Operational risk

Part

BIPRU Prudential sourcebook for Banks, Building Societies and Investment Firms

Chapter

Operational risk

Printed on: 06/11/2024

Rulebook at: 01/01/2011

BIPRU 6

Operational risk

BIPRU 6.1

Operational risk: Application and purpose

01/01/2007

Application

BIPRU 6.1.1

BIPRU 6 applies to a BIPRU firm except for:

(1) a BIPRU limited licence firm; and
(2) a BIPRU limited activity firm.

01/01/2007

BIPRU 6.1.2

A BIPRU limited licence firm or BIPRU limited activity firm that wishes to calculate an operational risk capital requirement in accordance with this chapter for the purposes of its capital resources requirement should apply for a waiver to modify GENPRU 1.1 or seek a variation to its permission so that it is treated as a full scope BIPRU investment firm.

01/01/2007

Purpose

BIPRU 6.1.3

The purpose of BIPRU 6 is:

(1) to detail the requirement to hold capital to cover operational risk losses and have appropriate systems and controls in place to manage operational risk; and
(2) to explain how to calculate the operational risk capital requirement, or ORCR.

01/01/2007

BIPRU 6.1.4

BIPRU 6 implements:

(1) Articles 102 to 104;
(2) Article 105, in part; and
(3) Annex X;

of the Banking Consolidation Directive.

01/01/2007

BIPRU 6.2

Operational risk: Methodologies and systems

01/01/2007

The definition of ORCR

BIPRU 6.2.1

The operational risk capital requirement (ORCR) for a firm is an amount calculated in accordance with:

(1) the basic indicator approach (see BIPRU 6.3); or
(2) the standardised approach (see BIPRU 6.4).

[Note: BCD Article 102(1)]

01/01/2007

BIPRU 6.2.2

The simplest method of calculating the ORCR is the basic indicator approach and a firm should use this approach if it does not, or is not permitted to, use another approach.

01/01/2007

BIPRU 6.2.3

A firm does not need a waiver to use the standardised approach. However there are eligibility conditions that a firm should satisfy if it is to use this approach. If it does not satisfy them, it should not use this approach.

01/01/2007

BIPRU 6.2.4

A firm may apply to the FSA for a waiver from BIPRU 6.2.1 R in order to use its own advanced measurement approach for the calculation of its ORCR (see BIPRU 6.5). If the waiver is granted, the ORCR will be an amount determined in accordance with such waiver.

[Note: BCD Article 105(1)]

01/01/2007

Restrictions on changing the approach used for calculating ORCR

BIPRU 6.2.5

A firm that calculates its ORCR using the standardised approach must not change to calculating its ORCR using the basic indicator approach.

[Note: BCD Article 102(2) (part)]

01/01/2007

BIPRU 6.2.6

A firm may apply to the FSA for a waiver from BIPRU 6.2.5 R where it can demonstrate good cause for changing to the basic indicator approach.

[Note: BCD Article 102(2) (part)]

01/01/2007

BIPRU 6.2.7

A firm that calculates its ORCR using an advanced measurement approach must not change to calculating its ORCR using the standardised approach or the basic indicator approach.

[Note: BCD Article 102(3) (part)]

01/01/2008

BIPRU 6.2.8

A firm may apply to the FSA for a waiver from BIPRU 6.2.7 R where it can demonstrate good cause for changing to the standardised approach or the basic indicator approach as the case may be.

[Note: BCD Article 102(3) (part)]

01/01/2007

Combination of different methodologies

BIPRU 6.2.9

Without prejudice to any other conditions that may be imposed by a firm's AMA permission, where a firm's AMA permission allows it to use an advanced measurement approach in combination with either the basic indicator approach or the standardised approach, the firm must comply with the following conditions:

(1) all operational risks of the firm are captured;
(2) the firm must be able to satisfy the FSA with respect to the methodology used to cover different activities, geographical locations or other relevant divisions determined on an internal basis; and
(3) BIPRU 6.4.1 R and BIPRU 6.5.6 R must be complied with for the part of activities covered by the standardised approach and advanced measurement approaches respectively.

[Note: BCD Article 102(4) and Annex X, Part 4 point 1]

01/01/2008

BIPRU 6.2.10

Where a firm's AMA permission allows it to use an advanced measurement approach in combination with either the basic indicator approach or the standardised approach, the FSA may impose additional conditions on a case by case basis as follows:

(1) on the date of implementation of an advanced measurement approach, a significant part of the firm's operational risks are captured by the advanced measurement approach; and
(2) the firm is obliged to roll out the advanced measurement approach to a material part of its operations within a time schedule set out in its AMA permission.

