Capital Adequacy Requirements (CAR) (2024) - Chapter 3 – Operational Risk

Note

For institutions with a fiscal year ending October 31 or December 31, respectively.

I. Introduction

The Capital Adequacy Requirements (CAR) for banks (including federal credit unions), bank holding companies, federally regulated trust companies and federally regulated loan companies are set out in nine chapters, each of which has been issued as a separate document. This document should be read in conjunction with the other CAR chapters. The complete list of CAR chapters is as follows:

  • Chapter 1 - Overview of Risk-based Capital Requirements
  • Chapter 2 - Definition of Capital
  • Chapter 3 - Operational Risk
  • Chapter 4 - Credit Risk - Standardized Approach
  • Chapter 5 - Credit Risk - Internal Ratings-Based Approach
  • Chapter 6 - Securitization
  • Chapter 7 - Settlement and Counterparty Risk
  • Chapter 8 - Credit Valuation Adjustment (CVA) Risk
  • Chapter 9 - Market Risk

Chapter 3 – Operational Risk

  1. The requirements related to the Standardized Approach in this chapter (section 3.4) are drawn from the Basel Committee on Banking Supervision's (BCBS) Basel Framework dated December 15, 2019.Footnote 1 For reference, the Basel paragraph numbers that are associated with the text appearing in this chapter are indicated in square brackets at the end of each paragraph.Footnote 2

3.1 Definition of operational risk

  1. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk,Footnote 3 but excludes strategic and reputational risk.

    [Basel Framework, OPE 10.1]

3.2 Measurement methodologies

  1. There are two methodologies for calculating operational risk capital:

    1. the Standardized Approach (SA); and,
    2. the Simplified Standardized Approach (SSA).
  2. Domestic Systemically Important Banks (D-SIBs) must use the Standardized Approach.

  3. Category I Small and Medium Sized Deposit-Taking Institutions (SMSBs) with annual Adjusted Gross IncomeFootnote 4 greater than $1.5 billion must also use the Standardized Approach.

    1. Category I SMSBs must calculate Adjusted Gross Income at each fiscal year-end. If annual Adjusted Gross Income is greater than $1.5 billion, the institution must notify OSFI within 60 days of the end of the fiscal year, and use the Standardized Approach for operational risk in the following fiscal year.
    2. Once a Category I institution crosses the $1.5 billion threshold, it must use the Standardized Approach for a minimum of two years. If, after two years, annual Adjusted Gross Income falls below $1.5 billion, the institution must notify OSFI and may revert to the Simplified Standardized Approach.Footnote 5
  4. Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion may apply to OSFI to use the SA if they have a minimum of five years of high-quality loss data (i.e. data meeting the minimum standard for loss data collection as outlined in section 3.4.2). If approved, an institution is not permitted to set the Internal Loss Multiplier (ILM) to less than one until OSFI has determined that they have 10 years of high-quality loss data.

  5. All other SMSBs must use the SSA.

3.3 The Simplified Standardized Approach

  1. Institutions using the SSA must hold capital for operational risk (ORC) equal to 15% of average annual Adjusted Gross Income (AGI) over the previous 12 fiscal quarters:

    ORCSSA=(AGIprevious 12 fiscal quarters3)×15%

    Where:

    ORCSSA=the operational risk capital charge under the Simplified Standardized Approach

    AGIprevious 12 fiscal quarters=Adjusted Gross Income over the previous 12 fiscal quarters

    Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.

  2. Adjusted Gross Income is defined as the sum of the following:

    1. The lesser of (i) the absolute value of net interest income, and (ii) 2.25% of interest earning assets;
    2. Dividend income;
    3. The absolute value of fee and commission income;
    4. The absolute value of other income;
    5. The absolute value of net profit/loss (trading book); and
    6. The absolute value of net profit/loss (banking book).

