value"                                  Exposure cl. = Corporates
                 |                                         Base         = On- and off-balance
                 v                                         ...
             1,234,567,000                     Data point ID: unique code for this combination

Because two cells in different templates may refer to the same data point, the DPM makes cross-template consistency explicit. The EBA publishes each version of the DPM with its templates, data point dictionary and validation rules as a reporting framework release (for example 3.x, 4.x), each applicable from a given reference date.

XBRL: the envelope. eXtensible Business Reporting Language is an XML-based standard for business reporting:

• A taxonomy (schemas and linkbases) defines the concepts, dimensions, labels and validation formulas generated from the DPM.
• An instance document contains the reported facts. Each fact has a value, a concept and a context (reporting entity, period and dimension members).
• Filing rules constrain how instances are built (for example, one entity and reference date per file).
• xBRL-CSV represents the same facts as CSV tables plus a JSON metadata file. It is much more compact for large reports, and the EBA has moved its frameworks to it.

Example: one fact in XBRL and xBRL-CSV (simplified, identifiers illustrative).

<!-- context: who, when and which dimension members -->
<xbrli:context id="c1">
  <xbrli:entity>
    <xbrli:identifier scheme="http://standards.iso.org/iso/17442">529900EXAMPLE0LEI0001.CON</xbrli:identifier>
  </xbrli:entity>
  <xbrli:period><xbrli:instant>2026-06-30</xbrli:instant></xbrli:period>
  <xbrli:scenario>
    <xbrldi:explicitMember dimension="eba_dim:APR">eba_AP:x12</xbrldi:explicitMember>  <!-- approach -->
    <xbrldi:explicitMember dimension="eba_dim:EXC">eba_EC:x30</xbrldi:explicitMember>  <!-- exposure class -->
  </xbrli:scenario>
</xbrli:context>

<!-- the fact: metric, context, unit, value -->
<eba_met:mi123 contextRef="c1" unitRef="EUR" decimals="-3">1234567000</eba_met:mi123>

  xBRL-CSV equivalent, table file c_07.00.csv:

  datapoint,factValue
  dp123456,1234567000
  dp123457,987654000
  ...

Validation rule example. A rule such as {C 03.00, r0010} = {C 01.00, r0020} / {C 02.00, r0010} (CET1 ratio equals CET1 divided by total RWA) is expressed as an XBRL formula and evaluated by the bank before submission and by the supervisor on receipt.

Beyond the EU. XBRL is also used by the US FFIEC for Call Reports, by many other banking supervisors, and by securities regulators for listed companies' financial statements (often as inline XBRL, which embeds tags in a human-readable HTML document). Initiatives such as the EU's Integrated Reporting Framework (IReF) and the Banks' Integrated Reporting Dictionary (BIRD) aim to define input data once and derive multiple reports from it.

Analogy. The DPM is the dictionary that defines every word, XBRL is the grammar and the envelope that lets the sentence be sent and checked by machine, and the validation rules are the spell checker that refuses a letter with obvious mistakes.

Key takeaways

• The DPM defines each reported value as a metric plus dimensions, independent of template layout.
• XBRL taxonomies are generated from the DPM; instance documents carry facts with contexts (entity, period, dimensions).
• xBRL-CSV encodes the same facts compactly and is the direction of travel for EBA reporting.
• Validation rules are machine-executable and checked both by banks before submission and by supervisors on receipt.

🧪 Practice

1. Beginner: What are the three elements of an XBRL context, and why is the period part of it?
2. Intermediate: The same data point appears in two templates and the bank reports different values. Explain why this cannot happen if the report is generated from a DPM-based data model, and how it can still happen in practice.
3. Interview: "The EBA publishes a new reporting framework release every year. How would you design the reporting platform so that releases are cheap to adopt?" Hint: load the DPM dictionary and validation rules as metadata rather than hard-coding templates; map internal data to data points through versioned configuration; support several framework versions in parallel by reference date; run the official validation rules in the pipeline; and automate regression comparison between releases.

Data Lineage Requirements

Why it matters. When a supervisor asks "where does this number in your LCR come from?", the bank must be able to answer precisely: which source records, which transformations and which manual adjustments produced it. Without lineage, errors cannot be traced to their origin, the impact of a system change on reports cannot be assessed, and the bank cannot prove its numbers are complete. Supervisors therefore expect documented, attribute-level lineage for regulatory and risk reports, most explicitly in the ECB's 2024 guide on effective risk data aggregation and risk reporting.

Concepts.

Concept	Meaning
Data lineage	The documented path of data from its origin to its use, including every transformation
Business lineage	Lineage expressed in business terms: "LCR stable deposits come from the retail deposit book, classified by deposit insurance coverage"
Technical lineage	Lineage at system, table, column and job level
Attribute-level lineage	Lineage for each data element (column/field), not just each dataset; expected for critical data
Critical data element (CDE)	A data element whose quality materially affects a key report or decision (for example deposit insurance flag, counterparty sector, maturity date)
Golden source	The authoritative system of record for a data element
End-user computing (EUC)	Spreadsheets and tools outside controlled IT; a frequent break in lineage

Example: tracing one LCR value.

