Directive 2006/48/EC of the European Parliament and of the council (repealed)Show full title

ANNEX X OPERATIONAL RISK

PART 1 Basic Indicator Approach

1. CAPITAL REQUIREMENT

1. Under the Basic Indicator Approach, the capital requirement for operational risk is equal to 15 % of the relevant indicator defined in points 2 to 9.

2. RELEVANT INDICATOR

2. The relevant indicator is the average over three years of the sum of net interest income and net non-interest income.

3. The three-year average is calculated on the basis of the last three twelve-monthly observations at the end of the financial year. When audited figures are not available, business estimates may be used.

4. If for any given observation, the sum of net interest income and net non-interest income is negative or equal to zero, this figure shall not be taken into account in the calculation of the three-year average. The relevant indicator shall be calculated as the sum of positive figures divided by the number of positive figures.

2.1. Credit institutions subject to Directive 86/635/EEC

5. Based on the accounting categories for the profit and loss account of credit institutions under Article 27 of Directive 86/635/EEC, the relevant indicator shall be expressed as the sum of the elements listed in Table 1. Each element shall be included in the sum with its positive or negative sign.

6. These elements may need to be adjusted to reflect the qualifications in points 7 and 8.

Table 1

1 Interest receivable and similar income

2 Interest payable and similar charges

3 Income from shares and other variable/fixed-yield securities

4 Commissions/fees receivable

5 Commissions/fees payable

6 Net profit or net loss on financial operations

7 Other operating income

2.1.1. Qualifications

7. The indicator shall be calculated before the deduction of any provisions and operating expenses. Operating expenses shall include fees paid for outsourcing services rendered by third parties which are not a parent or subsidiary of the credit institution or a subsidiary of a parent which is also the parent of the credit institution. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator if the expenditure is incurred from an undertaking subject to supervision under, or equivalent to, this Directive.

8. The following elements shall not be used in the calculation of the relevant indicator:

(a)

Realised profits/losses from the sale of non-trading book items;

(b)

Income from extraordinary or irregular items;

(c)

Income derived from insurance.

When revaluation of trading items is part of the profit and loss statement, revaluation could be included. When Article 36 (2) of Directive 86/635/EEC is applied, revaluation booked in the profit and loss account should be included.

2.2. Credit institutions subject to a different accounting framework

9. When credit institutions are subject to an accounting framework different from the one established by Directive 86/635/EEC, they should calculate the relevant indicator on the basis of data that best reflect the definition set out in points 2 to 8.

PART 2 Standardised Approach

1. CAPITAL REQUIREMENT

1. Under the Standardised Approach, the capital requirement for operational risk is the average over three years of the risk-weighted relevant indicators calculated each year across the business lines referred to in Table 2. In each year, a negative capital requirement in one business line, resulting from a negative relevant indicator may be imputed to the whole. However, where the aggregate capital charge across all business lines within a given year is negative, then the input to the average for that year shall be zero.

2. The three-year average is calculated on the basis of the last three twelve-monthly observations at the end of the financial year. When audited figures are not available, business estimates may be used.

Table 2

Business line	List of activities	Percentage
Corporate finance	Underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis Services related to underwriting Investment advice Advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to the mergers and the purchase of undertakings Investment research and financial analysis and other forms of general recommendation relating to transactions in financial instruments	18 %
Trading and sales	Dealing on own account Money broking Reception and transmission of orders in relation to one or more financial instruments Execution of orders on behalf of clients Placing of financial instruments without a firm commitment basis Operation of Multilateral Trading Facilities	18 %
Retail brokerage (Activities with a individual physical persons or with small and medium sized entities meeting the criteria set out in Article 79 for the retail exposure class)	Reception and transmission of orders in relation to one or more financial instruments Execution of orders on behalf of clients Placing of financial instruments without a firm commitment basis	12 %
Commercial banking	Acceptance of deposits and other repayable funds Lending Financial leasing Guarantees and commitments	15 %
Retail banking (Activities with a individual physical persons or with small and medium sized entities meeting the criteria set out in Article 79 for the retail exposure class)	Acceptance of deposits and other repayable funds Lending Financial leasing Guarantees and commitments	12 %
Payment and settlement	Money transmission services, Issuing and administering means of payment	18 %
Agency services	Safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management	15 %
Asset management	Portfolio management Managing of UCITS Other forms of asset management	12 %

3. Competent authorities may authorise a credit institution to calculate its capital requirement for operational risk using an alternative standardised approach, as set out in points 5 to 11.

