This subpart applies to bank holding companies with average total consolidated assets of $100 billion or more.

(a) Applicability—(1) Initial applicability. Subject to paragraph (c) of this section, a bank holding company must comply with the risk-management and risk-committee requirements set forth in § 252.33 and the liquidity risk-management and liquidity stress test requirements set forth in §§ 252.34 and 252.35 no later than the first day of the fifth quarter following the date on which its average total consolidated assets equal or exceed $100 billion.

(2) Changes in requirements following a change in category. A bank holding company with average total consolidated assets of $100 billion or more that changes from one category of banking organization described in § 252.5(b) through (e) to another of such categories must comply with the requirements applicable to the new category no later than on the first day of the second quarter following the change in the bank holding company's category.

(b) Cessation of requirements. Except as provided in paragraph (c) of this section, a bank holding company is subject to the risk-management and risk committee requirements set forth in § 252.33 and the liquidity risk-management and liquidity stress test requirements set forth in §§ 252.34 and 252.35 until its total consolidated assets are below $100 billion for each of four consecutive calendar quarters.

(c) Applicability for bank holding companies that are subsidiaries of foreign banking organizations. If a bank holding company that has average total consolidated assets of $100 billion or more is controlled by a foreign banking organization, the U.S. intermediate holding company established or designated by the foreign banking organization must comply with the risk-management and risk committee requirements set forth in § 252.153(e)(3) and the liquidity risk-management and liquidity stress test requirements set forth in § 252.153(e)(4).

A bank holding company subject to this subpart must comply with, and hold capital commensurate with the requirements of, any regulations adopted by the Board relating to capital planning and stress tests, in accordance with the applicability provisions set forth therein.

(a) Risk committee—(1) General. A bank holding company subject to this subpart must maintain a risk committee that approves and periodically reviews the risk-management policies of the bank holding company's global operations and oversees the operation of the bank holding company's global risk-management framework. The risk committee's responsibilities include liquidity risk-management as set forth in § 252.34(b).

(2) Risk-management framework. The bank holding company's global risk-management framework must be commensurate with its structure, risk profile, complexity, activities, and size and must include:

(i) Policies and procedures establishing risk-management governance, risk-management procedures, and risk-control infrastructure for its global operations; and

(ii) Processes and systems for implementing and monitoring compliance with such policies and procedures, including:

(A) Processes and systems for identifying and reporting risks and risk-management deficiencies, including regarding emerging risks, and ensuring effective and timely implementation of actions to address emerging risks and risk-management deficiencies for its global operations;

(B) Processes and systems for establishing managerial and employee responsibility for risk management;

(C) Processes and systems for ensuring the independence of the risk-management function; and

(D) Processes and systems to integrate risk management and associated controls with management goals and its compensation structure for its global operations.

(3) Corporate governance requirements. The risk committee must:

(i) Have a formal, written charter that is approved by the bank holding company's board of directors;

(ii) Be an independent committee of the board of directors that has, as its sole and exclusive function, responsibility for the risk-management policies of the bank holding company's global operations and oversight of the operation of the bank holding company's global risk-management framework;

(iii) Report directly to the bank holding company's board of directors;

(iv) Receive and review regular reports on not less than a quarterly basis from the bank holding company's chief risk officer provided pursuant to paragraph (b)(3)(ii) of this section; and

(v) Meet at least quarterly, or more frequently as needed, and fully document and maintain records of its proceedings, including risk-management decisions.

(4) Minimum member requirements. The risk committee must:

(i) Include at least one member having experience in identifying, assessing, and managing risk exposures of large, complex financial firms; and

(ii) Be chaired by a director who:

(A) Is not an officer or employee of the bank holding company and has not been an officer or employee of the bank holding company during the previous three years;

(B) Is not a member of the immediate family, as defined in section 225.41(b)(3) of the Board's Regulation Y (12 CFR 225.41(b)(3)), of a person who is, or has been within the last three years, an executive officer of the bank holding company, as defined in section 215.2(e)(1) of the Board's Regulation O (12 CFR 215.2(e)(1)); and

(C)(1) Is an independent director under Item 407 of the Securities and Exchange Commission's Regulation S-K (17 CFR 229.407(a)), if the bank holding company has an outstanding class of securities traded on an exchange registered with the U.S. Securities and Exchange Commission as a national securities exchange under section 6 of the Securities Exchange Act of 1934 (15 U.S.C. 78f) (national securities exchange); or

(2) Would qualify as an independent director under the listing standards of a national securities exchange, as demonstrated to the satisfaction of the Board, if the bank holding company does not have an outstanding class of securities traded on a national securities exchange.