  [Core banking: deposit accounts]                       CDEs: balance, product code,
     account_id, balance, product_code,                        insured_flag, customer_id
     opened_date, insured_flag
            |  daily extract (job DEP_EXTRACT_01), DQ checks: completeness vs GL, null insured_flag
            v
  [Data lake: deposits_raw]
            |  join with customer master on customer_id -> customer_type (retail/SME/corporate)
            |  rule LCR_DEP_CLASS_v7: retail + insured + established relationship -> "stable"
            v
  [Regulatory data mart: lcr_deposit_positions]
            |  aggregate by LCR category, apply run-off rate table v2025.1 (5% stable)
            v
  [LCR engine result: outflow_stable_retail = 1,000]
            |  manual adjustment ADJ-2026-061 (+12, late-booked accounts, approved by Finance)
            v
  [COREP C 73.00, stable retail deposits outflow: 1,012]

At each step, lineage records the source, the transformation rule and its version, the controls applied, and any manual adjustment with its owner and approval. If the supervisor challenges the 1,012, the bank can show that 1,000 came from 2.4 million accounts classified by rule version 7 and that 12 came from an approved adjustment.

How lineage is captured.

• Automated technical lineage: metadata harvested from ETL tools, SQL parsers, data catalogs, or open standards such as OpenLineage emitted by data pipelines.
• Business lineage: documented by data owners and linked to the technical lineage in a data catalog.
• Controls along the chain: reconciliations (record counts, sums vs general ledger), data quality rules on CDEs, and sign-offs.
• Weak points: spreadsheets, manual adjustments, and transformations embedded in reporting tools that do not expose their logic.

Analogy. Data lineage is like a supply chain traceability system for food: if a contaminated product is found on a shelf, the producer must be able to trace it back to the farm, the truck and the factory batch within hours, and identify every other product affected.

Key takeaways

• Lineage documents how each reported value is derived from source data, including transformations, rule versions and manual adjustments.
• Supervisors expect attribute-level lineage at least for critical data elements of key risk and regulatory reports.
• Automated technical lineage should be linked to business lineage and to the data quality controls at each step.
• Spreadsheets and undocumented manual adjustments are the most common breaks in lineage.

🧪 Practice

1. Beginner: Explain the difference between business lineage and technical lineage, with an example for the LCR.
2. Intermediate: A change is planned to the customer master's sector classification. Using the lineage example, list which reports and numbers could be affected and how you would quantify the impact before go-live.
3. Interview: "Design a lineage solution for a regulatory reporting platform with 40 source systems, a data lake and an Excel-based adjustment process." Hint: a graph model of datasets, columns, jobs and rules with versions; automated capture from pipelines (for example OpenLineage events or SQL parsing); replacing Excel adjustments with a controlled adjustment workflow that records owner, reason and approval; and linking CDEs to data quality results so the lineage shows both the path and the health of the data.

BCBS 239 Risk Data Aggregation

Why it matters. In 2008, many large banks could not quickly answer basic questions such as "what is our total exposure to Lehman Brothers across all entities and products?". Data was spread across incompatible systems and aggregated manually, so risk reports were slow, incomplete and sometimes wrong exactly when they were most needed. In January 2013, the Basel Committee issued BCBS 239, Principles for effective risk data aggregation and risk reporting, requiring banks to be able to produce accurate risk data quickly, in normal times and in a crisis. It applies to G-SIBs (from 2016) and is expected of D-SIBs, and supervisors increasingly apply it to all significant banks.

The 14 principles.

Group	Principle	Short meaning
I. Governance and infrastructure	1. Governance	Board and senior management own risk data aggregation; it is part of the risk framework
	2. Data architecture and IT infrastructure	Integrated data taxonomies and architecture across the group, also in stress
II. Risk data aggregation	3. Accuracy and integrity	Data is accurate and reconciled, aggregated largely automatically
	4. Completeness	All material risk data across the group is captured
	5. Timeliness	Aggregated data is available quickly, including in stress
	6. Adaptability	The bank can produce ad hoc data for new questions, scenarios and crises
III. Risk reporting	7. Accuracy	Reports precisely convey aggregated data and reflect risk exactly
	8. Comprehensiveness	Reports cover all material risks
	9. Clarity and usefulness	Reports are clear and suited to their audience
	10. Frequency	Report frequency matches the needs and increases in stress
	11. Distribution	Reports reach the right people, securely and in time
IV. Supervisory review	12. Review	Supervisors regularly assess compliance
	13. Remedial actions	Supervisors use tools to enforce remediation
	14. Home/host cooperation	Supervisors cooperate across jurisdictions

Compliance in practice. Implementation has been slow. The Basel Committee's progress report of November 2023 found that only two of the 31 assessed G-SIBs were fully compliant with all principles, a decade after publication. Typical supervisory findings:

• Weak ownership: no clear accountability for data at board and senior management level.
• Fragmented architecture with many manual steps, spreadsheets and reconciliations.
• Incomplete lineage and data quality controls on critical data elements.
• Inability to produce ad hoc stress reports in hours (for example exposure to a counterparty or country in distress).
• Programmes that change reporting tools but leave the underlying data problems untouched.

