# Pillar 3 Disclosure Report: [Institution name] [Reference date, e.g. 2026-12-31]

> Public prudential disclosure report and production file for a credit
> institution or investment firm subject to Part Eight of Regulation
> (EU) No 575/2013 (CRR, Articles 431 to 455) as amended by Regulation
> (EU) 2024/1623 (CRR3, applying from 2025-01-01). It covers the
> disclosure policy, the institution's classification and disclosure
> frequency, a map from each Part Eight article to the uniform
> disclosure templates of Commission Implementing Regulation (EU)
> 2024/3172 (the Pillar 3 ITS, as amended by Implementing Regulation
> (EU) 2026/722 for the EBA Pillar 3 data hub), key metrics, the
> qualitative risk management statements, the production controls and
> the management attestation. Articles and template codes are cited by
> number; obtain the regulation and the ITS annexes for the normative
> text and check the consolidated versions. Replace every `[bracketed]`
> value and every row marked *Example*. This is a documentation format,
> not legal, regulatory, accounting or financial advice.

<!--
Guidance: How to use this template
- Pillar 3 is the market-facing third pillar of the Basel framework:
  the institution publishes its capital, risk exposures, risk
  management and liquidity so that investors, depositors and analysts
  can compare it with peers. In the EU the content is set by CRR Part
  Eight and the format by the Pillar 3 ITS (fixed tables with
  prescribed rows and columns, plus flexible qualitative tables).
- This file has two jobs. Sections 1 to 9 are the report skeleton in
  the order readers expect (key metrics first). Sections 10 and 11 are
  the internal production record: data sources, reconciliations,
  omissions and the written attestation required by CRR Article
  431(3). Remove or move the internal sections before publication if
  your policy keeps them separate.
- Fill section 2 first. The institution's category (large, small and
  non-complex, or other; listed or not) decides which templates are due
  and how often, and the template map in section 3 follows from it.
- The worked example uses the fictional Fernhollow Bank, a mid-sized
  EU credit institution and significant institution under the ECB.
  Figures are EUR million at 2026-12-31 and agree with the ICAAP
  Report (`finance/icaap-report`) and the ILAAP Report
  (`finance/ilaap-report`). All names and figures are fictional.
- Related documents: Risk Appetite Statement
  (`finance/risk-appetite-statement`), IRRBB Policy and Report
  (`finance/irrbb-policy-and-report`), Recovery Plan
  (`finance/recovery-plan`), Financial Statement Disclosure Checklist
  (`finance/financial-statement-disclosure-checklist`), Operational
  Risk RCSA (`finance/operational-risk-rcsa`), Market Risk Limit
  Framework (`finance/market-risk-limit-framework`), Third-Party Risk
  Register for Non-ICT Services
  (`finance/third-party-risk-register-non-ict`).
-->

## Document control

<!-- Guidance: Record the reference date, the consolidation level and the version of the ITS you report against. Pitfall: a report whose figures do not match the supervisory returns (COREP, FINREP) for the same date and nobody can explain the difference. -->

| Field | Value |
|---|---|
| Document ID | [P3-YYYY-MM] *Example:* P3-2026-12 |
| Institution and level | [Legal name, LEI, consolidation level] *Example:* Fernhollow Bank, consolidated (prudential perimeter) |
| Reference date | [YYYY-MM-DD] *Example:* 2026-12-31 |
| Disclosure frequency covered | [Annual / Semi-annual / Quarterly] *Example:* Annual (full set) |
| Institution category | [Large / Small and non-complex / Other], [Listed / Non-listed] *Example:* Large, listed |
| Reporting basis | [CRR as amended by CRR3; Implementing Regulation (EU) 2024/3172 as amended] |
| Publication channel | [EBA Pillar 3 data hub and own website] |
| Linked supervisory returns | [COREP and FINREP submission IDs for the same date] |
| Currency and units | [EUR million] |
| Version | [0.1] |
| Status | [Draft / In review / Attested / Published] |
| Owner | [@head-regulatory-reporting] |
| Approvers/reviewers | [@cfo], [@cro], [audit committee], [management body] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal until published, then Public] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Pillar 3 coordinator (preparer) | [@name] | [Submitted for review] | YYYY-MM-DD |
| Chief Financial Officer | [@name] | [Figures confirmed against COREP and FINREP] | YYYY-MM-DD |
| Chief Risk Officer | [@name] | [Qualitative risk disclosures confirmed] | YYYY-MM-DD |
| Internal audit or second-line review | [@name] | [Review opinion, section 10.4] | YYYY-MM-DD |
| Attesting member of the management body or senior management | [@name] | [Written attestation, section 11] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Template map refreshed for the current ITS version |
| 0.5 | YYYY-MM-DD | [@name] | *Example:* Quantitative templates populated from the 2026-12-31 COREP run |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Attested and submitted to the EBA Pillar 3 data hub |