(b) Chief risk officer—(1) General. A bank holding company subject to this subpart must appoint a chief risk officer with experience in identifying, assessing, and managing risk exposures of large, complex financial firms.

(2) Responsibilities. (i) The chief risk officer is responsible for overseeing:

(A) The establishment of risk limits on an enterprise-wide basis and the monitoring of compliance with such limits;

(B) The implementation of and ongoing compliance with the policies and procedures set forth in paragraph (a)(2)(i) of this section and the development and implementation of the processes and systems set forth in paragraph (a)(2)(ii) of this section; and

(C) The management of risks and risk controls within the parameters of the company's risk control framework, and monitoring and testing of the company's risk controls.

(ii) The chief risk officer is responsible for reporting risk-management deficiencies and emerging risks to the risk committee and resolving risk-management deficiencies in a timely manner.

(3) Corporate governance requirements. (i) The bank holding company must ensure that the compensation and other incentives provided to the chief risk officer are consistent with providing an objective assessment of the risks taken by the bank holding company; and

(ii) The chief risk officer must report directly to both the risk committee and chief executive officer of the company.

(a) Responsibilities of the board of directors—(1) Liquidity risk tolerance. The board of directors of a bank holding company that is subject to this subpart must:

(i) Approve the acceptable level of liquidity risk that the bank holding company may assume in connection with its operating strategies (liquidity risk tolerance) at least annually, taking into account the bank holding company's capital structure, risk profile, complexity, activities, and size; and

(ii) Receive and review at least semi-annually information provided by senior management to determine whether the bank holding company is operating in accordance with its established liquidity risk tolerance.

(2) Liquidity risk-management strategies, policies, and procedures. The board of directors must approve and periodically review the liquidity risk-management strategies, policies, and procedures established by senior management pursuant to paragraph (c)(1) of this section.

(b) Responsibilities of the risk committee. The risk committee (or a designated subcommittee of such committee composed of members of the board of directors) must approve the contingency funding plan described in paragraph (f) of this section at least annually, and must approve any material revisions to the plan prior to the implementation of such revisions.

(c) Responsibilities of senior management—(1) Liquidity risk. (i) Senior management of a bank holding company subject to this subpart must establish and implement strategies, policies, and procedures designed to effectively manage the risk that the bank holding company's financial condition or safety and soundness would be adversely affected by its inability or the market's perception of its inability to meet its cash and collateral obligations (liquidity risk). The board of directors must approve the strategies, policies, and procedures pursuant to paragraph (a)(2) of this section.

(ii) Senior management must oversee the development and implementation of liquidity risk measurement and reporting systems, including those required by this section and § 252.35.

(iii) Senior management must determine at least quarterly whether the bank holding company is operating in accordance with such policies and procedures and whether the bank holding company is in compliance with this section and § 252.35 (or more often, if changes in market conditions or the liquidity position, risk profile, or financial condition warrant), and establish procedures regarding the preparation of such information.

(2) Liquidity risk tolerance. Senior management must report to the board of directors or the risk committee regarding the bank holding company's liquidity risk profile and liquidity risk tolerance at least quarterly (or more often, if changes in market conditions or the liquidity position, risk profile, or financial condition of the company warrant).

(3) Business lines or products. (i) Senior management must approve new products and business lines and evaluate the liquidity costs, benefits, and risks of each new business line and each new product that could have a significant effect on the company's liquidity risk profile. The approval is required before the company implements the business line or offers the product. In determining whether to approve the new business line or product, senior management must consider whether the liquidity risk of the new business line or product (under both current and stressed conditions) is within the company's established liquidity risk tolerance.