Supervisors now enforce these principles more directly. The ECB, for instance, can impose capital add-ons or periodic penalty payments for persistent deficiencies.

Example: a stress-day request. At 10:00 a large hedge fund defaults. The CRO asks for the group's total exposure by 14:00.

  Capability                       Weak setup (manual)                 BCBS 239-compliant setup
  ------------------------------------------------------------------------------------------------
  Find all legal entities of       Email to 6 entities, each with      Group-wide counterparty
  the counterparty group           its own customer IDs                hierarchy based on LEI
  Collect exposures                Spreadsheets from loans, OTC        Daily aggregated exposure
                                   derivatives, repo, prime brokerage  store, all products
  Apply netting and collateral     Inconsistent per desk               Central netting set and
                                                                       collateral data (Ch. 8.3)
  Reconcile                        Not possible in time                Automated controls vs
                                                                       source and GL
  Answer                           Next day, with caveats              Within hours, with known
                                                                       data quality status

Example: data quality metrics for a CDE. Banks typically define dimensions such as completeness, accuracy, validity, consistency and timeliness, and measure them on each critical data element.

  CDE: counterparty LEI on OTC derivative trades       Threshold   Actual   Status
  completeness (trades with LEI populated)              >= 99.5%    99.82%    OK
  validity (LEI format and check digits valid)          >= 99.9%    99.97%    OK
  consistency (LEI matches counterparty master)         >= 99.5%    98.90%    BREACH -> issue owner: Ref. Data
  timeliness (available by 06:00)                       >= 98%      99.40%    OK

Analogy. BCBS 239 is like requiring an airline to be able to tell, within minutes of a storm warning, where every aircraft, crew member and passenger is, using one reliable system, rather than phoning each airport and adding up the answers on paper.

Key takeaways

• BCBS 239 (2013) sets 14 principles for risk data aggregation and reporting, grouped into governance and infrastructure, aggregation, reporting and supervisory review.
• Its core demands are accuracy, completeness, timeliness and adaptability, in normal times and especially in stress.
• Compliance remains incomplete across large banks; supervisors increasingly enforce it with findings, add-ons and penalties.
• In practice it requires data ownership, an integrated architecture, lineage, data quality controls on CDEs and the ability to answer ad hoc questions quickly.

🧪 Practice

1. Beginner: Name the four groups of BCBS 239 principles and one principle from each.
2. Intermediate: Which BCBS 239 principles are most at risk if the liquidity report depends on a spreadsheet that one analyst updates manually every morning? Explain for each.
3. Interview: "You are asked to lead the BCBS 239 remediation for treasury risk data. Where do you start?" Hint: identify the key reports and their CDEs, assign owners, measure data quality and lineage gaps, prioritize by materiality and supervisory findings, fix data at source rather than in reporting, automate reconciliations, and prove timeliness and adaptability with stress drills.

<a id="94-conduct-and-compliance"></a>

9.4 Conduct and Compliance

Prudential regulation keeps banks solvent and liquid; conduct regulation keeps them honest and keeps the financial system from being used for crime. This subchapter covers the conduct rules that most directly affect treasury and its systems: anti-money laundering and know-your-customer, sanctions screening, market abuse, derivative trade reporting and record-keeping. Breaches here rarely threaten solvency directly, but they lead to some of the largest fines in banking, to criminal liability for individuals and to restrictions on doing business.

AML and KYC Basics

Why it matters. Criminals need to make the proceeds of drug trafficking, fraud, corruption or tax evasion look legitimate, and to move money for terrorism. Banks are the gateway to the financial system, so the law makes them responsible for not knowingly or negligently helping. Failures are punished severely: Danske Bank's Estonian branch processed around EUR 200bn of suspicious flows and the bank pleaded guilty in the US in 2022, and TD Bank pleaded guilty in 2024 and paid about USD 3bn in penalties, with an asset cap on its US business. Anti-money laundering (AML) is the overall framework; know your customer (KYC) is the part that establishes who the bank is dealing with.

How money laundering works.

  Placement                     Layering                          Integration
  -----------                   ----------                        -------------
  Illicit cash enters the  -->  Funds are moved through many  --> Funds return as apparently
  financial system (cash        accounts, entities, countries     legitimate wealth (property,
  deposits, cash-intensive      and products to hide their        business investment, loans
  businesses)                   origin (wires, FX, securities,    repaid with "profits")
                                trade invoices, shell companies)

Framework.

• International standard: the Financial Action Task Force (FATF), founded in 1989, issues 40 Recommendations and evaluates countries; jurisdictions with strategic deficiencies are placed on its "grey" or "black" lists.
• EU: successive AML directives, now replaced by a 2024 AML package: a directly applicable AML Regulation (AMLR, applying from July 2027), a new directive, and a new EU Anti-Money Laundering Authority (AMLA) in Frankfurt, which will directly supervise selected high-risk institutions.
• US: the Bank Secrecy Act (1970) and the USA PATRIOT Act (2001), enforced by FinCEN and the banking agencies; cash transactions above USD 10,000 require a Currency Transaction Report (CTR).
• Risk-based approach: effort should be proportional to risk. Every customer is identified, but high-risk customers receive deeper scrutiny.

The KYC lifecycle.

