Response to discussion on machine learning for IRB models
Go back
Banks have sufficient knowledge and experience to develop models using ML. They are already using this technology in other areas that do not require the approval of a supervisor (e.g. in the data preparation process, variable selection). However, model development is a time and resource-intensive process, and banks need to have clear criteria on the approval process for such models, which, as the paper discusses, present challenges related to compliance with regulatory requirements.
We do not believe that the development process should be different when using ML. The development and implementation of these models follows the same phases as any other model that does not use ML. In addition, there are a great variety of model-agnostic techniques that allow interpretation and explanation both of the results and the behaviour of the model, providing information equivalent to that given when using other techniques. (e.g. on the weight of the different variables in the decision).
We agree with the analysis of the opportunities made in the discussion paper. Other reports such as the one published by the Bank of Spain in February 2021 (link) also conclude that ML models perform better than traditional models in estimating the default rate, and that the potential benefits of using ML, in economic terms, would be significant for financial institutions. We therefore believe that it is essential to provide certainty to financial institutions in the presentation of these models to the supervisor and to ensure common supervisory criteria among all supervisors.
The report also takes a risk-based approach and distinguishes between the use of ML for parameter estimation and a secondary use that could be made e.g., for the revision of variables. We believe that it would be positive to be more specific on this point, and clarify how different requirements apply to different models, in order to encourage the use of ML at both two levels.
Unstructured data can be structured with sufficient controls to ensure that resulting data meet the quality and completeness requirements in accordance with existing regulatory requirements to be used in IRB. These controls are part of the monitoring process of the models, and they are performed periodically to mitigate any possible risks.
We would also highlight the importance of being able to use external data sources, not only in ML models but within any model. To this end, it would be positive to promote initiatives to certify the quality of external data. The development of data spaces being analysed by the Commission in its Data Strategy could be an opportunity for the financial sector to have access to quality external data sources for risk analysis.
As for the development and validation processes, these processes do not change substantially. Only some of the techniques and tests to be performed will be different but based on the same fundamental principles as for the other techniques. In this sense, according to regulatory requirements established on Art. 189 of CRR, models should be interpretable and explicable enough to be considered as white box models. However, we do not consider that the introduction of ML models will increase any risk associated to models' results interpretation. There are techniques that can be used to explain and describe the results in a similar way as we do with traditional models (e.g. by describing the relevant factors involved in the decision). ML is being used in many areas apart from IRB models such as in AML/CFT and fraud prevention. When ML is is used in those contexts, the explainability techniques that are already available are proving to be effective to understand the outcomes. However, within the IRB context, financial institutions do not have sufficient clarity on supervisory expectations about the interpretability of the results, which becomes a barrier to the adoption of this technology. Therefore, we believe that there is a need for the EBA to develop guidance on this issue that clarifies whether ML explainability techniques provide sufficient clarity to meet CRR requirements
Ex-ante: The use of ML allows for a more efficient human intervention in the development and implementation of the algorithms. Tasks such as the algorithm selection, the establishment of the boundary conditions, and parameterization of the algorithms (number of nodes, clustering...) are performed by people. At the same time, thanks to the use of ML, low value-added tasks such as the preparation of information sources or the selection of variables can be simplified making this part of the process more efficient. This allows also to eliminate the subjectivity of these processes, since every decision is statistically supported.
Ex-post: ML offers tools to ensure the interpretability of the models, in accordance to the requirement of "human judgement" established in the CRR. ML explainability techniques allow understanding the results and describe them in a similar way as we do with traditional models (e.g. by describing the relevant factors involved in the decision).
It is necessary to distinguish between challenges related to data and those related to the pure algorithm.
- On data (regardless of the use or lack of use of ML): economic explainability when the volume of variables is high; data depth (historical data of 10-20 years). Be sensitive to quantification (with more years) and differentiation (with less) by including ML techniques in short-term ordinations.
- Related to the ML algorithms (irrespective of data challenges): Economic interpretability of the variables that the algorithm can yield unilaterally, since in many cases these variables are jointly explained.
In addition, as it happens with the use of any new technologies, ML requires new IT capabilities and expertise compared to traditional methods. This challenge is not peculiar to ML models. Technological problems are intrinsic to any new model implementation.
