Supervisory Review and Evaluation Process (SREP)

The Supervisory Review and Evaluation Process (SREP) is the procedure by which banking supervisors in the European Union assess each bank's risks, governance and financial resources, and decide what the bank must do in response. It is carried out regularly, for the largest banks every year. The result is a set of requirements tailored to the individual bank, most visibly an additional capital requirement, together with any qualitative measures the supervisor considers necessary.

The SREP puts into practice the second pillar of the Basel framework, under which supervisors review risks that the standard minimum rules do not fully capture. Its legal basis is the Capital Requirements Directive, and its method is set out in guidelines from the European Banking Authority. For significant banks in the euro area, it is conducted by the European Central Bank working with national authorities; smaller banks are assessed by their national supervisors. It is the core annual exercise of prudential supervision.

The common methodology examines four areas:

• Business model. Whether the bank can generate acceptable returns over the next year and whether its strategy is sustainable over a longer horizon.
• Internal governance and risk management. The functioning of the board and its committees, the risk appetite statement, internal controls, risk data and culture.
• Risks to capital. Credit risk, market risk, operational risk and interest rate risk in the banking book, together with the bank's own assessment of the capital it needs.
• Risks to liquidity and funding. Short-term liquidity, the stability of funding and the bank's own assessment of its liquidity position, supported by liquidity stress testing.

Each element is given a score from 1, the lowest risk, to 4, the highest, and these are combined into an overall score. A separate grade indicates that a bank is considered failing or likely to fail.

Supervisors draw on regular regulatory reporting, on-site inspections, reviews of internal models, meetings with management and comparisons with peer banks. Two documents prepared by the bank itself are central. In the internal capital adequacy assessment process the bank sets out how much capital it believes it needs for all its material risks under normal and stressed conditions. In the internal liquidity adequacy assessment process it does the same for liquidity, drawing on its bank funding plan and contingency funding plan. The supervisor challenges both and forms its own view. Results of supervisory stress tests are a further input.

The process ends with a formal decision addressed to the bank. Its main components are:

• Pillar 2 requirement. A legally binding capital add-on covering risks that are underestimated or not covered by the minimum rules. It sits on top of the Pillar 1 capital requirement; see Pillar 2 capital requirement.
• Pillar 2 guidance. A non-binding expectation of further capital, informed by the stress test, that the supervisor wants the bank to hold above its requirements and buffers.
• Liquidity measures. Requirements such as holding additional liquid assets or reducing reliance on particular funding sources.
• Qualitative measures. Instructions to improve governance, risk management, data or the handling of problem loans, and in some cases restrictions on business or on distributions.

The Pillar 2 requirement must be met with capital of at least the same quality mix as the minimum requirement, so a set proportion has to be Common Equity Tier 1. Together with the minimum requirement and buffers such as the capital conservation buffer, it determines the level at which a bank faces automatic limits on dividends and bonuses.

The European Central Bank publishes aggregate results each year and, with the banks' agreement, the Pillar 2 requirement of each bank it supervises. Banks also include their requirement in their own Pillar 3 disclosure. Pillar 2 guidance is generally not published. The intensity and frequency of the review are scaled to the size and risk of the institution, with small, low-risk banks assessed in full less often.

Banks have criticised the process as opaque, arguing that it is difficult to trace how scores translate into capital figures and that decisions arrive late in the cycle. Others note that requirements have varied little from year to year for many banks, which suggests limited sensitivity to changes in risk. An independent review commissioned by the European Central Bank reported in 2023, and the supervisor has since announced changes intended to make the process shorter, more focused on each bank's main risks and clearer in its communication of decisions.

Outside the European Union, comparable processes operate under different names. In the United Kingdom the Prudential Regulation Authority runs its own supervisory review leading to Pillar 2A requirements and a PRA buffer, and other Basel member jurisdictions conduct equivalent second-pillar reviews.

• European Central Bank: Banking Supervision
• European Banking Authority