  Onboarding                 Risk rating          Ongoing monitoring              Review / exit
  -------------------        -------------        -------------------------       --------------
  Customer identification -> Customer risk   -->  Transaction monitoring    -->   Periodic review
  (CIP): name, address,      score: low /         Screening (sanctions,          (e.g. high risk 1y,
  date of birth, ID docs     medium / high        PEP, adverse media)            medium 3y, low 5y)
  Customer due diligence                          Event-driven review            Exit relationship if
  (CDD): purpose, nature,                         (new owner, alert, news)       risk unacceptable
  beneficial owners                               Suspicious activity ->
  Enhanced due diligence                          SAR / STR to the FIU
  (EDD) for high risk

• Beneficial owner: the natural person who ultimately owns or controls a customer; typically any person holding more than 25%, plus a person exercising control.
• Politically exposed persons (PEPs): people with prominent public functions, their family and close associates; EDD is mandatory.
• Suspicious activity reports (SARs) / suspicious transaction reports (STRs): filed with the national Financial Intelligence Unit (FIU) when the bank suspects money laundering. The customer must not be told (the tipping-off prohibition).

Why treasury cares. Treasury deals mostly with banks, funds and corporates, not with retail customers, but:

• Every trading counterparty must be onboarded with KYC before the first trade; the system must block trading with counterparties whose KYC is missing or expired.
• Correspondent banking (nostro and vostro accounts, Chapter 2.1) is high risk: the bank processes payments for customers of another bank that it does not know directly, so it must assess the respondent bank's AML controls.
• Trade finance, cross-border FX and securities transactions can be used for layering.
• Counterparty identifiers (LEI) and legal hierarchies from KYC are reused for credit limits (Chapter 8.3), regulatory reporting and sanctions screening.

Example: customer risk scoring.

Factor	Customer A: domestic manufacturer	Customer B: offshore trading company
Country of incorporation	Low risk (1)	High risk / secrecy jurisdiction (3)
Ownership structure	Simple, listed parent (1)	Three layers of holding companies, nominee directors (3)
Industry	Manufacturing (1)	Commodity trading (2)
Products used	Payments, FX forwards (1)	Large cross-border wires, cash deposits (3)
PEP connection	None (0)	Shareholder is a relative of a minister (3)
Score / rating	4 / Low	14 / High: EDD, senior approval, annual review

Example: a transaction monitoring rule for structuring.

  Rule STRUCT-01: possible structuring (splitting cash deposits to avoid the CTR threshold)
    IF   count(cash deposits between USD 8,000 and 9,999, same customer, rolling 10 days) >= 3
    AND  sum(those deposits) > USD 25,000
    THEN create alert, priority = medium (high if customer risk = high)

  Customer C, days 1-8: 9,500 | 9,200 | 9,800 | 9,400   -> 4 deposits, total 37,900 -> ALERT

An analyst investigates the alert and decides whether to close it with a documented rationale or file a SAR. Monitoring systems often produce more than 90% false positives, so tuning rules and prioritizing alerts is a major engineering and analytics topic.

Analogy. KYC is the check-in desk of an airport: it verifies who you are before you board. Transaction monitoring is the security camera system that watches for suspicious behaviour once you are inside.

Key takeaways

• Money laundering follows placement, layering and integration; banks must prevent and detect it under a risk-based approach.
• KYC identifies the customer and its beneficial owners, assesses risk and applies enhanced due diligence to high-risk customers such as PEPs.
• Ongoing transaction monitoring generates alerts; suspicions are reported to the FIU without tipping off the customer.
• Treasury systems must enforce KYC status before trading and reuse KYC reference data for limits, reporting and screening.

🧪 Practice

1. Beginner: Map each activity to placement, layering or integration: buying a property with funds from a shell company; depositing cash in several branches; wiring funds through three countries via FX conversions.
2. Intermediate: Propose two transaction monitoring rules for a correspondent banking relationship and describe one legitimate pattern that each rule might wrongly flag.
3. Interview: "How would you make sure no trade can be booked with a counterparty whose KYC has expired?" Hint: a pre-trade check against a KYC status service (with clear behaviour when it is unavailable), status events published on expiry or change, blocking in all booking channels including manual ones, exception workflows with approvals, and a daily reconciliation of new trades against KYC status.

Sanctions Screening

Why it matters. Governments use economic sanctions to put pressure on countries, regimes, organizations and individuals, for example in response to wars, terrorism, weapons proliferation or human rights abuses. Banks are the main enforcement point: a sanctioned party cannot be paid, its assets must be frozen, and certain transactions are prohibited. Liability is often strict: a bank can be fined even if it did not know it was dealing with a sanctioned party, and fines can reach billions (BNP Paribas paid about USD 9bn in 2014 for processing payments involving sanctioned countries). Unlike AML, sanctions compliance is mostly about matching names and entities against lists, in real time, without letting anything through.

Sources of sanctions.

Authority	Main lists and rules
United Nations Security Council	Consolidated UN list; implemented by member states
European Union	EU Consolidated Financial Sanctions List; sectoral restrictions (for example on Russian securities, deposits, financing)
United States (OFAC, Treasury)	Specially Designated Nationals (SDN) list, sectoral lists, country embargoes; secondary sanctions on non-US persons
United Kingdom	UK Sanctions List; financial sanctions enforced by OFSI
Other national lists	Switzerland, Japan, Canada, and others

Key concepts.

