The bank must meet the requirements at the outset and continuously, or agree a plan to return to compliance (CRE36.3 to 36.8). Rating systems need two dimensions (borrower default risk and transaction factors), at least seven non-defaulted borrower grades plus one default grade (four plus one under slotting) and documented, replicable criteria (CRE36.9 to 36.37). Ratings must be assigned at approval by parties not benefiting from the credit, refreshed at least annually, with overrides tracked and histories retained (CRE36.38 to 36.49). The bank must run credit risk stress tests, at minimum a mild recession such as two quarters of zero growth (CRE36.50 to 36.53). The board must approve material aspects, an independent credit risk control unit must own the systems and internal audit must review them at least annually (CRE36.54 to 36.59). Ratings must drive credit decisions, with a three-year track record before qualification (CRE36.60 to 36.61). Default means over 90 days past due or unlikely to pay (CRE36.68 to 36.76). Data histories must cover at least five years for PD, seven years for corporate LGD and EAD and five years for retail, plus conservatism, downturn LGD and a 12-month EAD horizon (CRE36.77 to 36.99). Realised outcomes must be backtested at least annually (CRE36.122 to 36.127), collateral revalued at least yearly (CRE36.131) and disclosure met (CRE36.148).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.