Office of the Superintendent of Financial Institutions
The Capital Adequacy Requirements (CAR) for banks (including federal credit unions), bank holding companies, federally regulated trust companies and federally regulated loan companies are set out in nine chapters, each of which has been issued as a separate document. This document should be read in conjunction with the other CAR chapters, which include:
The requirements related to the Standardized Approach in this chapter (Section 3.4) are drawn from the Basel Committee on Banking Supervision's (BCBS) Basel Framework dated December 15, 2019Footnote 2. For reference, the Basel paragraph numbers that are associated with the text appearing in this chapter are indicated in square brackets at the end of each paragraph.Footnote 3
Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal riskFootnote 4, but excludes strategic and reputational risk.
[Basel Framework, OPE 10.1]
There are two methodologies for calculating operational risk capital:
Domestic Systemically Important Banks (D-SIBs) must use the Standardized Approach.
Category I Small and Medium Sized Deposit-Taking Institutions (SMSBs) with annual Adjusted Gross IncomeFootnote 5 greater than $1.5 billion must also use the Standardized Approach.
Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion may apply to OSFI to use the SA if they have a minimum of five years of high-quality loss data (i.e., data meeting the minimum standard for loss data collection as outlined in section 3.4.2). If approved, an institution is not permitted to set the Internal Loss Multiplier (ILM) to less than one until OSFI has determined that they have ten years of high-quality loss data.
All other SMSBs must use the SSA.
Institutions using the SSA must hold capital for operational risk (ORC) equal to 15% of average annual Adjusted Gross Income (AGI) over the previous 12 fiscal quarters:
previous 12 fiscal quarters
the operational risk capital charge under the Simplified Standardized Approach
previous 12 fiscal quarters
Adjusted Gross Income over the previous 12 fiscal quarters
Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.
Adjusted Gross Income is defined as the sum of the following:
Adjusted Gross Income should (i) be gross of any provisions; (ii) be gross of operating expenses, and (iii) exclude extraordinary or irregular items as well as income derived from insurance. Institutions should refer to the reporting instructions in OSFI's Capital Adequacy Return for the specific line items in OSFI's P3 (Income Statement) and M4 (Balance Sheet) returns that should be used for each of the components of Adjusted Gross Income in the definition above.
Newly incorporated institutions having fewer than 12 quarters of financial information should calculate the operational risk capital charge using available Adjusted Gross Income data to develop proxies for the missing portions of the required three years' data.
Adjusted Gross Income should be adjusted to reflect acquired businesses and merged entities. Since the Adjusted Gross Income calculation is based on a rolling 12-quarter average, the most recent four quarters of Adjusted Gross Income for the acquired business or merged entity should be based on actual Adjusted Gross Income amounts reported by the acquired business or merged entity. If three years of historical financial data is not available for the acquired business or merged entity, the Adjusted Gross Income for the previous year may be used as a proxy for each of the other two years.
When an institution using the SSA makes a divestiture, Adjusted Gross Income may be adjusted, with OSFI approval, to reflect this divestiture.
The standardised approach methodology is based on the following components:
[Basel Framework, OPE 25.1]
Operational risk capital requirements under the Standardized Approach (ORCSA) are calculated by multiplying the BIC and the ILM, as shown in the formula below. Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.
[Basel Framework, OPE 25.2]
The BI comprises three components: the interest, leases and dividend component (ILDC), the services component (SC), and the financial component (FC).
[Basel Framework, OPE 25.3]
The BI is defined as:
In the formula below, a bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2, andFootnote 7:
Interest Earning Assets
Fee and Commission Income
Fee and Commission Expenses
Other Operating Income
Other Operating Expenses
Net P&L Trading Book
Net P&L Banking Book
[Basel Framework, OPE 25.4 and Basel Framework, OPE 25.5]
The definitions for each of the components of the BI are provided in Annex 3-1.
[Basel Framework, OPE 25.6]
The Business Indicator Component (BIC) is calculated as followsFootnote 8:
[Basel Framework, OPE 25.7]
An institution's internal operational risk loss experience affects the calculation of operational risk capital through the ILM. The ILM is defined as:
where the Loss Component (LC) is equal to 15 times average annual operational risk losses, net of recoveries, incurred over the previous 10 years. The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, an institution with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, an institution with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology.