    Adjusted Gross Income should (i) be gross of any provisions; (ii) be gross of operating expenses, and (iii) exclude extraordinary or irregular items as well as income derived from insurance. Institutions should refer to the reporting instructions in OSFI's Capital Adequacy Return for the specific line items in OSFI's P3 (Income Statement) and M4 (Balance Sheet) returns that should be used for each of the components of Adjusted Gross Income in the definition above.

  3. Newly incorporated institutions having fewer than 12 quarters of financial information should calculate the operational risk capital charge using available Adjusted Gross Income data to develop proxies for the missing portions of the required three years' data.

  4. Adjusted Gross Income should be adjusted to reflect acquired businesses and merged entities. Since the Adjusted Gross Income calculation is based on a rolling 12-quarter average, the most recent four quarters of Adjusted Gross Income for the acquired business or merged entity should be based on actual Adjusted Gross Income amounts reported by the acquired business or merged entity. If three years of historical financial data is not available for the acquired business or merged entity, the Adjusted Gross Income for the previous year may be used as a proxy for each of the other two years.

  5. When an institution using the SSA makes a divestiture, Adjusted Gross Income may be adjusted, with OSFI approval, to reflect this divestiture.

3.4 The Standardized Approach

  1. The standardized approach methodology is based on the following components:

    1. the Business Indicator (BI) which is a financial-statement-based proxy for operational risk;
    2. the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of regulatory determined marginal coefficients; and
    3. the Internal Loss Multiplier (ILM), which is a scaling factor that is based on an institution's average historical losses and the BIC.

    [Basel Framework, OPE 25.1]

  2. Operational risk capital requirements under the Standardized Approach (ORCSA) are calculated by multiplying the BIC and the ILM, as shown in the formula below. Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.

    ORCSA=BIC×ILM

    [Basel Framework, OPE 25.2]

3.4.1 Components of the Standardized Approach

  1. The BI comprises three components: the interest, leases and dividend component (ILDC), the services component (SC), and the financial component (FC).

    [Basel Framework, OPE 25.3]

  2. The BI is defined as:

    BI = ILDC +SC+ FC

    In the formula below, a bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2, and:Footnote 6

    ILDC=Min[Abs(Interest IncomeInterest Expense)¯;2.25%×Interest Earning Assets¯]+Dividend Income¯

    SC=MaxFee and Commission Income¯;Fee and Commission Expenses¯+Max[Other Operating Income¯;Other Operating Expenses¯]

    FC=Abs(Net P&L Trading Book)¯+Abs(Net P&L Banking Book)¯

    [Basel Framework, OPE 25.4 and Basel Framework, OPE 25.5]

  3. The definitions for each of the components of the BI are provided in Annex 3-1.

    [Basel Framework, OPE 25.6]

  4. The Business Indicator Component (BIC) is calculated as follows:Footnote 7

    1. 12% of BI, plus
    2. 3% of BI above $1.5 billion (if any), plus
    3. 3% of BI above $45 billion (if any).

    [Basel Framework, OPE 25.7]

  5. An institution's internal operational risk loss experience affects the calculation of operational risk capital through the ILM. The ILM is defined as:

    ILM=lnexp1-1+LCBIC0.8

    where the Loss Component (LC) is equal to 15 times average annual operational risk losses, net of recoveries, incurred over the previous 10 years. The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, an institution with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, an institution with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology.

    [Basel Framework, OPE 25.8 and Basel Framework, OPE 25.9]

  6. The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data (i.e. data meeting the minimum standard for loss data collection as outlined in section 3.4.2). Institutions that do not have ten years of high-quality loss data must calculate the capital requirement using an ILM greater than or equal to one. In these cases, OSFI will require an institution to calculate capital requirements using fewer than 10 years of losses if the ILM using the available high-quality loss data is greater than 1 and OSFI believes the losses are representative of the institution's operational loss exposure.

    [Basel Framework, OPE 25.10]

  7. ORC is to be calculated and reported quarterly. Financial information used in the calculation of the BI should be up to and including the institution's most recent fiscal quarter-end. Operational risk losses used in the calculation of the LC may be reported on a one-quarter lag.