The usage of ML models should not be only limited to regulatory capital models as they are totally useful for calculating provisions as well. Both estimations of expected losses and regulatory capital should be equivalent due to shortfall. Therefore, they should be calculated using the same methodology. An example will be pricing models that use both capital and provisions costs what means that they have to be calculated by using the same methodology.
- The use of AI in IRB models does not adversely affect the decision-making process of the lender, and therefore has no impact on the rights of individuals.
- In addition, any potential risk of harm to consumers will already be mitigated at this early stage, given that institutions will have to comply with the requirements set out in the IA act to calculate the credit scoring.
In general, we believe that AI applications which are used in the wider credit process (e.g. AI applications used in the valuation of collateral, which are rather a background tool in the process and do not affect a person’s access to essential services; or applications used in any phases following the initial disbursement of the loan which are used for monitoring and internal process efficiency) as well as other subsequent uses of the credit scoring in other applications that will not cause any harm to consumers (e.g. capital consumption models, or marketing campaigns) should be clearly excluded from the scope of the AI Act.
Moreover, the Discussion Paper mentioned that when the ML models are used as a complement to the traditional ones there is a less focus without specifying which are the requirements and the scope of the supervisory validation. We would need more details on this.
In addition, explainability techniques are validated against “solved cases” in order to ensure their explanatory power.
An essential requirement of interpretability/explainability techniques is to be agnostic to the model they seek to explain.
We believe that with the right involvement and training of different internal stakeholders banks can bridge this knowledge gap that the senior management may have of these models.
The principle-based recommendations proposed in this discussion paper are positive, but further guidance will be needed to 1) clarify supervisory expectations about the supervisory response, and 2) to ensure common supervisory criteria among all supervisors.
Following aspects are concerning for the Spanish Banking Association:
• Supervisory timing for issuing an opinion regarding these new approaches and the validation process of these models (tests performed, etc)
• Usage of interpretability techniques that are well accepted and considered as robust enough for explaining the predictions made by the models and global behaviour consistently.
• There should be additional guidance on supervisory expectations in terms of
o How the risk-based approach applies when using ML for secondary uses vs the in the primary model;
o when explainability is considered sufficient;
o when unfair bias has been properly identified and eliminated;
o How existing requirements on material changes would apply to models that iteratively learn and potentially change once in production.
1: Do you currently use or plan to use ML models in the context of IRB in your institution? If yes, please specify and answer questions 1.1, 1.2, 1.3. 1.4; if no, are there specific reasons not to use ML models? Please specify (e.g. too costly, interpretability concerns, certain regulatory requirements, etc.)
ML algorithms for IRB are not generally being used due to uncertainty about the current supervisory processes (although there are countries outside of the EU that do use more advanced algorithms for IRB model parts). Over the last few years, some financial entities have summitted to the supervisor ML models for IRB purposes. Currently these applications continue under revision.Banks have sufficient knowledge and experience to develop models using ML. They are already using this technology in other areas that do not require the approval of a supervisor (e.g. in the data preparation process, variable selection). However, model development is a time and resource-intensive process, and banks need to have clear criteria on the approval process for such models, which, as the paper discusses, present challenges related to compliance with regulatory requirements.
We do not believe that the development process should be different when using ML. The development and implementation of these models follows the same phases as any other model that does not use ML. In addition, there are a great variety of model-agnostic techniques that allow interpretation and explanation both of the results and the behaviour of the model, providing information equivalent to that given when using other techniques. (e.g. on the weight of the different variables in the decision).
We agree with the analysis of the opportunities made in the discussion paper. Other reports such as the one published by the Bank of Spain in February 2021 (link) also conclude that ML models perform better than traditional models in estimating the default rate, and that the potential benefits of using ML, in economic terms, would be significant for financial institutions. We therefore believe that it is essential to provide certainty to financial institutions in the presentation of these models to the supervisor and to ensure common supervisory criteria among all supervisors.
The report also takes a risk-based approach and distinguishes between the use of ML for parameter estimation and a secondary use that could be made e.g., for the revision of variables. We believe that it would be positive to be more specific on this point, and clarify how different requirements apply to different models, in order to encourage the use of ML at both two levels.
1.1: For the estimation of which parameters does your institution currently use or plan to use ML models, i.e. PD, LGD, ELBE, EAD, CCF?
