Operational risk is the risk of loss arising from inadequate or failed internal processes, people and systems, or from external events. This is the definition used by the Basel Committee on Banking Supervision, and it covers a wide range of mishaps: a mistyped trade, an employee fraud, a cyberattack, a software failure or a flood at a data centre. Banks, payment companies, exchanges, insurers and any other business that depends on staff and technology carry it.
Operational risk is distinct from credit risk, the danger that borrowers do not repay, and from market and liquidity risk, which come from price moves and funding shortfalls. Under the Basel definition it includes legal risk but excludes strategic and reputational risk. Unlike credit risk, it is not taken on deliberately in return for a reward; it comes with simply running a business, so the aim is to control it rather than to price it.
Operational risk in plain terms
Think of a restaurant. It can lose money because diners stop coming, which is a business problem, but it can also lose money because the fridge breaks overnight, a cashier pockets the takings, the booking system crashes on a Saturday night or a burst pipe floods the kitchen. None of those are bets the owner chose to make. They are the everyday ways things go wrong when people, equipment and routines are involved.
A bank or payment firm is the same, except that the kitchen is a network of computer systems moving enormous sums. A wrong figure typed into a payment screen, a badly tested software update or a phishing email that lets criminals in can each cost more than a pile of bad loans. Managing operational risk means listing what could go wrong, checking that safeguards work, and keeping a plan for carrying on when something breaks anyway.
Types of operational loss
Supervisors group operational losses into seven event types, which banks use to record and compare incidents:
- Internal fraud. Unauthorised trading, theft or deliberate misreporting by staff.
- External fraud. Robbery, forgery, hacking and other theft by outsiders.
- Employment practices and workplace safety. Discrimination claims, injury compensation and similar disputes.
- Clients, products and business practices. Mis-selling, market abuse and breaches of duty to customers.
- Damage to physical assets. Losses from natural disasters, fire or terrorism.
- Business disruption and system failures. Outages of software, hardware or telecommunications, including ransomware attacks that lock up systems.
- Execution, delivery and process management. Data-entry errors, failed settlements and missed deadlines.
Notable operational failures
A few cases show how quickly operational problems can grow. In 1995 Barings, Britain's oldest merchant bank, collapsed after Nick Leeson, a trader in Singapore, hid unauthorised derivatives losses of about £827 million. On 1 August 2012 Knight Capital, then one of the largest US market makers, deployed new algorithmic trading software incorrectly; the faulty code sent millions of unintended orders and the firm lost about 440 million dollars in roughly 45 minutes, forcing an emergency rescue. On 19 July 2024 a defective content update from the cybersecurity company CrowdStrike crashed about 8.5 million Windows computers worldwide, grounding flights and disrupting banks, card terminals and hospitals. Low-probability events of this kind are sometimes described as a black swan.
Capital requirements and formula
Under Basel II, banks could calculate capital for operational risk with a basic indicator approach, a standardised approach or their own advanced models. The final Basel III reforms, agreed in 2017 with an implementation date of 1 January 2023, replaced all three with a single standardised approach. The regulatory capital required is:
- is the operational risk capital requirement.
- is the business indicator component: a measure of the bank's size built from three years of interest, fee and trading income, multiplied by 12\% on the first 1 billion euros, 15\% between 1 billion and 30 billion euros, and 18\% above that.
- is the internal loss multiplier, which rises above 1 for banks whose losses over the previous ten years were high relative to their size and falls below 1 when they were low.
A bank with a business indicator of 10 billion euros has a business indicator component of billion euros. With an internal loss multiplier of 1, which the European Union has chosen to apply to all its banks, the capital requirement for operational risk is 1.47 billion euros.
Managing operational risk
Firms control operational risk through internal checks such as segregation of duties, second approval on large payments and daily reconciliation of accounts, backed by loss-event databases, key risk indicators, business continuity plans and insurance for some losses; see risk management. Regulators now stress operational resilience, the ability to keep important services running through disruption. The EU's Digital Operational Resilience Act (DORA), applicable from 17 January 2025, sets rules on technology risk, incident reporting and oversight of critical technology providers. In payment systems and other financial market infrastructure, an outage close to a cut-off time can stop participants sending funds, so an operational failure quickly becomes a liquidity and settlement risk problem.