(ii) Senior management must review at least annually significant business lines and products to determine whether any line or product creates or has created any unanticipated liquidity risk, and to determine whether the liquidity risk of each strategy or product is within the company's established liquidity risk tolerance.

(4) Cash-flow projections. Senior management must review the cash-flow projections produced under paragraph (e) of this section at least quarterly (or more often, if changes in market conditions or the liquidity position, risk profile, or financial condition of the bank holding company warrant) to ensure that the liquidity risk is within the established liquidity risk tolerance.

(5) Liquidity risk limits. Senior management must establish liquidity risk limits as set forth in paragraph (g) of this section and review the company's compliance with those limits at least quarterly (or more often, if changes in market conditions or the liquidity position, risk profile, or financial condition of the company warrant).

(6) Liquidity stress testing. Senior management must:

(i) Approve the liquidity stress testing practices, methodologies, and assumptions required in § 252.35(a) at least quarterly, and whenever the bank holding company materially revises its liquidity stress testing practices, methodologies or assumptions;

(ii) Review the liquidity stress testing results produced under § 252.35(a) at least quarterly;

(iii) Review the independent review of the liquidity stress tests under § 252.34(d) periodically; and

(iv) Approve the size and composition of the liquidity buffer established under § 252.35(b) at least quarterly.

(d) Independent review function. (1) A bank holding company subject to this subpart must establish and maintain a review function that is independent of management functions that execute funding to evaluate its liquidity risk management.

(2) The independent review function must:

(i) Regularly, but no less frequently than annually, review and evaluate the adequacy and effectiveness of the company's liquidity risk-management processes, including its liquidity stress test processes and assumptions;

(ii) Assess whether the company's liquidity risk-management function complies with applicable laws and regulations, and sound business practices; and

(iii) Report material liquidity risk-management issues to the board of directors or the risk committee in writing for corrective action, to the extent permitted by applicable law.

(e) Cash-flow projections. (1) A bank holding company subject to this subpart must produce comprehensive cash-flow projections that project cash flows arising from assets, liabilities, and off-balance sheet exposures over, at a minimum, short- and long-term time horizons. The bank holding company must update short-term cash-flow projections daily and must update longer-term cash-flow projections at least monthly.

(2) The bank holding company must establish a methodology for making cash-flow projections that results in projections that:

(i) Include cash flows arising from contractual maturities, intercompany transactions, new business, funding renewals, customer options, and other potential events that may impact liquidity;

(ii) Include reasonable assumptions regarding the future behavior of assets, liabilities, and off-balance sheet exposures;

(iii) Identify and quantify discrete and cumulative cash flow mismatches over these time periods; and

(iv) Include sufficient detail to reflect the capital structure, risk profile, complexity, currency exposure, activities, and size of the bank holding company and include analyses by business line, currency, or legal entity as appropriate.

(3) The bank holding company must adequately document its methodology for making cash flow projections and the included assumptions and submit such documentation to the risk committee.

(f) Contingency funding plan—(1) General. A bank holding company subject to this subpart must establish and maintain a contingency funding plan that sets out the company's strategies for addressing liquidity needs during liquidity stress events. The contingency funding plan must be commensurate with the company's capital structure, risk profile, complexity, activities, size, and established liquidity risk tolerance. The company must update the contingency funding plan at least annually, and when changes to market and idiosyncratic conditions warrant.

(2) Components of the contingency funding plan—(i) Quantitative assessment. The contingency funding plan must:

(A) Identify liquidity stress events that could have a significant impact on the bank holding company's liquidity;

(B) Assess the level and nature of the impact on the bank holding company's liquidity that may occur during identified liquidity stress events;

(C) Identify the circumstances in which the bank holding company would implement its action plan described in paragraph (f)(2)(ii)(A) of this section, which circumstances must include failure to meet any minimum liquidity requirement imposed by the Board;

(D) Assess available funding sources and needs during the identified liquidity stress events;

(E) Identify alternative funding sources that may be used during the identified liquidity stress events; and

(F) Incorporate information generated by the liquidity stress testing required under § 252.35(a).