[Note: BCD Annex X, Part 4 point 2]

01/01/2007

BIPRU 6.2.11

A firm applying for an AMA permission to use a combination of different approaches must be able to show that:

(1) at the date of implementation of the advanced measurement approach, approximately 50% (or more) of the firm's operational risk is captured under the AMA; and
(2) the firm has committed to roll out the advanced measurement approach for around 85% (or more) of its operational risk, subject to the remaining percentage not being concentrated in a single operation, within a timescale set out in the AMA permission.

01/01/2007

BIPRU 6.2.12

For the determination of its ORCR, a firm must not use any of the following combinations of methodologies:

(1) the basic indicator approach with the standardised approach;
(2) the basic indicator approach with the alternative standardised approach; or
(3) the standardised approach with the alternative standardised approach for the same business line.

01/01/2007

BIPRU 6.2.13

A firm may apply to the FSA for a waiver from BIPRU 6.2.12 R (1) and BIPRU 6.2.12 R (2) in exceptional circumstances, such as the recent acquisition of new business, which require a transition period for the roll out of the standardised approach (or the alternative standardised approach). In this event, a firm will need to make a commitment to roll out the standardised approach (or the alternative standardised approach) within a time schedule agreed with the FSA.

[Note: BCD Annex X, Part 4 points 3 and 4]

01/01/2007

BIPRU 6.3

Operational risk: Basic indicator approach

01/01/2007

ORCR

BIPRU 6.3.1

The ORCR under the basic indicator approach is equal to 15% of the relevant indicator defined in this section.

[Note: BCD Article 103 and Annex X, Part 1 point 1]

01/01/2007

Relevant indicator: General

BIPRU 6.3.2

(1) The relevant indicator is the three-year average of the sum of:

(a) a firm's net interest income; and
(b) a firm's net non-interest income.

(2) The three-year average must be calculated on the basis of the last three yearly observations at the end of the financial year. When audited figures are not available, business estimates may be used.
(3) If for any given observation, the sum of a firm's net interest income and net non-interest income is negative or equal to zero, this figure must be excluded from both the numerator and denominator when calculating the three year average. The relevant indicator must be calculated as the sum of the positive figures divided by the number of positive figures.

[Note: BCD Annex X, Part 1 points 2 to 4]

01/01/2007

Relevant indicator: An example calculation

BIPRU 6.3.3

If a firm has:

(1) two positive yearly relevant indicators of £20 each; and
(2) the final yearly observation shows a negative figure of £5; then

the relevant indicator is calculated as £20, being £40 (sum of positive figures) divided by 2 (number of positive figures).

01/01/2007

Relevant indicator: Insufficient income data

BIPRU 6.3.4

A firm that does not have sufficient income data to meet the three-year requirement (e.g. a start-up) may use its forecasted gross income projections for all or part of the three year time period when calculating its relevant indicator.

01/01/2007

Relevant indicator: Application of accounting categories

BIPRU 6.3.5

(1) This rule applies to a firm that is subject to the Bank Accounts Directive.
(2) Based on accounting categories for the profit and loss account of credit institutions under Article 27 of the Bank Accounts Directive, the relevant indicator in BIPRU 6.3.2 R must be expressed as the sum of the elements listed in the table in BIPRU 6.3.6 R.
(3) Each element in the table in BIPRU 6.3.6 R must be included in the sum with its positive or negative sign.

[Note: BCD Annex X, Part 1 point 5]

01/01/2007

BIPRU 6.3.6

Table: Relevant indicators This table belongs to BIPRU 6.3.5 R

Interest receivable and similar income

Interest payable and similar charges

Income from shares and other variable/fixed-yield securities.

Commissions/fees receivable

Commission/fees payable

Net profit or net loss on financial operations

Other operating income

01/01/2007

BIPRU 6.3.7

Income from a participation held in an undertaking by the firm or a subsidiary undertaking of the firm should not be included in the relevant indicator calculations, to ensure that intra-group dividends and other intra-group income flows are not double counted.

01/01/2007

BIPRU 6.3.8

Income received under an operating lease should be included as gross income less depreciation, not as gross rental income.

01/01/2007

BIPRU 6.3.9

(1) If a firm considers that, due to exceptional circumstances, using a three year average to calculate the relevant indicator would lead to a major overestimation of its ORCR, the firm may apply for a waiver from BIPRU 6.3.2 R.
(2) Exceptional circumstances might include stopping or selling a major business line.

