Risk Appetite Statement Template (Bank RAF, FSB, EBA)

Risk Appetite Statement: [Bank name]

Board-approved risk appetite statement (RAS) for a credit institution, written as the centre of its risk appetite framework (RAF): risk capacity, qualitative statements by risk type, quantitative metrics with appetite, tolerance and limit thresholds, the cascade to business lines and legal entities, monitoring and reporting, breach escalation and the annual review. The structure follows the FSB Principles for an Effective Risk Appetite Framework (18 November 2013), the EBA Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2021/05, applicable from 31 December 2021), the management body duties in Article 76 of the Capital Requirements Directive, and, for US national banks with average total consolidated assets of USD 50 billion or more, paragraphs II.E to II.H and II.K of the OCC heightened standards (12 CFR Part 30, Appendix D). Replace every [bracketed] value and every row marked Example. The worked example uses the fictional Fernhollow Bank, a mid-sized EU credit institution. This is a document format, not legal, regulatory, financial or accounting advice. Obtain the guidelines and laws for the normative text.

Document control

Approvals

Revision history

Contents

• 1. Purpose and scope
• 2. Roles and responsibilities
• 3. Link to strategy and business plan
• 4. Risk capacity
• 5. Qualitative risk appetite statements
• 6. Quantitative metrics and thresholds
• 7. Cascade to business lines and entities
• 8. Monitoring and reporting
• 9. Breach escalation and remediation
• 10. Links to other processes
• 11. Review, calibration and approval
• 12. Glossary and references
• Appendix A. Entities in scope
• Standard and licence note

1. Purpose and scope

This statement sets the aggregate level and the types of risk that [Bank name] is willing to accept, or wishes to avoid, in order to achieve its strategic objectives. It is the anchor of the risk appetite framework: every risk policy, limit framework, product approval and capital or liquidity plan must be consistent with it, and every exception must be traceable back to a decision recorded under section 9.

The statement covers all material risk types identified in the annual risk identification exercise: capital adequacy, liquidity and funding, credit risk (including concentration), interest rate risk in the banking book, market risk in the trading book, operational risk (including ICT, third-party and operational resilience), compliance and financial crime, conduct, and earnings. It applies to the prudential consolidation group listed in Appendix A. Subsidiaries that are themselves credit institutions adopt their own risk appetite statements, approved by their own boards, which must be no less prudent than the group allocation shown in section 7.

The statement is written for three audiences. The board uses it to steer and challenge management. Senior management uses it to plan, price and allocate capital. Supervisors use it to judge whether the bank knows its own limits and acts on them. For that reason the text is short, the metrics are few, and each metric has an owner, a data source and a measurement method.

Example: Fernhollow Bank is a fictional EU credit institution with total assets of EUR 47,400 million (leverage ratio exposure measure EUR 50,000 million, which adds off-balance-sheet commitments and derivative add-ons), a total risk exposure amount (TREA, risk-weighted assets including operational and market risk) of EUR 20,000 million and a retail, SME and commercial real estate (CRE) lending franchise in two EU Member States. It is a significant institution supervised directly by the ECB. The group comprises the parent bank, a leasing subsidiary and a payments subsidiary. CET1 capital is EUR 3,000 million and Tier 1 capital EUR 3,400 million, as in the ICAAP Report (finance/icaap-report). Values in this template are at the reference date 2026-09-30.

2. Roles and responsibilities

Clear decision rights are what turn a statement into a framework. The roles below follow the allocation described in the FSB principles and in the internal governance guidelines: the board owns appetite, the chief executive owns its delivery, the chief risk officer owns its independent measurement and challenge, the chief financial officer owns the integration with the financial plan, business line leaders own the risks they originate, and internal audit gives assurance that the framework works as designed.

Separate from the table, three behaviours matter in practice. First, the CRO must have direct access to the BRC chair and the right to escalate without going through the CEO. Second, business heads must be measured on risk-adjusted outcomes, so that remuneration does not reward breaches. Third, the board must spend enough meeting time on the RAS to challenge it, which is why the quarterly dashboard in section 8 is short.

3. Link to strategy and business plan

The risk appetite is set in the same cycle as the strategic plan and the budget. The CFO provides the projected balance sheet, income statement, RWA and funding profile for the plan horizon; the CRO projects each Level 1 metric under the baseline and under the adverse scenario from the Stress Testing Programme (finance/stress-testing-programme). If a projected metric falls outside appetite in the baseline, either the plan or the appetite must change before the board approves either document.

