Directive 2006/48/EC of the European Parliament and of the council (repealed)Show full title

PART 3 U.K. Advanced Measurement Approaches

1. QUALIFYING CRITERIA U.K.

1. To be eligible for an Advanced Measurement Approach, credit institutions must satisfy the competent authorities that they meet the qualifying criteria below, in addition to the general risk management standards in Article 22 and Annex V. U.K.

1.1. Qualitative Standards U.K.

2. The credit institution's internal operational risk measurement system shall be closely integrated into its day-to-day risk management processes. U.K.

3. The credit institution must have an independent risk management function for operational risk. U.K.

4. There must be regular reporting of operational risk exposures and loss experience. The credit institution shall have procedures for taking appropriate corrective action. U.K.

5. The credit institution's risk management system must be well documented. The credit institution shall have routines in place for ensuring compliance and policies for the treatment of non-compliance. U.K.

6. The operational risk management processes and measurement systems shall be subject to regular reviews performed by internal and/or external auditors. U.K.

7. The validation of the operational risk measurement system by the competent authorities shall include the following elements: U.K.

(a)

verifying that the internal validation processes are operating in a satisfactory manner;

(b)

making sure that data flows and processes associated with the risk measurement system are transparent and accessible.

1.2. Quantitative Standards U.K.

1.2.1. Process U.K.

8. Credit institutions shall calculate their capital requirement as comprising both expected loss and unexpected loss, unless they can demonstrate that expected loss is adequately captured in their internal business practices. The operational risk measure must capture potentially severe tail events, achieving a soundness standard comparable to a 99,9 % confidence interval over a one year period. U.K.

9. The operational risk measurement system of a credit institution must have certain key elements to meet the soundness standard set out in point 8. These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in points 13 to 24. A credit institution needs to have a well documented approach for weighting the use of these four elements in its overall operational risk measurement system. U.K.

10. The risk measurement system shall capture the major drivers of risk affecting the shape of the tail of the loss estimates. U.K.

11. Correlations in operational risk losses across individual operational risk estimates may be recognised only if credit institutions can demonstrate to the satisfaction of the competent authorities that their systems for measuring correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress. The credit institution must validate its correlation assumptions using appropriate quantitative and qualitative techniques. U.K.

12. The risk measurement system shall be internally consistent and shall avoid the multiple counting of qualitative assessments or risk mitigation techniques recognised in other areas of the capital adequacy framework. U.K.

1.2.2. Internal data U.K.

13. Internally generated operational risk measures shall be based on a minimum historical observation period of five years. When a credit institution first moves to an Advanced Measurement Approach, a three-year historical observation period is acceptable. U.K.

14. Credit institutions must be able to map their historical internal loss data into the business lines defined in Part 2 and into the event types defined in Part 5, and to provide these data to competent authorities upon request. There must be documented, objective criteria for allocating losses to the specified business lines and event types. The operational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the operational risk charge, as long as they continue to be treated as credit risk for the purposes of calculating minimum capital requirements. Operational risk losses that are related to market risks shall be included in the scope of the capital requirement for operational risk. U.K.

15. The credit institution's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. Credit institutions must be able to justify that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. Appropriate minimum loss thresholds for internal loss data collection must be defined. U.K.

16. Aside from information on gross loss amounts, credit institutions shall collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event. U.K.

17. There shall be specific criteria for assigning loss data arising from an event in a centralised function or an activity that spans more than one business line, as well as from related events over time. U.K.

18. Credit institutions must have documented procedures for assessing the on-going relevance of historical loss data, including those situations in which judgement overrides, scaling, or other adjustments may be used, to what extent they may be used and who is authorised to make such decisions. U.K.

1.2.3. External data U.K.

19. The credit institution's operational risk measurement system shall use relevant external data, especially when there is reason to believe that the credit institution is exposed to infrequent, yet potentially severe, losses. A credit institution must have a systematic process for determining the situations for which external data must be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use must be regularly reviewed, documented and subject to periodic independent review. U.K.

1.2.4. Scenario analysis U.K.

20. The credit institution shall use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments need to be validated and re-assessed through comparison to actual loss experience to ensure their reasonableness. U.K.

1.2.5. Business environment and internal control factors U.K.

21. The credit institution's firm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile. U.K.

22. The choice of each factor needs to be justified as a meaningful driver of risk, based on experience and involving the expert judgment of the affected business areas. U.K.

23. The sensitivity of risk estimates to changes in the factors and the relative weighting of the various factors need to be well reasoned. In addition to capturing changes in risk due to improvements in risk controls, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume. U.K.

24. This framework must be documented and subject to independent review within the credit institution and by competent authorities. Over time, the process and the outcomes need to be validated and re-assessed through comparison to actual internal loss experience and relevant external data. U.K.

2. IMPACT OF INSURANCE AND OTHER RISK TRANSFER MECHANISMS U.K.

25. Credit institutions shall be able to recognise the impact of insurance subject to the conditions set out in points 26 to 29 and other risk transfer mechanisms where the credit institution can demonstrate to the satisfaction of the competent authorities that a noticeable risk mitigating effect is achieved. U.K.

26. The provider is authorised to provide insurance or re-insurance and the provider has a minimum claims paying ability rating by an eligible ECAI which has been determined by the competent authority to be associated with credit quality step 3 or above under the rules for the risk weighting of exposures to credit institutions under Articles 78 to 83. U.K.

27. The insurance and the credit institutions' insurance framework shall meet the following conditions: U.K.

(a)

the insurance policy must have an initial term of no less than one year. For policies with a residual term of less than one year, the credit institution must make appropriate haircuts reflecting the declining residual term of the policy, up to a full 100 % haircut for policies with a residual term of 90 days or less;

(b)

the insurance policy has a minimum notice period for cancellation of the contract of 90 days;

(c)

the insurance policy has no exclusions or limitations triggered by supervisory actions or, in the case of a failed credit institution, that preclude the credit institution receiver or liquidator, from recovering for damages suffered or expenses incurred by the credit institution, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the credit institution; provided that the insurance policy may exclude any fine, penalty, or punitive damages resulting from actions by the competent authorities;

(d)

the risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of operational risk capital;

(e)

the insurance is provided by a third party entity. In the case of insurance through captives and affiliates, the exposure has to be laid off to an independent third party entity, for example through re-insurance, that meets the eligibility criteria; and

(f)

the framework for recognising insurance is well reasoned and documented.

28. The methodology for recognising insurance shall capture the following elements through discounts or haircuts in the amount of insurance recognition: U.K.

(a)

the residual term of an insurance policy, where less than one year, as noted above;

(b)

a policy's cancellation terms, where less than one year; and

(c)

the uncertainty of payment as well as mismatches in coverage of insurance policies.

29. The capital alleviation arising from the recognition of insurance shall not exceed 20 % of the capital requirement for operational risk before the recognition of risk‐mitigation techniques. U.K.

3. APPLICATION TO USE AN ADVANCED MEASUREMENT APPROACH ON A GROUP-WIDE BASIS U.K.

30. When an Advanced Measurement Approach is intended to be used by the EU parent credit institution and its subsidiaries, or by the subsidiaries of an EU parent financial holding company, the application shall include a description of the methodology used for allocating operational risk capital between the different entities of the group. U.K.

31. The application shall indicate whether and how diversification effects are intended to be factored in the risk measurement system. U.K.