  8. Institutions should perform a reconciliation between the BI and Net Interest Income and Non-Interest IncomeFootnote 8 for the previous three years. This information should be available to OSFI upon request.

  9. At the consolidated level, the SA calculations use fully consolidated BI figures, which net all the intragroup income and expenses.

    [Basel Framework, OPE 10.4]

  10. A subsidiary institution using the SA should use its own consolidated income and loss experience in the calculation of BI and LC for the SA calculations, and is subject to the minimum standards for the use of loss data in the following sections.

    [Basel Framework OPE, 10.5 and Basel Framework, OPE 10.6]

3.4.2 Minimum standards for the use of loss data under the standardized approach

  1. Institutions using the SA are required to use loss data as a direct input into the operational risk capital calculations. The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the institution's operational loss exposure. The minimum loss data standards are outlined in sections 3.4.3, 3.4.4, 3.4.5 and 3.4.7.Footnote 9 The quality of institutions' loss data will be reviewed by OSFI periodically.

    [Basel Framework OPE, 25.12]

  2. Institutions using the SA that do not meet the loss data standardsFootnote 10 are required to hold capital that is at a minimum equal to 100% of the BIC (i.e. ILM greater than or equal to one). The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting adjustment to the ILM, must be publicly disclosed.

    [Basel Framework OPE, 25.13]

3.4.3 General criteria on loss data identification, collection and treatment

  1. The proper identification, collection and treatment of internal loss data are essential prerequisites to the capital calculation under the standardized approach. The general criteria for the use of the LC are as follows:

    [Basel Framework, OPE 25.14]

    1. Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period.

      [Basel Framework, OPE 25.15]

    2. Internal loss data are most relevant when clearly linked to an institution's current business activities, technological processes and risk management procedures. Therefore, an institution must have robust, documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.

      [Basel Framework, OPE 25.16]

    3. For risk management purposes, and to assist in supervisory validation and/or review, institutions should map historical internal loss data into the relevant Level 1 supervisory categories as defined in Annex 3-2 and to provide this data to OSFI upon request. The institution must document criteria for allocating losses to the specified event types.

      [Basel Framework, OPE 25.17]

    4. An institution's internal loss data must be comprehensive and capture all materialFootnote 11 activities and exposures from all appropriate subsystems and geographic locations.Footnote 12

      [Basel Framework, OPE 25.18]

    5. For the purposes of the operational risk capital calculation, the minimum threshold, net of recoveries, for including a loss event in the data collection and calculation of average annual losses is set at $30,000.Footnote 13

      [Basel Framework, OPE 25.18]

    6. Aside from information on gross loss amounts, the institution must collect information about the reference dates of operational risk events, including:

      • the date when the event happened or first began ("date of occurrence"), where available;
      • the date on which the institution became aware of the event ("date of discovery"); and
      • the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognized in the institution's profit and loss (P&L) accounts ("date of accounting").

      In addition, the institution must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event.Footnote 14 The level of detail of any descriptive information should be commensurate with the size of the gross loss amount.

      [Basel Framework, OPE 25.19]

    7. Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set.

      [Basel Framework, OPE 25.20]

    8. Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardized approach for operational risk.

      [Basel Framework, OPE 25.21]

    9. Institutions must have processes to independently review the comprehensiveness and accuracy of loss data. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.

      [Basel Framework, OPE 25.22]

3.4.4 Specific criteria on loss data identification, collection and treatment

  1. Building an acceptable loss data set from the available internal data requires that the institution develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses.

    [Basel Framework, OPE 25.23]

  2. Gross loss is a loss before recoveries of any type. Net loss is defined as the loss after taking into account the impact of recoveries. The recovery is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party.Footnote 15

    [Basel Framework, OPE 25.24]

  3. Institutions must be able to identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Institutions should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the institution receives payment. Receivables do not count as recoveries. Verification of recovery payments received to net losses must be provided to OSFI upon request.