Record here, in prose, the trade-offs the board accepted. Example: the board accepted a lower return on equity target in exchange for keeping the CET1 appetite floor at 12.0%, 1.875 points above OCR plus Pillar 2 guidance, during the cloud migration, because a capital raise during a migration incident would be hard to execute.

4. Risk capacity

Risk capacity is the outer boundary. It is determined by regulatory requirements and by the bank's obligations to depositors, creditors and other stakeholders. Appetite is set inside capacity, with enough distance that a severe but plausible stress does not push the bank through capacity before management actions take effect.

The CET1 requirement adds up as 4.5 + 1.125 + 2.5 + 0.5 + 0.5 = 9.125% of TREA. With TREA of EUR 20,000 million this is EUR 1,825 million of CET1. Fernhollow Bank holds EUR 3,000 million of CET1, a ratio of 15.0%, so the surplus over the requirement is EUR 1,175 million (5.875 percentage points of TREA). Adding Pillar 2 guidance gives 10.125%, or EUR 2,025 million. The adverse scenario in the ICAAP depletes CET1 by 3.1 percentage points to a 2028 trough of 11.9% (12.35% after pre-approved management actions), which is why appetite starts well above capacity. The leverage ratio is 3,400 / 50,000 = 6.8% against a 3.0% requirement; Fernhollow Bank is not a G-SII, so no leverage ratio buffer applies.

Headroom for any ratio metric is computed in the same way:

Example: headroom to the CET1 appetite floor is (15.0% minus 12.0%) times EUR 20,000 million, which equals EUR 600 million. Expressed as additional TREA the same CET1 could support, the headroom is 3,000 / 0.12 minus 20,000 = EUR 5,000 million; section 7 allocates that TREA budget.

5. Qualitative risk appetite statements

Qualitative statements describe the kind of bank the board wants. They cover risks that are hard to quantify, set the tone for risk culture, and tell staff what to do when a situation is not covered by a limit. Each statement uses one of four appetite levels: seek (risk taken deliberately to earn a return), accept (risk tolerated as a by-product of the business, within limits), minimise (risk reduced as far as cost allows) and avoid (no appetite; activities that would create it are prohibited).

Write statements that a new employee could apply. A useful test is to ask a business head to explain, without notes, what QS-03 means for a loan request outside the home markets. If the answer is "it depends", the statement needs a sharper boundary.

6. Quantitative metrics and thresholds

6.1 Threshold model

The bank uses three thresholds per metric. The names vary between institutions and the FSB principles do not prescribe them, so define them once and use them everywhere.

Thresholds must be ordered: appetite, then tolerance, then limit, then the recovery plan indicator, then capacity. A limit that sits below a recovery indicator means the recovery plan would be triggered before the board knew of a breach, which inverts the escalation logic.

6.2 Level 1 metric table

All values are at the reference date. Direction "Min" means a higher value is better and thresholds are floors; "Max" means a lower value is better and thresholds are ceilings.

Check the example zones against the threshold model. RAS-CRD-03 at 84% is worse than the 80% appetite but better than the 90% tolerance, so it is amber. RAS-OPR-02 at one event equals the tolerance value but is worse than the appetite of zero, so it is amber. RAS-CMP-01 at 2.9% sits between 2.0% and 4.0%, so it is amber. All other metrics are at or better than appetite and are green; RAS-IRR-02 at 5.6% is green but within 0.4 points of appetite, so its trend is commented on in the dashboard.

The capital and liquidity thresholds form one ladder with the other plans. For the LCR, the ILAAP and Contingency Funding Plan early warning of 130% sits above the 120% appetite, the 115% limit equals the CFP activation level and the 105% recovery indicator is the one in the Recovery Plan (finance/recovery-plan). For CET1, the 12.0% appetite floor is the recovery plan early-warning level and 11.0% is its recovery indicator. For the NSFR, the 115% ILAAP early warning sits above the 110% appetite, the 107% limit equals the CFP activation level and 102% is the recovery indicator. For the survival horizon, the 70-day ILAAP early warning is the CFP Stage 1 trigger, the 60-day appetite sits above the 50-day limit, which is the CFP Stage 2 (activation) trigger, and 30 days is the recovery indicator. The IRRBB thresholds equal the early warning (9%) and internal limit (12%) in the IRRBB Policy and Report (finance/irrbb-policy-and-report).

Each metric must have a full definition record (numerator, denominator, source system, cut-off, adjustments, owner, data quality checks). Use the Metric Definition template (data/metric-definition) or the KRI catalogue fields in the KRI Framework Specification (finance/kri-framework-spec) so that the definition is identical in the RAS dashboard, the ICAAP and the recovery plan.