01/01/2007

Qualifications

BIPRU 6.3.10

(1) The relevant indicator for the basic indicator approach must be calculated before the deduction of any provisions and operating expenses.
(2) Operating expenses must include fees paid for outsourcing services rendered by third parties which are not a parent undertaking or subsidiary undertaking of the firm or a subsidiary undertaking of a parent undertaking which is also the parent undertaking of the firm. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator if the expenditure is incurred by an undertaking subject to supervision under, or equivalent to, the Banking Consolidation Directive.

[Note: BCD Annex X, Part 1 point 7]

01/01/2007

BIPRU 6.3.11

The definition of 'outsourcing' for the purposes of BIPRU 6.3.10 R (2) is set out in detail in a Joint Forum paper of the Basel Committee on Banking Supervision entitled "Outsourcing in Financial Services" dated February 2005 and can be summarised as meaning a firm's use of a third party to perform activities on a continuing basis that would normally be undertaken by the firm, now or in the future and can be the initial transfer of an activity (or part of that activity) from the firm to a third party or a further transfer of an activity (or part thereof) from one third party service provider to another.

01/01/2007

BIPRU 6.3.12

The following elements must not be used in the calculation of the relevant indicator:

(1) realised profits/losses from the sale of non-trading book items;
(2) income from extraordinary or irregular items; and
(3) income derived from insurance.

[Note: BCD Annex X, Part 1 point 8 (part)]

01/01/2007

BIPRU 6.3.13

When revaluation of trading items is part of the profit and loss statement, revaluation may be included in the calculation of the relevant indicator.

[Note: BCD Annex X, Part 1 point 8 (part)]

01/01/2007

BIPRU 6.3.14

When Article 36(2) of the Bank Accounts Directive is applied, revaluation booked in the profit and loss account must be included in the calculation of the relevant indicator.

[Note: BCD Annex X, Part 1 point 8 (part)]

01/01/2007

BIPRU 6.3.15

When a firm is subject to an accounting framework different from the one established by the Bank Accounts Directive, it must calculate the relevant income indicator on the basis of internal data that best reflect the definition in this section.

[Note: BCD Annex X, Part 1 points 6 and 9]

01/01/2007

General risk management standards

BIPRU 6.3.16

In common with all BIPRU firms, a firm calculating its ORCR using the basic indicator approach is required to meet the general risk management standards set out in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R.

06/04/2007

BIPRU 6.4

Operational risk: Standardised approach

01/01/2007

Eligibility

BIPRU 6.4.1

(1) To be eligible for the standardised approach, a firm must meet the qualifying criteria set out in this rule, in addition to the general risk management standards set out in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R .
(2) A firm must have a well-documented assessment and management system for operational risk with clear responsibilities for the system assigned within the firm. The system must identify the firm's exposures to operational risk and track relevant operational risk data, including material loss data.
(3) A firm's operational risk assessment and management system must be subject to regular independent review.
(4) A firm's operational risk assessment system must be closely integrated into the firm's risk management processes. Its output must be an integral part of the process of monitoring and controlling the firm's operational risk profile.
(5) A firm must implement a system of management reporting that provides operational risk reports to relevant functions within the firm. A firm must have procedures in place for taking appropriate action in response to the information contained in such reports.

[Note: BCD Article 104(6) and Annex X, Part 2 point 12 (part)]

06/04/2007

BIPRU 6.4.2

A firm must comply with the criteria in BIPRU 6.4.1 R having regard to the size and scale of its activities and to the principle of proportionality.

[Note: BCD Annex X, Part 2 point 12 (part)]

01/01/2007

Business lines

BIPRU 6.4.3

Under the standardised approach, a firm must divide its activities into a number of business lines as set out in this section.

[Note: BCD Article 104(1)]

01/01/2007

BIPRU 6.4.4

The list of activities in BIPRU 6.4.15 R is not a complete definition of the activities within a business line and it may be possible for an activity to be allocated to a business line other than the one to which it is attributed in BIPRU 6.4.15 R.

01/01/2007

BIPRU 6.4.5

For each business line, a firm must calculate a capital requirement for operational risk as a certain percentage of a relevant indicator, in accordance with the rules in this section.

[Note: BCD Article 104(2)]

01/01/2007

ORCR calculated using the standardised approach

BIPRU 6.4.6

The ORCR under the standardised approach is calculated as the three-year average of the yearly summations of the capital requirements across the business lines referred to in BIPRU 6.4.15 R.

[Note: BCD Annex X, Part 2 point 1 (part)]

31/12/2010

BIPRU 6.4.7

In any given year, negative capital requirements (resulting from negative gross income) in any business line may offset positive capital requirements in other business lines without limit. However, where the aggregate of the capital requirements across all business lines within a given year is negative, the input to the numerator for that year must be zero.

