Business model and risk culture

At the same time, the authorities point out that the choice of business model remains the
responsibility of the institution; the supervisory response in the first instance is to
ensure that the institution’s Board and senior management have considered the
inherent risks stemming from their business models and that there exist appropriate
controls and buffers to mitigate them. Building on existing experience and
instruments as well as forthcoming European Banking Authority (EBA) and ECB
guidance, BaFin and the Bundesbank should adopt a comprehensive approach for
assessing banks’ and insurance companies’ business models.

This will allow
supervisors to identify the inherent risks associated with different business models
independently from the institutions and help them challenge assumptions made by
those institutions on the level of risk and the required controls and buffers. Moreover,
since major acquisitions (and qualifying holdings) can have a significant impact on
banks’ risk profile, the authorities should consider adapting their practices to ensure
that, at a minimum, they are always informed of such activities at an early stage. This
would enable supervisors to identify and assess the potential risk implications for the
institution and to take steps to mitigate or avoid these risks.

Finally, drawing on
international guidance on corporate governance and risk culture, the authorities are
encouraged to continue to increase their expertise and efforts to ensure appropriate
coverage of these qualitative aspects through on-site inspections and off-site analysis.