We believe that the use of ML offers opportunities to improve the estimation of any of the parameters mentioned. We do not believe that any parameter should be left out. Although ML is not currently being used for parameter estimation due to regulatory uncertainty, we do believe that there are opportunities in using ML for: (1) risk driver selection; (2) imputation of missing variables, within tree selection; (3) simulation of different combinations to select the most suitable tree; (4) data quality control; (5) information processing; (6) challenger models (performance challenge of algorithms of traditional techniques).1.2: Can you specify for which specific purposes these ML models are used or planned to be used? Please specify at which stage of the estimation process they are used, i.e. data preparation, risk differentiation, risk quantification, validation.
See answer to question 1.11.3: Please also specify the type of ML models and algorithms (e.g. random forest, k-nearest neighbours, etc.) you currently use or plan to use in the IRB context?
It is difficult to provide an exhaustive list of ML algorithms that would be useful. Some of the techniques being used today are for example Random Forest and GBT (Gradient Boosting Trees). However, techniques can be very different, and the list of techniques will evolve for sure over time. Therefore, we believe flexibility should be ensured when defining/specifying the type of AML models.1.4: Are you using or planning to use unstructured data for these ML models? If yes, please specify what kind of data or type of data sources you use or are planning to use. How do you ensure an adequate data quality?
Using unstructured data is not specific to ML, but a more general question to all models. Data should not be discarded for being unstructured if it provides value to the model. For example, ML techniques are being used to exploit financial information contained in unstructured reports.Unstructured data can be structured with sufficient controls to ensure that resulting data meet the quality and completeness requirements in accordance with existing regulatory requirements to be used in IRB. These controls are part of the monitoring process of the models, and they are performed periodically to mitigate any possible risks.
We would also highlight the importance of being able to use external data sources, not only in ML models but within any model. To this end, it would be positive to promote initiatives to certify the quality of external data. The development of data spaces being analysed by the Commission in its Data Strategy could be an opportunity for the financial sector to have access to quality external data sources for risk analysis.
2: Have you outsourced or are you planning to outsource the development and implementation of the ML models and, if yes, for which modelling phase? What are the main challenges you face in this regard?
Banks develop and implement these models with in-house capabilities. No change of strategy is envisaged in this respect, as the necessary ML capabilities are available internally. Only consulting services for internal capacity building at peak planning times (as is being done so far for this type of models) are required.3: Do you see or expect any challenges regarding the internal user acceptance of ML models (e.g. by credit officers responsible for credit approval)? What are the measures taken to ensure good knowledge of the ML models by their users (e.g. staff training, adapting required documentation to these new models)?
As happens with the usage of traditional models, it is key to ensure that all Lines of Defense have the skills to understand the results of the models. Banks are promoting reskilling, hiring specialized profiles and enhancing model risk culture among their organizations.As for the development and validation processes, these processes do not change substantially. Only some of the techniques and tests to be performed will be different but based on the same fundamental principles as for the other techniques. In this sense, according to regulatory requirements established on Art. 189 of CRR, models should be interpretable and explicable enough to be considered as white box models. However, we do not consider that the introduction of ML models will increase any risk associated to models' results interpretation. There are techniques that can be used to explain and describe the results in a similar way as we do with traditional models (e.g. by describing the relevant factors involved in the decision). ML is being used in many areas apart from IRB models such as in AML/CFT and fraud prevention. When ML is is used in those contexts, the explainability techniques that are already available are proving to be effective to understand the outcomes. However, within the IRB context, financial institutions do not have sufficient clarity on supervisory expectations about the interpretability of the results, which becomes a barrier to the adoption of this technology. Therefore, we believe that there is a need for the EBA to develop guidance on this issue that clarifies whether ML explainability techniques provide sufficient clarity to meet CRR requirements
4: If you use or plan to use ML models in the context of IRB, can you please describe if and where (i.e. in which phase of the estimation process, e.g. development, application or both) human intervention is allowed and how it depends on the specific use of the ML model?
Human intervention is present in all phases of IRB models both ex-ante, during the development of the models, and ex-post, once implemented.Ex-ante: The use of ML allows for a more efficient human intervention in the development and implementation of the algorithms. Tasks such as the algorithm selection, the establishment of the boundary conditions, and parameterization of the algorithms (number of nodes, clustering...) are performed by people. At the same time, thanks to the use of ML, low value-added tasks such as the preparation of information sources or the selection of variables can be simplified making this part of the process more efficient. This allows also to eliminate the subjectivity of these processes, since every decision is statistically supported.
