Revised Operational Risk Capital Framework

Home , Basel II, Basic indicator approach

March 2016

kpmg.com Introduction

The Basel Committee on Banking Supervision (BCBS) The BCBS has published a further consultation on operational are proposing to scrap internal modelling of operational risk capital measurement. This risk capital in an attempt to introduce simplicity and confirms the withdrawal of the comparability across banks. Banks will welcome this internal modelling‑based Advanced Measurement Approach (AMA), and clarity in an area that has been under review for many proposes to replace all of the Basel years but concerns will remain around increased capital II approaches to operational risk with costs, additional data and disclosure burdens, good risk a single revised Business Indicator (BI) approach – the Standardised management incentivisation, national application and Measurement Approach (SMA). global consistency. Responses should be submitted by 3 June 2016.

The BCBS has also published a consultation paper on revised Pillar 3 disclosure requirements, including Summary amendments relating to operational risk. These include revising disclosures The proposed SMA combines a view of the BCBS that the inherent to meet the newly proposed SMA, revised version of the BI approach complexity of the AMA and the lack additional disclosures of internal (which the BCBS first consulted on of comparability arising from a wide losses, and more detailed information in 2014) with some recognition of range of internal modelling practices relating to a bank’s operational risk bank‑specific loss data. The BCBS has exacerbated the variability in management framework. Responses sees this as a way of introducing risk‑weighted asset calculations should be submitted by 10 June 2016. a degree of risk‑sensitivity, which across banks using the AMA and provides some incentive for banks eroded confidence in risk‑weighted These are both part of a wider picture to improve their operational risk capital ratios. covering all the components of the management, while simplifying denominator of the capital ratio – the the approach. Banks with low The BCBS states that the objective BCBS has already published its revised operational risk losses will benefit of these proposals is not to market risk framework, while revisions from a lower operational risk increase significantly overall capital to the capital treatment of credit risk regulatory capital charge – although requirements. However, this is not and the introduction of a capital floor are this will not apply to small banks. a ‘one size fits all’ proposal, and both due to be finalised by the end of the impact will vary from bank to 2016. It is clear that apparently technical The removal of the internal bank and will lead to an increase in papers will continue to shape business modelling approach for operational minimum capital requirements for model and strategy. risk regulatory capital reflects the some institutions.

Banks will welcome greater certainty in an area that has been under review for many years, notably the revisions to the BI approach in response to comments on the 2014 proposals, and the recognition of bank‑specific loss data. However, some concerns are likely to remain:

Capital Data and systems Incentives for good Disclosure operational risk management

Analysis of the 2014 proposals The data requirements for The introduction of an internal The enhanced Pillar 3 disclosure showed that some global calculating internal loss loss component will provide requirements will require banks banks could face increases of experience and the proposed some regulatory incentive for to detail how they manage their up to 70 percent of their Pillar 1 disclosure requirements will firms to reduce their operational operational risks as well as their operational risk capital charges. impose an additional burden risk losses. However, this loss history. The latest proposals should on some banks. Banks not element of risk‑sensitivity is have a smaller impact, but this currently using the AMA will limited to past losses, and does could still be significant for have to put the necessary not include the three other key some banks. The overall impact systems and processes in place elements of the AMA, namely will also depend on how the to collect, analyse, and report the external data, forward‑looking proposed new Pillar 1 approach required data; while even banks scenario analysis information, interfaces with Pillar 2 capital currently adopting AMA may and the business environment requirements – banks that can have to revise their systems and and internal control factors demonstrate good internal processes to deliver the required (BEICF) data (even if these modelling and strong operational calculations and disclosures. elements were difficult to apply risk systems and controls could consistently across banks under potentially gain a partial offset to the AMA). The Pillar 2 capital higher Pillar 1 requirements. framework is used as a tool by some regulators to encourage enhanced risk management across banks. As an example in the UK, the PRA has issued standard methodologies for assessing Pillar 2 operational risk capital, taking into account internal data, forecast losses and scenario analysis. However, it remains to be seen how this will be applied by supervisors and how consistently this will be used globally.

Operational risk management and measurement has been a key regulatory focus given the number of significant loss incidents across banking in recent years, which banks have failed to prevent or hold sufficient capital against. For example, the PRA has recently published new standards for Pillar 2 operational risk measurement in the UK, while the EBA has included operational risk in its 2016 EU‑wide stress test exercise.

