Capital Adequacy Requirements (CAR) Chapter 3 – Operational Risk

Document Properties

• Type of Publication: Guideline
  
• Effective Date: February 2023 /April 2023^{Footnote 1}
• Audiences: Banks / BHC / T&L

I. Introduction

The Capital Adequacy Requirements (CAR) for banks (including federal credit unions), bank holding companies, federally regulated trust companies and federally regulated loan companies are set out in nine chapters, each of which has been issued as a separate document. This document should be read in conjunction with the other CAR chapters, which include:

• Chapter 1 - Overview of Risk-based Capital Requirements
• Chapter 2 - Definition of Capital
• Chapter 3 - Operational Risk
• Chapter 4 - Credit Risk - Standardized Approach
• Chapter 5 - Credit Risk - Internal Ratings Based Approach
• Chapter 6 - Securitization
• Chapter 7 - Settlement and Counterparty Risk
• Chapter 8 - Credit Valuation Adjustment (CVA) Risk
• Chapter 9 - Market Risk

Chapter 3 – Operational Risk

1. The requirements related to the Standardized Approach in this chapter (Section 3.4) are drawn from the Basel Committee on Banking Supervision's (BCBS) Basel Framework dated December 15, 2019^{Footnote 2}. For reference, the Basel paragraph numbers that are associated with the text appearing in this chapter are indicated in square brackets at the end of each paragraph.^{Footnote 3}

3.1 Definition of operational risk

2. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk^{Footnote 4}, but excludes strategic and reputational risk.

   [Basel Framework, OPE 10.1]

3.2 Measurement methodologies

3. There are two methodologies for calculating operational risk capital:

   1. the Standardized Approach (SA); and,
   2. the Simplified Standardized Approach (SSA).

4. Domestic Systemically Important Banks (D-SIBs) must use the Standardized Approach.

5. Category I Small and Medium Sized Deposit-Taking Institutions (SMSBs) with annual Adjusted Gross Income^{Footnote 5} greater than $1.5 billion must also use the Standardized Approach.

   1. Category I SMSBs must calculate Adjusted Gross Income at each fiscal year-end. If annual Adjusted Gross Income is greater than $1.5 billion, the institution must notify OSFI within 60 days of the end of the fiscal year, and use the Standardized Approach for operational risk in the following fiscal year.
   2. Once a Category I institution crosses the $1.5 billion threshold, it must use the Standardized Approach for a minimum of two years. If, after two years, annual Adjusted Gross Income falls below $1.5 billion, the institution must notify OSFI and may revert to the Simplified Standardized Approach^{Footnote 6}.

6. Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion may apply to OSFI to use the SA if they have a minimum of five years of high-quality loss data (i.e., data meeting the minimum standard for loss data collection as outlined in section 3.4.2). If approved, an institution is not permitted to set the Internal Loss Multiplier (ILM) to less than one until OSFI has determined that they have ten years of high-quality loss data.

7. All other SMSBs must use the SSA.

3.3 The Simplified Standardized Approach

8. Institutions using the SSA must hold capital for operational risk (ORC) equal to 15% of average annual Adjusted Gross Income (AGI) over the previous 12 fiscal quarters:

   ${\mathrm{ORC}}_{\mathrm{SSA}}=\left(\frac{{\mathrm{AGI}}_{\mathrm{previous\; 12\; fiscal\; quarters}}}{3}\right)\times 15\%$

   Where:

   ${\mathrm{ORC}}_{\mathrm{SSA}}=\mathrm{the\; operational\; risk\; capital\; charge\; under\; the\; Simplified\; Standardized\; Approach}$

   ${\mathrm{AGI}}_{\mathrm{previous\; 12\; fiscal\; quarters}}=\mathrm{Adjusted\; Gross\; Income\; over\; the\; previous\; 12\; fiscal\; quarters}$

   Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.

9. Adjusted Gross Income is defined as the sum of the following:

   1. The lesser of (i) the absolute value of net interest income, and (ii) 2.25% of interest earning assets;
   2. Dividend income;
   3. The absolute value of fee and commission income;
   4. The absolute value of other income;
   5. The absolute value of net profit/loss (trading book); and,
   6. The absolute value of net profit/loss (banking book).

   Adjusted Gross Income should (i) be gross of any provisions; (ii) be gross of operating expenses, and (iii) exclude extraordinary or irregular items as well as income derived from insurance. Institutions should refer to the reporting instructions in OSFI's Capital Adequacy Return for the specific line items in OSFI's P3 (Income Statement) and M4 (Balance Sheet) returns that should be used for each of the components of Adjusted Gross Income in the definition above.