(ii) Liquidity event management process. The contingency funding plan must include an event management process that sets out the bank holding company's procedures for managing liquidity during identified liquidity stress events. The liquidity event management process must:

(A) Include an action plan that clearly describes the strategies the company will use to respond to liquidity shortfalls for identified liquidity stress events, including the methods that the company will use to access alternative funding sources;

(B) Identify a liquidity stress event management team that would execute the action plan described in paragraph (f)(2)(ii)(A) of this section;

(C) Specify the process, responsibilities, and triggers for invoking the contingency funding plan, describe the decision-making process during the identified liquidity stress events, and describe the process for executing contingency measures identified in the action plan; and

(D) Provide a mechanism that ensures effective reporting and communication within the bank holding company and with outside parties, including the Board and other relevant supervisors, counterparties, and other stakeholders.

(iii) Monitoring. The contingency funding plan must include procedures for monitoring emerging liquidity stress events. The procedures must identify early warning indicators that are tailored to the company's capital structure, risk profile, complexity, activities, and size.

(iv) Testing. The bank holding company must periodically test:

(A) The components of the contingency funding plan to assess the plan's reliability during liquidity stress events;

(B) The operational elements of the contingency funding plan, including operational simulations to test communications, coordination, and decision-making by relevant management; and

(C) The methods the bank holding company will use to access alternative funding sources to determine whether these funding sources will be readily available when needed.

(g) Liquidity risk limits—(1) General. A bank holding company must monitor sources of liquidity risk and establish limits on liquidity risk that are consistent with the company's established liquidity risk tolerance and that reflect the company's capital structure, risk profile, complexity, activities, and size.

(2) Liquidity risk limits established by a global systemically important BHC, Category II bank holding company, or Category III bank holding company. If the bank holding company is a global systemically important BHC, Category II bank holding company, or Category III bank holding company, liquidity risk limits established under paragraph (g)(1) of this section must include limits on:

(i) Concentrations in sources of funding by instrument type, single counterparty, counterparty type, secured and unsecured funding, and as applicable, other forms of liquidity risk;

(ii) The amount of liabilities that mature within various time horizons; and

(iii) Off-balance sheet exposures and other exposures that could create funding needs during liquidity stress events.

(h) Collateral, legal entity, and intraday liquidity risk monitoring. A bank holding company subject to this subpart must establish and maintain procedures for monitoring liquidity risk as set forth in this paragraph.

(1) Collateral. The bank holding company must establish and maintain policies and procedures to monitor assets that have been, or are available to be, pledged as collateral in connection with transactions to which it or its affiliates are counterparties. These policies and procedures must provide that the bank holding company:

(i) Calculates all of its collateral positions according to the frequency specified in paragraph (h)(1)(i)(A) or (B) of this section, or as directed by the Board, specifying the value of pledged assets relative to the amount of security required under the relevant contracts and the value of unencumbered assets available to be pledged;

(A) If the bank holding company is not a Category IV bank holding company, on at least a weekly basis; or

(B) If the bank holding company is a Category IV bank holding company, on at least a monthly basis;

(ii) Monitors the levels of unencumbered assets available to be pledged by legal entity, jurisdiction, and currency exposure;

(iii) Monitors shifts in the bank holding company's funding patterns, such as shifts between intraday, overnight, and term pledging of collateral; and

(iv) Tracks operational and timing requirements associated with accessing collateral at its physical location (for example, the custodian or securities settlement system that holds the collateral).

(2) Legal entities, currencies, and business lines. The bank holding company must establish and maintain procedures for monitoring and controlling liquidity risk exposures and funding needs within and across significant legal entities, currencies, and business lines, taking into account legal and regulatory restrictions on the transfer of liquidity between legal entities.