The BCBS consultation proposes a The revised BI approach also addresses The concerns previously highlighted new Standardised Measurement some of the comments received on the in relation to the BI components Approach (SMA) that revises the earlier proposal by reducing differences introduced in the previous 2014 Business Indicator (BI) approach in the treatment of the “distribute proposal are summarised in (proposed in 2014) and combines it with only” and the “originate to distribute” Table 1 below, along with the some recognition of a bank’s internal business models, under which banks corresponding changes proposed in loss data (for medium and large sized that originate products would have faced the new consultation. A comparison banks), thereby introducing a degree a lower operational risk charge; reducing of the calculations of each of the BI of risk‑sensitivity and providing some the inconsistent treatment of dividend components across the different rules incentive for banks to improve their income across jurisdictions; reducing or proposals (i.e. Gross Income (Basel operational risk management. Banks the impact of high net interest margins II), 2014 BI proposal, and latest BI with more effective risk management and high fee revenues and expenses in proposal) follows in Table 2. and lower operational risk losses will be inflating the operational risk charge; and required to hold a comparatively lower taking a more consistent approach to operational risk regulatory capital charge. the treatment of leasing compared with Banks that do not meet the minimum credit. In addition, the BI operational risk data quality standards will be penalised charge has been made more linear in the with a higher capital charge. way it applies to banks of different sizes.

Table 1: Concerns highlighted in relation to the BI components introduced in the 2014 proposal and corresponding proposed changes in the new consultation

BI Component Concern of previous Description of concern raised in Proposed changes in the new consultation Impacted proposal previous proposal Interest Inconsistency in the The treatment of dividend income in financial Dividend income has been included in the interest component treatment of dividend statements varies significantly across jurisdictions component of the BI. income leading to inconsistencies in the BI across banks, e.g. some banks include dividend income within the interest component. Interest Overcapitalisation of Banks with high NIM (Net Interest Income/ A linear normalisation ratio for high‑margin component banks with a high net Interest‑earning Assets) have high BI values leading banks (larger than 3.5%) is adopted. The Interest interest margin (NIM) to over‑conservative regulatory capital. component is adjusted by the ratio of the NIM cap, set to 3.5%, to the actual NIM. Interest Inconsistent treatment Business models based on credit finance, financial To ensure consistency across banks and component of leasing compared leasing or operating leasing face similar operational jurisdictions, all financial and operating lease income with credit risks, therefore the contributions of income and and expenses are netted and then included in expenses from financial and operating lease to the absolute value into the interest component (i.e. the BI should be consistent with the contribution of absolute value of average lease income over the credit finance, irrespective of accounting treatment. three years less average lease expense over the three years). Services Asymmetric impact The former definition of the services component The services component is changed from the sum component on the ‘distribute only’ meant that banks distributing products bought from of fee income, fee expense, other operating income and the ‘originate to third parties would include both the fee income and and other operating expenses, to the maximum of distribute’ business fee expense, thereby leading to higher capital than fee income and fee expense, plus the maximum models banks producing the products themselves who of other operating income and other operating would include only fee income, even though both expense. banks face similar operational risks. Services Overcapitalisation of Banks with a high fee component produces very The BI for high fee banks (i.e. share of fees greater component banks with high fee high BI values, resulting in over‑conservative than 50% of unadjusted BI) is modified by accounting revenues and expenses regulatory capital. for only 10% of fees in excess of 50% of the unadjusted BI (with absolute value of net fee income as a floor to avoid unintended capital reductions). Source: KPMG International, March 2016

BI Component Gross Income Business Indicator Business Indicator Impacted (Basel II) (2014 Consultation) (2016 Consultation) Interest Interest Income Abs (Interest Income – Interest Expense) Min [ Abs (Interest Income – Interest Expense); Component – Interest Expense 0.035 x Interest Earning Assets ] (ILDC) + Abs (Lease Interest – Lease Expense) + Dividend Income Services Fee Income Fee Income Max (Other Operating Income; Other Operating Component – Fee Expense + Fee Expense Expense) (SC) + Other Operating + Other Operating Income + Max{ Abs(Fee Income – Fee Expense); Income + Other Operating Expense Min [ Max (Fee Income; Fee Expense); 0.5 * uBI + 0.1 * Max (Fee Income – Fee Expense) – 0.5 * uBI ]}