10. Newly incorporated institutions having fewer than 12 quarters of financial information should calculate the operational risk capital charge using available Adjusted Gross Income data to develop proxies for the missing portions of the required three years' data.

11. Adjusted Gross Income should be adjusted to reflect acquired businesses and merged entities. Since the Adjusted Gross Income calculation is based on a rolling 12-quarter average, the most recent four quarters of Adjusted Gross Income for the acquired business or merged entity should be based on actual Adjusted Gross Income amounts reported by the acquired business or merged entity. If three years of historical financial data is not available for the acquired business or merged entity, the Adjusted Gross Income for the previous year may be used as a proxy for each of the other two years.

12. When an institution using the SSA makes a divestiture, Adjusted Gross Income may be adjusted, with OSFI approval, to reflect this divestiture.

3.4 The Standardized Approach

13. The standardised approach methodology is based on the following components:

    1. the Business Indicator (BI) which is a financial-statement-based proxy for operational risk;
    2. the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of regulatory determined marginal coefficients; and
    3. the Internal Loss Multiplier (ILM), which is a scaling factor that is based on an institution's average historical losses and the BIC.

    [Basel Framework, OPE 25.1]

14. Operational risk capital requirements under the Standardized Approach (ORC_SA) are calculated by multiplying the BIC and the ILM, as shown in the formula below. Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.

    ${\mathrm{ORC}}_{\mathrm{SA}}=\mathrm{BIC}\times \mathrm{ILM}$

    [Basel Framework, OPE 25.2]

3.4.1 Components of the Standardized Approach

15. The BI comprises three components: the interest, leases and dividend component (ILDC), the services component (SC), and the financial component (FC).

    [Basel Framework, OPE 25.3]

16. The BI is defined as:

    $\mathrm{BI}=\mathrm{ILDC}+\mathrm{SC}+\mathrm{FC}$

    In the formula below, a bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2, and^{Footnote 7}:

    $\mathrm{ILDC}=\mathrm{Min}[\overline{\mathrm{Abs}(\mathrm{Interest\; Income}–\mathrm{Interest\; Expense})};2.25\%\times \overline{\mathrm{Interest\; Earning\; Assets}}]+\overline{\mathrm{Dividend\; Income}}$

    $\mathrm{SC}=\mathrm{Max}\left[\overline{\mathrm{Fee\; and\; Commission\; Income}};\overline{\mathrm{Fee\; and\; Commission\; Expenses}}\right]+\mathrm{Max}[\overline{\mathrm{Other\; Operating\; Income}};\overline{\mathrm{Other\; Operating\; Expenses}}]$

    $\mathrm{FC}=\overline{\mathrm{Abs}\left(\mathrm{Net\; P\&L\; Trading\; Book}\right)}+\overline{\mathrm{Abs}\left(\mathrm{Net\; P\&L\; Banking\; Book}\right)}$

    [Basel Framework, OPE 25.4 and Basel Framework, OPE 25.5]

17. The definitions for each of the components of the BI are provided in Annex 3-1.

    [Basel Framework, OPE 25.6]

18. The Business Indicator Component (BIC) is calculated as follows^{Footnote 8}:

    1. 12% of BI, plus
    2. 3% of BI above $1.5 billion (if any), plus
    3. 3% of BI above $45 billion (if any).

    [Basel Framework, OPE 25.7]

19. An institution's internal operational risk loss experience affects the calculation of operational risk capital through the ILM. The ILM is defined as:

    $\mathrm{ILM}=\ln \left(\exp \left(1\right)-1+{\left(\frac{\mathrm{LC}}{\mathrm{BIC}}\right)}^{0.8}\right)$

    where the Loss Component (LC) is equal to 15 times average annual operational risk losses, net of recoveries, incurred over the previous 10 years. The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, an institution with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, an institution with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology.

    [Basel Framework, OPE 25.8 and Basel Framework, OPE 25.9]

20. The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data (i.e., data meeting the minimum standard for loss data collection as outlined in section 3.4.2). Institutions that do not have ten years of high-quality loss data must calculate the capital requirement using an ILM greater than or equal to one. In these cases, OSFI will require an institution to calculate capital requirements using fewer than ten years of losses if the ILM using the available high-quality loss data is greater than 1 and OSFI believes the losses are representative of the institution's operational loss exposure.

    [Basel Framework, OPE 25.10]

21. ORC is to be calculated and reported quarterly. Financial information used in the calculation of the BI should be up to and including the institution's most recent fiscal quarter-end. Operational risk losses used in the calculation of the LC may be reported on a one-quarter lag.