[Basel Framework, OPE 25.8 and Basel Framework, OPE 25.9]
The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data (i.e., data meeting the minimum standard for loss data collection as outlined in section 3.4.2). Institutions that do not have ten years of high-quality loss data must calculate the capital requirement using an ILM greater than or equal to one. In these cases, OSFI will require an institution to calculate capital requirements using fewer than ten years of losses if the ILM using the available high-quality loss data is greater than 1 and OSFI believes the losses are representative of the institution's operational loss exposure.
[Basel Framework, OPE 25.10]
ORC is to be calculated and reported quarterly. Financial information used in the calculation of the BI should be up to and including the institution's most recent fiscal quarter-end. Operational risk losses used in the calculation of the LC may be reported on a one-quarter lag.
Institutions should perform a reconciliation between the BI and Net Interest Income and Non-Interest IncomeFootnote 9 for the previous three years. This information should be available to OSFI upon request.
At the consolidated level, the SA calculations use fully consolidated BI figures, which net all the intragroup income and expenses.
[Basel Framework, OPE 10.4]
A subsidiary institution using the SA should use its own consolidated income and loss experience in the calculation of BI and LC for the SA calculations, and is subject to the minimum standards for the use of loss data in the following sections.
[Basel Framework OPE, 10.5 and Basel Framework, OPE 10.6]
Institutions using the SA are required to use loss data as a direct input into the operational risk capital calculations. The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the institution's operational loss exposure. The minimum loss data standards are outlined in sections 3.4.3, 3.4.4, 3.4.5 and 3.4.7Footnote 10. The quality of institutions' loss data will be reviewed by OSFI periodically.
[Basel Framework OPE, 25.12]
Institutions using the SA that do not meet the loss data standardsFootnote 11are required to hold capital that is at a minimum equal to 100% of the BIC (i.e. ILM greater than or equal to one). The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting adjustment to the ILM, must be publicly disclosed.
[Basel Framework OPE, 25.13]
The proper identification, collection and treatment of internal loss data are essential prerequisites to the capital calculation under the standardised approach. The general criteria for the use of the LC are as follows:
[Basel Framework, OPE 25.14]
Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period.
[Basel Framework, OPE 25.15]
Internal loss data are most relevant when clearly linked to an institution's current business activities, technological processes and risk management procedures. Therefore, an institution must have robust, documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.
[Basel Framework, OPE 25.16]
For risk management purposes, and to assist in supervisory validation and/or review, institutions should map historical internal loss data into the relevant Level 1 supervisory categories as defined in Annex 3-2 and to provide this data to OSFI upon request. The institution must document criteria for allocating losses to the specified event types.
[Basel Framework, OPE 25.17]
An institution's internal loss data must be comprehensive and capture all materialFootnote 12 activities and exposures from all appropriate subsystems and geographic locationsFootnote 13.
[Basel Framework, OPE 25.18]
For the purposes of the operational risk capital calculation, the minimum threshold, net of recoveries, for including a loss event in the data collection and calculation of average annual losses is set at $30,000Footnote 14.
Aside from information on gross loss amounts, the institution must collect information about the reference dates of operational risk events, including
In addition, the institution must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss eventFootnote 15. The level of detail of any descriptive information should be commensurate with the size of the gross loss amount.
[Basel Framework, OPE 25.19]
Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set.
[Basel Framework, OPE 25.20]
Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardised approach for operational risk.
[Basel Framework, OPE 25.21]
Institutions must have processes to independently review the comprehensiveness and accuracy of loss data. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.
[Basel Framework, OPE 25.22]
Building an acceptable loss data set from the available internal data requires that the institution develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses.
[Basel Framework, OPE 25.23]
Gross loss is a loss before recoveries of any type. Net loss is defined as the loss after taking into account the impact of recoveries. The recovery is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third partyFootnote 16.
[Basel Framework, OPE 25.24]
Institutions must be able to identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Institutions should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the institution receives payment. Receivables do not count as recoveries. Verification of recovery payments received to net losses must be provided to OSFI upon request.
[Basel Framework, OPE 25.25]
The following items must be included in the gross loss computation of the loss data set:
[Basel Framework, OPE 25.26]
The following items should be excluded from the gross loss computation of the loss data set:
[Basel Framework, OPE 25.27]
Institutions must use the date of accounting for building the loss data setFootnote 22. The institution must use a date no later than the date of accounting for including losses related to legal events in the loss data set. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L.
[Basel Framework, OPE 25.28]
Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment.
