1 BIPRU 6 applies to a BIPRU firm except for:

1. (1)

   a BIPRU limited licence firm; and

2. (2)

   a BIPRU limited activity firm.

The operational risk capital requirement (ORCR) for a firm is an amount calculated in accordance with:

1. (1)

   the basic indicator approach (see BIPRU 6.3); or

2. (2)

   the standardised approach (see BIPRU 6.4).

   [Note: BCD Article 102(1)]

A firm that calculates its ORCR using the standardised approach must not change to calculating its ORCR using the basic indicator approach.

[Note: BCD Article 102(2) (part)]

A firm that calculates its ORCR using an advanced measurement approach must not change to calculating its ORCR using the standardised approach or the basic indicator approach.

[Note: BCD Article 102(3) (part)]

Without prejudice to any other conditions that may be imposed by a firm'sAMA permission, where a firm'sAMA permission allows it to use an advanced measurement approach in combination with either the basic indicator approach or the standardised approach, the firm must comply with the following conditions:

1. (1)

   all operational risks of the firm are captured;

2. (2)

   the firm must be able to satisfy the FSA with respect to the methodology used to cover different activities, geographical locations or other relevant divisions determined on an internal basis; and

3. (3)

   BIPRU 6.4.1 R and BIPRU 6.5.6 R must be complied with for the part of activities covered by the standardised approach and advanced measurement approaches respectively.

   [Note: BCD Article 102(4) and Annex X, Part 4 point 1]

A firm applying for an AMA permission to use a combination of different approaches must be able to show that:

1. (1)

   at the date of implementation of the advanced measurement approach, approximately 50% (or more) of the firm'soperational risk is captured under the AMA; and

2. (2)

   the firm has committed to roll out the advanced measurement approach for around 85% (or more) of its operational risk, subject to the remaining percentage not being concentrated in a single operation, within a timescale set out in the AMA permission.

For the determination of its ORCR, a firm must not use any of the following combinations of methodologies:

1. (1)

   the basic indicator approach with the standardised approach;

2. (2)

   the basic indicator approach with the alternative standardised approach; or

3. (3)

   the standardised approach with the alternative standardised approach for the same business line.

The ORCR under the basic indicator approach is equal to 15% of the relevant indicator defined in this section.

[Note: BCD Article 103 and Annex X, Part 1 point 1]

1. (1)

   The relevant indicator is the three-year average of the sum of:

   1. (a)

      a firm's net interest income; and

   2. (b)

      a firm's net non-interest income.

2. (2)

   The three-year average must be calculated on the basis of the last three yearly observations at the end of the financial year. When audited figures are not available, business estimates may be used.

3. (3)

   If for any given observation, the sum of a firm's net interest income and net non-interest income1 is negative or equal to zero, this figure must be excluded from both the numerator and denominator when calculating the three year average. The relevant indicator must be calculated as the sum of the positive figures divided by the number of positive figures.

   [Note: BCD Annex X, Part 1 points 2 to 4]

1. (1)

   This rule applies to a firm that is subject to the Bank Accounts Directive.

2. (2)

   Based on accounting categories for the profit and loss account of credit institutions under Article 27 of the Bank Accounts Directive, the relevant indicator in BIPRU 6.3.2 R must be expressed as the sum of the elements listed in the table in BIPRU 6.3.6 R.

3. (3)

   Each element in the table in BIPRU 6.3.6 R must be included in the sum with its positive or negative sign.

   [Note: BCD Annex X, Part 1 point 5]

1. (1)

   The relevant indicator for the basic indicator approach must be calculated before the deduction of any provisions and operating expenses.

2. (2)

   Operating expenses must include fees paid for outsourcing services rendered by third parties which are not a parent undertaking or subsidiary undertaking of the firm or a subsidiary undertaking of a parent undertaking which is also the parent undertaking of the firm. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator if the expenditure is incurred by an undertaking subject to supervision under, or equivalent to, the Banking Consolidation Directive.

   [Note: BCD Annex X, Part 1 point 7]

The following elements must not be used in the calculation of the relevant indicator:

1. (1)

   realised profits/losses from the sale of non-trading book items;

2. (2)

   income from extraordinary or irregular items; and

3. (3)

   income derived from insurance.

   [Note: BCD Annex X, Part 1 point 8 (part)]

When revaluation of trading items is part of the profit and loss statement, revaluation may be included in the calculation of the relevant indicator.

[Note: BCD Annex X, Part 1 point 8 (part)]

When Article 36(2) of the Bank Accounts Directive is applied, revaluation booked in the profit and loss account must be included in the calculation of the relevant indicator.

