Capital Requirements Directive IV Framework Operational Risk Allen & Overy Client Briefing Paper 13 | January 2014 www.allenovery.com 2 CRD IV Framework: Operational Risk | January 2014 CRD IV Framework: Operational Risk This briefing paper is part of a series of briefings on relevant to the in-house lawyer. This briefing is for the implementation of Basel III in Europe via the general guidance only and does not constitute Capital Requirements Directive IV1 (CRD IV) and definitive advice. the Capital Requirements Regulation2 (CRR), replacing the Banking Consolidation Directive3 and NOTE: In relation to the topics discussed in the Capital Adequacy Directive.4 The legislation is this briefing, the CRR contains a number of highly complex: these briefings are intended to discretions for member states in relation to provide a high-level overview of the architecture of national implementation. The regime may the regulatory capital and liquidity framework and therefore differ across member states in a to draw attention to the legal issues likely to be number of respects. 1 2013/36/EU. This briefing paper is based on information 2 Regulation 575/2013. 3 2006/48/EU. available as of 17 January 2014. 4 2006/49/EU. Background and scope Sources Basel II introduced a requirement for credit institutions CRD IV (Directive 2013/36/EU): Article 85. and investment firms to hold capital specifically to cover operational risk losses. Operational risk (defined CRR (Regulation 575/2013): Article 20, Article 95, as the risk of loss resulting from inadequate or failed Title III (Articles 312-324), Article 446, Article 454, internal processes, people and systems or from external Article 500, Recital (52). events, including legal risk) had not historically been subject to capital adequacy requirements. In Basel I, European Banking Authority (EBA)’s Guidelines on operational risk was implicitly covered through the the Advanced Measurement Approach (AMA) – treatment of credit and market risk. Extensions and Changes (January 2012). Pillar One of Basel II established hard capital Committee of European Banking Supervisors requirements for operational risk – the operational risk (CEBS)’ Guidelines on the management of capital requirement (ORCR). There are three operational risk in market-related activities approaches that may be taken to the measurement of (October 2010). operational risk capital: CEBS’ Guidelines on operational risk mitigation Basic indicator approach; techniques (December 2009). Standardised approach (or the alternative UK Financial Conduct Authority (FCA) Policy standardised approach); or Statement (PS13/10) CRD IV for Investment Firms (December 2013). An advanced measurement approach (AMA). © Allen & Overy LLP 2014 3 Background and scope (continued) Sources (continued) The basic indicator and standardised approaches use UK Prudential Regulation Authority (PRA) Policy percentages of net income associated with the relevant Statement (PS7/13) Strengthening capital standards: business as a proxy for operational risk. AMA uses implementing CRD IV, feedback and final rules more sophisticated means of establishing the (December 2013). operational risk requirement, and requires significant resources, and robust systems and controls, to PRA Supervisory Statement (SS14/13) Operational implement and maintain. AMA falls within the risk (December 2013) (the PRA Supervisory definition of “internal approaches” for the purposes of Statement in respect of Operational Risk). CRD IV. PRA Supervisory Statement (SS8/13) The Basel I The operational risk provisions of Basel II were floor (December 2013) (the PRA Supervisory implemented in the EEA via the Banking Consolidation Statement in respect of the Basel I Floor). Directive and Capital Adequacy Directive (together, the CRD) and in the UK through the SYSC5 and BIPRU6 modules of the FSA7 Handbook. Basel III does not involve substantive change to operational risk provisions but the way in which they are implemented in the European Union (the EU) has changed as they are now included in the directly applicable CRR. This has implications for the scope for and method of providing flexibility at national level (see “National discretions and UK implementation” below). 5 Senior Management Arrangements, Systems and Controls. 6 Prudential sourcebook for Banks, Building Societies and Investment Firms. 