17.1 A Bank must have policies and processes that provide a comprehensive, Bank-wide view of significant sources of concentration risk, including also sources of concentration risk not captured by the large exposure limit as described in this regulation, such as exposures to a single industry, economic sector, geographic region, as well as exposures to a particular asset class, product, collateral or currency.

17.2 A Bank's information systems must be able to identify and aggregate risk concentrations in a timely manner, and facilitate the active monitoring and management of all risk concentrations as described in Article 17.1.

17.3 A Bank's risk appetite statement must include thresholds for acceptable concentrations of risk reflecting the Bank's risk appetite. These thresholds must be appropriately integrated into a Bank's processes and procedures, and well understood by any relevant staff.

17.4 All material risk concentrations must be regularly reviewed and reported to the Board. Such reports must highlight any current, near or expected breaches of the risk appetite and of the regulatory requirements.

17.5 Senior management must monitor the large exposure limits described in this regulation for the purposes of risk management and to detect any breaches. In the case of breaches, senior management must comply with Article 3.5 of this regulation immediately. Immediate communication means that this communication cannot be subject to Board approval, review, or any other form of confirmation by the Board.

17.6 A Bank must include in its stress testing programmes the impact of significant risk concentrations.

17.7 A Bank must cover in its Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP) all forms of concentration risk.

17.8 New or additional exposures resulting in a large exposure may only be granted following approval by the Board of the Bank, or following approval by a designated Board committee.

17.9 Where an existing exposure becomes a large exposure for any reason other than the Bank granting an additional exposure, the Board must be informed immediately. Such a large exposure must also be approved by the Board or a designated Board committee, but it may be done ex-post within a reasonable timeframe.

17.10 A large exposure must be subject to increased monitoring, proportional to its size and risks, in terms of all associated risks, including also risks other than credit risk such as legal, compliance, market and interest rate risk. This should also be reflected in the frequency, detail, and the granularity of reporting to the Board.