ECB fines Banque Internationale a Luxembourg EUR 3.255 million over internal-model breach
 European central bank building sign in frankfurt germany, Tobias Arhelger / Shutterstock.com.

The European Central Bank has fined Banque Internationale a Luxembourg (BIL) EUR 3.255 million after finding that the Luxembourg-based lender intentionally failed to apply its ECB-approved internal models when calculating expected loss on defaulted retail and corporate exposures. The administrative penalty was announced on 29 June 2026. The ECB classified the breach as "severe" under its penalty-setting guide.

The supervisory investigation concluded that the breach led BIL to under-deduct the IRB shortfall and to report overstated capital ratios for three consecutive quarters, from the fourth quarter of 2023 through the second quarter of 2024.

SUPERVISORY FINDINGS ON INTERNAL MODELS

According to the ECB, BIL's failure to apply its approved internal models meant that the bank did not properly calculate the shortfall between expected losses and provisions on exposures in default, an element that feeds directly into the deduction from Common Equity Tier 1 capital under the IRB approach. If the expected loss is higher than a bank's provisions, the bank must subtract the difference from its capital, the ECB said.

As a result of the intentional breach, reported capital ratios during the affected period were higher than they should have been for three consecutive quarters. The ECB described capital ratios as key indicators of a bank's capital strength and ability to absorb losses.

According to the ECB's published decision, taken on 19 June 2026, BIL continued to use its previous approach for calculating the expected loss best estimate after a 2023 ECB decision replaced it, despite knowing that approach was not compliant; the breach ran from 2 October 2023 to 22 October 2024.

APPEAL ROUTE AND WIDER IMPLICATIONS

The ECB said the decision is appealable before the Court of Justice of the European Union.

The ECB assessed BIL's misconduct as 'high' because the breach was committed with intent, and its impact as 'medium'; it treated remedial actions taken by the bank as a mitigating circumstance.