The European Central Bank has imposed a €6,940,000 administrative penalty on Belfius Banque SA, the Belgian state-owned lender, after determining that the bank failed to implement amended internal-rating-based credit risk models by the 26 January 2024 deadline set in an ECB decision, and to submit an audit report testing and validating them. The decision, dated 6 June 2025 and announced publicly on 18 July 2025, classified the severity of the breach as severe, the middle of the ECB's five severity categories (minor, moderately severe, severe, very severe and extremely severe).
The breach period ran from 27 January 2024 to 17 March 2025, a span of more than thirteen months during which Belfius did not have the revised internal models in production as required by its regulatory obligations.
THE NATURE OF THE IRB MODEL BREACH
The IRB approach allows banks to use their own credit risk models, subject to regulatory approval and validation, to determine the capital they must hold against different categories of lending exposure. Belfius failed to meet that obligation across a period spanning more than a year, and the ECB classified the breach as severe.
Belfius applied a remedial measure to mitigate the underestimation of the affected risk-weighted exposure amounts, which the ECB treated as a mitigating circumstance. The ECB nonetheless assessed Belfius's misconduct as 'high': the obligation was clearly stipulated in the ECB decision, the bank had been reminded of it, and it knew the delay would very likely breach the decision.
The ECB did not disclose the specific technical or operational cause of the failure to meet the implementation deadline. The ECB noted that the bank may challenge the decision before the Court of Justice of the European Union; the breach period ended on 17 March 2025.
PENALTY ASSESSMENT
The €6.94 million fine reflects the ECB's assessment of the misconduct as 'high' and the impact of the breach as 'medium', together with the bank's size and the mitigating remedial measure, under the ECB's guide to setting administrative pecuniary penalties. The ECB has authority to penalise significant institutions for breaches of directly applicable EU law and of its own regulations and decisions – this penalty was imposed under Article 18(7) of the SSM Regulation for breach of an ECB decision – and the quantum of each penalty considers the nature, gravity and duration of the infringement as well as the degree of responsibility attributable to the institution.
Belfius is classified as a significant institution under the SSM and is therefore subject to direct ECB supervision.