## Contents

<!-- Guidance: Keep this list aligned with the headings below. -->

1. [Purpose, scope and disclosure policy](#1-purpose-scope-and-disclosure-policy)
2. [Institution category and disclosure frequency](#2-institution-category-and-disclosure-frequency)
3. [Template map](#3-template-map)
4. [Key metrics and overview of risk exposure amounts](#4-key-metrics-and-overview-of-risk-exposure-amounts)
5. [Risk management objectives and governance](#5-risk-management-objectives-and-governance)
6. [Own funds, capital requirements and output floor](#6-own-funds-capital-requirements-and-output-floor)
7. [Credit, counterparty, market, CVA and operational risk](#7-credit-counterparty-market-cva-and-operational-risk)
8. [Leverage, liquidity, interest rate risk and encumbrance](#8-leverage-liquidity-interest-rate-risk-and-encumbrance)
9. [ESG, remuneration and other disclosures](#9-esg-remuneration-and-other-disclosures)
10. [Production process and controls](#10-production-process-and-controls)
11. [Attestation](#11-attestation)
12. [Jurisdiction notes](#12-jurisdiction-notes)
13. [Glossary and references](#13-glossary-and-references)
14. [Standard and licence note](#14-standard-and-licence-note)

## 1. Purpose, scope and disclosure policy

<!-- Guidance: State what the report covers, at which consolidation level, and point to the formal disclosure policy. Questions: Which entities are in the prudential perimeter and how does it differ from the accounting perimeter? Which information was omitted as non-material, proprietary or confidential, and why? Pitfall: omitting a template without recording the reason and without saying so in the report. -->

### 1.1 Scope of application

State the name of the institution, the level of application (individual, sub-consolidated or consolidated) and the main differences between the accounting and the prudential scope of consolidation. CRR Article 436 asks for this, and the ITS templates on the scope of application (the EU LI and EU LIA series) show the reconciliation.

| Item | Value |
|---|---|
| Top entity of the prudential group | [Legal name, LEI] |
| Entities fully consolidated for accounting but deducted or risk-weighted for prudential purposes | [Names, treatment] |
| Practical or legal impediments to the transfer of own funds within the group | [None identified / Description] |
| Subsidiaries with own funds below the requirement | [None / Names and shortfall] |

*Example:* Fernhollow Bank publishes this report at the consolidated level. The prudential perimeter equals the accounting perimeter except for Fernhollow Insurance Agency, which is consolidated in the financial statements but is not a financial sector entity and is risk-weighted as an equity holding in the prudential scope. Fernhollow Payments (payment institution subsidiary) is fully consolidated in both.

### 1.2 Disclosure policy

CRR Article 431(3) requires a formal policy approved by the management body that sets out how the institution meets its disclosure requirements, and internal processes, systems and controls to verify that disclosures are appropriate and compliant. Summarise the policy here and link the approved version.

| Policy element | Content | Reference |
|---|---|---|
| Approval and review cycle | [Management body, yearly] | [Policy ID, version] |
| Roles | [Finance owns quantitative templates, risk owns qualitative tables, legal reviews omissions] | [RACI] |
| Materiality approach for omissions (Art. 432) | [Criteria and who decides] | [Section 10.3] |
| Publication channel and timing (Art. 433, 434) | [EBA data hub, own website, date relative to financial statements] | [Section 2.3] |
| Verification and attestation (Art. 431(3)) | [Second-line review, attestation by named officer] | [Section 11] |

### 1.3 Omitted information

CRR Article 432 allows an institution to omit information that is not material, or that is proprietary or confidential, as long as it says so and, for proprietary or confidential items, publishes more general information on the subject. Record every omission.

| Omission ID | Template or row | Ground (non-material / proprietary / confidential) | Reasoning | What is disclosed instead | Approved by |
|---|---|---|---|---|---|
| OMI-001 *(Example)* | EU CCR6 (credit derivatives exposures) | Non-material | Notional below the internal threshold of 0.1% of total assets, no hedging use | Statement in section 7.2 that credit derivatives are immaterial | [@cfo], YYYY-MM-DD |

## 2. Institution category and disclosure frequency

<!-- Guidance: The category drives everything else. Determine it from the CRR definitions, record the evidence and set the calendar. Questions: Is the institution large, small and non-complex or other? Is it listed? Which reference dates fall due this year? Pitfall: assuming the previous year's category without checking the size thresholds again. -->

### 2.1 Category

CRR Part Eight sets out the disclosure scope by category (Articles 433a to 433c, inserted by Regulation (EU) 2019/876, CRR2, and amended by CRR3): Article 433a for large institutions, Article 433b for small and non-complex institutions and Article 433c for other institutions, each with different content for listed and non-listed institutions. The definitions of "large institution" and "small and non-complex institution" are in CRR Article 4(1), points (146) and (145), also inserted by CRR2. Record the test that you applied.

| Test | Result | Evidence |
|---|---|---|
| Global or other systemically important institution (G-SII, O-SII) | [Yes / No] | [Designation decision, date] |
| Total assets at or above the "large" threshold in Art. 4(1)(146) | [Yes / No] | [Figure, date, check the current threshold] |
| Small and non-complex criteria in Art. 4(1)(145) met | [Yes / No] | [Criteria checked one by one] |
| Securities admitted to trading on a regulated market (listed) | [Yes / No] | [Venue, ISIN] |
| Resulting category | [Large listed / Large non-listed / SNCI listed / SNCI non-listed / Other listed / Other non-listed] | |

*Example:* Fernhollow Bank is designated an O-SII by its national authority, which makes it a large institution, and its senior bonds and shares are listed. It therefore discloses the full annual set, the semi-annual subset and the quarterly key metrics.