6.3 Calibration notes

Record for each metric how the thresholds were calibrated. A credible calibration usually combines four inputs: the distance to capacity, the peak impact in the adverse stress scenario, the bank's own history and peer data where available, and the strategy. Example: the CET1 appetite floor of 12.0% equals the OCR of 9.125%, plus Pillar 2 guidance of 1.0%, plus a 1.875 percentage point management buffer (9.125 + 1.0 + 1.875 = 12.0). The buffer is about 60% of the 3.1 point adverse depletion (1.875 / 3.1 = 60.5%), because pre-approved management actions restore part of a larger loss. Starting from 15.0%, the adverse trough of 11.9% falls 0.1 point below the floor, which is why the management actions in the ICAAP Report (finance/icaap-report, section 9) are part of the plan: they lift the trough to 12.35%. The limit of 11.5% keeps 0.5 percentage points above the 11.0% recovery indicator so that a limit breach is always reported before the recovery plan is formally invoked, and the recovery indicator itself sits 1.875 points above the 9.125% MDA threshold.

Avoid calibration by habit. When a metric has been green for eight consecutive quarters with large headroom, ask whether the threshold still constrains behaviour or whether it should be tightened. Equally, when a metric is permanently amber, either the strategy or the threshold is wrong, and the board should decide which.

7. Cascade to business lines and entities

The cascade turns a group appetite into limits that people can act on. Level 1 metrics belong to the board. Level 2 limits allocate the Level 1 appetite to business lines, legal entities and risk types and are approved by the BRC. Level 3 limits sit inside policies and frameworks (credit authorities, desk limits, process tolerances, key risk indicators) and are approved by the CRO or by risk committees with delegated authority.

The current row adds up to 5,275 + 10,850 + 1,600 + 1,800 + 475 = EUR 20,000 million, the TREA in section 4. It takes the credit, market and CVA RWEA of 17,500 from the business-line table in the ICAAP Report (finance/icaap-report, section 2): Retail Banking 4,400 (mortgages); SME and Commercial 10,025 (SME and mid-corporate 7,400 less the leasing subsidiary's 1,575, plus CRE 4,200); Treasury and Markets 1,400 (credit 300, market 1,000, CVA 100); Leasing 1,575; Payments 100. Operational risk RWEA of 2,500 is then allocated by share of revenue (35%, 33%, 8%, 9% and 15%, giving 875, 825, 200, 225 and 375). Check: 4,400 + 875 = 5,275; 10,025 + 825 = 10,850; 1,400 + 200 = 1,600; 1,575 + 225 = 1,800 (the TREA released by recovery option RO-02 in the Recovery Plan (finance/recovery-plan)); 100 + 375 = 475. The budget row adds up to 6,600 + 13,000 + 2,000 + 2,200 + 600 + 600 = EUR 25,000 million. With CET1 of EUR 3,000 million, TREA of 25,000 million would give a CET1 ratio of exactly 12.0% (3,000 / 25,000), so the budget is the ceiling at the appetite floor, not a growth target: the plan projects a CET1 ratio of 15.1% at the end of year 1, well inside it, and the EUR 600 million reserve may be released only by the BRC. The operational loss row adds up to 4.5 + 3.0 + 1.0 + 1.0 + 2.0 + 0.5 = 12.0 million, equal to the appetite.

Rules for the cascade:

1. Allocations at Level 2 must not exceed the Level 1 appetite in total unless the BRC records a diversification argument and the reserve that absorbs it.
2. Each subsidiary board approves its own statement, including thresholds no less prudent than its allocation, and reports breaches to the group CRO within the same timelines as section 9.
3. Level 3 limits must state which Level 1 or Level 2 metric they protect. A Level 3 limit that maps to nothing is either redundant or protects a risk missing from the RAS.
4. Key risk indicators are the main Level 3 instrument for operational, ICT and compliance risk; their catalogue and thresholds live in the KRI Framework Specification (finance/kri-framework-spec).

8. Monitoring and reporting

Monitoring compares the actual risk profile with appetite, tolerance and limit for every metric, together with the trend and the forecast under the current plan. Risk data must be accurate, complete, timely and adaptable, and risk reports accurate, comprehensive, clear and timely, which is the substance of the BCBS Principles for effective risk data aggregation and risk reporting (BCBS 239, cited by name). Where a figure relies on manual adjustments or known data gaps, the report says so next to the figure.