    [Basel Framework, OPE 25.25]

  4. The following items must be included in the gross loss computation of the loss data set:

    1. Direct charges, including impairments and settlements, to the institution's P&L accounts and write-downs due to the operational risk event;
    2. Costs incurred as a consequence of the event including:
      1. external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers);
      2. costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event; and
      3. uncollected revenue due to an operational risk event that can be quantified based on the contractual obligations of the institution's client or customer.
    3. Provisions or reserves accounted for in the P&L against the potential operational loss impact;Footnote 16
    4. Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L ("pending losses");Footnote 17 and
    5. Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods ("timing losses").Footnote 18 Timing losses should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period.Footnote 19Footnote 20

    [Basel Framework, OPE 25.26]

  5. The following items should be excluded from the gross loss computation of the loss data set:

    1. Costs of general maintenance contracts on property, plant or equipment;
    2. Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and
    3. Insurance premiums.

    [Basel Framework, OPE 25.27]

  6. Institutions must use the date of accounting for building the loss data set.Footnote 21 This includes using the date of accounting for including losses related to legal events in the loss dataset. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L.

    [Basel Framework, OPE 25.28]

  7. Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment.

    [Basel Framework, OPE 25.29]

3.4.5 Exclusion of losses from the Loss Component

  1. Institutions may request OSFI approval to exclude certain operational loss events that are no longer relevant to the institution's risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the institution's risk profile, OSFI will consider whether the cause of the loss event could occur in other areas of the institution's operations.Footnote 22 Taking settled legal exposures and divested businesses as examples, OSFI would expect the organization's analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.

    [Basel Framework, OPE 25.30]

  2. The total loss amount and number of exclusions must be disclosed in accordance with the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions.

    [Basel Framework, OPE 25.31]

  3. A request for loss exclusions is subject to a materiality threshold such that the excluded loss event should be greater than 5% of the institution's average annual losses over the past 10 years. In addition, losses can only be eligible for exclusion after being included in an institution's operational risk loss database for a minimum of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period.

    [Basel Framework, OPE 25.32]

3.4.6 Exclusions of divested activities from the Business Indicator

  1. Institutions may request OSFI approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed in accordance with the Pillar 3 requirements.

    [Basel Framework, OPE 25.33]

3.4.7 Inclusion of BI items and operational loss events related to mergers and acquisitions

  1. The measurement of the BI must include BI items that result from acquired businesses and merged entities. If three years of historical financial data is not available for an acquired business or merged entity, actual BI items for at least the previous year may be used for the BI calculation, and the BI items for the previous year may be used as a proxy for each of the other two years. Alternatively, institutions may use 125% of Adjusted Gross Income of the acquired business or merged entity (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for the acquired business or merged entity's BI.

    [Basel Framework, OPE 25.34]

  2. Institutions using the standardized approach must also include historical loss events from the acquired business or merged entity for the previous 10 years.

    1. If an acquired business or merged entity does not have historical high-quality loss data for the previous 10 years, the institution must estimate historical loss data for each of the years where data is missing for the purposes of calculating the LC (actual high-quality loss data should be used for those years where available).

      1. If the institution's ILM in the quarter prior to the merger or acquisition was less than or equal to one, operational losses for each missing year should be estimated as 1%Footnote 23 of the BI of the acquired business or merged entity at the time of acquisition.Footnote 24

      2. If the institution's ILM in the quarter prior to the merger or acquisition was greater than one, estimated operational losses for each missing year of the acquired business or merged entity in the 10-year window should be estimated as x% of the BI of the acquired business or merged entity at the time of acquisition,Footnote 24 where

        x=average annual net losses for the past ten years reported in the quarter prior to the merger / acquisitionBI reported in the quarter prior to the merger / acquisition

    2. Post-acquisition or merger, if the collection of actual loss data for the acquired business or merged entity is not feasible immediately, the institution may temporarily estimate operational risk loss amounts for the acquired business or merged entity, using the methodology detailed in paragraph 40(a) above.

