Beyond the black box — what IFRS 9 ECL transparency actually requires

IFRS 9 has now been in production at most GCC banks for nearly a decade. The first implementations — many of them rushed against the 2018 effective date, calibrated against limited regional data, and built largely by external vendors — were treated as completed projects. In 2026 they look less like completed projects and more like inheritance.

The audit committee asks a question about a Stage 2 macroeconomic overlay. The answer requires a vendor invoice. The CRO needs to defend a Significant Increase in Credit Risk threshold to the regulator. The methodology document is a four-year-old PDF, and the people who wrote it have moved on. The ECL number itself is fine. What sits underneath it — the chain of assumptions, parameters, and overrides that produced it — is the part that has quietly become a liability.

That is the practical meaning of a “black-box” model. Not that the outputs are wrong, but that the institution can no longer fully account for how they were produced. Under IFRS 9 — and under the CBUAE Model Management Standards published in late 2022 — that gap is increasingly being treated as a finding, not a feature.

What transparency actually requires

IFRS 9 itself is fairly explicit about what a defensible ECL model needs to demonstrate, though the requirement is distributed across several paragraphs rather than stated in one place.

That obligation alone implies that the scenarios used, their weights, and how they translate into the parameters have to be visible. Paragraphs B5.5.17–B5.5.40 set out the supporting expectations on data, segmentation, and forward-looking information. Paragraph 5.5.9 sets the SICR test, with B5.5.7 and B5.5.10–B5.5.14 detailing the criteria that institutions can use. Paragraph B5.5.42 sets the multi-scenario weighting requirement.

What the standard does not do is prescribe a specific model form. PD, LGD and EAD are the conventional decomposition, but IFRS 9 will accept a loss-rate approach, a roll-rate approach, or a more granular structural model — provided the institution can demonstrate that the chosen approach captures the principle in 5.5.17. The latitude is intentional. The accountability that comes with it is not optional.

The CBUAE Model Management Standards extend this in a direction that matters for UAE institutions specifically. Article 4.9.3 lists nine minimum documentation items that any model in scope must carry — including the model’s purpose, methodology, assumptions, limitations, data lineage, validation results, performance monitoring, model uses and dependencies. Article 8 sets out governance around model overrides — the standard does not prohibit overrides, but it requires that every override be documented, justified, time-bounded, and reviewed at a frequency proportional to its size. Article 10 sets out independent validation requirements, both quantitative and qualitative.

The pattern that emerges is consistent. Every material judgement should be retrievable. A reviewer should be able to reconstruct how an ECL number was produced from the inputs without recourse to anyone outside the institution.

Where opacity actually surfaces

In practice, the gap between what an ECL model produces and what an institution can defend tends to show up in three places.

The first is the audit cycle. External auditors have become substantially more granular on IFRS 9 since the early implementation period. Questions on Stage 2 movements, SICR threshold calibration, and the rationale for individual macro variable weightings now routinely require multiple rounds of response. When the underlying documentation is thin or out of date, each round becomes a small reconstruction project — the auditor’s hours billed back, the institution’s risk and finance teams pulled into reconciliation work that should have been a single-document lookup.

The second is supervisory review. Both the CBUAE thematic reviews and the routine on-site inspections conducted across GCC regulators have, since around 2023, focused increasingly on the defensibility of the model rather than the model itself. The supervisor’s question is rarely “is your PD correct” — it is “can you tell us why this borrower segment moved from a 0.8% PD last year to a 1.2% PD this year, and which of those forty basis points came from data refresh, recalibration, methodology change, and macro overlay.” A model that cannot decompose that question into its components is a model that produces uncomfortable supervisory dialogues.

The third — and least visible — is strategic decision-making. ECL outputs feed pricing, RAROC, portfolio limits, and Pillar 2 capital. When the line management cannot trace a movement in ECL back to a specific change in assumption or parameter, they tend to treat the output as noise. The model becomes something the institution complies with rather than uses. That is the quiet cost of opacity, and it is the one least often raised in board papers.

What a transparent ECL model lets you do

The test of whether a model is genuinely transparent is operational, not aesthetic. A transparent ECL model is one where the institution’s own team — not the vendor, not the consultant — can answer, in a single working day, questions of the following kind. Which assumption changed between the prior reporting period and this one. Which segments are most sensitive to a 100 basis point change in the base macro variable. Why a specific large exposure moved between stages. Whether a given override is still within its documented justification, or has drifted.

To support that operational test, a defensible ECL model needs four things visible at all times. A versioned methodology document that separates the modeller’s logic from the implementation. Parameter tables in plain text or spreadsheet form that any analyst can read without the model running. An override register with case-by-case rationale and review dates. A macro overlay traceable from scenario assumption, through variable, to portfolio impact.

None of these are exotic requirements. None of them require a different model. They require that the documentation around the model has been treated as a first-class deliverable rather than as a closing-stage afterthought.

A closing observation

That gap is closeable. It is also, in our experience, the gap that distinguishes an ECL model that an institution owns from an ECL model that the institution holds a licence to use.