CAPITAL REQUIREMENTS The Operational Framework under a Retail Perspective

by Niclas Hageback asel II’s double-counting rule may reduce the AMA capital charge for retail more than the regulators have expect- Bed. The purpose of this article is to encourage retail banks to better analyze their pool of loss data through a PD/LGD/EAD filter to help find the actual ratio between pure losses and credit-related operational risk losses. The goal is to be in a better position to decide on a capital approach and to take a more holistic view on operational risk and mitigants.

n analysis of pools of risk-related contents, the larg- charge based on three different operational risk loss data er part of the operational risk calculation methodologies: 1) the A has shown that a consider- losses that would form the ; 2) the able number of retail-banking- basis of the historical loss dis- Standardized Approach; and 3) related operational risk losses tribution and the scenario the AMA. affect the credit risk capital analysis calculation under The two first methodologies charge. You might ask, “So what?” AMA are excluded. are based on the assumption that According to Basel II, such losses 2. From a practical point of view, operational risk correlates with should be excluded from the oper- it makes sense for a retail the size of the financial institu- ational risk capital calculation to closely coordinate and tion; the only way to lower the under the Advanced Measurement integrate the credit risk man- capital charge is by lowering the Approach (AMA) to avoid “double agement and operational risk size of gross income, which is a counting.” Hence, a bank with a management functions, as perverse incentive for managing retail-related focus needs to be operational risk mitigants can the risk-reward relationship. AMA very aware of two points: play an important part in assumes that the level of capital 1. From a regulatory capital reducing credit risk losses. should reflect the existing risk point of view, it is possible exposures; thus, line managers that substantial savings can be The Basel II Effect have added incentives to optimize achieved if a retail bank opts Basel II introduces opera- controls and mitigants. for AMA instead of the tional risk as a separate risk cate- A few key constraints Standardized Approach. This gory with a dedicated framework notwithstanding, AMA is a free- is because, given their credit- that includes a regulatory capital modelling approach. Some of

© 2005 by RMA. Niclas Hageback is a director in KPMG Asia Pacific’s Financial Services Group in Taiwan.

64 The RMA Journal June 2005 The Operational Risk Framework under a Retail Perspective these constraints refer to how cer- This can, for example, be due ter can be developed as depicted tain data, such as internal loss to external fraud or errors in in Figure 1. data, is used. Basel II requires the rating model, through When trying to apply the operational risk losses to be cate- human, system, or process PD/EAD/LGD filter on the QIS2 gorized in eight business lines errors. pool of loss data, we can use the (including retail banking) and • (EAD)— categorization by loss event types seven types of loss events. operational risk cause(s) lead- as a crude divider. When examin- When operational risk losses ing to the reduction of the ing the types, we realize that some have been collated, analyzed, and loan amount. This could typi- are more likely than others to classified accordingly, certain cally be due to fraud or negli- affect the credit risk parameters. types, such as collateral manage- gence or errors in adhering to For example: ment failures, are likely to relate limits and account manage- • Internal fraud. to credit risk. To avoid a double ment. • External fraud. counting of these losses in the reg- • (LGD)— • Employment practices and ulatory capital charge calculation, operational risk cause(s) lead- workplace safety. Basel II stipulates that such losses ing to a lower-than-expected • Clients, products, and busi- will be excluded from the opera- value of collaterals that can be ness practices. tional risk capital charge and only triggered by events such as • Damage to physical assets. be part of the credit risk capital fraud, management, or • Business disruption and sys- charge. process failures. tem failure. After determining the param- • Execution, delivery, and Analyzing Operational Risk eters that will trigger an impact on process management. Losses the credit risk capital charge, a fil- The larger part of the “exter- The Basel Committee con- ducted an operational risk loss Figure 1 data collection exercise referred to Operational risk loss as QIS2— The Quantitative Impact with established financial impact. Study 2—The 2002 Loss Data Collection Exercise for Operational Did the loss occur in No Did the loss Risk . Eighty-nine banks participat- association with the lending cause the No Loss will impact and/or counterparty approval ed globally, and 47,269 losses were default of a PD. Exclude process? Yes counterparty? from OpRisk recorded and then categorized by Yes capital business line and loss event type. calculation. Pinpointing and segregating the operational-risk-related credit Did the loss Did the loss occur in No losses from the QIS2 loss data association with the account cause a No Loss will impact procedures and limit settings? reduction of EAD. Exclude pool require some assumptions Yes the loan from OpRisk about the characteristics of these exposure? Yes capital types of losses. First, it’s necessary calculation. to break down the credit risk Did the loss occur in association with the No Did the loss model into its risk parameters to Loss will collateral valuation and/or cause a No impact LGD. better understand how operational collateral management reduction in Yes Exclude from process? the collateral risk losses might affect the credit Yes OpRisk capital value? risk capital charge. These parame- calculation. ters include: • (PD)— The loss is most likely a “pure” operational risk loss; however, investigate any potential operational risk cause(s) lead- impact on the other credit risk modeling ing to a counterparty default. parameters.