2. PRINCIPLES FOR BUSINESS LINE MAPPING

4. Credit institutions must develop and document specific policies and criteria for mapping the relevant indicator for current business lines and activities into the standardised framework. The criteria must be reviewed and adjusted as appropriate for new or changing business activities and risks. The principles for business line mapping are:

(a)

all activities must be mapped into the business lines in a mutually exclusive and jointly exhaustive manner;

(b)

any activity which cannot be readily mapped into the business line framework, but which represents an ancillary function to an activity included in the framework, must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective‐mapping criterion must be used;

(c)

if an activity cannot be mapped into a particular business line then the business line yielding the highest percentage must be used. The same business line equally applies to any associated ancillary activity;

(d)

credit institutions may use internal pricing methods to allocate the relevant indicator between business lines. Costs generated in one business line which are imputable to a different business line may be reallocated to the business line to which they pertain, for instance by using a treatment based on internal transfer costs between the two business lines;

(e)

the mapping of activities into business lines for operational risk capital purposes must be consistent with the categories used for credit and market risks;

(f)

senior management is responsible for the mapping policy under the control of the governing bodies of the credit institution; and

(g)

the mapping process to business lines must be subject to independent review.

3. ALTERNATIVE INDICATORS FOR CERTAIN BUSINESS LINES

3.1. Modalities

5. The competent authorities may authorise the credit institution to use an alternative relevant indicator for the business lines: retail banking and commercial banking.

6. For these business lines, the relevant indicator shall be a normalised income indicator equal to the three-year average of the total nominal amount of loans and advances multiplied by 0,035.

7. For the retail and/or commercial banking business lines, the loans and advances shall consist of the total drawn amounts in the corresponding credit portfolios. For the commercial banking business line, securities held in the non trading book shall also be included.

3.2. Conditions

8. The authorisation to use alternative relevant indicators shall be subject to the conditions in points 9 to 11.

3.2.1. General condition

9. The credit institution meets the qualifying criteria set out in point 12.

3.2.2. Conditions specific to retail banking and commercial banking

10. The credit institution is overwhelmingly active in retail and/or commercial banking activities, which shall account for at least 90 % of its income.

11. The credit institution is able to demonstrate to the competent authorities that a significant proportion of its retail and/or commercial banking activities comprise loans associated with a high PD, and that the alternative standardised approach provides an improved basis for assessing the operational risk.

4. QUALIFYING CRITERIA

12. Credit institutions must meet the qualifying criteria listed below, in addition to the general risk management standards set out in Article 22 and Annex V. Satisfaction of these criteria shall be determined having regard to the size and scale of activities of the credit institution and to the principle of proportionality.

(a)

Credit institutions shall have a well-documented assessment and management system for operational risk with clear responsibilities assigned for this system. They shall identify their exposures to operational risk and track relevant operational risk data, including material loss data. This system shall be subject to regular independent review.

(b)

The operational risk assessment system must be closely integrated into the risk management processes of the credit institution. Its output must be an integral Part of the process of monitoring and controlling the credit institution's operational risk profile.

(c)

Credit institutions shall implement a system of management reporting that provides operational risk reports to relevant functions within the credit institution. Credit institutions shall have procedures for taking appropriate action according to the information within the management reports.

PART 3 Advanced Measurement Approaches

1. QUALIFYING CRITERIA

1. To be eligible for an Advanced Measurement Approach, credit institutions must satisfy the competent authorities that they meet the qualifying criteria below, in addition to the general risk management standards in Article 22 and Annex V.

1.1. Qualitative Standards

2. The credit institution's internal operational risk measurement system shall be closely integrated into its day-to-day risk management processes.

3. The credit institution must have an independent risk management function for operational risk.

4. There must be regular reporting of operational risk exposures and loss experience. The credit institution shall have procedures for taking appropriate corrective action.