### 2.2 Frequency calendar

Use the frequency columns of the ITS mapping (the EBA publishes a mapping tool with the instructions) to place each template in the calendar. The broad pattern for large institutions is: everything once a year, a subset of quantitative templates every six months and a small set of key metrics every quarter. Small and non-complex institutions disclose a reduced set, mostly once a year. Confirm each template against the current ITS rather than this summary.

| Reference date | Frequency | Templates due *(Example for a large listed institution)* | Submission target |
|---|---|---|---|
| 2026-03-31 | Quarterly | EU KM1, EU OV1, EU LIQ1, EU CMS1 and other quarterly items per the mapping | [Date] |
| 2026-06-30 | Semi-annual | Quarterly set plus the semi-annual quantitative templates | [Date] |
| 2026-09-30 | Quarterly | Quarterly set | [Date] |
| 2026-12-31 | Annual | Full set, including qualitative tables and remuneration | [Same date as the annual financial statements or as soon as possible after (Art. 433)] |

### 2.3 Publication channel

CRR3 amended Article 434 so that institutions submit their disclosures to the EBA, which publishes them centrally, and Article 434a mandates uniform formats. Implementing Regulation (EU) 2026/722 amended the Pillar 3 ITS to support the EBA Pillar 3 data hub (P3DH). The EBA reported that the hub went live on 2026-01-28, with large and other institutions submitting from 2026-01-26 and a transitional period ending with the 2025-12-31 reference date. Small and non-complex institutions were not yet onboarded to the hub at the time of writing; check the EBA P3DH page for the current onboarding plan.

| Item | Value |
|---|---|
| Submission route | [EBA Pillar 3 data hub, via the national competent authority or directly, as instructed] |
| Format | [Machine-readable format and taxonomy version required by the EBA] |
| Own-website publication | [URL, same date as submission] |
| Archive | [Previous reports kept online for the period set in the policy] |

## 3. Template map

<!-- Guidance: One row per Part Eight article that applies to you. Map it to the ITS template codes, the frequency, the owner and the source system. Questions: Is every applicable article covered? Does every quantitative template have a reconciliation to a supervisory return? Pitfall: copying a peer's template list without checking your category and the current ITS version. -->

The map below follows the order of CRR Part Eight. Template codes are those used in the Pillar 3 ITS annexes (prefix "EU"); letters in a code (for example EU OVA) denote a qualitative table, numbers (EU OV1) a quantitative template. Confirm codes and applicability against the current ITS annexes, as amendments add and retire templates.

| Map ID | CRR article | Topic | ITS templates (check current annex) | Frequency *(Example)* | Owner | Source |
|---|---|---|---|---|---|---|
| MAP-01 | 435 | Risk management objectives and policies, governance | EU OVA, EU OVB, plus the qualitative tables of each risk area | Annual | [@cro] | Risk policies |
| MAP-02 | 436 | Scope of application | EU LI1, EU LI2, EU LI3, EU LIA, EU LIB, EU PV1 | Annual | [@finance-reporting] | FINREP, consolidation |
| MAP-03 | 437 | Own funds | EU CC1, EU CC2, EU CCA | Semi-annual (CC1, CC2), annual (CCA) | [@capital-management] | COREP own funds |
| MAP-04 | 437a | Own funds and eligible liabilities (MREL, TLAC) | Templates of the separate MREL and TLAC disclosure ITS (Implementing Regulation (EU) 2021/763 as amended by (EU) 2024/1618; check the current version) | Per that ITS | [@treasury] | Resolution returns |
| MAP-05 | 438 | Own funds requirements, risk-weighted exposure amounts, output floor | EU OV1, EU KM1 (part), EU CMS1, EU CMS2, EU INS1, EU INS2 | Quarterly (OV1), per mapping (CMS) | [@capital-management] | COREP |
| MAP-06 | 439 | Counterparty credit risk | EU CCRA, EU CCR1 to EU CCR8 | Semi-annual, annual (CCRA) | [@market-risk] | CCR engine |
| MAP-07 | 440 | Countercyclical capital buffer | EU CCyB1, EU CCyB2 | Semi-annual | [@capital-management] | COREP |
| MAP-08 | 441 | G-SII indicators | G-SII indicator template | Annual (G-SIIs only) | [@finance-reporting] | G-SII data collection |
| MAP-09 | 442 | Credit risk and dilution risk, credit quality | EU CRA, EU CRB, EU CR1, EU CR1-A, EU CR2, EU CQ1 to EU CQ8 | Semi-annual, annual | [@credit-risk] | FINREP, credit systems |
| MAP-10 | 443 | Encumbered and unencumbered assets | EU AE1 to EU AE4 | Annual | [@treasury] | Asset encumbrance return |
| MAP-11 | 444, 453 | Standardised approach, credit risk mitigation | EU CRC, EU CRD, EU CR3, EU CR4, EU CR5 | Semi-annual, annual | [@credit-risk] | COREP credit risk |
| MAP-12 | 445, 455 | Market risk | Market risk templates (EU MRA, EU MR series) per the version in force for the reference date | Semi-annual, annual | [@market-risk] | Market risk engine |
| MAP-13 | 445a | Credit valuation adjustment risk | EU CVAA, EU CVA1, EU CVAB, EU CVA2 to EU CVA4 | Per mapping | [@market-risk] | CVA engine |
| MAP-14 | 446 | Operational risk | EU ORA, EU OR1 to EU OR3 (instructions in the ITS annex revised for June 2026) | Annual | [@op-risk] | Loss database, business indicator |
| MAP-15 | 447 | Key metrics | EU KM1 | Quarterly | [@capital-management] | COREP, liquidity returns |
| MAP-16 | 448 | Interest rate risk in the banking book | EU IRRBBA, EU IRRBB1 | Semi-annual, annual | [@alm] | IRRBB engine |
| MAP-17 | 449 | Securitisation positions | EU SECA, EU SEC1 to EU SEC5 | Semi-annual, annual | [@securitisation] | Securitisation register |
| MAP-18 | 449a | ESG risks | ESG templates in the ITS annex | Per mapping | [@sustainability-risk] | ESG data hub |
| MAP-19 | 449b | Aggregate exposure to shadow banking entities | Template to be specified by the amending ITS | Per amending ITS | [@credit-risk] | Large exposures data |
| MAP-20 | 450 | Remuneration policy | EU REMA, EU REM1 to EU REM5 | Annual | [@hr-reward] | HR systems |
| MAP-21 | 451 | Leverage ratio | EU LRA, EU LR1 to EU LR3 | Semi-annual, annual | [@finance-reporting] | COREP leverage |
| MAP-22 | 451a | Liquidity requirements | EU LIQA, EU LIQB, EU LIQ1, EU LIQ2 | Quarterly (LIQ1), semi-annual (LIQ2) | [@treasury] | LCR and NSFR returns |
| MAP-23 | 452 | IRB approach | EU CRE, EU CR6, EU CR6-A, EU CR7, EU CR7-A, EU CR8, EU CR9, EU CR9.1, EU CR10 | Semi-annual, annual | [@credit-risk-models] | IRB engine |