[Note: BCD Annex X, Part 2 point 1 (part)]

31/12/2010

BIPRU 6.4.8

(1) If a firm considers that, due to exceptional circumstances, using a three year average to calculate the relevant indicator would lead to a major overestimation of its ORCR, the firm may apply for a waiver from BIPRU 6.4.5 R.
(2) Exceptional circumstances might include stopping or selling a major business line.

01/01/2007

Relevant indicator

BIPRU 6.4.9

The three year average in BIPRU 6.4.6 R must be calculated on the basis of the last three twelve monthly observations at the end of the financial year. When audited figures are not available, business estimates may be used.

[Note: BCD Annex X, Part 2 point 2]

01/01/2007

Principles for business line mapping

BIPRU 6.4.10

A firm must develop and document specific policies and criteria for mapping the relevant indicator for current business lines and activities into the framework for the standardised approach. The criteria must be reviewed and adjusted for new or changing business activities and risks as appropriate.

[Note: BCD Annex X, Part 2 point 4 (part)]

01/01/2007

BIPRU 6.4.11

(1) The principles for business line mapping that a firm must meet are set out in this rule.
(2) All activities must be mapped into the business lines in a mutually exclusive and jointly exhaustive manner.
(3) Any activity which cannot be readily mapped into the business line framework, but which represents an ancillary function to an activity included in the framework, must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective mapping criterion must be used (e.g., proportional allocation of the indicators).
(4) If an activity cannot be mapped into a particular business line then the business line yielding the highest charge for the firm must be used. The same business line equally applies to any associated ancillary activity.
(5) A firm may use internal pricing methods to allocate the relevant indicator between business lines.
(6) The mapping of activities into business lines for operational risk capital purposes must be consistent with the definitions of business lines used by the firm for credit and market risks.
(7) Senior management must be responsible for the mapping policy.
(8) The mapping process to business lines must be subject to independent review.

[Note: BCD Annex X, Part 2 point 4 (part)]

01/01/2007

BIPRU 6.4.12

A firm that is mapping activities to a business line should take into account:

(1) the activities listed in respect of each business line in the table in BIPRU 6.4.15 R; and
(2) the organisation of the firm's business in respect of that business line.

01/01/2007

BIPRU 6.4.13

A firm should take into account its business and organisation when mapping activities to the business lines in the table in BIPRU 6.4.15 R.

01/01/2007

BIPRU 6.4.14

For the purposes of BIPRU 6.4.11 R (5), costs generated in one business line which are imputable to a different business line may be reallocated to the business line to which they pertain, for instance by using a treatment based on internal transfer costs between two business lines.

[Note: BCD Annex X, Part 2 point 4 (part)]

01/01/2007

BIPRU 6.4.15

Table: Percentages applying to the income indicator of individual business lines
This table belongs to BIPRU 6.4.3 R

Business line

List of activities

Percentage

Corporate finance

•Underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis

•Services related to underwriting

•Investment advice

•Advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to the mergers and the purchase of undertakings

•Investment research and financial analysis and other forms of general recommendation relating to transactions in financial instruments

18%

Trading and sales

•Dealing on own account

•Money broking

•Reception and transmission of orders in relation to one or more financial instruments

•Execution of orders on behalf of clients

•Placing of financial instruments on a best efforts basis

•Operation of multilateral trading facilities

18%

Retail brokerage
(Activities with individual physical persons or with a retail SME as defined under the standardised approach to credit risk)

•Reception and transmission of orders in relation to one or more financial instruments

•Execution of orders of behalf of clients

•Placing of financial instruments without a firm commitment basis

12%

Commercial banking

•Acceptance of deposits and other repayable funds

•Lending

•Financial leasing

•Guarantees and commitments

15%

Retail banking
(Activities with an individual physical persons or with a retail SME as defined under the standardised approach to credit risk)

•Acceptance of deposits and other repayable funds

•Lending

•Financial leasing

•Guarantees and commitments

12%

Payment and settlement

•Money transmission services

•Issuing and administering means of payment

18%

Agency services

•Safekeeping and administration of financial instruments for the account of clients including custodianship and related services such as cash/collateral management

15%

Asset management

•Portfolio management

•UCITS management and other forms of asset management

12%

01/01/2007

The alternative standardised approach

BIPRU 6.4.16

Under the alternative standardised approach, a firm using the standardised approach may use alternative indicators for retail banking and commercial banking business lines if it complies with BIPRU 6.4.17 R to BIPRU 6.4.21 R.