5. The credit institution's risk management system must be well documented. The credit institution shall have routines in place for ensuring compliance and policies for the treatment of non-compliance.

6. The operational risk management processes and measurement systems shall be subject to regular reviews performed by internal and/or external auditors.

7. The validation of the operational risk measurement system by the competent authorities shall include the following elements:

(a)

verifying that the internal validation processes are operating in a satisfactory manner;

(b)

making sure that data flows and processes associated with the risk measurement system are transparent and accessible.

1.2. Quantitative Standards

1.2.1. Process

8. Credit institutions shall calculate their capital requirement as comprising both expected loss and unexpected loss, unless they can demonstrate that expected loss is adequately captured in their internal business practices. The operational risk measure must capture potentially severe tail events, achieving a soundness standard comparable to a 99,9 % confidence interval over a one year period.

9. The operational risk measurement system of a credit institution must have certain key elements to meet the soundness standard set out in point 8. These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in points 13 to 24. A credit institution needs to have a well documented approach for weighting the use of these four elements in its overall operational risk measurement system.

10. The risk measurement system shall capture the major drivers of risk affecting the shape of the tail of the loss estimates.

11. Correlations in operational risk losses across individual operational risk estimates may be recognised only if credit institutions can demonstrate to the satisfaction of the competent authorities that their systems for measuring correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress. The credit institution must validate its correlation assumptions using appropriate quantitative and qualitative techniques.

12. The risk measurement system shall be internally consistent and shall avoid the multiple counting of qualitative assessments or risk mitigation techniques recognised in other areas of the capital adequacy framework.

1.2.2. Internal data

13. Internally generated operational risk measures shall be based on a minimum historical observation period of five years. When a credit institution first moves to an Advanced Measurement Approach, a three-year historical observation period is acceptable.

14. Credit institutions must be able to map their historical internal loss data into the business lines defined in Part 2 and into the event types defined in Part 5, and to provide these data to competent authorities upon request. There must be documented, objective criteria for allocating losses to the specified business lines and event types. The operational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the operational risk charge, as long as they continue to be treated as credit risk for the purposes of calculating minimum capital requirements. Operational risk losses that are related to market risks shall be included in the scope of the capital requirement for operational risk.

15. The credit institution's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. Credit institutions must be able to justify that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. Appropriate minimum loss thresholds for internal loss data collection must be defined.

16. Aside from information on gross loss amounts, credit institutions shall collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event.

17. There shall be specific criteria for assigning loss data arising from an event in a centralised function or an activity that spans more than one business line, as well as from related events over time.

18. Credit institutions must have documented procedures for assessing the on-going relevance of historical loss data, including those situations in which judgement overrides, scaling, or other adjustments may be used, to what extent they may be used and who is authorised to make such decisions.

1.2.3. External data

19. The credit institution's operational risk measurement system shall use relevant external data, especially when there is reason to believe that the credit institution is exposed to infrequent, yet potentially severe, losses. A credit institution must have a systematic process for determining the situations for which external data must be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use must be regularly reviewed, documented and subject to periodic independent review.

1.2.4. Scenario analysis

20. The credit institution shall use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments need to be validated and re-assessed through comparison to actual loss experience to ensure their reasonableness.

1.2.5. Business environment and internal control factors

21. The credit institution's firm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile.

22. The choice of each factor needs to be justified as a meaningful driver of risk, based on experience and involving the expert judgment of the affected business areas.

23. The sensitivity of risk estimates to changes in the factors and the relative weighting of the various factors need to be well reasoned. In addition to capturing changes in risk due to improvements in risk controls, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume.

24. This framework must be documented and subject to independent review within the credit institution and by competent authorities. Over time, the process and the outcomes need to be validated and re-assessed through comparison to actual internal loss experience and relevant external data.

2. IMPACT OF INSURANCE AND OTHER RISK TRANSFER MECHANISMS

25. Credit institutions shall be able to recognise the impact of insurance subject to the conditions set out in points 26 to 29 and other risk transfer mechanisms where the credit institution can demonstrate to the satisfaction of the competent authorities that a noticeable risk mitigating effect is achieved.

