Operational Risk Capital

Operational risk capital is the amount of regulatory capital that a bank is required to hold to absorb losses arising from operational risk. The Basel framework defines this as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk. Typical losses include fraud by staff or outsiders, processing errors, system failures, cyber attacks, damage to premises, and fines and compensation for misconduct.

Together with credit risk and market risk, operational risk is one of the three risk types covered by the Pillar 1 capital requirement. The capital figure is multiplied by 12.5 to express it as risk-weighted assets, and for many large banks it is the second-largest component after credit risk.

The first Basel Accord contained no explicit charge for operational risk, which was assumed to be covered by the margin built into the credit risk requirement. Large losses during the 1990s, including the collapse of Barings in 1995 after unauthorised trading, led the Basel Committee on Banking Supervision to introduce a separate requirement in Basel II, published in 2004. It offered three methods of increasing sophistication:

• Basic indicator approach. Capital was set at 15 per cent of the bank's average annual gross income over the previous three years.
• Standardised approach. Gross income was divided among eight business lines, each with its own percentage between 12 and 18 per cent, on the view that some activities are operationally riskier than others.
• Advanced measurement approaches. With supervisory approval, a bank could use its own statistical model, drawing on internal and external loss data, scenario analysis and assessments of its control environment.

The financial crisis and its aftermath exposed weaknesses in all three. The two simpler methods relied on gross income as a measure of exposure, but income fell during the crisis just as operational losses, especially from litigation and misconduct, rose sharply. The model-based methods proved complex and produced widely differing results for banks with similar profiles, because modelling rare, very large events from limited data left wide scope for judgement. Supervisors concluded that the numbers were neither comparable nor reliably conservative.

In December 2017, as part of the finalisation of Basel III, the Basel Committee withdrew all existing methods and replaced them with one standardised approach for every bank. Internal models are no longer permitted for this risk type under Pillar 1. The calculation has two elements.

The first is the business indicator, a measure of the scale of a bank's activity drawn from its financial statements. It combines an interest, leases and dividends component, a services component based on fees and other operating income and expense, and a financial component based on trading and banking book results. The business indicator is converted into a business indicator component by applying marginal coefficients that rise with size: 12 per cent on the first billion euros, 15 per cent between one and thirty billion, and 18 per cent above that.

The second is the internal loss multiplier, which adjusts the result according to the bank's own loss history. It depends on the ratio between a loss component, set at fifteen times the bank's average annual operational losses over the previous ten years, and the business indicator component. A bank with losses in line with its size has a multiplier of one; heavier losses raise the requirement and lighter losses reduce it. The capital requirement is the product of the two:

Here $\text{BIC}$ is the business indicator component and $\text{ILM}$ is the internal loss multiplier. For the smallest banks the multiplier is fixed at one, and national authorities may set it at one for all banks in their jurisdiction, which removes the link to loss history. The European Union and the United Kingdom have chosen that option in their implementations.

Where the multiplier is used, banks must maintain high-quality loss data: ten years of history, clear rules on which events are included and when a loss is dated, and thresholds for collection. Even where it is not, banks are expected to collect and disclose loss data, which appears in Pillar 3 disclosure. Because a formula based on size cannot capture differences in control quality, supervisors may add capital under the Pillar 2 capital requirement where they consider the standard result too low, for example after serious conduct failings or where technology risk is poorly managed.

Banks and some academics argue that the new method is insensitive to risk, since the business indicator rewards neither better controls nor insurance, and that a loss component based on a ten-year average penalises a bank for events long after their causes have been fixed. Supporters reply that simplicity and comparability matter more than precision for a risk that is inherently hard to model. A further point is that capital is only a partial answer to operational failures: an outage is not cured by equity, which is why regulators have added separate requirements on operational resilience, such as operational resilience mapping, cybersecurity risk controls and oversight of third-party risk. Internal governance of these risks normally follows the three lines model.

• Basel Committee on Banking Supervision