Ex-post: ML offers tools to ensure the interpretability of the models, in accordance to the requirement of "human judgement" established in the CRR. ML explainability techniques allow understanding the results and describe them in a similar way as we do with traditional models (e.g. by describing the relevant factors involved in the decision).
5. Do you see any issues in the interaction between data retention requirements of GDPR and the CRR requirements on the length of the historical observation period?
The use of ML does not pose any additional challenge to comply with data protection regulation.6.a) Methodology (e.g. which tests to use/validation activities to perform).
We don’t think that the use of ML requires a different methodology or specific steps in the development process. The steps are the same (selection of LRV period, selection of variables, selection of drivers, construction of decision trees...).6.b) Traceability (e.g. how to identify the root cause for an identified issue).
As mentioned in the previous question, the historical information requirements represent a problem in models that use hundreds of variables for which we might not have sufficient historical data. As described in the discussion paper in this case a risk-based approach should be applied, making it possible to differentiate the use of ML e.g., in risk differentiation systems, where 2 or 3 years may be sufficient for scoring, from risk quantification systems where it is necessary to identify central trends at 10, 15 years.6.c) Knowledge needed by the validation function (e.g. specialised training sessions on ML techniques by an independent party).New textarea
As with the other lines of defense, banks are incorporating profiles with specific knowledge to the validation function. In addition, we are providing ML training to enable reskilling and upskilling of available profiles.6.d) Resources needed to perform the validation (e.g. more time needed for validation)?
As with the construction process, in the case of validation we consider that the process to be followed and the tests to be performed are equivalent to a "traditional" model.7: Can you please elaborate on your strategy to overcome the overfitting issues related to ML models (e.g. cross-validation, regularisation)?
Monitoring and control processes for ML-based models are similar to those for models based on other techniques. The building steps do not change.8: What are the specific challenges you see regarding the development, maintenance and control of ML models in the IRB context, e.g., when verifying the correct implementation of internal rating and risk parameters in IT systems, when monitoring the correct functioning of the models or when integrating control models for identifying possible incidences?
ML is not currently used in the estimation of credit risk models given the regulatory uncertainty that exists.It is necessary to distinguish between challenges related to data and those related to the pure algorithm.
- On data (regardless of the use or lack of use of ML): economic explainability when the volume of variables is high; data depth (historical data of 10-20 years). Be sensitive to quantification (with more years) and differentiation (with less) by including ML techniques in short-term ordinations.
- Related to the ML algorithms (irrespective of data challenges): Economic interpretability of the variables that the algorithm can yield unilaterally, since in many cases these variables are jointly explained.
In addition, as it happens with the use of any new technologies, ML requires new IT capabilities and expertise compared to traditional methods. This challenge is not peculiar to ML models. Technological problems are intrinsic to any new model implementation.
9: How often do you plan to update your ML models (e.g., by re estimating parameters of the model and/or its hyperparameters) Please explain any related challenges with particular reference to those related to ensuring compliance with Regulation (EU) No 529/2014 (i.e. materiality assessment of IRB model changes).
A distinction needs to be made between two possible scenarios: 1) where ML is used to design the model and then the model remains static; and 2) the case where the model iteratively learns through new data and potentially changes periodically. In the first scenario, more clarity would be needed as to whether the existing policy on material changes will be amended to provide exceptions for such models. The second scenario, on the other hand, does not seem feasible for regulatory models that must comply with the current material changes policy. This policy would need to be modified for ML models that are periodically trained. It should be clarified which scenarios are considered plausible from the supervisory point of view.10: Are you using or planning to use ML for credit risk apart from regulatory capital purposes? Please specify (i.e. loan origination, loan acquisition, provisioning, ICAAP).
We see many opportunities in the use of ML within the credit risk area and beyond capital estimation, e.g., in admission, monitoring, recoveries and defaulting.The usage of ML models should not be only limited to regulatory capital models as they are totally useful for calculating provisions as well. Both estimations of expected losses and regulatory capital should be equivalent due to shortfall. Therefore, they should be calculated using the same methodology. An example will be pricing models that use both capital and provisions costs what means that they have to be calculated by using the same methodology.