[Note: BCD Annex X, Part 2 point 3]

01/01/2007

Eligibility for the alternative standardised approach

BIPRU 6.4.17

To be eligible to use the alternative standardised approach, a firm must meet the following conditions, in addition to the general risk management standards set out in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R :

(1) the firm must meet the eligibility criteria for the standardised approach in BIPRU 6.4.1 R;
(2) the firm must be overwhelmingly active in retail and/or commercial banking activities, which must account for at least 90% of its income; and
(3) the firm must be able to demonstrate that a significant proportion of its retail and/or commercial banking activities comprise loans associated with a high probability of default, and that the alternative standardised approach provides an improved basis for assessing the operational risk.

[Note: BCD Article 104(3) and Annex X, Part 2 points 5 and 8 to 11]

06/04/2007

BIPRU 6.4.18

In relation to BIPRU 6.4.17 R (3), the FSA's view is that a high probability of default is equal to or greater than 3.5%.

01/01/2007

ORCR calculated using the alternative standardised approach

BIPRU 6.4.19

(1) The relevant indicators under the alternative standardised approach are the same as for the standardised approach except for the two following business lines:

(a) retail banking; and
(b) commercial banking.

(2) For retail banking and commercial banking, the ORCR must be calculated as a normalised income indicator equal to the three-year average of the total nominal amount of loans and advances multiplied:

(a) by 0.035, and then
(b) by the appropriate business line percentage set out in BIPRU 6.4.15 R.

[Note: BCD Annex X, Part 2 point 6]

01/01/2007

BIPRU 6.4.20

For the retail and/or commercial banking business lines, the loans and advances must consist of the total drawn amounts in the corresponding credit portfolios.

[Note: BCD Annex X, Part 2 point 7 (part)]

01/01/2007

BIPRU 6.4.21

For the commercial banking business line, the securities held in the non-trading book must also be included.

[Note: BCD Annex X, Part 2 point 7 (part)]

01/01/2007

BIPRU 6.5

Operational risk: Advanced measurement approaches

01/01/2008

Application

BIPRU 6.5.1

BIPRU 6.5 applies to a BIPRU firm with an AMA permission.

01/01/2008

AMA permissions: general

BIPRU 6.5.2

The rules in GENPRU and BIPRU do not allow a firm to use the advanced measurement approach. A firm that wishes to use an advanced measurement approach, based on the firm's own operational risk measurement systems, for the calculation of its ORCR should therefore apply for AMA permission to use the advanced measurement approach as explained in BIPRU 1.3.

01/01/2008

BIPRU 6.5.3

The FSA will not grant a firm an AMA permission to use the advanced measurement approach if the firm does not meet the standards in BIPRU 6.5.5 R.

01/01/2008

BIPRU 6.5.4

An AMA permission will generally modify BIPRU 6.2.1 R (Calculation of ORCR) by amending, to the extent set out in the AMA permission, the calculation of the ORCR of the firm to be calculated in accordance with BIPRU 6.5.

01/01/2008

Minimum standards

BIPRU 6.5.5

A firm must be able to satisfy the FSA that it meets:

(1) the general risk management standards in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R;
(2) the qualitative standards set out in this section; and
(3) the quantitative standards set out in this section.

[Note: BCD Article 105(2) and Annex X Part 3 point 1]

01/01/2008

Qualitative standards

BIPRU 6.5.6

(1) This rule sets out the qualitative standards that a firm's operational risk measurement system must meet.
(2) A firm's internal operational risk measurement system must be closely integrated into its day-to-day risk management processes.
(3) A firm must have an independent risk management function for operational risk.
(4) There must be regular reporting of operational risk exposures and loss experience. The firm must have procedures for taking appropriate corrective action.
(5) A firm's risk management system must be well documented. The firm must have a routine in place for ensuring compliance and policies for the treatment of non-compliance.
(6) A firm's operational risk management processes and measurement systems must be subject to regular reviews performed by internal and/or external auditors.
(7) A firm must ensure that in respect of its operational risk measurement system:

(a) its internal validation processes are operating in a satisfactory manner; and
(b) the data flows and processes associated with the risk measurement system are transparent and accessible.

[Note: BCD Annex X Part 3 points 2 to 7]

01/01/2008

BIPRU 6.5.7

For the purposes of BIPRU 6.5.6 R (2), a firm should be able to show that:

(1) its operational risk measurement systems and processes provide benefits to the firm and are not limited to determining regulatory capital;
(2) the operational risk measurement system and framework forms part of the systems and controls it has in place; and
(3) the operational risk measurement system and framework are capable of adapting to the changes in the business of the firm and evolving as the firm gains experience of risk management techniques.

01/01/2008

BIPRU 6.5.8

For the purposes of BIPRU 6.5.6 R (3), a firm should be able to show that the independent risk management function is sufficiently separate from the business units of the firm to allow its professional judgement and recommendations to be effective and impartial.