(3) Intraday exposures. The bank holding company must establish and maintain procedures for monitoring intraday liquidity risk exposures that are consistent with the bank holding company's capital structure, risk profile, complexity, activities, and size. If the bank holding company is a global systemically important BHC, Category II bank holding company, or a Category III bank holding company, these procedures must address how the management of the bank holding company will:

(i) Monitor and measure expected daily gross liquidity inflows and outflows;

(ii) Manage and transfer collateral to obtain intraday credit;

(iii) Identify and prioritize time-specific obligations so that the bank holding company can meet these obligations as expected and settle less critical obligations as soon as possible;

(iv) Manage the issuance of credit to customers where necessary; and

(v) Consider the amounts of collateral and liquidity needed to meet payment systems obligations when assessing the bank holding company's overall liquidity needs.

(a) Liquidity stress testing requirement—(1) General. A bank holding company subject to this subpart must conduct stress tests to assess the potential impact of the liquidity stress scenarios set forth in paragraph (a)(3) of this section on its cash flows, liquidity position, profitability, and solvency, taking into account its current liquidity condition, risks, exposures, strategies, and activities.

(i) The bank holding company must take into consideration its balance sheet exposures, off-balance sheet exposures, size, risk profile, complexity, business lines, organizational structure, and other characteristics of the bank holding company that affect its liquidity risk profile in conducting its stress test.

(ii) In conducting a liquidity stress test using the scenarios described in paragraphs (a)(3)(i) and (iii) of this section, the bank holding company must address the potential direct adverse impact of associated market disruptions on the bank holding company and incorporate the potential actions of other market participants experiencing liquidity stresses under the market disruptions that would adversely affect the bank holding company.

(2) Frequency. The bank holding company must perform the liquidity stress tests required under paragraph (a)(1) of this section according to the frequency specified in paragraph (a)(2)(i) or (ii), or as directed by the Board:

(i) If the bank holding company is not a Category IV bank holding company, at least monthly; or

(ii) If the bank holding company is a Category IV bank holding company, at least quarterly.

(3) Stress scenarios. (i) Each liquidity stress test conducted under paragraph (a)(1) of this section must include, at a minimum:

(A) A scenario reflecting adverse market conditions;

(B) A scenario reflecting an idiosyncratic stress event for the bank holding company; and

(C) A scenario reflecting combined market and idiosyncratic stresses.

(ii) The bank holding company must incorporate additional liquidity stress scenarios into its liquidity stress test, as appropriate, based on its financial condition, size, complexity, risk profile, scope of operations, or activities. The Board may require the bank holding company to vary the underlying assumptions and stress scenarios.

(4) Planning horizon. Each stress test conducted under paragraph (a)(1) of this section must include an overnight planning horizon, a 30-day planning horizon, a 90-day planning horizon, a one-year planning horizon, and any other planning horizons that are relevant to the bank holding company's liquidity risk profile. For purposes of this section, a “planning horizon” is the period over which the relevant stressed projections extend. The bank holding company must use the results of the stress test over the 30-day planning horizon to calculate the size of the liquidity buffer under paragraph (b) of this section.

(5) Requirements for assets used as cash-flow sources in a stress test. (i) To the extent an asset is used as a cash flow source to offset projected funding needs during the planning horizon in a liquidity stress test, the fair market value of the asset must be discounted to reflect any credit risk and market volatility of the asset.

(ii) Assets used as cash-flow sources during a planning horizon must be diversified by collateral, counterparty, borrowing capacity, and other factors associated with the liquidity risk of the assets.

(iii) A line of credit does not qualify as a cash flow source for purposes of a stress test with a planning horizon of 30 days or less. A line of credit may qualify as a cash flow source for purposes of a stress test with a planning horizon that exceeds 30 days.

(6) Tailoring. Stress testing must be tailored to, and provide sufficient detail to reflect, a bank holding company's capital structure, risk profile, complexity, activities, and size.

(7) Governance—(i) Policies and procedures. A bank holding company subject to this subpart must establish and maintain policies and procedures governing its liquidity stress testing practices, methodologies, and assumptions that provide for the incorporation of the results of liquidity stress tests in future stress testing and for the enhancement of stress testing practices over time.

