Internal Risk-Management Models as a Basis for Capital Requirements