01/01/2008

BIPRU 6.5.9

For the purposes of BIPRU 6.5.6 R (4), a firm should ensure that:

(1) its governing body or designated committee (where one is used) possesses a general understanding of the firm's AMA; and
(2) its senior management possesses a good understanding of the firm's AMA and its operation.

01/01/2008

BIPRU 6.5.10

(1) A firm's governing body or designated committee may choose to approve only material aspects of the firm's AMA and material changes to the firm's AMA.
(2) Where a firm's governing body or designated committee chooses to approve only material aspects of the firm's AMA and material changes to the firm's AMA:

(a) the firm's governing body or designated committee should define the firm's overall approach to the AMA and approve a policy statement defining that approach; and
(b) the firm should define and document the process for approval of non-material aspects of the firm's AMA.

01/01/2008

BIPRU 6.5.11

For the purposes of BIPRU 6.5.6 R (7), a firm should develop and adopt an internal validation methodology of its operational risk measurement system and management processes that:

(1) is proportionate and appropriate to the business of the firm;
(2) takes into account changing market and operating conditions of the firm;
(3) encompasses both quantitative and qualitative methods of the firm's operational risk measurement system;
(4) is periodically assessed by the firm;
(5) is subject to regular independent review to ensure effective implementation; and
(6) is clearly documented.

01/01/2008

Quantitative standards: process

BIPRU 6.5.12

(1) This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to process.
(2) A firm must calculate its capital requirement as comprising both expected loss and unexpected loss, unless the firm can demonstrate that expected loss is adequately captured in its internal business practices.
(3) The operational risk measure of a firm must capture potentially severe tail events, achieving a soundness standard comparable to a 99.9% confidence interval over a one year period.
(4) The operational risk measurement system of a firm must have certain key elements to meet the soundness standard set out in (2) and (3). These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in BIPRU 6.5.21 R to BIPRU 6.5.25 R.
(5) A firm must have a well documented approach for weighting the use of the four elements in (4) in its overall risk measurement system.
(6) A firm's risk measurement system must capture the major drivers of risk affecting the shape of the tail of the loss estimates.
(7) A firm must only recognise correlations in operational risk losses across individual operational risk estimates to the extent they are set out in its AMA permission. The firm must validate its correlation assumptions using appropriate quantitative and qualitative techniques.
(8) A firm's risk measurement system must be internally consistent and must avoid the multiple counting of qualitative assessments or risk mitigants recognised in other areas of the capital adequacy framework.

[Note: BCD Annex X Part 3 points 8 to 10, 11 (part) and 12]

01/01/2008

BIPRU 6.5.13

For the purposes of BIPRU 6.5.12 R (7), the firm must be able to show that its system for measuring correlations is sound, implemented with integrity, and takes into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress.

[Note: BCD Annex X Part 3 point 11 (part)]

01/01/2008

BIPRU 6.5.14

A firm should be able to satisfy the FSA that it has considered the following with respect to its operational risk measurement systems:

(1) whether the choice of distributions used provides both a good fit with the data and an ability adequately to account for rare events;
(2) whether the estimated parameters and capital numbers used for the simulated inclusion or exclusion of unusually large losses are sufficiently robust;
(3) the co-dependency, or independency, of assumptions governing the relationships between risk types and between business lines;
(4) the number of simulations or iterations required during model execution to provide reasonably stable capital results;
(5) the emergence of different data types, such as the combination of internal and external loss data, based on different degrees of credibility; and
(6) the methodologies used for the purposes of achieving a soundness standard comparable to a 99.9% confidence interval.

01/01/2008

BIPRU 6.5.15

For the purposes of BIPRU 6.5.12 R (2), a firm should be able to show that its operational risk measurement systems that capture expected loss are:

(1) clearly documented;
(2) sound, implemented with integrity and consistently applied, and take into account uncertainty surrounding expected loss;
(3) subject to regular reviews by the firm of the reasonableness of the expected loss estimates and comparisons with subsequent outcomes; and
(4) based on justifiable assumptions for capturing and reviewing the reasonableness of the expected loss estimates.

01/01/2008

BIPRU 6.5.16

For the purposes of BIPRU 6.5.15 G, the firm should use the business management definition it uses for the purposes of identifying an expected loss.

01/01/2008

BIPRU 6.5.17

Where a firm is using a combination of budgeting and pricing for the purposes of the operational risk measurement system for capturing expected loss, a firm should be able to show that:

(1) the process is transparent, can be repeated and provides support to the firm's management of its business;
(2) to a reasonable degree of certainty, budgeted resources for the relevant year cover budgeted expected losses;
(3) its forecasting takes into account both historic performance and drivers which may affect future trends; and
(4) the forecasting in (3) is monitored on a periodic basis and adjusted as appropriate.