Three points need care in 2026 and 2027:

- **Market risk.** The CRR3 market risk own funds requirements (FRTB) were postponed in the EU to 2027-01-01. Implementing Regulation (EU) 2026/722 deferred the repeal of the previous ITS, Implementing Regulation (EU) 2021/637, by one year in line with that postponement. A further Commission delegated act with targeted market risk measures from 2027-01-01 was in preparation in mid-2026. Check which market risk templates apply to each reference date.
- **ESG and shadow banking.** The EBA consulted in 2026 on an amending ITS for ESG risks (Article 449a), equity exposures and the aggregate exposure to shadow banking entities (Article 449b), with proposed first reference dates of 2026-12-31 and 2027-12-31 for small and non-complex institutions. Check whether it has been adopted and published before you finalise MAP-18 and MAP-19.
- **Operational risk.** CRR3 replaced the previous operational risk approaches with a single standardised approach, so the disclosure of the advanced measurement approach (Article 454 in the pre-CRR3 text) no longer applies in the EU. The EBA revised the operational risk instructions with effect from June 2026.

## 4. Key metrics and overview of risk exposure amounts

<!-- Guidance: EU KM1 and EU OV1 are the first templates every reader opens. Fill them from the same data as COREP and show at least the current and the previous period. Questions: Do ratios recompute from the amounts shown? Are fully loaded and transitional figures labelled? Pitfall: a KM1 ratio that does not agree with the capital adequacy figures in the annual report for the same date. -->

### 4.1 Key metrics (EU KM1, extract)

| Row | Metric | 2026-12-31 *(Example)* | 2026-06-30 *(Example)* |
|---|---|---|---|
| 1 | Common Equity Tier 1 (CET1) capital | 3,000 | 2,900 |
| 2 | Tier 1 capital | 3,400 | 3,300 |
| 3 | Total capital | 4,000 | 3,900 |
| 4 | Total risk exposure amount (TREA) | 20,000 | 19,800 |
| 5 | CET1 ratio | 15.00% | 14.65% |
| 6 | Tier 1 ratio | 17.00% | 16.67% |
| 7 | Total capital ratio | 20.00% | 19.70% |
| | Overall capital requirement for CET1 (incl. combined buffer) | 9.125% | 9.125% |
| 13 | Leverage ratio total exposure measure | 50,000 | 49,000 |
| 14 | Leverage ratio | 6.80% | 6.73% |
| 15 to 17 | LCR: liquidity buffer, net outflows, ratio | 6,260 / 4,200 / 149.0% | [Values] |
| 18 to 20 | NSFR: available and required stable funding, ratio | 36,000 / 30,000 / 120.0% | [Values] |

Recompute: 3,000 / 20,000 = 15.00%; 3,400 / 20,000 = 17.00%; 4,000 / 20,000 = 20.00%; 3,400 / 50,000 = 6.80%. For 2026-06-30: 2,900 / 19,800 = 14.65%; 3,300 / 19,800 = 16.67%; 3,900 / 19,800 = 19.70%; 3,300 / 49,000 = 6.73%. LCR 6,260 / 4,200 = 149.0% and NSFR 36,000 / 30,000 = 120.0%, as in the ILAAP Report. Row numbers are indicative; use the row identifiers of the current KM1 layout. The ITS asks for LCR figures in KM1 as averages of month-end observations over the preceding twelve months; the example uses the point values at the reference date to stay consistent with the ILAAP Report, so replace them with averages in a real report.

