IOB LBO cheat sheet

Model risk tiers: high-impact models (credit scoring, AML detection) require independent validation, documented lineage and ongoing monitoring; low-impact models require lighter review.

EU AI Act risk classes: prohibited practices, high-risk (creditworthiness, employment), limited-risk (transparency duties), minimal-risk; high-risk obligations include risk management, data governance and human oversight.

Explainability trade-off: SHAP/LIME give post-hoc attribution for complex models; inherently interpretable models (logistic regression, decision trees) may be preferred where adverse action reasons must be given.

Hallucination control for generative tools: retrieval-augmented generation, grounding in approved document stores, output logging and human-in-the-loop for customer-facing content.

Data minimisation under GDPR/DPDP principles: collect only what the model needs; special-category data needs an explicit lawful basis and often a DPIA.

Shadow AI risk: unsanctioned use of public LLMs can leak client data; controls are an approved tool inventory, DLP on prompts and contractual no-training clauses.

Digital onboarding KPIs: straight-through processing rate, drop-off by step, false-positive rate in identity checks, and time-to-first-transaction.

Open banking model: consent-based API data sharing under PSD2-style regimes shifts value to aggregators; banks defend with embedded finance and proprietary data.

Suitability test: know the client (objectives, horizon, risk tolerance, capacity for loss, knowledge), know the product, and document why the recommendation fits.

Risk tolerance vs risk capacity: tolerance is psychological willingness; capacity is financial ability to absorb loss. A high-tolerance client with low capacity must be capped at capacity.

Time-weighted return removes cash-flow effects and measures manager skill; money-weighted (IRR) reflects the client's actual experience.

Diversification limit rule of thumb: concentration above roughly 10-20% in a single issuer or sector warrants documented justification and monitoring.

Fee disclosure: total cost of ownership = product charge + platform charge + advisory fee + incidental costs; must be shown cumulatively in monetary terms where rules require.

Rebalancing bands: typical tolerance bands of ±5% relative or ±2-3% absolute around target weights trigger rebalancing; wider bands reduce cost, narrower bands control drift.

Vulnerable client indicators: bereavement, cognitive decline, coercion by third parties; triggers enhanced record-keeping and, where relevant, a trusted-contact process.

Annuity vs drawdown decision: annuity transfers longevity and investment risk for certainty; drawdown retains flexibility but requires sustainable withdrawal rate analysis.

Net interest margin = (interest income − interest expense) / average earning assets; a core profitability driver sensitive to rate curve shape.

Cost-to-income ratio = operating expenses / operating income; lower is more efficient, but cuts that damage service or controls are false economies.

Current account economics: primary-relationship customers hold higher balances and buy more products; acquisition cost is recovered over multi-year relationship value, not year one.

Deposit beta: the share of a policy-rate change passed through to deposit rates; high-beta products (savings) reprice fast, low-beta (current accounts) lag.

Payment fraud controls: strong customer authentication, transaction risk scoring, beneficiary cooling periods for new payees, and confirmation of payee.

APP fraud liability shifts toward sending banks under reimbursement regimes; controls are behavioural analytics, scam warnings and mule-account detection.

Liquidity coverage ratio = high-quality liquid assets / net cash outflows over 30 days; retail deposits are more stable and attract lower run-off factors than wholesale.

Branch and digital channel mix: measure cost per transaction by channel; digital is cheaper per transaction but migration must not exclude vulnerable or low-digital customers.

NAV per share = (total assets − total liabilities) / shares outstanding; subscriptions and redemptions are struck at the next computed NAV after receipt.

UCITS limits: max 10% of NAV in transferable securities of a single issuer; 5/10/40 rule applies to the 5% bucket (max 10% per issuer, aggregate max 40%).

Tracking difference = fund return − index return; tracking error is the standard deviation of that difference. Difference is a level, error is volatility.

Total expense ratio excludes transaction costs and performance fees; ongoing charges figure is broader but still not the full cost of ownership.

Sharpe ratio = (portfolio return − risk-free rate) / standard deviation; it penalises total volatility, including upside, and is unreliable for illiquid or non-normal returns.

Information ratio = active return / tracking error; measures skill per unit of active risk, not absolute outperformance.