[Basel Framework, OPE 25.29]
Institutions may request OSFI approval to exclude certain operational loss events that are no longer relevant to the institution's risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the institution's risk profile, OSFI will consider whether the cause of the loss event could occur in other areas of the institution's operationsFootnote 23. Taking settled legal exposures and divested businesses as examples, OSFI would expect the organisation's analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.
[Basel Framework, OPE 25.30]
The total loss amount and number of exclusions must be disclosed in accordance with the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions.
[Basel Framework, OPE 25.31]
A request for loss exclusions is subject to a materiality threshold such that the excluded loss event should be greater than 5% of the institution's average annual losses over the past 10 years. In addition, losses can only be eligible for exclusion after being included in an institution's operational risk loss database for a minimum of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period.
[Basel Framework, OPE 25.32]
Institutions may request OSFI approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed in accordance with the Pillar 3 requirements.
[Basel Framework, OPE 25.33]
The measurement of the BI must include BI items that result from acquired businesses and merged entities. If three years of historical financial data is not available for an acquired business or merged entity, actual BI items for at least the previous year may be used for the BI calculation, and the BI items for the previous year may be used as a proxy for each of the other two years. Alternatively, institutions may use 125% of Adjusted Gross Income of the acquired business or merged entity (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for the acquired business or merged entity's BI.
[Basel Framework, OPE 25.34]
Institutions using the standardized approach must also include historical loss events from the acquired business or merged entity for the previous ten years.
If an acquired business or merged entity does not have historical high-quality loss data for the previous ten years, the institution must estimate historical loss data for each of the years where data is missing for the purposes of calculating the LC (actual high-quality loss data should be used for those years where available).
If the institution's ILM in the quarter prior to the merger or acquisition was less than or equal to one, operational losses for each missing year should be estimated as 1%Footnote 24 of the BI of the acquired business or merged entity at the time of acquisitionFootnote 25.
average annual net losses for the past ten years reported in the quarter prior to the merger / acquisition
BI reported in the quarter prior to the merger / acquisition
Post-acquisition or merger, if the collection of actual loss data for the acquired business or merged entity is not feasible immediately, the institution may temporarily estimate operational risk loss amounts for the acquired business or merged entity, using the methodology detailed in paragraph 40(a) above.
[Basel Framework OPE 10.2]
Interest income from all financial assets and other interest income
(includes interest income from financial and operating leases and profits from leased assets)
Interest expenses from all financial liabilities and other interest expenses
(includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets)
Income from ordinary banking operations not included in other BI items but of similar nature
(income from operating leases should be excluded)
The following P&L items do not contribute to any of the items of the BI:
[Basel Framework OPE 10.3]
[Basel Framework OPE 25.17]
Transactions not reported (intentional)
Transaction type unauthorised (w/monetary loss)
Mismarking of position (intentional)
Fraud / credit fraud / worthless deposits
Theft / extortion / embezzlement / robbery
Misappropriation of assets
Malicious destruction of assets
Check kiting Smuggling
Account take-over / impersonation / etc.
Tax non-compliance / evasion (wilful)
Bribes / kickbacks
Insider trading (not on firm's account)
Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events
Compensation, benefit, termination issues
Organised labour activity
General liability (slip and fall, etc.)
Employee health & safety rules events Workers compensation
Fiduciary breaches / guideline violations
Suitability / disclosure issues (KYC, etc.)
Retail customer disclosure violations
Breach of privacy
Misuse of confidential information
Improper trade / market practices
Market manipulation Insider trading (on firm's account)
Natural disaster losses
Human losses from external sources (terrorism, vandalism)
Utility outage / disruptions
Data entry, maintenance or loading error
Missed deadline or responsibility
Model / system misoperation
Accounting error / entity attribution error
Other task misperformance
Collateral management failure
Reference Data Maintenance
For institutions with a fiscal year ending October 31 or December 31, respectively.
Return to footnote 1
Return to footnote 2
Following the format: [Basel Framework, XXX yy.zz].
Return to footnote 3
Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements.
Return to footnote 4
Adjusted Gross Income is defined in paragraph 9 of this chapter.
Return to footnote 5
For example, if fiscal 2024 Adjusted Gross Income is greater than $1.5 billion for the first time, the institution must use the Standardized Approach starting in fiscal Q1 2026 and continue using the SA until, at a minimum, the end of fiscal 2027.
Return to footnote 6
Abs() represents the absolute value of the term or calculation within the brackets. The absolute value of net items (e.g., interest income – interest expense) should be calculated first year by year. Only after this year by year calculation should the average of the three years be calculated.