### 4.2 Overview of risk exposure amounts (EU OV1, extract)

| Risk type | RWEA 2026-12-31 *(Example)* | Own funds requirement (8%) *(Example)* |
|---|---|---|
| Credit risk (excluding counterparty credit risk) | 16,400 | 1,312 |
| Market risk | 1,000 | 80 |
| Credit valuation adjustment risk | 100 | 8 |
| Operational risk | 2,500 | 200 |
| **Total** | **20,000** | **1,600** |

Recompute: 16,400 + 1,000 + 100 + 2,500 = 20,000; 8% of 20,000 = 1,600, and 1,312 + 80 + 8 + 200 = 1,600. In the real OV1, show counterparty credit risk, settlement risk, securitisation and the amounts below deduction thresholds on their own rows; the example folds them into credit risk because the ICAAP Report does.

## 5. Risk management objectives and governance

<!-- Guidance: CRR Article 435 asks for the risk management objectives and policies for each category of risk, plus governance arrangements. Write for an informed outside reader. Questions: How does the risk appetite translate into limits? Who are the members of the management body and how many directorships do they hold? Is there a risk committee and how often did it meet? Pitfall: pasting internal policy text that a reader cannot follow, or generic statements that would fit any bank. -->

### 5.1 Risk management statement and risk profile (EU OVA)

Include a concise risk statement approved by the management body that describes the overall risk profile associated with the business strategy, with key ratios that show how the risk profile interacts with the risk tolerance. Then describe, per risk category, the strategies and processes, the structure and organisation of the risk management function, the scope and nature of risk reporting and measurement systems, and the hedging and mitigation policies.

*Example:* The management body of Fernhollow Bank declares that the bank's risk management arrangements are adequate for its profile and strategy. The bank is a retail and SME lender in two euro area countries. Its appetite is expressed through a CET1 floor of 12.0%, a leverage ratio floor of 4.5%, an LCR floor of 120% and an NSFR floor of 110% (Risk Appetite Statement, `finance/risk-appetite-statement`). At 2026-12-31 all four metrics were above their floors, as shown in EU KM1.

| Risk category | Strategy and process (summary) | Measurement | Mitigation | Reporting |
|---|---|---|---|---|
| Credit risk *(Example)* | Retail mortgages and SME loans within sector and single-name limits | IRB for retail mortgages, standardised for the rest | Collateral, guarantees | Monthly to the risk committee |
| Market risk *(Example)* | Small client-hedging trading book, no proprietary trading | Internal model for general market risk, standardised for specific risk | Limits, hedging | Daily to the treasurer, monthly to the risk committee |
| Liquidity risk *(Example)* | Deposit-funded balance sheet with a liquidity buffer | LCR, NSFR, internal stress survival horizon | Buffer, contingency funding plan | Daily and monthly |
| Operational risk *(Example)* | Three lines model, RCSA and loss data collection | Standardised approach | Controls, insurance, third-party risk management | Quarterly |

### 5.2 Governance arrangements (EU OVB)

| Item | Disclosure *(Example)* |
|---|---|
| Number of directorships held by members of the management body | [Per member, counted under the CRD rules] |
| Recruitment policy and the members' knowledge, skills and expertise | [Summary, link to the policy] |
| Diversity policy, objectives and targets, and achievement | [Summary] |
| Separate risk committee and number of meetings in the year | [Yes, 10 meetings] |
| Information flow on risk to the management body | [Reports, frequency] |

## 6. Own funds, capital requirements and output floor

<!-- Guidance: Show how capital is built up from the balance sheet (CC1, CC2), the main features of capital instruments (CCA) and, under CRR3, the comparison of modelled and standardised amounts (CMS1, CMS2). Questions: Does CC2 reconcile every own funds item to a balance sheet line? Are transitional arrangements labelled? Pitfall: reconciling to the accounting balance sheet instead of the balance sheet under the regulatory scope of consolidation. -->

### 6.1 Composition of own funds (EU CC1, summary)

| Item | 2026-12-31 *(Example)* |
|---|---|
| CET1 capital before regulatory adjustments | [Amount] |
| Total regulatory adjustments to CET1 | [Amount] |
| CET1 capital | 3,000 |
| Additional Tier 1 capital | 400 |
| Tier 1 capital | 3,400 |
| Tier 2 capital | 600 |
| Total capital | 4,000 |

Recompute: 3,000 + 400 = 3,400; 3,400 + 600 = 4,000. Fill the regulatory adjustment rows (intangible assets, deferred tax assets, prudent valuation adjustments, shortfall of credit risk adjustments to expected losses for IRB exposures and others) from COREP; the example leaves them as placeholders because the ICAAP Report shows CET1 after deductions only.