26. The provider is authorised to provide insurance or re-insurance and the provider has a minimum claims paying ability rating by an eligible ECAI which has been determined by the competent authority to be associated with credit quality step 3 or above under the rules for the risk weighting of exposures to credit institutions under Articles 78 to 83.

27. The insurance and the credit institutions' insurance framework shall meet the following conditions:

(a)

the insurance policy must have an initial term of no less than one year. For policies with a residual term of less than one year, the credit institution must make appropriate haircuts reflecting the declining residual term of the policy, up to a full 100 % haircut for policies with a residual term of 90 days or less;

(b)

the insurance policy has a minimum notice period for cancellation of the contract of 90 days;

(c)

the insurance policy has no exclusions or limitations triggered by supervisory actions or, in the case of a failed credit institution, that preclude the credit institution receiver or liquidator, from recovering for damages suffered or expenses incurred by the credit institution, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the credit institution; provided that the insurance policy may exclude any fine, penalty, or punitive damages resulting from actions by the competent authorities;

(d)

the risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of operational risk capital;

(e)

the insurance is provided by a third party entity. In the case of insurance through captives and affiliates, the exposure has to be laid off to an independent third party entity, for example through re-insurance, that meets the eligibility criteria; and

(f)

the framework for recognising insurance is well reasoned and documented.

28. The methodology for recognising insurance shall capture the following elements through discounts or haircuts in the amount of insurance recognition:

(a)

the residual term of an insurance policy, where less than one year, as noted above;

(b)

a policy's cancellation terms, where less than one year; and

(c)

the uncertainty of payment as well as mismatches in coverage of insurance policies.

29. The capital alleviation arising from the recognition of insurance shall not exceed 20 % of the capital requirement for operational risk before the recognition of risk‐mitigation techniques.

3. APPLICATION TO USE AN ADVANCED MEASUREMENT APPROACH ON A GROUP-WIDE BASIS

30. When an Advanced Measurement Approach is intended to be used by the EU parent credit institution and its subsidiaries, or by the subsidiaries of an EU parent financial holding company, the application shall include a description of the methodology used for allocating operational risk capital between the different entities of the group.

31. The application shall indicate whether and how diversification effects are intended to be factored in the risk measurement system.

PART 4 Combined use of different methodologies

1. USE OF AN ADVANCED MEASUREMENT APPROACH IN COMBINATION WITH OTHER APPROACHES

1. A credit institution may use an Advanced Measurement Approach in combination with either the Basic Indicator Approach or the Standardised Approach, subject to the following conditions:

(a)

all operational risks of the credit institution are captured. The competent authority shall be satisfied with the methodology used to cover different activities, geographical locations, legal structures or other relevant divisions determined on an internal basis; and

(b)

the qualifying criteria set out in Parts 2 and 3 are fulfilled for the Part of activities covered by the Standardised Approach and Advanced Measurement Approaches respectively.

2. On a case-by case basis, the competent authority may impose the following additional conditions:

(a)

on the date of implementation of an Advanced Measurement Approach, a significant part of the credit institution's operational risks are captured by the Advanced Measurement Approach; and

(b)

the credit institution takes a commitment to roll out the Advanced Measurement Approach across a material Part of its operations within a time schedule agreed with its competent authorities.

2. COMBINED USE OF THE BASIC INDICATOR APPROACH AND OF THE STANDARDISED APPROACH

3. A credit institution may use a combination of the Basic Indicator Approach and the Standardised Approach only in exceptional circumstances such as the recent acquisition of new business which may require a transition period for the roll out of the Standardised Approach.

4. The combined use of the Basic Indicator Approach and the Standardised Approach shall be conditional upon a commitment by the credit institution to roll out the Standardised Approach within a time schedule agreed with the competent authorities.

PART 5 Loss event type classification

Table 3

Event-Type Category	Definition
Internal fraud	Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/discrimination events, which involves at least one internal party
External fraud	Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party
Employment Practices and Workplace Safety	Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events
Clients, Products & Business Practices	Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product
Damage to Physical Assets	Losses arising from loss or damage to physical assets from natural disaster or other events
Business disruption and system failures	Losses arising from disruption of business or system failures
Execution, Delivery & Process Management	Losses from failed transaction processing or process management, from relations with trade counterparties and vendors