Counterparty credit risk: the governance behind the capital number

In March 2021, the prime brokerages financing a single family office discovered at the same moment that they shared a problem. Archegos Capital Management had breached its margin thresholds. The family office ran a highly leveraged equity portfolio through total return swaps1. Each dealer thought its own position was under control. None knew how large the others’ positions were. When the forced unwind began, combined losses across the group passed $10 billion, a figure the Basel Committee cites in its work on bank exposures to non-bank financial institutions.¹ Archegos was not a market risk failure. It was a counterparty credit risk failure: weak due diligence, loose margining discipline, and no mechanism for seeing the aggregate exposure building up across dealers.

Counterparty credit risk (CCR) is the risk that the party on the other side of a derivative or securities financing trade defaults before final settlement. It differs from lending risk in one crucial way: the exposure is not fixed at inception. A loan’s outstanding balance is known. A derivative’s value moves with the market, so the amount at risk depends on market moves no one can predict when the trade is struck.

Banks measure that moving exposure in one of two ways: a regulator-set formula, or their own simulation models run under supervisory permission. The choice looks like a modelling question. It is also a governance commitment that sits at senior management level from the moment a permission is granted. The Basel Committee on Banking Supervision (BCBS) published new CCR management guidelines in December 2024 (d588), and the Prudential Regulation Authority (PRA) updated its supervisory expectations for CCR models in January 2026, taking effect on 1 January 2027 alongside the UK’s Basel 3.1 rules.

Why CCR breaks the template

Counterparty credit risk is two-dimensional in a way most credit risk is not. In a loan portfolio, the amount at risk is broadly fixed while the borrower’s credit quality evolves. In a derivatives portfolio, both the exposure and the counterparty’s credit quality are uncertain, and they interact. The worst case is not a large exposure or a weak counterparty. It is both arriving together.

Wrong-way risk is the name for this adverse correlation: the exposure to a counterparty growing at exactly the moment that counterparty’s credit quality falls. Archegos was a textbook case. Its swap positions were concentrated in a handful of stocks, and its solvency depended on those same stocks, so each dealer’s exposure grew in step with Archegos’s distress.

The BCBS’s December 2024 guidelines read like a post-mortem of the Archegos episode. They organise sound practice into four chapters, and the headings say it plainly: due diligence and monitoring, credit risk mitigation, exposure measurement, and governance.¹ In practice that means knowing the counterparty and continuing to watch it, margining to the actual risk, measuring exposure with more than one metric, and putting a risk framework, independent oversight and real limits behind all three. Each one names something Archegos’s dealers didn’t do.

Notional is the wrong number

Measuring the exposure starts with rejecting the obvious number. A derivative’s notional measures the size of the contract, not the amount at risk. A five-year interest rate swap with a notional of £100 million does not put £100 million at risk for either party. What’s at risk is the cost of replacing the net cash flows a defaulting counterparty would have paid, and that depends on where interest rates sit at the time of default.

The regulatory measure is exposure at default (EAD), and for derivatives it has two parts. Replacement cost (RC) is the loss the bank would take if the counterparty defaulted today, at current prices. Potential future exposure (PFE) estimates how far the position could move against the bank over the trade’s remaining life.

Banks calculate both parts across the netting set: the trades covered by a single legally enforceable close-out netting agreement. On default, every trade in the set is terminated and valued at once, and only the net balance changes hands. Most of what each side owes the other cancels out, which is why the amount genuinely at risk is a fraction of the gross total.

The 85 to 90% netting reduction is an observed average, not a set parameter: ISDA measured it across US dealer books,² and how much any one firm nets away depends on how evenly its own trades sit either side of the market.

What the rules fix is the condition. If a court ignored the netting agreement, the defaulter’s administrator could claim the trades in its favour in full and leave the bank queuing as an unsecured creditor for the rest, so the benefit counts for capital only where the agreement is legally enforceable across the jurisdictions involved. Establishing that is a legal question the firm has to settle, and keep settled, before any modelling choice arises.