Where uBI = Interest Component + Max (Other Operating Income; Other Operating Expense) + Max (Fee Income; Fee Expense) + Financial Component Financial Net P&L on Trading Abs (Net P&L on Trading Book) Abs (Net P&L on Trading Book) Component (FC) Book + Abs (Net P&L on Banking Book) + Abs (Net P&L on Banking Book) Other Dividend Income Not included Dividend income included in interest component

Source: KPMG International, March 2016

Under the new approach, banks are Table 3: BI component in the 2016 consultation divided into five ‘buckets’ based on the value of the BI, as defined in Table 3 BI Range BI Component The 2014 proposal introduced below. For banks that fall within the first a set of escalating coefficients 1. €0 to €1bn 0.11*BI bucket, with BI of less than €1 billion, based on the size of the bank 2. €1bn to €3bn €110m + 0.15(BI – €1bn) the operational risk capital charge would as reflected in the BI, assuming be an increasing linear function of the BI 3. €3bn to €10bn €410m + 0.19(BI – €3bn) that the relationship between and would not take into account internal 4. €10bn to €30bn €1.74bn + 0.23(BI – €10bn) operational risk exposure and losses. For banks in buckets 2 through 5. €30bn and above €6.34bn + 0.29(BI – €30bn) size increases in a non‑linear 5, the capital is calculated in two steps: fashion. To keep the framework Source: BCBS Consultative Document: Standardised 1. A baseline level of capital is Measurement Approach for operational risk, March 2016 simple, a discrete structure for calculated using the BI component. the coefficients was proposed, Table 4: Proposed coefficients per bucket under the as per Table 4. Under the 2. A portion of the BI component above 2014 proposal new proposals, the BI €1 billion is multiplied by an ‘internal component increases linearly loss multiplier’ which is based on an BI (€ Millions) Coefficient within buckets, however the internal loss component to take into marginal effect of the BI on 1. 0–100 [10%] account the different risk profiles the BI component increases 2. >100–1,000 [13%] of banks, thereby introducing risk progressively the higher the sensitivity in the approach. The 3. >1,000–3,000 [17%] bucket. Specifically, the unit consultation paper proposes one 4. >3000–30,000 [22%] increase in the BI relates to way of introducing risk sensitivity, 5. >30,000 [30%] a marginal increase of 0.11, while seeking views on alternative 0.15, 0.19, 0.23 and 0.29 Source: BCBS Consultative Document: Standardised approaches. Measurement Approach for operational risk, March 2016 under buckets 1, 2, 3, 4 and 5 respectively.

200%

150%

100%

50%

0% 1 2 3 4 5 BI Buckets

SMA (Loss Comp = 0.5 x BI Comp) SMA (Loss Comp = BI Comp) SMA (Loss Comp = 2 x BI Comp) SMA (Loss Comp = 4 x BI Comp) SMA (Loss Comp = 6 x BI Comp)

Source: KPMG International, March 2016

The internal loss component reflects Minimum data standards would In addition to the minimum data the operational loss exposure of a bank therefore include: standards, the proposed Pillar 3 that can be inferred from its internal disclosure requirements would mean loss experience. The loss component • A minimum of 5‑10 years of internal banks also need to capture and report: distinguishes between loss events loss data (ILD). above €10 million, above €100 million, • Documented procedures and • The value of the business indicator/ and smaller loss events, to differentiate processes for the identification, subcomponent drivers of the SMA between banks with different loss collection and treatment of ILD. calculation for the last 3 years (i.e. interest, services, financial). distribution tails but similar average loss • Mapping of ILD to relevant totals. Banks would be required to use Basel categories and criteria for • Their internal losses for the last 3 10 years of good‑quality loss data to allocating losses. years (including the number of losses calculate the averages used in the loss over €1m, the total amount of losses • A minimum threshold of €10,000 for component. In the transition period, over €1m, and the total of the 5 capturing ILD. banks that do not have 10 years of good largest losses). • Specific loss data information such quality loss data may use a minimum • The historical losses used for SMA as gross loss, recoveries, reference of 5 years of data to calculate the loss calculation split out over the last ten dates (date of occurrence, discovery component. years (total amount and total amount and accounting), drivers and causes. over €1m), for banks in buckets 2‑5 • Specific criteria for assigning loss using internal losses. data arising from an event in a centralised function. • The treatment of boundary events.

• Policies and procedures for including ILD in the calculation dataset.