• Asset freeze / blocking: funds of listed persons must be frozen and no funds made available to them.
• Ownership and control: sanctions extend to entities owned or controlled by listed persons. Under OFAC's 50% rule, an entity owned 50% or more in aggregate by one or more SDNs is blocked even if it is not named. The EU applies an ownership test (more than 50%) and a control test, with more case-by-case guidance on aggregating holdings.
• Sectoral sanctions: restrictions on certain activities rather than on all dealings, for example buying new debt above a certain maturity issued by listed companies.
• Jurisdiction: US sanctions apply to USD payments that clear through US banks, which is why non-US banks screen against OFAC lists as well.
• Block vs reject: under OFAC rules, property of an SDN is blocked (held in a frozen account); other prohibited transactions are rejected (returned). Both must be reported to OFAC within 10 business days.

What is screened.

  Static (customer) screening                       Transaction (payment) screening
  ------------------------------                    ------------------------------------------
  When: onboarding, list updates (daily or          When: every payment and trade instruction,
        intra-day), customer data changes                 in real time, before release
  What: customers, beneficial owners, directors,    What: all parties and agents (ordering
        guarantors, counterparties                        customer, beneficiary, intermediary
                                                          banks, BICs), free text, addresses,
                                                          vessel names, ports, goods descriptions
                       \                                      /
                        v                                    v
                 Fuzzy matching engine (names, aliases, transliterations, dates of birth)
                        |
                        v
           Alert -> Level 1 review -> Level 2 / compliance -> release | reject | block + report

Fuzzy matching. Names are spelled inconsistently across alphabets and systems ("Mohammed", "Muhammad", "Mohamad"), so exact matching would miss true hits. Engines use edit distances (Levenshtein, Jaro-Winkler), phonetic algorithms, transliteration tables, token reordering and weighting of common words, plus secondary identifiers (date of birth, nationality, address) to separate true hits from false ones.

Example: a name match.

  Payment beneficiary:   "Ivan Petrof"        List entry: "Ivan Petrov" (SDN), DOB 1971-03-12
  Levenshtein distance = 1 (f vs v);  length = 11
  Similarity = 1 - 1/11 = 0.91       threshold for alert = 0.85  -> ALERT

  Analyst review: beneficiary is a company account "Ivan Petrof GmbH", incorporated 2019,
  registered in Austria, no link to the listed person -> false positive, documented and released.
  Good list hygiene: add the entity to a "good guy" list so the same payment does not alert again,
  subject to periodic review.

Example: ownership aggregation.

       SDN A            SDN B           Person C (not listed)
        30%              25%                  45%
          \               |                   /
           +--------------+------------------+
                          |
                    Company X (not named on any list)

  OFAC 50% rule: 30% + 25% = 55%  ->  Company X is blocked
  A payment to Company X must be blocked although its name produces no screening alert.
  -> Requires ownership data from KYC or third-party providers, not just name screening.

Treasury relevance. FX and money market payments, securities settlement, collateral transfers and correspondent banking all go through screening. Treasury must also check investment and collateral portfolios against sectoral restrictions (for example, whether a bond issuer became subject to sanctions after purchase), and screening delays must be built into intraday liquidity planning for time-critical payments.

Analogy. Sanctions screening is like passport control with a watch list: every traveller is checked against the list, slightly misspelled names must still be caught, and most matches turn out to be people who merely share a common name.

Key takeaways

• Sanctions come from the UN, EU, US (OFAC), UK and others; banks must screen against all lists relevant to their activities and currencies.
• Ownership rules extend sanctions to unlisted entities owned or controlled by listed persons; OFAC aggregates holdings under the 50% rule.
• Customers are screened at onboarding and on list updates; payments and trades are screened in real time across all parties and free text.
• Fuzzy matching is needed to catch variants, but produces many false positives that analysts must resolve and document.

🧪 Practice

1. Beginner: Explain the difference between blocking and rejecting a payment under OFAC rules.
2. Intermediate: Company Y is owned 40% by SDN D, 15% by Company Z and 45% by unlisted investors. Company Z is itself owned 60% by SDN E. Is Company Y blocked under the OFAC 50% rule? Show your reasoning.
3. Interview: "Our payment screening engine adds 4 seconds per payment and generates 3,000 alerts per day, 99.5% false positives. How would you improve it?" Hint: tune thresholds and matching algorithms by list and field, use secondary identifiers, maintain governed good-guy lists, exploit structured ISO 20022 data, prioritize alerts by risk, measure the effect on true-hit detection with test cases before changing anything, and scale the engine horizontally for latency.

Market Abuse Regulation

Why it matters. Financial markets only work if participants trust that prices reflect genuine supply and demand and that no one is trading on secret information. Insider dealing and manipulation transfer wealth from honest investors to cheaters and, over time, drive participants away. Banks have been at the centre of major scandals: manipulation of LIBOR and other benchmarks, and collusion in FX markets (the "Cartel" chat rooms) led to fines of around USD 10bn on several banks between 2014 and 2015. The EU Market Abuse Regulation (MAR, Regulation (EU) 596/2014), applicable since July 2016, is the main framework in Europe; the UK applies an onshored version, and the US relies on securities and commodities laws.