(ii) Controls and oversight. A bank holding company subject to this subpart must establish and maintain a system of controls and oversight that is designed to ensure that its liquidity stress testing processes are effective in meeting the requirements of this section. The controls and oversight must ensure that each liquidity stress test appropriately incorporates conservative assumptions with respect to the stress scenario in paragraph (a)(3) of this section and other elements of the stress test process, taking into consideration the bank holding company's capital structure, risk profile, complexity, activities, size, business lines, legal entity or jurisdiction, and other relevant factors. The assumptions must be approved by the chief risk officer and be subject to the independent review under § 252.34(d) of this subpart.

(iii) Management information systems. The bank holding company must maintain management information systems and data processes sufficient to enable it to effectively and reliably collect, sort, and aggregate data and other information related to liquidity stress testing.

(8) Notice and response. If the Board determines that a bank holding company must conduct liquidity stress tests according to a frequency other than the frequency provided in paragraphs (a)(2)(i) and (ii) of this section, the Board will notify the bank holding company before the change in frequency takes effect, and describe the basis for its determination. Within 14 calendar days of receipt of a notification under this paragraph, the bank holding company may request in writing that the Board reconsider the requirement. The Board will respond in writing to the company's request for reconsideration prior to requiring the company conduct liquidity stress tests according to a frequency other than the frequency provided in paragraphs (a)(2)(i) and (ii) of this section.

(b) Liquidity buffer requirement. (1) A bank holding company subject to this subpart must maintain a liquidity buffer that is sufficient to meet the projected net stressed cash-flow need over the 30-day planning horizon of a liquidity stress test conducted in accordance with paragraph (a) of this section under each scenario set forth in paragraph (a)(3)(i) through (iii) of this section.

(2) Net stressed cash-flow need. The net stressed cash-flow need for a bank holding company is the difference between the amount of its cash-flow need and the amount of its cash flow sources over the 30-day planning horizon.

(3) Asset requirements. The liquidity buffer must consist of highly liquid assets that are unencumbered, as defined in paragraph (b)(3)(ii) of this section:

(i) Highly liquid asset. A highly liquid asset includes:

(A) Cash;

(B) Assets that meet the criteria for high quality liquid assets as defined in 12 CFR 249.20; or

(C) Any other asset that the bank holding company demonstrates to the satisfaction of the Board:

(1) Has low credit risk and low market risk;

(2) Is traded in an active secondary two-way market that has committed market makers and independent bona fide offers to buy and sell so that a price reasonably related to the last sales price or current bona fide competitive bid and offer quotations can be determined within one day and settled at that price within a reasonable time period conforming with trade custom; and

(3) Is a type of asset that investors historically have purchased in periods of financial market distress during which market liquidity has been impaired.

(ii) Unencumbered. An asset is unencumbered if it:

(A) Is free of legal, regulatory, contractual, or other restrictions on the ability of such company promptly to liquidate, sell or transfer the asset; and

(B) Is either:

(1) Not pledged or used to secure or provide credit enhancement to any transaction; or

(2) Pledged to a central bank or a U.S. government-sponsored enterprise, to the extent potential credit secured by the asset is not currently extended by such central bank or U.S. government-sponsored enterprise or any of its consolidated subsidiaries.

(iii) Calculating the amount of a highly liquid asset. In calculating the amount of a highly liquid asset included in the liquidity buffer, the bank holding company must discount the fair market value of the asset to reflect any credit risk and market price volatility of the asset.

(iv) Operational requirements. With respect to the liquidity buffer, the bank holding company must:

(A) Establish and implement policies and procedures that require highly liquid assets comprising the liquidity buffer to be under the control of the management function in the bank holding company that is charged with managing liquidity risk; and

(B) Demonstrate the capability to monetize a highly liquid asset under each scenario required under § 252.35(a)(3).

(v) Diversification. The liquidity buffer must not contain significant concentrations of highly liquid assets by issuer, business sector, region, or other factor related to the bank holding company's risk, except with respect to cash and securities issued or guaranteed by the United States, a U.S. government agency, or a U.S. government-sponsored enterprise.