BIPRU 6.5 Operational risk: Advanced measurement approaches

BIPRU 6.5 applies to a BIPRU firm with an AMA permission.

A firm must be able to satisfy the appropriate regulator that it meets:

1. (1)

   the general risk management standards in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R;2

2. (2)

   the qualitative standards set out in this section; and

3. (3)

   the quantitative standards set out in this section.

   [Note: BCD Article 105(2) and Annex X Part 3 point 1]

1. (1)

   This rule sets out the qualitative standards that a firm's operational risk measurement system must meet.

2. (2)

   A firm's internal operational risk measurement system must be closely integrated into its day-to-day risk management processes.

3. (3)

   A firm must have an independent risk management function for operational risk.

4. (4)

   There must be regular reporting of operational risk exposures and loss experience. The firm must have procedures for taking appropriate corrective action.

5. (5)

   A firm's risk management system must be well documented. The firm must have a routine in place for ensuring compliance and policies for the treatment of non-compliance.

6. (6)

   A firm's operational risk management processes and measurement systems must be subject to regular reviews performed by internal and/or external auditors.

7. (7)

   A firm must ensure that in respect of its operational risk measurement system:

   1. (a)

      its internal validation processes are operating in a satisfactory manner; and

   2. (b)

      the data flows and processes associated with the risk measurement system are transparent and accessible.

      [Note: BCD Annex X Part 3 points 2 to 7]

1. (1)

   This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to process.

2. (2)

   A firm must calculate its capital requirement as comprising both expected loss and unexpected loss, unless the firm can demonstrate that expected loss is adequately captured in its internal business practices.

3. (3)

   The operational risk measure of a firm must capture potentially severe tail events, achieving a soundness standard comparable to a 99.9% confidence interval over a one year period.

4. (4)

   The operational risk measurement system of a firm must have certain key elements to meet the soundness standard set out in (2) and (3). These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in BIPRU 6.5.21 R to BIPRU 6.5.25 R.

5. (5)

   A firm must have a well documented approach for weighting the use of the four elements in (4) in its overall risk measurement system.

6. (6)

   A firm's risk measurement system must capture the major drivers of risk affecting the shape of the tail of the loss estimates.

7. (7)

   A firm must only recognise correlations in operational risk losses across individual operational risk estimates to the extent they are set out in its AMA permission. The firm must validate its correlation assumptions using appropriate quantitative and qualitative techniques.

8. (8)

   A firm's risk measurement system must be internally consistent and must avoid the multiple counting of qualitative assessments or risk mitigants recognised in other areas of the capital adequacy framework.

   [Note: BCD Annex X Part 3 points 8 to 10, 11 (part) and 12]

For the purposes of BIPRU 6.5.12 R (7), the firm must be able to show that its system for measuring correlations is sound, implemented with integrity, and takes into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress.

[Note: BCD Annex X Part 3 point 11 (part)]

1. (1)

   This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to internal data.

2. (2)

   A firm's internally generated operational risk measures must be based on a minimum historical observation period of five years. When a firm first moves to the advanced measurement approach, a three year historical observation period may be used.

3. (3)

   A firm must be able to map its historical internal loss data into the business lines defined in BIPRU 6.4.15 R and into the event type categories defined in BIPRU 6.5.25 R, and must be able to provide this data to the appropriate regulator upon request. Loss events which affect the entire firm may be allocated to an additional business line 'corporate items' due to exceptional circumstances.3 The firm must have documented, objective criteria for allocating losses to the specified business lines and event types. A firm's operational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the ORCR, as long as they continue to be treated as credit risk for the purposes of calculating the capital resources requirement. Operational risk losses that are related to market risks must be included in the scope of the capital requirement for operational risk.

4. (4)

   A firm's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. A firm must be able to demonstrate that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. A firm must define appropriate minimum loss thresholds for internal loss data collection.

5. (5)

   Aside from information on gross loss amounts, a firm must collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event.

6. (6)

   A firm must have specific criteria for assigning loss data arising from an event in a centralised function or an activity that spans more than one business line, as well as from related events over time.

7. (7)

   A firm must have documented procedures for assessing the ongoing relevance of historical loss data, including those situations in which judgement overrides, scaling or other adjustments may be used, to what extent they may be used and who is authorised to make such decisions.