7 UK Financial Services Authority. www.allenovery.com 4 CRD IV Framework: Operational Risk | January 2014 Application The ORCR applies to credit institutions and full execution and portfolio management and which scope investment firms. may carry out the activities of reception/transmission of orders and/or The following limited scope investment firms are investment advice but which does not carry out not subject to the ORCR: the activities of dealing on own account, underwriting, placing financial instruments, (i) an investment firm that is not authorised to operation of multilateral trading facilities deal on own account or provide the investment (MTFs) or safekeeping and administration of services of underwriting or placing financial financial instruments for the account of clients instruments on a firm commitment basis; and and which is not permitted to hold client money or securities. (ii) an investment firm which is authorised to provide the investment services of client order © Allen & Overy LLP 2014 5 Basic indicator approach The simplest method of calculating the ORCR is subsidiary of a parent which is also the parent of the the basic indicator approach. A firm must use this credit institution/investment firm); or which is approach if it does not, or is not permitted to, use subject to rules under, or equivalent to, the CRR. another approach. The ORCR under the basic Fees paid for outsourcing must be included in indicator approach is equal to 15% of the average operating expenses (and so not deducted from the over three years of the “relevant indicator”. The relevant indicator) when the conditions above are relevant indicator is the sum of a firm’s net interest not met. income and its net non-interest income. Income from a participation held in an undertaking by the A firm that does not have sufficient income data to firm or a subsidiary undertaking of the firm should meet the three-year requirement (eg a start-up) may not be included in the relevant indicator calculations, use its forecasted gross income projections for all or to ensure that intra-group dividends and other intra- part of the three year time period when calculating group income flows are not double counted. its relevant indicator. The following elements must not be used in the If a firm can prove to its regulator that, due to a calculation of the relevant indicator: merger, an acquisition or a disposal of entities or activities, using a three year average to calculate the (i) realised profits/losses from the sale of non- relevant indicator would lead to a biased estimation trading book items; of its ORCR, the regulator may permit it to amend the calculation to take account of such events. The (ii) income from extraordinary or irregular items; regulator must inform the EBA of its decision. The and regulator may also, on its own initiative, require a firm to amend its calculation in such circumstances. (iii) income derived from insurance. A firm calculating its ORCR using the basic The relevant indicator for the basic indicator indicator approach is required to meet the general approach must be calculated before the deduction risk management standards in CRD IV. These of any provisions and operating expenses. Fees paid require a firm to have robust governance for outsourcing can be deducted from the relevant arrangements, effective risk management processes indicator when the outsourcing is to a third party and adequate internal control mechanisms which is a parent or subsidiary of the firm whose appropriate to its size, nature, scale and complexity. process, service or activity is being outsourced (or a www.allenovery.com 6 CRD IV Framework: Operational Risk | January 2014 Standardised approach Under the standardised approach, a firm must To be eligible for the standardised approach, in divide its activities into a number of business lines addition to the general risk management standards and calculate a capital requirement for operational in CRD IV, a firm must have: risk for each business line as a specified percentage of a relevant indicator. The ORCR under the a well-documented assessment and management standardised approach is the average over three system for operational risk with clear years of the risk weighted relevant indicators responsibilities for the system assigned within the calculated each year across the business lines. This firm. The system must identify the firm’s is a three stage process – first, the firm must map its exposures to operational risk and track relevant previous three years of net interest income and net operational risk data, including material loss data; non-interest income to the eight business lines set out below; second, individual business line ORCRs an operational risk assessment and management are calculated by multiplying the firm’s three year system subject to regular independent review; average net interest income and net non-interest an operational risk assessment system closely income in each business line by the percentage (beta integrated into the firm’s risk management factor) assigned to that business line; and finally, the processes. Its output must be an integral part of total ORCR is calculated as the sum of the the process of monitoring and controlling the individual business line ORCRs. firm’s operational risk profile; and A firm must develop and document specific policies and criteria for mapping the relevant indicator for a system of management reporting that provides current business lines and activities into the operational risk reports to relevant functions framework for the standardised approach. The within the firm. A firm must have procedures in mapping process must meet a number of principles place for taking appropriate action in response to including senior management responsibility for the the information contained in such reports. mapping policy and independent review.