A one-page board view is often more useful than a long pack. Show each Level 1 metric as a row with the current value, the three thresholds, the zone, the change since last quarter and an arrow for the forecast. Keep commentary to what changed and what management is doing about it.

Data controls: each metric has a named data owner, a reconciliation to the general ledger or regulatory return where one exists (COREP, FINREP, LCR and NSFR templates), and a quality check before release. The enterprise risk function keeps a log of restatements: a metric that is restated after the board has seen it is itself a reportable finding.

9. Breach escalation and remediation

Escalation is proportionate to the zone and must start as soon as the measurement is known, not at the next scheduled committee. Passive breaches (caused by market movements, rating migrations or changes in the denominator) are escalated in the same way as active breaches (caused by a decision), but the remediation plan may differ.

9.1 Breach log

Temporary excesses of a limit require board approval, a stated end date and a stated reason. The board does not raise a threshold during a breach to make the breach disappear; any recalibration follows section 11 and takes effect only after the breach is closed or explicitly carried into the new calibration with a documented rationale.

Supervisory notification: decide in advance which breaches the competent authority must or should be told about, such as a fall below a capital or liquidity requirement, use of a buffer, or a breach that triggers recovery plan escalation. Record the legal basis and the deadline for each in the bank's regulatory notification register and refer to it here rather than copying it.

10. Links to other processes

The RAS influences decisions only if other processes are required to consult it. The table records where each process uses the RAS and what evidence shows it.

11. Review, calibration and approval

The RAS is reviewed at least once a year in the planning cycle and off-cycle when a trigger occurs: a material change in strategy or business model, an acquisition or disposal, a new or changed SREP requirement, a stress event, a recovery plan escalation, or an internal audit finding that the RAF is not effective. The CRO leads the review, the CFO and business heads provide projections and challenge, and the BRC holds a dedicated workshop before the board decision.

The review answers five questions in writing. Does every material risk from the risk identification have a qualitative statement and, where measurable, a metric? Are thresholds still ordered correctly relative to capacity and recovery indicators? Did the past year's breaches show thresholds that were too tight or too loose? Did the cascade work, with Level 2 and Level 3 limits mapped to Level 1? Is the data behind each metric reliable enough for the board to act on it?

Internal audit assesses the RAF at least annually against the FSB principles and the internal governance guidelines, including whether the RAS is used in decisions and whether breaches were escalated on time. Findings are tracked to closure in the audit issue log; see the IIA Internal Audit Engagement template (compliance/iia-internal-audit-engagement) for the engagement record.

12. Glossary and references

12.1 Glossary

12.2 References

• Financial Stability Board, Principles for an Effective Risk Appetite Framework, 18 November 2013.
• European Banking Authority, Guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05, 2 July 2021, applicable from 31 December 2021. A revised version was consulted on in 2025 (EBA/CP/2025/20); check whether final revised guidelines apply.
• Directive 2013/36/EU (CRD), Articles 76, 98(5), 104, 129 to 131, as amended, EUR-Lex.
• Regulation (EU) No 575/2013 (CRR) as amended by Regulation (EU) 2024/1623 (CRR3, applicable from 1 January 2025), Articles 92, 412 and 413, EUR-Lex.
• Commission Delegated Regulation (EU) 2024/856 on the supervisory outlier test for interest rate risk in the banking book, EUR-Lex.
• Directive 2014/59/EU (BRRD), Article 45 (MREL), EUR-Lex.
• 12 CFR Part 30, Appendix D, OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches, paragraphs II.E to II.H and II.K (eCFR, as amended in 2026).
• Basel Committee on Banking Supervision, Corporate governance principles for banks (2015) and Principles for effective risk data aggregation and risk reporting (BCBS 239, 2013), cited by name only.

Appendix A. Entities in scope

Standard and licence note

Structure aligned with the FSB Principles for an Effective Risk Appetite Framework (2013) and with the risk management and risk appetite topics of the EBA Guidelines on internal governance (EBA/GL/2021/05); EBA material is reused with acknowledgement and no text is reproduced. Based on public law where cited: Directive 2013/36/EU, Regulation (EU) No 575/2013 and its amendments, Delegated Regulation (EU) 2024/856 and Directive 2014/59/EU (EUR-Lex), and 12 CFR Part 30 Appendix D (US federal work, public domain). Basel Committee publications are cited by name only. All text, thresholds and figures are original and illustrative; they are not regulatory requirements or recommendations. Fernhollow Bank and all figures are fictional. Check the current official version of each guideline, regulation and supervisory decision before use. Template licence: MIT.