### 6.2 Reconciliation to the balance sheet (EU CC2) and capital instruments (EU CCA)

For CC2, list each balance sheet item under the regulatory scope of consolidation that feeds an own funds row and give the cross-reference letter used in CC1. For CCA, list every capital instrument with its issuer, identifier, governing law, regulatory treatment, maturity, call features, coupon terms, write-down or conversion triggers and its position in the creditor hierarchy. Publish the full terms and conditions of each instrument, as Article 437 requires.

### 6.3 Output floor comparison (EU CMS1, EU CMS2)

CRR3 introduced the output floor in CRR Article 92(3), with a transitional factor that rises each year under Article 465 from 50% in 2025. Institutions using internal models compare their modelled RWEA with the RWEA they would have under standardised approaches only.

| Risk type | Modelled RWEA *(Example)* | Standardised-only RWEA *(Example)* |
|---|---|---|
| Total | 20,000 | 23,500 |
| Floor at the 2026 factor of 55% *(check Art. 465)* | | 12,925 |
| Floor binding? | | No |

Recompute: 55% x 23,500 = 12,925, which is below 20,000, so the floor is not binding. These figures agree with the ICAAP Report, section 5.3.

## 7. Credit, counterparty, market, CVA and operational risk

<!-- Guidance: Cover each risk area with its qualitative table and quantitative templates as mapped in section 3. Questions: Do exposure totals agree across CR1, CR4 and CR6? Are non-performing and forborne amounts consistent with FINREP? Is the market risk template set the one in force for this reference date? Pitfall: totals that differ between templates because they use different exposure definitions without an explanation. -->

### 7.1 Credit risk and credit quality

Describe the credit risk strategy, the definition of default and of past due and impaired exposures, the approach to credit risk adjustments and the use of credit risk mitigation. Then populate the credit quality templates (performing and non-performing exposures, forborne exposures, collateral obtained by taking possession) and the approach templates (standardised in EU CR4 and CR5, IRB in EU CR6 onwards).

| Check | Rule | Result *(Example)* |
|---|---|---|
| CQ-01 | Gross carrying amount in EU CR1 equals FINREP for the same perimeter | Agreed, difference 0 |
| CQ-02 | Non-performing exposure ratio in the narrative equals the CQ templates | Agreed, 2.1% |
| CQ-03 | Exposure classes in CR4 and CR6 add up to the credit risk RWEA in OV1 | Agreed, 16,400 |

### 7.2 Counterparty credit risk

Describe the methods used to measure counterparty exposure (for example the standardised approach for counterparty credit risk), the limits, the collateral and margining policies, and wrong-way risk. Populate the CCR templates for the approaches you use and state if a template does not apply.

*Example:* Fernhollow Bank's derivatives are interest rate and FX hedges with central counterparties and a few banks under collateral agreements. Credit derivatives are immaterial and EU CCR6 is omitted under OMI-001.

### 7.3 Market risk and CVA risk

State which market risk approaches apply at the reference date and use the matching template set. For 2026 reference dates the EU market risk own funds requirements under CRR3 had been deferred to 2027-01-01; check the version of the market risk templates that applies to each reference date. Describe the CVA risk approach under CRR3 and populate the CVA tables and templates.

*Example:* Market risk RWEA of 1,000 (internal model 962.5, standardised 37.5) and CVA RWEA of 100 agree with OV1 and with the VaR Backtesting Report (`finance/var-backtesting-report`).

### 7.4 Operational risk

Describe the operational risk management framework, the business indicator and its components, the loss data used and any exclusions approved by the competent authority, as the current operational risk templates require. The Operational Risk RCSA (`finance/operational-risk-rcsa`) and the Operational Loss Event Report (`finance/operational-loss-event-report`) are the internal sources.

*Example:* Operational risk RWEA of 2,500 corresponds to an own funds requirement of 200 (8% of 2,500).

## 8. Leverage, liquidity, interest rate risk and encumbrance

<!-- Guidance: These templates are read together by funding investors. Questions: Does the leverage exposure measure reconcile to the balance sheet (LR1)? Does the LCR narrative explain concentration of funding and currency mismatch? Is the IRRBB sensitivity on the same basis as the supervisory outlier test? Pitfall: an LCR template with averages and a narrative quoting the point value, without saying which is which. -->

### 8.1 Leverage ratio

Populate the leverage templates (reconciliation of accounting assets to the leverage exposure, the common disclosure, the split of on-balance sheet exposures) and describe the processes used to manage the risk of excessive leverage and the factors that moved the ratio during the period.

*Example:* The leverage ratio is 6.80% (3,400 / 50,000), against the 3.0% requirement in CRR Article 92(1)(d) and the internal floor of 4.5%.

### 8.2 Liquidity

Describe the liquidity risk management strategy, the structure of the liquidity function, the funding sources, the stress testing and the contingency funding plan, then populate the LCR and NSFR templates.

*Example:* The liquidity buffer of 6,260 after haircuts holds 5,600 of Level 1 assets (central bank reserves 2,000 and government bonds 3,600), which is 89.5% of the buffer (5,600 / 6,260); the rest is Level 2A covered bonds (510) and Level 2B RMBS (150) after haircuts. The composition and the stress results are in the ILAAP Report, section 5, and the Contingency Funding Plan (`finance/contingency-funding-plan`).