Annex 3-1: Definition of Business Indicator components

[Basel Framework OPE 10.2]

Business Indicator Definitions
BI Component Income Statement or balance sheet items Description Typical sub-items
Interest, lease and dividend Interest income

Interest income from all financial assets and other interest income
(includes interest income from financial and operating leases and profits from leased assets)

  • Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets, financial leases and operational leases
  • Interest income from hedge accounting derivatives
  • Other interest income
  • Profits from leased assets
Interest expenses

Interest expenses from all financial liabilities and other interest expenses
(includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets)

  • Interest expenses from deposits, debt securities issued, financial leases, and operating leases
  • Interest expenses from hedge accounting derivatives
  • Other interest expenses
  • Losses from leased assets
  • Depreciation and impairment of operating leased assets
Interest earning assets (balance sheet item)Footnote 25 Total gross outstanding loans, advances, interest bearing securities (including government bonds), and lease assets measured at the end of each financial year
Dividend income Dividend income from investments in stocks and funds not consolidated in the institution's financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures.
Services Fee and commission income Income received from providing advice and services. Includes income received by the institution as an outsourcer of financial services. Fee and commission income from:
  • Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers)
  • Clearing and settlement; Asset management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitisations; Loan commitments
Fee and commission expenses Expenses paid for receiving advice and services. Includes outsourcing fees paid by the institution for the supply of financial services, but not outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources) Fee and commission expenses from:
  • Clearing and settlement; Custody; Servicing of securitisations; Loan commitments and guarantees received; and Foreign transactions
Other operating income

Income from ordinary banking operations not included in other BI items but of similar nature
(income from operating leases should be excluded)

  • Rental income from investment properties
  • Gains from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37)
Other operating expenses Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events (expenses from operating leases should be excluded)
  • Losses from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37)
  • Losses incurred as a consequence of operational loss events (e.g. fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years
  • Expenses related to establishing provisions/reserves for operational loss events
Financial Net profit (loss) on the trading book
  • Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities)
  • Net profit/loss from hedge accounting
  • Net profit/loss from exchange differences
Net profit (loss) on the banking book
  • Net profit/loss on financial assets and liabilities measured at fair value through profit and loss
  • Realized gains/losses on financial assets and liabilities not measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortized cost
  • Net profit/loss from hedge accounting
  • Net profit/loss from exchange differences

The following P&L items do not contribute to any of the items of the BI:

  • Income and expenses from insurance or reinsurance businesses
  • Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased (including deposit insurance premiums)
  • Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, human resources, information technology - IT), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)
  • Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)
  • Expenses of premises and fixed assets (except when these expenses result from operational loss events)
  • Depreciation/amortization of tangible and intangible assets (except depreciation related to operating lease assets, which should be included in financial and operating lease expenses)
  • Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events
  • Expenses due to share capital repayable on demand
  • Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)
  • Changes in goodwill recognized in profit or loss
  • Corporate income tax (tax based on profits including current tax and deferred).

[Basel Framework OPE 10.3]

Annex 3-2: Detailed Loss Event Type Classification

[Basel Framework OPE 25.17]

Event-Type Category (Level 1) Definition Categories (Level 2) Activity Examples (Level 3)
Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party Unauthorized Activity
  • Transactions not reported (intentional)
  • Transaction type unauthorized (w/monetary loss)
  • Mismarking of position (intentional)
Theft and Fraud
  • Fraud / credit fraud / worthless deposits
  • Theft / extortion / embezzlement / robbery
  • Misappropriation of assets
  • Malicious destruction of assets
  • Forgery
  • Check kiting Smuggling
  • Account take-over / impersonation / etc.
  • Tax non-compliance / evasion (wilful)
  • Bribes / kickbacks
  • Insider trading (not on firm's account)
External fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party Theft and Fraud
  • Theft/Robbery
  • Forgery
  • Check kiting
Systems Security
  • Hacking damage
  • Theft of information (w/monetary loss)
Employment Practices and Workplace Safety

Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events

Employee Relations
  • Compensation, benefit, termination issues
  • Organized labour activity
Safe Environment
  • General liability (slip and fall, etc.)
  • Employee health and safety rules events Workers compensation
Diversity and Discrimination All discrimination types
Clients, Products and Business Practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, Disclosure and Fiduciary
  • Fiduciary breaches / guideline violations
  • Suitability / disclosure issues (KYC, etc.)
  • Retail customer disclosure violations
  • Breach of privacy
  • Aggressive sales
  • Account churning
  • Misuse of confidential information
  • Lender liability
Improper Business or Market Practices
  • Antitrust
  • Improper trade / market practices
  • Market manipulation Insider trading (on firm's account)
  • Unlicensed activity
  • Money laundering
Product Flaws Product defects (unauthorized, etc.) Model errors
Selection, Sponsorship and Exposure
  • Failure to investigate client per guidelines
  • Exceeding client exposure limits
Advisory Activities Disputes over performance of advisory activities
Damage to Physical Assets Losses arising from loss or damage to physical assets from natural disaster or other events. Disasters and other events
  • Natural disaster losses
  • Human losses from external sources (terrorism, vandalism)
Business disruption and system failures Losses arising from disruption of business or system failures Systems
  • Hardware
  • Software
  • Telecommunications
  • Utility outage / disruptions
Execution, Delivery and Process Management Losses from failed transaction processing or process management, from relations with trade counterparties and vendors Transaction Capture, Execution and Maintenance
  • Miscommunication
  • Data entry, maintenance or loading error
  • Missed deadline or responsibility
  • Model / system misoperation
  • Accounting error / entity attribution error
  • Other task misperformance
  • Delivery failure
  • Collateral management failure
  • Reference Data Maintenance
Monitoring and Reporting
  • Failed mandatory reporting obligation
  • Inaccurate external report (loss incurred)
Customer Intake and Documentation
  • Client permissions / disclaimers missing
  • Legal documents missing / incomplete
Customer / Client Account Management
  • Unapproved access given to accounts
  • Incorrect client records (loss incurred)
  • Negligent loss or damage of client assets
Trade counterparties
  • Non-client counterparty misperformance
  • Miscellaneous non-client counterparty disputes
Vendors and suppliers
  • Outsourcing
  • Vendor disputes

Footnotes

Footnote 1

The Basel Framework

Return to footnote 1

Footnote 2

Following the format: [Basel Framework, XXX yy.zz].

Return to footnote 2

Footnote 3

Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements.

Return to footnote 3

Footnote 4

Adjusted Gross Income is defined in paragraph 9 of this chapter.

Return to footnote 4

Footnote 5

For example, if fiscal 2024 Adjusted Gross Income is greater than $1.5 billion for the first time, the institution must use the Standardized Approach starting in fiscal Q1 2026 and continue using the SA until, at a minimum, the end of fiscal 2027.

Return to footnote 5

Footnote 6

Abs() represents the absolute value of the term or calculation within the brackets. The absolute value of net items (e.g. interest income – interest expense) should be calculated first year by year. Only after this year by year calculation should the average of the three years be calculated.

Return to footnote 6

Footnote 7

For example, if an institution had a BI = $50 billion, the BIC = ($50B × 0.12) + [($50B -$1.5B) × 0.03] + [($50B − $45B) × 0.03] = $7.605 B.

Return to footnote 7

Footnote 8

Net Interest and Non-Interest Income is line 22 from OSFI's P3 return.

Return to footnote 8

Footnote 9

Institutions are also required to meet OSFI's Data Maintenance Expectations for Institutions Using the Standardized Approach for Operational Risk Capital Data.

Return to footnote 9

Footnote 10

This includes Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion that have been approved to use the SA, but do not have 10 years of high-quality loss data. These institutions must receive OSFI approval before they can set ILM<1 in the calculation of ORCSA.