01/01/2008

BIPRU 6.5.18

For the purposes of BIPRU 6.5.12 R (3), a firm should be able to show that in respect of its operational risk measurement system:

(1) the methodology for obtaining a soundness standard comparable to a 99.9% confidence level is practical and appropriate;
(2) it has assessed its overall model outputs as sufficiently robust; and
(3) it reviews its methodology on an ongoing basis.

01/01/2008

BIPRU 6.5.19

For the purpose of developing and reviewing its methodology for obtaining a soundness standard comparable to a 99.9% confidence level, a firm should consider whether any of the following are appropriate:

(1) stress testing;
(2) sensitivity analysis;
(3) scenario analysis;
(4) back testing; and
(5) boot-strapping techniques.

01/01/2008

BIPRU 6.5.20

Where a firm is using scaling for the purposes of the operational risk measurement system, it should be able to show that the methodology used is robust and based on assumptions that are meaningful and credible.

01/01/2008

Quantitative standards: internal data

BIPRU 6.5.21

(1) This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to internal data.
(2) A firm's internally generated operational risk measures must be based on a minimum historical observation period of five years. When a firm first moves to the advanced measurement approach, a three year historical observation period may be used.
(3) A firm must be able to map its historical internal loss data into the business lines defined in BIPRU 6.4.15 R and into the event type categories defined in BIPRU 6.5.25 R, and must be able to provide this data to the FSA upon request. Loss events which affect the entire firm may be allocated to an additional business line 'corporate items' due to exceptional circumstances. The firm must have documented, objective criteria for allocating losses to the specified business lines and event types. A firm's operational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the ORCR, as long as they continue to be treated as credit risk for the purposes of calculating the capital resources requirement. Operational risk losses that are related to market risks must be included in the scope of the capital requirement for operational risk.
(4) A firm's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. A firm must be able to demonstrate that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. A firm must define appropriate minimum loss thresholds for internal loss data collection.
(5) Aside from information on gross loss amounts, a firm must collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event.
(6) A firm must have specific criteria for assigning loss data arising from an event in a centralised function or an activity that spans more than one business line, as well as from related events over time.
(7) A firm must have documented procedures for assessing the ongoing relevance of historical loss data, including those situations in which judgement overrides, scaling or other adjustments may be used, to what extent they may be used and who is authorised to make such decisions.

[Note: BCD Annex X Part 3 points 13 to 18]

31/12/2010

Quantitative standards: external data

BIPRU 6.5.22

(1) This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to external data.
(2) A firm's operational risk measurement system must use relevant external data, especially when there is reason to believe that the firm is exposed to infrequent, yet potentially severe, losses. A firm must have a systematic process for determining the situations for which external data should be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use should be regularly reviewed, documented and subject to periodic independent review.

[Note: BCD Annex X Part 3 point 19]

01/01/2008

Quantitative standards: scenario analysis

BIPRU 6.5.23

(1) This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to scenario analysis.
(2) A firm must use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments must be validated and re-assessed through comparison to actual loss experience to ensure their reasonableness.

[Note: BCD Annex X Part 3 point 20]

01/01/2008

Quantitative standards: business environment and internal control factors

BIPRU 6.5.24

(1) This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to business environment and internal control factors.
(2) A firm's firm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile.
(3) A firm must be able to justify the choice of each factor as a meaningful driver of risk, based on experience and involving the expert judgment of the affected business areas.
(4) The sensitivity of risk estimates to changes in the factors and the relative weighting of the various factors must be well reasoned. In addition to capturing changes in risk due to improvements in risk controls, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume.
(5) A firm must document this framework and make it subject to independent review within the firm and make it available for review by supervisors.
(6) Over time, a firm must validate and re-assess the process and the outcomes through comparison to actual internal loss experience and relevant external data.

[Note: BCD Annex X Part 3 points 21 to 24]

01/01/2008

Table: Loss event type classification

BIPRU 6.5.25

This table belongs to BIPRU 6.5.21 R (3).