What MAR prohibits.

Offence	Meaning	Example
Insider dealing	Trading, or cancelling orders, on the basis of inside information	Buying a bank's bonds knowing it will announce an unexpected capital raise
Unlawful disclosure	Sharing inside information outside the normal exercise of employment	A treasury employee tells a friend about an imminent issuance
Market manipulation	Transactions, orders or information that give false signals or secure an abnormal price	Spoofing, wash trades, marking the close, spreading false rumours, benchmark manipulation

Inside information is information that is precise, not public, relates directly or indirectly to an issuer or instrument, and would be likely to have a significant effect on prices if made public.

Scope. Financial instruments traded on EU regulated markets, MTFs and OTFs, and instruments whose value depends on them (including OTC derivatives), plus emission allowances and benchmarks. Spot FX is not a financial instrument under EU law, so it falls outside MAR, but FX derivatives are in scope, and FX spot conduct is covered by the industry FX Global Code (2017) and general conduct rules.

Obligations on banks.

• Surveillance and STORs (Article 16): anyone professionally arranging or executing transactions must have systems to detect suspicious orders and transactions and report them to the regulator without delay (suspicious transaction and order reports).
• Insider lists (Article 18): issuers and those acting for them must keep lists of everyone with access to inside information.
• Managers' transactions (Article 19): persons discharging managerial responsibilities must notify their own trades in the issuer's instruments.
• Market soundings (Article 11): before a transaction, a bank may share inside information with potential investors only under a documented procedure ("wall-crossing").
• Safe harbours (Article 5): buy-back programmes and stabilisation that follow defined conditions are not considered abuse.

Why treasury is directly exposed. Treasury is an issuer: it prepares bond issuances, capital transactions and buy-backs (Chapter 7.1), which are often inside information. Treasury is also a trader: it trades government bonds, futures and swaps for liquidity and hedging. Information barriers ("Chinese walls") between the people preparing an issuance and the people trading must be enforced, and treasury trading must be included in market surveillance.

Example: spoofing on a bond futures order book.

  Time      Action by trader T                               Best bid / ask        Effect
  ------------------------------------------------------------------------------------------------
  10:00:00  Resting order: SELL 20 lots at 131.42            131.40 / 131.42
  10:00:01  Places BUY 500 lots at 131.40, 131.39, 131.38    bids look very deep   others raise bids
            (no intention to execute)
  10:00:03  Others lift the offer: T's SELL 20 fills 131.42  131.41 / 131.43
  10:00:04  Cancels all 500 BUY lots                         131.39 / 131.41       book returns
  ------------------------------------------------------------------------------------------------
  Surveillance signals: large orders on the opposite side of a small genuine order, cancelled
  within seconds after the small order fills; pattern repeated many times per day;
  high order-to-trade ratio.

In the US, spoofing has been a criminal offence since the Dodd-Frank Act. In 2020, JPMorgan paid about USD 920m to settle spoofing charges in precious metals and Treasury futures.

Engineering view. Surveillance systems ingest every order event (new, amend, cancel, fill) with precise timestamps, market data and communications (chat, email, voice transcripts), and run pattern detection for spoofing, layering, wash trades, front-running and insider dealing around events such as issuance announcements. Each alert must be investigated, and decisions documented and retained.

Analogy. MAR is like the rules of a card game enforced by a casino: you may play skilfully, but not look at others' cards (insider dealing), show your cards to friends (unlawful disclosure) or stack the deck (manipulation), and the casino's cameras (surveillance) must report anything suspicious.

Key takeaways

• MAR prohibits insider dealing, unlawful disclosure of inside information and market manipulation, including benchmark manipulation.
• Banks must run surveillance and file STORs, keep insider lists and manage market soundings.
• Treasury is exposed both as an issuer with inside information and as an active trader.
• Effective surveillance needs complete order event data with accurate timestamps, market data and communications.

🧪 Practice

1. Beginner: Which of these is in scope of EU MAR: a spot EUR/USD trade; an EUR/USD FX option; a government bond traded on an MTF; an interest rate swap referencing a listed bond future?
2. Intermediate: Treasury is preparing an AT1 issuance to be announced in two weeks. Describe the controls needed for the treasury traders who also manage the bank's own bond portfolio.
3. Interview: "Design a spoofing detection alert for a futures trading desk." Hint: reconstruct the order book from order events; look for orders on one side that are large relative to genuine orders on the other side, cancelled shortly after the other side executes; parameterize size ratios and time windows per instrument; score repeated patterns; and test against labelled historical cases to manage false positives.

Trade Reporting (EMIR, Dodd-Frank)

Why it matters. When Lehman Brothers failed in 2008, regulators could not see who was exposed to whom in the huge over-the-counter (OTC) derivatives market, and AIG had accumulated massive one-way credit default swap positions largely unnoticed. At the 2009 Pittsburgh summit, the G20 agreed that all OTC derivatives should be reported to trade repositories, standardized contracts centrally cleared and traded on platforms, and that non-cleared derivatives should face higher capital and margin requirements. Trade reporting gives regulators a map of the derivatives market. The EU implemented it through EMIR and the US through Title VII of the Dodd-Frank Act. For a treasury that uses swaps and FX forwards to hedge (Chapter 3.6, 6.3), every trade generates reporting obligations.