Return to footnote 7
For example, if an institution had a BI = $50 billion, the BIC = ($50B x 0.12) + [($50B -$1.5B) x 0.03] + [($50B - $45B) x 0.03] = $7.605 B.
Return to footnote 8
Net Interest and Non-Interest Income is line 22 from OSFI's P3 return.
Return to footnote 9
Institutions are also required to meet OSFI's Data Maintenance Expectations for Institutions Using the Standardized Approach for Operational Risk Capital Data.
Return to footnote 10
This includes Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion that have been approved to use the SA, but do not have 10 years of high-quality loss data. These institutions must receive OSFI approval before they can set ILM<1 in the calculation of ORCSA.
Return to footnote 11
10 years of actual or estimated loss data must be included for all parts of an institution. Estimation of more than 10% of an institution's total loss data over the past 10 years using the methodology detailed in paragraph 40(a) is only permitted on a temporary basis. Where this is the case, the institution must inform OSFI and come below the 10% threshold in a timely manner in order to continue to meet the loss data standards. (see section 3.4.7).
Return to footnote 12
The financial impacts of events that an institution is responsible for should be included in the dataset as operational losses. For outsourced activities, the financial impacts of events that are paid by the outsourcer (rather than by the institution) are not operational losses to the institution. [Basel Framework, OPE 25.18 FAQ#1]
Return to footnote 13
Loss impacts denominated in a foreign currency should be converted using the same exchange rate that is used to convert the institution's financial statements of the period the loss impacts were accounted for. [Basel Framework, OPE 25.18 FAQ#2]
Return to footnote 14
Tax effects (e.g. reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of the standardised approach for operational risk.
Return to footnote 15
Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.
Return to footnote 16
When an institution makes a provision due to an operational loss event, such provision must be considered an operational loss immediately for the calculation of the Loss Component. When a charge-off (such as a settlement) eventually takes place later, only the difference between the initial provision and the charge-off (if any) should be added to the operational loss calculation. There should be no double counting of the same financial impacts in the calculation of operational losses. For example, if an institution takes a $1 million provision for a legal event in 2018, this should be included in the loss data for 2018. If the legal event is settled for $1.2 million in 2019, an additional $200,000 should be included in 2019. [Basel Framework, OPE 25.26 FAQ#1]
Return to footnote 17
For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these events are recognised through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across institutions or countries.
Return to footnote 18
Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution's financial accounts (e.g. revenue overstatement, accounting errors and mark-to-market errors). While these events do not represent a true financial impact on the institution, (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution's financial statements.
Return to footnote 19
For example, when an institution refunds a client that was overbilled due to an operational failure, if the refund is provided in the same financial accounting period as the overbilling took place and thus no misrepresentation of the institution's financial statements occurs, there is no operational loss. However, if the refund occurs in a subsequent financial accounting period to the overbilling, it is considered a timing loss and should be included in the loss dataset if it exceeds the $30 thousand minimum threshold (note that in this case the prior overbilling cannot be netted against the payment to the client as a recovery). [Basel Framework, OPE 25.26 FAQ #2]
Return to footnote 20
For timing losses that are accounting errors, institutions must determine the threshold for inclusion of these events in the loss data set. This threshold may be greater than $30,000 but must be below the level used by the institution's external auditor for determining the summary of material misstatements within the annual financial statement audit. Accounting errors do not include errors in the mark-to-market valuation of financial assets or timing errors that involve third parties (e.g. customer over-billing or underpayment to third parties), which must be included in the loss data set when the amount of the timing loss exceeds $30,000.
Return to footnote 21
For losses from uncollected revenue (paragraph 31(b)(iii)), institutions may use either the date in which the revenue should have been collected, or the date on which the decision was made not to collect the revenue.
Return to footnote 22
This includes consideration of the extent to which the loss event was due to the lack of effective operational risk management policies, practices or controls within the institution.
Return to footnote 23
1% of BI is the implied level of annual losses for an institution with an ILM=1 and a marginal coefficient of 15%.
Return to footnote 24
Institutions may alternatively use 125% of Adjusted Gross Income (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for BI to calculate BI for an acquired business or merged entity at the time of acquisition.
Return to footnote 25
For clarity, all outstanding credit obligations, including those of non-accrued status (e.g., non-performing loans), in the balance sheet should be included in the interest-earning assets. [Basel Framework, OPE 10.2 FAQ #1]
Return to footnote 26