22. Institutions should perform a reconciliation between the BI and Net Interest Income and Non-Interest Income^{Footnote 9} for the previous three years. This information should be available to OSFI upon request.

23. At the consolidated level, the SA calculations use fully consolidated BI figures, which net all the intragroup income and expenses.

    [Basel Framework, OPE 10.4]

24. A subsidiary institution using the SA should use its own consolidated income and loss experience in the calculation of BI and LC for the SA calculations, and is subject to the minimum standards for the use of loss data in the following sections.

    [Basel Framework OPE, 10.5 and Basel Framework, OPE 10.6]

3.4.2 Minimum standards for the use of loss data under the standardized approach

25. Institutions using the SA are required to use loss data as a direct input into the operational risk capital calculations. The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the institution's operational loss exposure. The minimum loss data standards are outlined in sections 3.4.3, 3.4.4, 3.4.5 and 3.4.7^{Footnote 10}. The quality of institutions' loss data will be reviewed by OSFI periodically.

    [Basel Framework OPE, 25.12]

26. Institutions using the SA that do not meet the loss data standards^{Footnote 11}are required to hold capital that is at a minimum equal to 100% of the BIC (i.e. ILM greater than or equal to one). The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting adjustment to the ILM, must be publicly disclosed.

    [Basel Framework OPE, 25.13]

3.4.3 General criteria on loss data identification, collection and treatment

27. The proper identification, collection and treatment of internal loss data are essential prerequisites to the capital calculation under the standardised approach. The general criteria for the use of the LC are as follows:

    [Basel Framework, OPE 25.14]

    1. Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period.

       [Basel Framework, OPE 25.15]

    2. Internal loss data are most relevant when clearly linked to an institution's current business activities, technological processes and risk management procedures. Therefore, an institution must have robust, documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.

       [Basel Framework, OPE 25.16]

    3. For risk management purposes, and to assist in supervisory validation and/or review, institutions should map historical internal loss data into the relevant Level 1 supervisory categories as defined in Annex 3-2 and to provide this data to OSFI upon request. The institution must document criteria for allocating losses to the specified event types.

       [Basel Framework, OPE 25.17]

    4. An institution's internal loss data must be comprehensive and capture all material^{Footnote 12} activities and exposures from all appropriate subsystems and geographic locations^{Footnote 13}.

       [Basel Framework, OPE 25.18]

    5. For the purposes of the operational risk capital calculation, the minimum threshold, net of recoveries, for including a loss event in the data collection and calculation of average annual losses is set at $30,000^{Footnote 14}.

       [Basel Framework, OPE 25.18]

    6. Aside from information on gross loss amounts, the institution must collect information about the reference dates of operational risk events, including

       • the date when the event happened or first began ("date of occurrence"), where available;
       • the date on which the institution became aware of the event ("date of discovery"); and
       • the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognised in the institution's profit and loss (P&L) accounts ("date of accounting").

       In addition, the institution must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event^{Footnote 15}. The level of detail of any descriptive information should be commensurate with the size of the gross loss amount.

       [Basel Framework, OPE 25.19]

    7. Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set.

       [Basel Framework, OPE 25.20]

    8. Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardised approach for operational risk.

       [Basel Framework, OPE 25.21]

    9. Institutions must have processes to independently review the comprehensiveness and accuracy of loss data. At a minimum, this would include effective and independent challenge by the institution's second line of defense, and periodic independent review by the third line of defense.

       [Basel Framework, OPE 25.22]

3.4.4 Specific criteria on loss data identification, collection and treatment

28. Building an acceptable loss data set from the available internal data requires that the institution develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses.

    [Basel Framework, OPE 25.23]

29. Gross loss is a loss before recoveries of any type. Net loss is defined as the loss after taking into account the impact of recoveries. The recovery is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party^{Footnote 16}.

    [Basel Framework, OPE 25.24]

30. Institutions must be able to identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Institutions should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the institution receives payment. Receivables do not count as recoveries. Verification of recovery payments received to net losses must be provided to OSFI upon request.

    [Basel Framework, OPE 25.25]

31. The following items must be included in the gross loss computation of the loss data set:

    1. Direct charges, including impairments and settlements, to the institution's P&L accounts and write-downs due to the operational risk event;
    2. Costs incurred as a consequence of the event including:
       1. external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers);
       2. costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event; and,
       3. uncollected revenue due to an operational risk event that can be quantified based on the contractual obligations of the institution's client or customer.
    3. Provisions or reserves accounted for in the P&L against the potential operational loss impact^{Footnote 17};
    4. Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L ("pending losses")^{Footnote 18}; and
    5. Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods ("timing losses")^{Footnote 19}. Timing losses should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period^{Footnote 20 Footnote 21}.