[Note: BCD Annex X, Part 1 point 8 (part)]

When a firm is subject to an accounting framework different from the one established by the Bank Accounts Directive, it must calculate the relevant income indicator on the basis of internal data that best reflect the definition in this section.

[Note: BCD Annex X, Part 1 points 6 and 9]

1. (1)

   To be eligible for the standardised approach, a firm must meet the qualifying criteria set out in this rule, in addition to the general risk management standards set out in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R1.

   1
2. (2)

   A firm must have a well-documented assessment and management system for operational risk with clear responsibilities for the system assigned within the firm. The system must identify the firm's exposures to operational risk and track relevant operational risk data, including material loss data.

3. (3)

   A firm'soperational risk assessment and management system must be subject to regular independent review.

4. (4)

   A firm'soperational risk assessment system must be closely integrated into the firm's risk management processes. Its output must be an integral part of the process of monitoring and controlling the firm'soperational risk profile.

5. (5)

   A firm must implement a system of management reporting that provides operational risk reports to relevant functions within the firm. A firm must have procedures in place for taking appropriate action in response to the information contained in such reports.

   [Note: BCD Article 104(6) and Annex X, Part 2 point 12 (part)]

A firm must comply with the criteria in BIPRU 6.4.1 R having regard to the size and scale of its activities and to the principle of proportionality.

[Note: BCD Annex X, Part 2 point 12 (part)]

Under the standardised approach, a firm must divide its activities into a number of business lines as set out in this section.

[Note: BCD Article 104(1)]

For each business line, a firm must calculate a capital requirement for operational risk as a certain percentage of a relevant indicator, in accordance with the rules in this section.

[Note: BCD Article 104(2)]

The ORCR under the standardised approach is calculated as the three-year average of the yearly summations of the capital requirements 2across the business lines referred to2 in BIPRU 6.4.15 R.

[Note: BCD Annex X, Part 2 point 1 (part)]

In any given year, negative capital requirements (resulting from negative gross income) in any business line may offset positive capital requirements in other business lines without limit. However, where the aggregate of the capital requirements across all business lines within a given year is negative, the input to the numerator for that year must be zero.2

[Note: BCD Annex X, Part 2 point 1 (part)]

The three year average in BIPRU 6.4.6 R must be calculated on the basis of the last three twelve monthly observations at the end of the financial year. When audited figures are not available, business estimates may be used.

[Note: BCD Annex X, Part 2 point 2]

A firm must develop and document specific policies and criteria for mapping the relevant indicator for current business lines and activities into the framework for the standardised approach. The criteria must be reviewed and adjusted for new or changing business activities and risks as appropriate.

[Note: BCD Annex X, Part 2 point 4 (part)]

1. (1)

   The principles for business line mapping that a firm must meet are set out in this rule.

2. (2)

   All activities must be mapped into the business lines in a mutually exclusive and jointly exhaustive manner.

3. (3)

   Any activity which cannot be readily mapped into the business line framework, but which represents an ancillary function to an activity included in the framework, must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective mapping criterion must be used (e.g., proportional allocation of the indicators).

4. (4)

   If an activity cannot be mapped into a particular business line then the business line yielding the highest charge for the firm must be used. The same business line equally applies to any associated ancillary activity.

5. (5)

   A firm may use internal pricing methods to allocate the relevant indicator between business lines.

6. (6)

   The mapping of activities into business lines for operational risk capital purposes must be consistent with the definitions of business lines used by the firm for credit and market risks.

7. (7)

   Senior management must be responsible for the mapping policy.

8. (8)

   The mapping process to business lines must be subject to independent review.

   [Note: BCD Annex X, Part 2 point 4 (part)]

For the purposes of BIPRU 6.4.11 R (5), costs generated in one business line which are imputable to a different business line may be reallocated to the business line to which they pertain, for instance by using a treatment based on internal transfer costs between two business lines.

[Note: BCD Annex X, Part 2 point 4 (part)]

To be eligible to use the alternative standardised approach, a firm must meet the following conditions, in addition to the general risk management standards set out in SYSC 4.1.1 R to SYSC 4.1.2 R and 1SYSC 7.1.16 R1:

1. (1)

   the firm must meet the eligibility criteria for the standardised approach in BIPRU 6.4.1 R;

2. (2)

   the firm must be overwhelmingly active in retail and/or commercial banking activities, which must account for at least 90% of its income; and

3. (3)

   the firm must be able to demonstrate that a significant proportion of its retail and/or commercial banking activities comprise loans associated with a high probability of default, and that the alternative standardised approach provides an improved basis for assessing the operational risk.