Liquidity mismatch risk in open-ended funds: daily dealing against illiquid assets requires swing pricing, redemption gates, notice periods or holdback tools.

Settlement discipline: T+1 in US markets increases the funding and FX timing burden for cross-border investors relative to T+2 regimes.

Three lines model: first line owns and manages risk, second line provides oversight and challenge, third line (internal audit) gives independent assurance.

Risk appetite framework: statement, quantitative metrics with limits and triggers, escalation paths, and board approval with periodic review.

Compliance risk assessment: rate inherent risk (products, clients, geography, channel), apply control effectiveness to derive residual risk, then allocate monitoring.

KRI design: forward-looking, tied to a risk driver, with defined thresholds (green/amber/red) and a named owner who must act on breach.

Regulatory change management: horizon scanning, impact assessment, gap remediation plan, validation testing, and evidence of board-level attestation.

Record retention: keep the evidence that a control operated, not only the policy; regulators test outcomes, and undocumented controls are treated as absent.

Whistleblowing channel requirements: independence, confidentiality, anonymity option, anti-retaliation protection and reporting to the board or a committee.

Conduct risk indicators: complaints root cause, mis-selling remediation, conflicts of interest register, and remuneration structures that reward inappropriate sales.

Five Cs of credit: character, capacity, capital, collateral, conditions; capacity (debt-service ability) is usually the strongest predictor of default.

DSCR = net operating income / total debt service; a covenant of 1.20x means a 20% cushion before cash flow fails to cover debt service.

LTV = loan amount / appraised value; higher LTV raises loss given default, so pricing and mortgage insurance scale with it.

Expected loss = PD × LGD × EAD; pricing must cover expected loss plus risk-adjusted return on capital and operating cost.

Basel IRB approach: banks use internal PD, LGD and EAD estimates subject to supervisory approval and minimum floors; standardised approach uses external ratings or fixed risk weights.

Credit scoring governance: monitor population stability index and score-to-default calibration; drift signals require recalibration, not just threshold tuning.

Covenant types: affirmative (reporting, insurance), negative (no further liens), financial (leverage, interest cover); breach triggers waiver or acceleration rights.

Concentration risk: single-name and sector limits; large-exposure regimes cap exposure to a single counterparty as a percentage of eligible capital.

Value at Risk is a loss threshold at a confidence level over a horizon (e.g. 1-day 99% VaR); it says nothing about the size of losses beyond that threshold.

Expected shortfall = average loss in the tail beyond VaR; Basel moved to ES at 97.5% because it captures tail severity and is sub-additive.

Risk decomposition: market, credit, liquidity, operational, conduct and strategic risk; each needs its own limit structure and reporting cadence.

Stress testing: scenario (historical and hypothetical) plus sensitivity analysis; reverse stress testing identifies scenarios that breach viability.

Correlation breakdown: diversification benefits estimated in calm markets understate losses in stress, when correlations converge toward one.

Operational risk loss data: internal losses, external losses, scenario analysis and business-environment factors feed the capital and control cycle.

Liquidity risk metrics: LCR for 30-day survival, NSFR for structural funding over one year (available stable funding / required stable funding ≥ 100%).

Model risk management: inventory, tiering, independent validation, ongoing performance monitoring, and documented limitations with compensating controls.

Double materiality: financial materiality (ESG affecting enterprise value) and impact materiality (enterprise affecting people and environment); CSRD-style regimes require both.

SFDR classification: Article 6 (no sustainability objective), Article 8 (promotes environmental or social characteristics), Article 9 (sustainable investment as objective).

EU Taxonomy: an activity is aligned only if it makes a substantial contribution to one objective, does no significant harm to others, and meets minimum social safeguards.

Greenwashing controls: pre-approval of sustainability claims, substantiation file per claim, consistent use of defined terms, and product naming rules.

PCAF-financed emissions = attribution factor (outstanding / total equity plus debt) × borrower emissions; reported in tCO2e per unit of financed amount.

Transition risk vs physical risk: transition arises from policy, technology and market shifts; physical from acute and chronic climate hazards.

Scope 1, 2, 3: direct emissions, purchased energy, and value-chain emissions; Scope 3 usually dominates for financial institutions via financed emissions.

ESG rating divergence: providers use different methodologies and weightings, so scores are not comparable across vendors; disclose the provider and method used.