    [Basel Framework, OPE 25.26]

32. The following items should be excluded from the gross loss computation of the loss data set:

    1. Costs of general maintenance contracts on property, plant or equipment;
    2. Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and
    3. Insurance premiums.

    [Basel Framework, OPE 25.27]

33. Institutions must use the date of accounting for building the loss data set^{Footnote 22}. The institution must use a date no later than the date of accounting for including losses related to legal events in the loss data set. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L.

    [Basel Framework, OPE 25.28]

34. Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment.

    [Basel Framework, OPE 25.29]

3.4.5 Exclusion of losses from the Loss Component

35. Institutions may request OSFI approval to exclude certain operational loss events that are no longer relevant to the institution's risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the institution's risk profile, OSFI will consider whether the cause of the loss event could occur in other areas of the institution's operations^{Footnote 23}. Taking settled legal exposures and divested businesses as examples, OSFI would expect the organisation's analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.

    [Basel Framework, OPE 25.30]

36. The total loss amount and number of exclusions must be disclosed in accordance with the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions.

    [Basel Framework, OPE 25.31]

37. A request for loss exclusions is subject to a materiality threshold such that the excluded loss event should be greater than 5% of the institution's average annual losses over the past 10 years. In addition, losses can only be eligible for exclusion after being included in an institution's operational risk loss database for a minimum of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period.

    [Basel Framework, OPE 25.32]

3.4.6 Exclusions of divested activities from the Business Indicator

38. Institutions may request OSFI approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed in accordance with the Pillar 3 requirements.

    [Basel Framework, OPE 25.33]

3.4.7 Inclusion of BI items and operational loss events related to mergers and acquisitions

39. The measurement of the BI must include BI items that result from acquired businesses and merged entities. If three years of historical financial data is not available for an acquired business or merged entity, actual BI items for at least the previous year may be used for the BI calculation, and the BI items for the previous year may be used as a proxy for each of the other two years. Alternatively, institutions may use 125% of Adjusted Gross Income of the acquired business or merged entity (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for the acquired business or merged entity's BI.

    [Basel Framework, OPE 25.34]

40. Institutions using the standardized approach must also include historical loss events from the acquired business or merged entity for the previous ten years.

    1. If an acquired business or merged entity does not have historical high-quality loss data for the previous ten years, the institution must estimate historical loss data for each of the years where data is missing for the purposes of calculating the LC (actual high-quality loss data should be used for those years where available).

       1. If the institution's ILM in the quarter prior to the merger or acquisition was less than or equal to one, operational losses for each missing year should be estimated as 1%^{Footnote 24} of the BI of the acquired business or merged entity at the time of acquisition^{Footnote 25}.

       2. If the institution's ILM in the quarter prior to the merger or acquisition was greater than one, estimated operational losses for each missing year of the acquired business or merged entity in the ten-year window should be estimated as x% of the BI of the acquired business or merged entity at the time of acquisition^{Footnote 25}, where

          $x=\frac{\mathrm{average\; annual\; net\; losses\; for\; the\; past\; ten\; years\; reported\; in\; the\; quarter\; prior\; to\; the\; merger\; /\; acquisition}}{\mathrm{BI\; reported\; in\; the\; quarter\; prior\; to\; the\; merger\; /\; acquisition}}$

    2. Post-acquisition or merger, if the collection of actual loss data for the acquired business or merged entity is not feasible immediately, the institution may temporarily estimate operational risk loss amounts for the acquired business or merged entity, using the methodology detailed in paragraph 40(a) above.

Annex 3-1: Definition of Business Indicator components

[Basel Framework OPE 10.2]

The following P&L items do not contribute to any of the items of the BI:

• Income and expenses from insurance or reinsurance businesses
• Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased (including deposit insurance premiums)
• Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, human resources, information technology - IT), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)
• Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)
• Expenses of premises and fixed assets (except when these expenses result from operational loss events)
• Depreciation/amortisation of tangible and intangible assets (except depreciation related to operating lease assets, which should be included in financial and operating lease expenses)
• Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events
• Expenses due to share capital repayable on demand
• Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)
• Changes in goodwill recognised in profit or loss
• Corporate income tax (tax based on profits including current tax and deferred).

[Basel Framework OPE 10.3]

Annex 3-2: Detailed Loss Event Type Classification

[Basel Framework OPE 25.17]