[F1 ANNEX VIII U.K. INTERNAL MODELS

Textual Amendments

F1 Inserted by Directive 98/31/EC of the European Parliament and of the Council of 22 June 1998 amending Council Directive 93/6/EEC on the capital adequacy of investment firms and credit institutions.

2. Recognition shall only be given if the competent authority is satisfied that the institution's risk-management system is conceptually sound and implemented with integrity and that, in particular, the following qualitative standards are met: U.K.

(i)

the internal risk-measurement model is closely integrated into the daily risk-management process of the institution and serves as the basis for reporting risk exposures to senior management of the institution;

(ii)

the institution has a risk control unit that is independent from business trading units and reports directly to senior management. The unit must be responsible for designing and implementing the institution's risk-management system. It shall produce and analyse daily reports on the output of the risk-measurement model and on the appropriate measures to be taken in terms of trading limits;

(iii)

the institution's board of directors and senior management are actively involved in the risk-control process and the daily reports produced by the risk-control unit are reviewed by a level of management with sufficient authority to enforce both reductions of positions taken by individual traders as well as in the institution's overall risk exposure;

(iv)

the institution has sufficient numbers of staff skilled in the use of sophisticated models in the trading, risk-control, audit and back-office areas;

(v)

the institution has established procedures for monitoring and ensuring compliance with a documented set of internal policies and controls concerning the overall operation of the risk-measurement system;

(vi)

the institution's models have a proven track record of reasonable accuracy in measuring risks;

(vii)

the institution frequently conduct a rigorous programme of stress testing and the results of these tests are reviewed by senior management and reflected in the policies and limits it sets;

(viii)

the institution must conduct, as part of its regular internal auditing process, an independent review of its risk-measurement system. This review must include both the activities of the business trading units and of the independent risk-control unit. At least once a year, the institution must conduct a review of its overall risk-management process. The review must consider:

• the adequacy of the documentation of the risk-management system and process and the organisation of the risk-control unit,

• the integration of market risk measures into daily risk management and the integrity of the management information system,

• the process the institution employs for approving risk-pricing models and valuation systems that are used by front and back-office personnel,

• the scope of market risks captured by the risk-measurement model and the validation of any significant changes in the risk-measurement process,

• the accuracy and completeness of position data, the accuracy and appropriateness of volatility and correlation assumptions, and the accuracy of valuation and risk sensitivity calculations,

• the verification process the institution employs to evaluate the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources,

  and

• the verification process the institution uses to evaluate back-testing that is conducted to assess the model's accuracy.]