Event-Type Category

Definition

Internal fraud

Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party

External fraud

Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party

Employee Practices and Workplace Safety

Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events

Clients, Products & Business Practices

Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product

Damage to Physical Assets

Losses arising from loss or damage to physical assets from natural disaster or other events

Business disruption and system failures

Losses arising from disruption of business or system failures

Execution, Delivery & Process Management

Losses from failed transaction processing or process management, from relations with trade counterparties and vendors

[Note: BCD Annex X Part 5 Table 3]

01/01/2008

Impact of insurance and risk transfer mechanisms

BIPRU 6.5.26

(1) A firm may recognise the impact of insurance for the purposes of its operational risk measurement system subject to the conditions set out in this rule and BIPRU 6.5.27 R.
(2) The provider must be authorised to provide insurance or re-insurance.
(3) The provider must have a minimum claims paying ability rating by an eligible ECAI associated with credit quality step 3 or above under the rules for the risk weighting of exposures to firms under the standardised approach to credit risk.

[Note: BCD Annex X Part 3 points 25 to 26]

01/01/2008

BIPRU 6.5.27

(1) A firm must ensure that its insurance and its insurance framework meet the conditions in this rule.
(2) The insurance policy must have an initial term of no less than one year. For policies with a residual term of less than one year the firm must make appropriate haircuts to reflect the declining residual term of the policy, up to a full 100% haircut for policies with a residual term of 90 days or less.
(3) The insurance policy must have a minimum notice period for cancellation of the contract of 90 days.
(4) The insurance policy must contain no exclusions or limitations based upon supervisory actions or, in the case of a failed firm, that preclude the firm, its receiver or liquidator from recovering for damages suffered or expenses incurred by the firm, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the firm. The insurance policy may exclude coverage for any fine, penalty or punitive damages resulting from actions by a competent authority or third country competent authority.
(5) The risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of the ORCR.
(6) The insurance must be provided by a third party entity. In the case of insurance through captives and affiliates, the exposure must be laid off to an independent third party entity, for example through reinsurance that meets the eligibility criteria.
(7) The framework for recognising insurance must be well reasoned and documented.
(8) The methodology for recognising insurance must capture the following elements through discounts or haircuts in the amount of insurance recognition:

(a) the residual term of a policy, where less than one year, as noted in (2);
(b) a policy's cancellation terms, where less than one year;
(c) mismatches in coverage of insurance policies; and
(d) the uncertainty of payment.

(9) The capital alleviation arising from the recognition of insurances and other risk transfer mechanisms must not exceed 20% of the capital requirement before the recognition of risk mitigation techniques.

[Note: BCD Annex X Part 3 points 27 to 29]

31/12/2010

BIPRU 6.5.28

For the purposes of BIPRU 6.5.27 R (7), a firm should be able to demonstrate that the mitigating effect of the insurance is appropriate and relevant to the firm's business.

01/01/2008

BIPRU 6.5.29

For the purposes of BIPRU 6.5.27 R (9), a firm should be able to set out clearly how it made its assessment of the appropriate level of capital alleviation, including any assumptions made by the firm and how the insurances and other risk transfer mechanisms have been factored into the firm's risk measurement system.

31/12/2010

BIPRU 6.5.30

A firm may recognise a risk transfer mechanism other than insurance to the extent that a noticeable risk mitigating effect is achieved and the risk transfer mechanism is included in the firm's AMA permission.

[Note: BCD Annex X Part 3 point 25]

31/12/2010

BIPRU 6.5.30A

A firm that recognises the impact of insurance and operational risk mitigation techniques for the purposes of its operational risk measurement system should be able to show that it has considered the Commission of European Banking Supervisors' guidelines on operational risk mitigation techniques published in December 2009. This can be found at http://www.c-ebs.org/documents/Publications/Standards---Guidelines/2009/Operational-risk-mitigation-techniques/Guidelines.aspx.

31/12/2010

Use of an advanced measurement approach on a groupwide basis

BIPRU 6.5.31

Where an EEA parent institution and its subsidiary undertakings or an EEA parent financial holding company and its subsidiary undertakings use an advanced measurement approach on a unified basis for the parent undertaking and its subsidiary undertakings, the qualifying criteria set out in BIPRU 6.5 may be met by the parent undertaking and its subsidiary undertakings considered together where permitted by the AMA permission.

[Note: BCD Article 105(4)]

01/01/2008

BIPRU 6.5.32

Where the AMA is used on a unified basis for the parent undertaking and its subsidiary undertakings, and approval and reporting of the AMA are carried out at the group level, the qualifying criteria in BIPRU 6.5 may be met if:

(1) the subsidiary undertakings have delegated to the governing body or designated committee of the EEA parent institution or EEA parent financial holding company responsibility for approval of the AMA;
(2) the governing body or designated committee of the EEA parent institution or EEA parent financial holding company approves either:

(a) all aspects of the AMA, and material changes; or
(b) all aspects of the AMA that are material in the context of the group, and material changes to those, and a policy statement defining the overall approach to the AMA.

01/01/2008