Comparison.

Aspect	EU EMIR (Regulation 648/2012, as amended by EMIR Refit)	US Dodd-Frank (CFTC Parts 43 and 45; SEC for security-based swaps)
What	All derivatives, OTC and exchange-traded	Swaps (CFTC); security-based swaps (SEC, Regulation SBSR)
Who reports	Both counterparties (dual-sided); financial counterparties report on behalf of small non-financial counterparties (NFC-)	One reporting counterparty, chosen by hierarchy (swap dealer > major swap participant > financial > non-financial)
Where	Registered trade repositories (TRs)	Swap data repositories (SDRs)
When	By the end of the working day after execution, modification or termination (T+1)	Regulatory reporting T+1 or T+2 depending on counterparty type; real-time public reporting of price and volume (Part 43) as soon as technologically practicable
What else	Daily valuation and margin/collateral updates	Valuation and margin data for swap dealers
Format	ISO 20022 XML, around 200 fields since EMIR Refit (April 2024 in the EU, September 2024 in the UK)	CFTC technical specification, aligned with global data elements

Global identifiers. Supervisors agreed common identifiers so that reports from different repositories can be combined:

Identifier	Standard	Identifies
LEI (Legal Entity Identifier)	ISO 17442	Counterparties, brokers, CCPs
UTI (Unique Transaction Identifier)	ISO 23897	The trade; both counterparties must report the same UTI, so one side generates it and shares it
UPI (Unique Product Identifier)	ISO 4914	The product type (for example a fixed-float IRS in EUR referencing EURIBOR 6M)
CDE (Critical Data Elements)	CPMI-IOSCO guidance	Harmonized definitions of fields such as notional, price, dates

Example: reporting an interest rate swap. On 14 October 2026, a EU bank's treasury (financial counterparty) enters a EUR 100m 5-year swap with a US swap dealer, paying fixed 2.45% and receiving 6M EURIBOR, cleared at a CCP.

  EMIR (bank reports its side to its TR by end of 15 October 2026)
    UTI                     generated by the swap dealer per UTI hierarchy, shared via confirmation
    Counterparty 1          bank LEI          Counterparty 2      dealer LEI
    Direction               fixed leg payer   Cleared             Y, CCP LEI, clearing timestamp
    UPI                     EUR IRS fixed-float EURIBOR 6M
    Notional                100,000,000 EUR   Effective / maturity 2026-10-16 / 2031-10-16
    Fixed rate              2.45%             Floating index      EURIBOR, 6M
    Action type             NEWT (new)        then daily: VALU (valuation), MARU (margin)

  Dodd-Frank (swap dealer is the reporting counterparty; bank only confirms its data)
    Part 45: dealer reports to an SDR, T+1
    Part 43: price and notional (capped) published anonymously in real time

  Later lifecycle events, each reported:  partial termination -> MODI / TERM,
  error in notional -> CORR, report sent in error -> EROR

After clearing, the original bilateral trade is terminated and replaced by two trades with the CCP, each with its own UTI, which must also be reported. This is a frequent source of reconciliation breaks.

Data quality and reconciliation. Trade repositories pair and match the reports of the two counterparties on key fields, and send back acceptance or rejection messages and reconciliation statuses. Supervisors monitor the number of unpaired and unmatched trades, late reports and rejected submissions, and EMIR Refit requires counterparties to notify their supervisor of significant reporting errors. Other related regimes follow the same logic: MiFIR transaction reporting (orders and transactions in instruments traded on venues, T+1 to the national regulator) and SFTR (repos and securities lending, very relevant to treasury funding and collateral activity).

Engineering view. A trade reporting system needs an eligibility engine (which regimes apply to which trade), field derivation from trade, static and lifecycle data, UTI generation and sharing, submission and acknowledgement handling, a daily reconciliation against the TR's view of open trades, and workflows to correct rejected and unmatched reports.

Analogy. Trade reporting is like requiring every car sale to be registered with a central vehicle registry by the next day: the buyer and seller each file a record with the same contract number, and the registry checks that both records agree.

Key takeaways

• Following the 2009 G20 commitments, derivatives must be reported to trade repositories: EMIR in the EU, Dodd-Frank in the US.
• EMIR is dual-sided and covers all derivatives with T+1 deadlines; Dodd-Frank uses a single reporting counterparty and adds real-time public reporting.
• LEI, UTI and UPI make reports combinable across repositories; matching UTIs on both sides is essential.
• Lifecycle events, valuations and collateral must be reported, and reconciliation breaks must be managed actively.