### 8.3 Interest rate risk in the banking book

Describe how the institution defines, measures and manages IRRBB, the main modelling assumptions (non-maturity deposits, prepayments), and disclose the changes in economic value of equity and net interest income under the supervisory shock scenarios. Use the same figures as the IRRBB Policy and Report (`finance/irrbb-policy-and-report`).

### 8.4 Encumbered and unencumbered assets

Disclose encumbered and unencumbered assets by type, collateral received and sources of encumbrance, and explain the main encumbrance drivers (covered bonds, central bank operations, repos, derivative margins). The ITS asks for median values over the period for these templates; check the instructions.

## 9. ESG, remuneration and other disclosures

<!-- Guidance: These are the disclosures with the most change in 2026. Questions: Does the ESG section use the template set in force for this reference date? Do remuneration figures agree with the remuneration policy report? Does the countercyclical buffer use the rates in force at the reference date in each country? Pitfall: ESG narrative that is not tied to the ESG quantitative templates and the institution's transition plan. -->

### 9.1 ESG risks (Article 449a)

Describe how environmental, social and governance risks are integrated in strategy, governance and risk management, and populate the ESG templates (exposures to carbon-related sectors, physical risk, alignment metrics and other templates required for the reference date). CRR3 widened the scope of Article 449a, and in 2026 the EBA consulted on amending the ESG templates with simpler requirements for smaller institutions; check which version applies. Link the Climate Transition Plan (`finance/climate-transition-plan`) once it is in place.

### 9.2 Shadow banking (Article 449b)

Disclose the aggregate exposure to shadow banking entities as specified by the ITS once the amending templates apply. Until then, record in section 1.3 that the template is not yet specified.

### 9.3 Remuneration (Article 450)

Describe the remuneration policy, governance (remuneration committee), the link between pay and performance, the ratio between variable and fixed remuneration, deferral and malus and clawback arrangements, and populate the remuneration templates for identified staff. Respect the confidentiality of individuals: where fewer staff are in a category than the policy threshold, aggregate the data.

### 9.4 Countercyclical buffer, securitisation and G-SII indicators

| Area | Disclosure | Note *(Example)* |
|---|---|---|
| Countercyclical buffer (Art. 440) | Geographical distribution of relevant credit exposures and the institution-specific buffer rate | 0.5% weighted rate, as in the ICAAP Report |
| Securitisation (Art. 449) | Role (originator, sponsor, investor), positions, approaches, significant risk transfer | Investor in senior RMBS only |
| G-SII indicators (Art. 441) | Values of the indicators used to score G-SIIs | Not applicable: Fernhollow Bank is not a G-SII |

## 10. Production process and controls

<!-- Guidance: This is the internal record that lets the attesting officer sign. Questions: Where does every figure come from? Which checks ran and did they pass? Who reviewed the narrative? Pitfall: manual copying from spreadsheets into the publication format with no reconciliation evidence. -->

### 10.1 Process

The diagram shows the production run for one reference date. Quantitative templates are built only from closed supervisory returns, and no figure moves to review until the reconciliations in section 10.2 pass.

```mermaid
flowchart TD
    A["Close supervisory returns: COREP, FINREP, liquidity"] --> B["Extract template data from the reporting data mart"]
    B --> C["Populate quantitative templates in the ITS format"]
    C --> D["Run cross-template and return reconciliations"]
    D --> E{"All checks passed?"}
    E -- "No" --> F["Investigate, correct source data, log the break"]
    F --> B
    E -- "Yes" --> G["Draft qualitative tables with risk owners"]
    G --> H["Second-line and internal audit review"]
    H --> I["Written attestation by named officer"]
    I --> J["Submit to EBA Pillar 3 data hub and publish on website"]
```

### 10.2 Reconciliation and quality checks

| Check ID | Check | Frequency | Owner | Result *(Example)* |
|---|---|---|---|---|
| P3-CHK-01 | KM1 capital and ratios equal COREP own funds and TREA | Each reference date | [@capital-management] | Passed |
| P3-CHK-02 | OV1 total equals the sum of risk types and the KM1 TREA | Each reference date | [@capital-management] | Passed |
| P3-CHK-03 | CC2 reconciles CC1 items to the regulatory balance sheet | Semi-annual | [@finance-reporting] | Passed |
| P3-CHK-04 | LIQ1 averages recompute from the month-end data | Quarterly | [@treasury] | Passed |
| P3-CHK-05 | Leverage exposure reconciles to total assets (LR1) | Semi-annual | [@finance-reporting] | Passed |
| P3-CHK-06 | Narrative figures equal template figures | Each publication | [@pillar3-coordinator] | Passed after one correction |
| P3-CHK-07 | File passes the EBA format validation rules before submission | Each submission | [@regulatory-reporting] | Passed |

### 10.3 Omission and materiality decisions

Record each decision in the table in section 1.3 with the criteria applied. Re-assess omissions every year; information that was immaterial last year may not be this year.