© 2016 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Printed in the United Kingdom. There is an inherent possibility of an Table 3: Significant policy changes or consultations regarding operational risk modelling extreme event occurring that would not be commercially viable to hold capital Provide clearer supervisory Enhance regulatory against. Arguably, the best approach to guidance relating to harmonisation in the banking governance, data and sector across the European managing risks of this nature is to ensure modelling, to assist the maturity Union by establishing of AMA organisations’ common standards for the BCBS BCBS that robust processes are in place around operational risk management assessment methodology for BCBS Revisions to Standardised and measurement practices all AMA approved banks scenario analysis and horizon scanning, Basel II the Simpler Measurement Approaches Approach and that effective but realistic contingency JUNE 2011 JUNE 2015 plans are in place as required – something which should be part of good risk JUNE 2004 OCT 2014 MAR 2016 management within the business. EB A Set out the framework of BCBS Introduced the Revised Introduced the Regulatory the three approaches to Supervisory Standardised Approach (RSA) Standardised Measurement Technical modelling the minimum Guidelines which aimed to simplify BIA Approach (SMA) aiming to The management and measurement Standards-use capital requirements for for AMA and TS A to allow more build on the simplicity and of AMA of operational risk has been a key operational risk (BIA, TS A comparability between consistency offered by the and AMA); which organisations using the standardised approach as regulatory focus for a number of years introduce increasing approach and give a more well as improve risk given the number of significant loss levels of sophistication accurate reﬂection of the sensitivity by incorporating and risk-sensitivity operational risk inherent within internal loss data incidents across the banking sector, a bank which banks have failed to prevent or Source: KPMG International, March 2016 hold sufficient capital against. Figure 3 shows a timeline overview of regulatory activity for operational risk.

Basel II current approaches for Figure 4: Basel II approaches to calculating operational risk capital calculating operational risk capital The three existing approaches – BIA, TSA and AMA – have features which introduce increasing levels of sophistication and risk‑sensitivity. Internationally active banks and banks with significant operational risk exposures were Basic Indicator Advanced Measurement Approach (AMA) expected to use an approach that is more Approach (BIA) • Not risk‑sensitive • Risk‑sensitive sophisticated and that is appropriate • Based on 15% gross • Involves complex, for the risk profile of the institution. income statistical models • No standard method; Banks were encouraged to move along The Standardised allow for flexibility the spectrum of available approaches Approach (TSA) as they developed more sophisticated • Not risk‑sensitive • Based on weighted operational risk measurement and precentage of gross management systems and practices. income per business line

The three existing approaches to Source: KPMG International, calculation operational risk capital are March 2016 summarised in Figure 4.

The Basic Indicator Approach (BIA) For both the BIA and TSA, gross income account the bank’s historical operational Under the BIA, banks are required to hold is used as a broad indicator that serves risk loss data, external operational capital for operational risk equal to the as a proxy for the scale of business risk loss data (from sources such as average over the previous three years of a operations as it is assumed that a bank’s ORX), forward‑looking operational risk fixed percentage (15%) of positive annual exposure to operational risk is linearly scenarios, as well as the bank’s Business gross income (GI). related to the size of the bank’s revenue. Environment and Internal Control Factors. These approaches do not take into While this approach is risk‑sensitive, The Standardised Approach (TSA) account the management of operational incorporating the operational risk TSA is simply an extension to the BIA that risk within the business and therefore are environment of the bank, it has obtained allows banks to divide their activities into not considered to be risk‑sensitive. a reputation for being both too complex eight business lines and apply a weight to and too reliant on statistical models. The Advanced Measurement each of these business lines. The capital In order to become AMA approved, Approach (AMA) charge for each business line is calculated banks must be able to demonstrate by multiplying gross income by a factor The three existing approaches – BIA, TSA that they have in place a robust risk assigned to that business line. The factor The AMA allows banks to calculate the management framework. (known as the beta‑factor) ranges from regulatory capital requirement equal to 12% to 18% depending on the business the risk measure generated by the bank’s line. A negative GI for a business line may internal operational risk measurement be included, but a total GI for any given system using quantitative and qualitative year that is negative must be set to zero. criteria. This approach takes into

Lisa Afonso Manager, Operational Risk E: [email protected]

kpmg.com/socialmedia kpmg.com/app

© 2016 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis‑à‑vis third parties, nor does KPMG International have any such authority to obligate or bind any member firm. All rights reserved.

Create Graphics | CRT058776 | March 2016