   [Note: BCD Annex X Part 3 points 13 to 18]

1. (1)

   This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to external data.

2. (2)

   A firm's operational risk measurement system must use relevant external data, especially when there is reason to believe that the firm is exposed to infrequent, yet potentially severe, losses. A firm must have a systematic process for determining the situations for which external data should be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use should be regularly reviewed, documented and subject to periodic independent review.

   [Note: BCD Annex X Part 3 point 19]

1. (1)

   This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to scenario analysis.

2. (2)

   A firm must use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments must be validated and re-assessed through comparison to actual loss experience to ensure their reasonableness.

   [Note: BCD Annex X Part 3 point 20]

1. (1)

   This rule sets out the quantitative standards that a firm's operational risk measurement system must meet with respect to business environment and internal control factors.

2. (2)

   A firm's firm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile.

3. (3)

   A firm must be able to justify the choice of each factor as a meaningful driver of risk, based on experience and involving the expert judgment of the affected business areas.

4. (4)

   The sensitivity of risk estimates to changes in the factors and the relative weighting of the various factors must be well reasoned. In addition to capturing changes in risk due to improvements in risk controls, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume.

5. (5)

   A firm must document this framework and make it subject to independent review within the firm and make it available for review by supervisors.

6. (6)

   Over time, a firm must validate and re-assess the process and the outcomes through comparison to actual internal loss experience and relevant external data.

   [Note: BCD Annex X Part 3 points 21 to 24]

1. (1)

   A firm may recognise the impact of insurance for the purposes of its operational risk measurement system subject to the conditions set out in this rule and BIPRU 6.5.27 R.

2. (2)

   The provider must be authorised to provide insurance or re-insurance.

3. (3)

   The provider must have a minimum claims paying ability rating by an eligible ECAI associated with credit quality step 3 or above under the rules for the risk weighting of exposures to firms under the standardised approach to credit risk .

   [Note: BCD Annex X Part 3 points 25 to 26]

1. (1)

   A firm must ensure that its insurance and its insurance framework meet the conditions in this rule.

2. (2)

   The insurance policy must have an1 initial term of no less than one year. For policies with a residual term of less than one year the firm must make appropriate haircuts to reflect the declining residual term of the policy, up to a full 100% haircut for policies with a residual term of 90 days or less.

3. (3)

   The insurance policy must have a minimum notice period for cancellation of the contract of 90 days.

4. (4)

   The insurance policy must contain no exclusions or limitations based upon supervisory actions or, in the case of a failed firm, that preclude the firm, its receiver or liquidator from recovering for damages suffered or expenses incurred by the firm, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the firm. The insurance policy may exclude coverage for any fine, penalty or punitive damages resulting from actions by a competent authority or third country competent authority.

5. (5)

   The risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of the ORCR.

6. (6)

   The insurance must be provided by a third party entity. In the case of insurance through captives and affiliates, the exposure must be laid off to an independent third party entity, for example through reinsurance that meets the eligibility criteria.

7. (7)

   The framework for recognising insurance must be well reasoned and documented.

8. (8)

   The methodology for recognising insurance must capture the following elements through discounts or haircuts in the amount of insurance recognition:

   1. (a)

      the residual term of a policy, where less than one year, as noted in (2);

   2. (b)

      a policy's cancellation terms, where less than one year;

   3. (c)

      mismatches in coverage of insurance policies; and

   4. (d)

      the uncertainty of payment.

9. (9)

   The capital alleviation arising from the recognition of insurances and other risk transfer mechanisms3 must not exceed 20% of the capital requirement before the recognition of risk mitigation techniques.

   [Note: BCD Annex X Part 3 points 27 to 29]

A firm may recognise a risk transfer mechanism other than insurance to the extent that a noticeable risk mitigating effect is achieved and the risk transfer mechanism is included in the firm's AMA permission.

[Note: BCD Annex X Part 3 point 25]3

Where an EEA parent institution and its subsidiary undertakings or an EEA parent financial holding company and its subsidiary undertakings or an EEA parent mixed financial holding company and its subsidiary undertakings7 use an advanced measurement approach on a unified basis for the parent undertaking and its subsidiary undertakings, the qualifying criteria set out in BIPRU 6.5 may be met by the parent undertaking and its subsidiary undertakings considered together where permitted by the AMA permission.

[Note: BCD Article 105(4)]