65 The Operational Risk Framework under a Retail Perspective nal fraud” loss event type—with not lend itself to a more granular such losses should be included in the possible exception of bank rob- analysis, given the level of details the AMA capital calculation as well beries—could affect any of the recorded during the collation as in the value-at-risk calculation credit risk parameters. The same phase. The uncertain assumptions for . Theoretically, this goes for “execution, delivery, and concerning the allocation of loss might be viewed as an inconsisten- process management,” where a event types make us cautious cy because it constitutes a clear majority of failures in retail-related about drawing any conclusions. case of double counting. Why, processes—such as the underwrit- However, just a macro-level then, aren’t these losses excluded ing, servicing, and closing of review of the numbers indicates as well? The likely reason is that accounts—will affect PD, EAD, or that a large part of retail bank the impact of these types of losses LGD. For the other loss event operational risk losses might have on the market risk capital charge is types, any conclusive statements to be excluded from the AMA brief because of the short time are difficult to make. “Employ- capital calculation. span of included data; the burden ment practices and workplace safe- For a retail bank aiming to of going through the exercise of ty” is probably the only definitive properly configure the ratio excluding them from the opera- exclusion from any impact on the between “pure” operational risk tional risk charge has not been con- credit risk charge. (See Figure 2.) losses and operational risk losses sidered worthwhile. Let’s establish a rough esti- belonging in the credit risk capital mate of the percentage of retail charge, further dimensions need Practical Implications for Retail bank operational risk losses that to be included, such as capturing Banks could be excluded from the AMA the process in which the loss took AMA versus Standardized calculation given their credit risk place. This analysis should be Approach. Estimating the capital capital impact. We’ll assume that conducted at the individual loss charge by using the Standardized up to 100% of “external fraud” and level to ensure accuracy. Approach or the Alternative “execution, delivery, and process Even if this study focused Standardized Approach is fairly management” and 0% of other loss solely on the retail banking busi- uncomplicated: a size proxy multi- event types can be allocated to the ness line, a reasonable hypothesis plied with an externally given credit risk charge. We then arrive is that a similar analogy could be multiplier. at the following numbers: drawn for the commercial banking On the other hand, the • With regard to “total gross business line, because strong links approximation of the AMA capital loss amounts,” 53% of the between operational and credit risk hinges on a number of factors and losses need to be excluded. losses should exist there as well. is not a straightforward process. • With regard to “number of Is there a corresponding appli- The bank’s historical internal losses,” 77% of the losses cation for operational-risk-related operational risk losses are a key need to be excluded. market risk losses? The answer is driver behind the AMA capital Unfortunately, the data does no, because Basel II prescribes that charge. All else being equal,

Figure 2 Total Gross Loss Amounts (euros, millions) Employment, Clients, Products Damage to Business Execution, No Event Business Line Internal External Practices & & Business Physical Disruption & Delivery & Process Type Fraud Fraud Workplace Safety Practices Assets System Failures Management Information Total Retail Banking 331.9 787.1 340.0 254.1 87.5 26.5 424.5 37.4 2,289 % Retail Banking 14% 34% 15% 11% 4% 1% 19% 2% 100% Number of Individual Losses Employment, Clients, Products Damage to Business Execution, No Event Business Line Internal External Practices & & Business Physical Disruption & Delivery & Process Type Fraud Fraud Workplace Safety Practices Assets System Failures Management Information Total Retail Banking 1,268.0 17,107.0 2,063.0 2,125.0 520.0 163.0 5,289.0 347.0 28,882 % Retail Banking 4%% 59%% 7% 7% 2% 1% 18% 1% 100% Source: The 2002 Loss Data Collection Exercise for Operational Risk, The Basel Committee on Banking Supervision.

66 The RMA Journal June 2005