### 10.4 Review opinion

| Reviewer | Scope | Opinion *(Example)* | Open findings |
|---|---|---|---|
| Second line (risk control) | Qualitative tables, consistency with risk reports | Satisfactory | None |
| Internal audit | Process and controls, sample of templates | Satisfactory with one low finding on manual narrative updates | IA-P3-01, due YYYY-MM-DD |

## 11. Attestation

<!-- Guidance: CRR Article 431(3) requires at least one member of the management body or senior management to attest in writing that the disclosures were made in line with the formal policies and internal processes, systems and controls. Keep the signed attestation with the report. Pitfall: an attestation signed before the final figures were locked. -->

I, [name, position], attest that the disclosures in this report for the reference date [YYYY-MM-DD] have been prepared in accordance with the formal disclosure policy and the internal processes, systems and controls approved by the management body of [institution name].

| Signed | Position | Date |
|---|---|---|
| [Name] | [Member of the management body / senior management] | YYYY-MM-DD |

## 12. Jurisdiction notes

<!-- Guidance: If the group has entities outside the EU, list the local Pillar 3 regimes with dates. These are examples, not a complete list. Pitfall: assuming the EU templates satisfy another regulator's rules. -->

| Jurisdiction | Basis | Status as of 2026-10 (check the official source) |
|---|---|---|
| EU | CRR Part Eight as amended by CRR3; Implementing Regulation (EU) 2024/3172 as amended by (EU) 2026/722 | In force; ESG and shadow banking amendments in progress |
| UK | PRA Rulebook, Disclosure (CRR) Part, with PRA templates; Basel 3.1 rules under PRA PS1/26 (2026-01-20) apply from 2027-01-01, with the FRTB internal model approach deferred to 2028-01-01 | Check the PRA Rulebook for the disclosure templates that apply to each reference date |
| US | 12 CFR Part 217, Subpart D (§ 217.61 onwards) public disclosure for Federal Reserve-regulated institutions with total consolidated assets of USD 50 billion or more that are not advanced approaches institutions; advanced approaches institutions under Subpart E, §§ 217.171 to 217.173 | Check the eCFR and any changes from the Basel III endgame rulemaking |

## 13. Glossary and references

<!-- Guidance: Define every abbreviation once and list sources with versions and dates. -->

| Term | Meaning |
|---|---|
| Pillar 3 | Public disclosure of prudential information, the third pillar of the Basel framework |
| ITS | Implementing technical standards; here, the uniform disclosure formats under CRR Article 434a |
| P3DH | EBA Pillar 3 data hub, the central publication point for EU Pillar 3 disclosures |
| CET1, AT1, T2 | Common Equity Tier 1, Additional Tier 1, Tier 2 capital |
| TREA, RWEA | Total risk exposure amount; risk-weighted exposure amount |
| LCR, NSFR | Liquidity coverage ratio; net stable funding ratio |
| IRRBB | Interest rate risk in the banking book |
| Output floor | Lower bound on TREA set as a percentage of the standardised-only TREA (CRR Art. 92(3)) |
| SNCI | Small and non-complex institution (CRR Art. 4(1)(145)) |
| COREP, FINREP | EU supervisory reporting frameworks for own funds and for financial information |

References (cited by number and title; obtain the official text):

- Regulation (EU) No 575/2013 (CRR), Part Eight, Articles 431 to 455, as amended by Regulation (EU) 2024/1623 (CRR3). EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1623/oj
- Commission Implementing Regulation (EU) 2024/3172 laying down implementing technical standards on public disclosures of the information in Titles II and III of Part Eight of the CRR, repealing Implementing Regulation (EU) 2021/637. EBA page: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/transparency-and-pillar-3/implementing-technical-1
- Commission Implementing Regulation (EU) 2026/722 amending Implementing Regulation (EU) 2024/3172 as regards the use by institutions other than small and non-complex institutions of the EBA single access point for their disclosures (OJ 2026-03-27, in force 2026-04-16). EUR-Lex: https://eur-lex.europa.eu/eli/reg_impl/2026/722/oj
- EBA, Pillar 3 data hub, and press release "The EBA Pillar 3 data hub goes live", 2026-01-28: https://www.eba.europa.eu/risk-and-data-analysis/pillar-3-data-hub
- Prudential Regulation Authority, PS1/26 Implementation of the Basel 3.1 final rules, 2026-01-20.
- 12 CFR Part 217, Subpart D, § 217.61 Purpose and scope: https://www.law.cornell.edu/cfr/text/12/217.61
- Basel Committee on Banking Supervision, Basel Framework, disclosure requirements chapters (DIS) (name only).

## 14. Standard and licence note

Based on Regulation (EU) No 575/2013 Part Eight as amended by Regulation (EU) 2024/1623 and on Commission Implementing Regulation (EU) 2024/3172 as amended by Implementing Regulation (EU) 2026/722. EUR-Lex and EBA material is reused with acknowledgement; article numbers and template codes are cited and no normative text, template layout or instruction is reproduced. Basel Committee material is cited by name only. The structure, guidance, checks and the Fernhollow Bank example are original; Fernhollow Bank and every figure are fictional. Check the current official versions, the consolidated texts and the current ITS annexes before use, as Pillar 3 requirements change often. This is a documentation format, not legal, regulatory, accounting or financial advice.

Template licence: MIT.