🧪 Practice

1. Beginner: Who reports under EMIR when an EU bank enters an FX forward with an EU corporate that is a small non-financial counterparty (NFC-)?
2. Intermediate: In the example, the swap is cleared 30 minutes after execution. List the reports the bank must make under EMIR for the original trade and the cleared trade, and explain why both counterparties must use the same UTI.
3. Interview: "The trade repository reports that 3% of our trades are unmatched with our counterparties. How would you reduce it?" Hint: analyse breaks by field and counterparty; check UTI generation and sharing, LEI mapping, notional and date conventions, timing of lifecycle events and clearing; agree data conventions with frequent counterparties; and add pre-submission validation and daily break monitoring with owners.

Record-Keeping Obligations

Why it matters. Supervisors, auditors, prosecutors and courts often need to reconstruct what happened months or years later: why a trade was executed, what a customer was told, who approved a limit breach, what the trader said on the phone. Record-keeping rules require banks to keep complete, accurate, unalterable and retrievable records for defined periods. Failures are punished even without any other misconduct: between 2021 and 2024, US regulators fined banks and brokers more than USD 2bn in total for letting staff discuss business on WhatsApp and other unmonitored "off-channel" messaging apps.

Main obligations relevant to treasury.

Regime	What must be kept	Minimum retention
MiFID II (EU)	Records of all services, orders and transactions; telephone conversations and electronic communications that relate to (or are intended to lead to) transactions	5 years, up to 7 if requested by the regulator
EMIR (EU)	Records of every derivative concluded and any modification	5 years after termination of the contract
MAR (EU)	Insider lists; records supporting STORs and surveillance decisions	5 years
AML (EU and US)	Customer due diligence documents and transaction records	5 years after the end of the relationship or transaction
CFTC (US)	Swap dealers: full records of each swap; oral communications	Life of the swap plus 5 years; oral records 1 year
SEC Rule 17a-4 (US broker-dealers)	Books, records and business communications, in non-rewriteable form or with a complete audit trail	3 to 6 years depending on record type
Basel / prudential	Data and documentation supporting capital, liquidity and model calculations, regulatory reports	Set by national rules and internal policy (often 7 to 10 years)

Properties of a compliant record.

• Complete: all relevant channels captured, including voice, chat, email and mobile devices used for business.
• Immutable: records cannot be altered or deleted before the end of the retention period (WORM storage, object lock, or an audit trail of every change).
• Accurate timestamps: MiFID II requires business clocks synchronized to UTC, with a maximum divergence of 100 microseconds for high-frequency trading and 1 second for voice trading.
• Retrievable: records must be found and produced within short deadlines when the regulator asks, which requires indexing and search, not just storage.
• Deleted when no longer needed: data protection law (the GDPR in the EU) requires personal data not to be kept longer than necessary. Legal retention obligations override the right to erasure while they last, but records must be deleted once retention ends, unless a legal hold applies due to litigation or investigation.

Example: a retention schedule implemented as code.

  record_class                trigger_event           retention    legal_basis
  ---------------------------------------------------------------------------------------
  OTC_DERIVATIVE_TRADE        trade_termination_date  5y           EMIR Art. 9
  TRADER_VOICE_RECORDING      recording_date          5y (7y opt)  MiFID II Art. 16(7)
  KYC_FILE                    relationship_end_date   5y           AMLR
  LIMIT_BREACH_APPROVAL       approval_date           7y           internal policy
  REGULATORY_REPORT_SNAPSHOT  reference_date          10y          internal policy

  Daily job:
    for each record:
      if legal_hold(record): skip                       # litigation / investigation
      expiry = trigger_event_date + retention
      if today > expiry: delete record and log deletion (who, what, when, under which rule)

Example: a swap traded on 3 March 2026 and terminated early on 15 September 2028 must be kept until at least 15 September 2033 under EMIR, even though the trade itself was alive for only two and a half years.

Engineering view. Record-keeping touches almost every treasury system: trade capture must keep a full audit trail of amendments (who changed what, when and why), reporting systems must keep the exact data snapshot used for each submitted report, and communications must be captured from approved channels only. Event-sourced designs, append-only logs and storage with retention locks map naturally onto these requirements.

Analogy. Record-keeping is like a flight data recorder: it must capture everything relevant, it must be tamper-proof, and it is only valuable if investigators can retrieve and read it quickly after an incident.

Key takeaways

• Banks must keep complete, immutable, accurately timestamped and retrievable records of transactions, communications and decisions.
• Retention periods differ by regime (typically at least 5 years) and are often counted from an event such as trade termination or end of relationship.
• Data protection requires deletion after retention ends, except under legal hold; retention schedules should be implemented as rules, not manual processes.
• Off-channel communications are a major enforcement focus; only monitored channels may be used for business.

🧪 Practice

1. Beginner: Under EMIR, until when must a 10-year swap traded on 1 June 2026 be kept if it runs to maturity?
2. Intermediate: A customer asks the bank to delete all their personal data under the GDPR, two years after closing their accounts and one year after a dispute over an FX trade reached the courts. Which records can be deleted, and which must be kept? Explain.
3. Interview: "Design the audit trail for a treasury trade capture system so that any trade can be reconstructed as of any point in time." Hint: event-sourced or bitemporal model (valid time and system time), append-only storage with retention locks, user, timestamp and reason for each change, linkage to approvals and communications, and query APIs that rebuild the trade and its reports as of a given date.

---

<a id="10-corporate-treasury-and-cash-management-services"></a>