ECB Guide to Internal Models

A major enhancement in the 2025 guide is the codified expectation of a robust MRM framework, emphasizing:

• Group-wide consistency: Model lifecycle governance must be either centralized or independently audited across subsidiaries with high alignment.
• Model documentation: Must support replicability, track changes, and maintain comprehensive registers.
• Model complexity assessment: Institutions must periodically assess and classify internal models based on complexity, especially for ML and dynamic models.
• Skills and training: Defined competency standards for all stakeholders, including model developers, validators, senior management, and board members.

The ECB reiterates expectations for clear roles and responsibilities across the three lines of defense:

• Management body must oversee material model decisions, supported by documented mandates.
• Validation must be functionally independent from development, with increased scrutiny for high-complexity models.
• Internal audit must independently assess models, model governance, and follow up on findings with action plans and annual reviews.

For the first time, the ECB explicitly requires institutions to:

• Assess materiality of climate and environmental risks across the internal model lifecycle.
• Incorporate these risk drivers into IRB, market, and counterparty credit risk models where relevant.

This aligns with the ECB’s broader supervisory focus on sustainability and complements its earlier Guide on Climate-related and Environmental Risks (2020).

A significant and novel addition is a detailed chapter on ML-based internal models, with specific supervisory expectations covering:

• Explainability and documentation: ML models must be auditable, interpretable, and documented in a way that supports replicability.
• Model drift monitoring: Institutions must identify unintended shifts in performance or logic over time.
• Material change classification: Switching from traditional to ML-based methods is generally a material model change requiring supervisory approval.
• Override governance: Override frequency and rationale for ML-based rating outputs must be strictly monitored and documented.

These expectations apply across credit risk, market risk, and counterparty credit risk models using advanced analytics or unstructured data.

To address transitional arrangements under Basel III/FRTB, the guide contains two parallel market risk chapters:

• CRR2: Retains existing VaR and stressed VaR methodologies.
• CRR3: Introduces Expected Shortfall (ES), Default Risk Charge (DRC), and Profit and Loss Attribution (PLA) tests.

Institutions using FRTB internal models under CRR3 must adhere to updated methodologies and validation expectations.

The guide also:

• Re-emphasizes compliance with BCBS 239, Digital Operational Resilience Act (DORA), and EBA outsourcing guidelines.
• Requires robust IT infrastructure for model traceability and version control.
• Establishes detailed controls for third-party vendors supplying model components, especially for ML tools or data.