Return to footnote 10

Footnote 11

10 years of actual or estimated loss data must be included for all parts of an institution. Estimation of more than 10% of an institution's total loss data over the past 10 years using the methodology detailed in paragraph 40(a) is only permitted on a temporary basis. Where this is the case, the institution must inform OSFI and come below the 10% threshold in a timely manner in order to continue to meet the loss data standards. (see section 3.4.7).

Return to footnote 11

Footnote 12

The financial impacts of events that an institution is responsible for should be included in the dataset as operational losses. For outsourced activities, the financial impacts of events that are paid by the outsourcer (rather than by the institution) are not operational losses to the institution. [Basel Framework, OPE 25.18 FAQ#1]

Return to footnote 12

Footnote 13

Loss impacts denominated in a foreign currency should be converted using the same exchange rate that is used to convert the institution's financial statements of the period the loss impacts were accounted for. [Basel Framework, OPE 25.18 FAQ#2]

Return to footnote 13

Footnote 14

Tax effects (e.g. reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of the standardized approach for operational risk.

Return to footnote 14

Footnote 15

Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.

Return to footnote 15

Footnote 16

When an institution makes a provision due to an operational loss event, such provision must be considered an operational loss immediately for the calculation of the Loss Component. When a charge-off (such as a settlement) eventually takes place later, only the difference between the initial provision and the charge-off (if any) should be added to the operational loss calculation. There should be no double counting of the same financial impacts in the calculation of operational losses. For example, if an institution takes a $1 million provision for a legal event in 2018, this should be included in the loss data for 2018. If the legal event is settled for $1.2 million in 2019, an additional $200,000 should be included in 2019. [Basel Framework, OPE 25.26 FAQ#1]

Return to footnote 16

Footnote 17

For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these events are recognized through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across institutions or countries.

Return to footnote 17

Footnote 18

Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution's financial accounts (e.g. revenue overstatement, accounting errors and mark-to-market errors). While these events do not represent a true financial impact on the institution, (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution's financial statements.

Return to footnote 18

Footnote 19

For example, when an institution refunds a client that was overbilled due to an operational failure, if the refund is provided in the same financial accounting period as the overbilling took place and thus no misrepresentation of the institution's financial statements occurs, there is no operational loss. However, if the refund occurs in a subsequent financial accounting period to the overbilling, it is considered a timing loss and should be included in the loss dataset if it exceeds the $30,000 minimum threshold (note that in this case the prior overbilling cannot be netted against the payment to the client as a recovery). [Basel Framework, OPE 25.26 FAQ #2]

Return to footnote 19

Footnote 20

For timing losses that are accounting errors, institutions must determine the threshold for inclusion of these events in the loss data set. This threshold may be greater than $30,000 but must be below the level used by the institution's external auditor for determining the summary of material misstatements within the annual financial statement audit. Accounting errors do not include errors in the mark-to-market valuation of financial assets or timing errors that involve third parties (e.g. customer over-billing or underpayment to third parties), which must be included in the loss data set when the amount of the timing loss exceeds $30,000.

Return to footnote 20

Footnote 21

For losses from uncollected revenue (paragraph 31(b)(iii)), institutions may use either the date in which the revenue should have been collected, or the date on which the decision was made not to collect the revenue.

Return to footnote 21

Footnote 22

This includes consideration of the extent to which the loss event was due to the lack of effective operational risk management policies, practices or controls within the institution.

Return to footnote 22

Footnote 23

1% of BI is the implied level of annual losses for an institution with an ILM=1 and a marginal coefficient of 15%.

Return to footnote 23

Footnote 24

Institutions may alternatively use 125% of Adjusted Gross Income (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for BI to calculate BI for an acquired business or merged entity at the time of acquisition.

Return to footnote 24

Footnote 25

For clarity, all outstanding credit obligations, including those of non-accrued status (e.g. non-performing loans), in the balance sheet should be included in the interest-earning assets. [Basel Framework, OPE 10.2 FAQ #1]

Return to footnote 25