(1) The competent authority must review on a regular basis, and at least every 3 years, an institution's compliance with the requirements regarding internal approaches that require permission by the competent authorities before using such internal approaches for the calculation of own funds requirements in accordance with Part 3 of the capital requirements regulation and CRR rules.

(2) In its review the competent authority must have particular regard to changes in an institution's business and to the implementation of those approaches to new products.

(3) Where material deficiencies are identified in risk capture by an institution's internal approaches, the competent authority must ensure these are rectified, or take appropriate steps to mitigate their consequences, including by imposing higher multiplication factors, or imposing capital add-ons, or taking other appropriate and effective measures.

(4) The competent authority must in particular review and assess whether the institution uses well developed and up-to-date techniques and practices for its internal approaches.