Collateral and clearing work the same way, and the bilateral margining rules behind them are themselves under revision:³ daily variation margin keeps the replacement cost near zero, initial margin reduces the potential move beyond it without eliminating the gap between the last margin call and replacement after default, and clearing through a qualifying central counterparty attracts preferential treatment again.

Standardised or modelled

With exposure at default as the target, the question is how to calculate it, and that’s where the governance stakes sharpen.

The Standardised Approach for Counterparty Credit Risk (SA-CCR) is the default (BCBS 279). It calculates EAD as 1.4 × (RC + PFE)⁴2, with future exposure built from supervisory parameters calibrated to the 2008 stress period. There’s no internal model to approve. The inputs are observable and the output is comparable across firms. The cost is bluntness: parameters set to be prudent for every institution can substantially overstate one portfolio’s economic exposure, especially for a large, well-diversified, actively margined book.

The internal models method (IMM) is the alternative: the bank simulates thousands of future market paths and measures its own exposure distribution. EAD comes from effective expected positive exposure (EEPE), a time-average of the simulated exposure profile, floored so the model can’t treat near-term exposure as negligible. For large, well-netted, actively margined portfolios, IMM usually produces materially lower capital than SA-CCR.

That saving is not free. IMM requires prior supervisory permission under CRE53, granted against tests of risk management quality, validation standards, and the use test (the model must drive the firm’s own risk decisions, not just its regulatory returns).⁵ The choice between SA-CCR and IMM is a capital decision, but it is also a governance commitment that sits at senior management level from the moment a permission is granted. The permission must be maintained, evidenced, and, from 2027, personally attested.

What is the CVA charge, and why is it separate from the default charge?

Default is not the only way a counterparty costs money. When the market decides a counterparty has become riskier, its credit spread widens, and the bank’s trades with that counterparty are worth less than they were. The bank takes that loss whether or not the counterparty ever defaults. The credit valuation adjustment (CVA) risk charge puts capital against exactly that loss, and it is a separate charge: a firm with bilateral derivatives exposure faces the default-risk requirement and the CVA requirement on the same trades.

Basel 3.1 offers a basic approach (BA-CVA) open to all firms and a standardised approach (SA-CVA) that, like IMM, requires supervisory approval. The pattern repeats: the more risk-sensitive number is bought with another permission to maintain. The mechanics of the CVA charge are covered in our companion article on xVA⁶.

What changes for IMM and SA-CVA firms from 1 January 2027?

For UK firms holding IMM or SA-CVA permissions, the PRA has set the date those commitments harden. PRA Supervisory Statement SS12/13, updated in January 2026, takes effect on 1 January 2027 alongside the Basel 3.1 final rules. It tightens the permission framework in specific places: a new CVA model permission, a floor formula for effective expected positive exposure, and a materiality threshold for model changes standardised at 5%. The underlying discipline is not new. Significant model changes go to the PRA before implementation, not after.⁷

The sharpest change is personal. From 1 January 2027, the designated Senior Management Function (SMF) holder responsible for the internal models method must attest to it each year. The permission documentation, the model change log, and the validation pack stop being background regulatory filing. They become what a named individual must be satisfied with before signing.

Run Archegos through that lens. Every failure the BCBS catalogued was a governance failure: due diligence no one refreshed, margin thresholds no one tightened, an aggregate position no one could see. No supervisory statement gives one dealer sight of another’s book. What SS12/13 does is force each firm to evidence, annually and under a named signature, that its own measurement, margining, and model governance would have held.

Counterparty credit risk has long been a specialist corner, left to derivatives desks and the modelling teams behind them. From January 2027 that stops working. For credit risk teams approaching the deadline, the question is not only which method gives the right capital number. It is whether the governance behind that method, the model change log, the validation pack, the annual SMF attestation, would survive the same scrutiny SS12/13 now applies to the capital number itself.

Frequently asked questions