11. Do you see any challenges in using ML in the context of IRB models stemming from the AI act?
IRB models are not considered in the IA act as high-risk application. Therefore, even when credit scoring is used as an input to IRB models, we understand that the requirements of the AI act should not apply to IRB models.- The use of AI in IRB models does not adversely affect the decision-making process of the lender, and therefore has no impact on the rights of individuals.
- In addition, any potential risk of harm to consumers will already be mitigated at this early stage, given that institutions will have to comply with the requirements set out in the IA act to calculate the credit scoring.
In general, we believe that AI applications which are used in the wider credit process (e.g. AI applications used in the valuation of collateral, which are rather a background tool in the process and do not affect a person’s access to essential services; or applications used in any phases following the initial disbursement of the loan which are used for monitoring and internal process efficiency) as well as other subsequent uses of the credit scoring in other applications that will not cause any harm to consumers (e.g. capital consumption models, or marketing campaigns) should be clearly excluded from the scope of the AI Act.
12. Do you see any additional challenge or issue that is relevant for discussion related to the use of ML models in the IRB context?
Supervisory teams should be sized and skilled properly to face the review of these models. The regulatory framework for the approval of regulatory models is demanding. Currently, ECB is taking several months to issue regulatory approvals so the increase of the complexity of the approaches might drive into enlarging the time need for receiving feedback. These types of models will require an effective supervisory process.Moreover, the Discussion Paper mentioned that when the ML models are used as a complement to the traditional ones there is a less focus without specifying which are the requirements and the scope of the supervisory validation. We would need more details on this.
13: Are you using or planning to use ML for collateral valuation? Please specify.
We believe that the application of ML can help to improve the quality of current valuations (i.e. for real estate valuation).14. Do you see any other area where the use of ML models might be beneficial?
Although within the industry the use of ML in regulatory models is quite limited given the legal uncertainty, the possibilities within these techniques to help improve risk management and enhance the business are endless. Some examples (not an exhaustive list) can be: fraud detection (identifying fraudulent transactions patterns and reducing the false alarms), cybersecurity event detection, task automation (i.e. cognitive robots), information quality improvement (i.e. outliers search), and business applications (i.e. offering tailored products to customers).15: What does your institution do to ensure explainability of the ML models, i.e. the use of ex post tools to describe the contribution of individual variables or the introduction of constraints in the algorithm to reduce complexity?
As we have been commenting, banks do not currently use ML for IRB models. However, explainability is one of the key elements we consider when we use ML in any kind of application. To ensure the explainability of the results we do not apply a single interpretative technique. Banks use several techniques at the same time, which allows us to question the model from different perspectives (global and local). In this way they can ensure that the results are consistent and make sense from a business perspective.In addition, explainability techniques are validated against “solved cases” in order to ensure their explanatory power.
An essential requirement of interpretability/explainability techniques is to be agnostic to the model they seek to explain.
16. Are you concerned about how to share the information gathered on the interpretability with the different stakeholders (e.g. senior management)? What approaches do you think could be useful to address these issues?
Senior management and other stakeholders such as portfolio managers must understand the model and its results from a business/economic point of view. They do not need to get into technicalities, just as they do not need to get into technicalities when using other mathematical techniques to build IRB models. The challenge is the same as with traditional models. It is not an issue that concerns us more because of using ML.We believe that with the right involvement and training of different internal stakeholders banks can bridge this knowledge gap that the senior management may have of these models.
17: Do you have any concern related to the principle-based recommendations?
As the report reflects, one of the main challenges for using ML is the uncertainty about supervisory expectations around the possible use of ML in the context of the IRB framework. We believe that developing a common understanding among supervisors and clarifying these expectations is a necessary step to facilitate banks to take advantage of these models.The principle-based recommendations proposed in this discussion paper are positive, but further guidance will be needed to 1) clarify supervisory expectations about the supervisory response, and 2) to ensure common supervisory criteria among all supervisors.
Following aspects are concerning for the Spanish Banking Association:
• Supervisory timing for issuing an opinion regarding these new approaches and the validation process of these models (tests performed, etc)
• Usage of interpretability techniques that are well accepted and considered as robust enough for explaining the predictions made by the models and global behaviour consistently.
• There should be additional guidance on supervisory expectations in terms of
o How the risk-based approach applies when using ML for secondary uses vs the in the primary model;
o when explainability is considered sufficient;
o when unfair bias has been properly identified and eliminated;
o How existing requirements on material changes would apply to models that iteratively learn and potentially change once in production.