   [Note: BCD Article 104(3) and Annex X, Part 2 points 5 and 8 to 11]

1. (1)

   The relevant indicators under the alternative standardised approach are the same as for the standardised approach except for the two following business lines:

   1. (a)

      retail banking; and

   2. (b)

      commercial banking.

2. (2)

   For retail banking and commercial banking, the ORCR must be calculated as a normalised income indicator equal to the three-year average of the total nominal amount of loans and advances multiplied:

   1. (a)

      by 0.035, and then

   2. (b)

      by the appropriate business line percentage set out in BIPRU 6.4.15 R.

      [Note: BCD Annex X, Part 2 point 6]

For the retail and/or commercial banking business lines, the loans and advances must consist of the total drawn amounts in the corresponding credit portfolios.

[Note: BCD Annex X, Part 2 point 7 (part)]

For the commercial banking business line, the securities held in the non-trading book must also be included.

[Note: BCD Annex X, Part 2 point 7 (part)]

BIPRU 6.5 applies to a BIPRU firm with an AMA permission.

A firm must be able to satisfy the FSA that it meets:

1. (1)

   the general risk management standards in SYSC 4.1.1 R to SYSC 4.1.2 R and SYSC 7.1.16 R;2

2. (2)

   the qualitative standards set out in this section; and

3. (3)

   the quantitative standards set out in this section.

   [Note:BCD Article 105(2) and Annex X Part 3 point 1]

1. (1)

   This rule sets out the qualitative standards that a firm'soperational risk measurement system must meet.

2. (2)

   A firm's internal operational risk measurement system must be closely integrated into its day-to-day risk management processes.

3. (3)

   A firm must have an independent risk management function for operational risk.

4. (4)

   There must be regular reporting of operational risk exposures and loss experience. The firm must have procedures for taking appropriate corrective action.

5. (5)

   A firm's risk management system must be well documented. The firm must have a routine in place for ensuring compliance and policies for the treatment of non-compliance.

6. (6)

   A firm'soperational risk management processes and measurement systems must be subject to regular reviews performed by internal and/or external auditors.

7. (7)

   A firm must ensure that in respect of its operational risk measurement system:

   1. (a)

      its internal validation processes are operating in a satisfactory manner; and

   2. (b)

      the data flows and processes associated with the risk measurement system are transparent and accessible.

      [Note:BCD Annex X Part 3 points 2 to 7]

1. (1)

   This rule sets out the quantitative standards that a firm'soperational risk measurement system must meet with respect to process.

2. (2)

   A firm must calculate its capital requirement as comprising both expected loss and unexpected loss, unless the firm can demonstrate that expected loss is adequately captured in its internal business practices.

3. (3)

   The operational risk measure of a firm must capture potentially severe tail events, achieving a soundness standard comparable to a 99.9% confidence interval over a one year period.

4. (4)

   The operational risk measurement system of a firm must have certain key elements to meet the soundness standard set out in (2) and (3). These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in BIPRU 6.5.21 R to BIPRU 6.5.25 R.

5. (5)

   A firm must have a well documented approach for weighting the use of the four elements in (4) in its overall risk measurement system.

6. (6)

   A firm's risk measurement system must capture the major drivers of risk affecting the shape of the tail of the loss estimates.

7. (7)

   A firm must only recognise correlations in operational risk losses across individual operational risk estimates to the extent they are set out in its AMA permission. The firm must validate its correlation assumptions using appropriate quantitative and qualitative techniques.

8. (8)

   A firm's risk measurement system must be internally consistent and must avoid the multiple counting of qualitative assessments or risk mitigants recognised in other areas of the capital adequacy framework.

   [Note:BCD Annex X Part 3 points 8 to 10, 11 (part) and 12]

For the purposes of BIPRU 6.5.12 R (7), the firm must be able to show that its system for measuring correlations is sound, implemented with integrity, and takes into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress.

[Note:BCD Annex X Part 3 point 11 (part)]

1. (1)

   This rule sets out the quantitative standards that a firm'soperational risk measurement system must meet with respect to internal data.

2. (2)

   A firm's internally generated operational risk measures must be based on a minimum historical observation period of five years. When a firm first moves to the advanced measurement approach, a three year historical observation period may be used.

3. (3)

   A firm must be able to map its historical internal loss data into the business lines defined in BIPRU 6.4.15 R and into the event type categories defined in BIPRU 6.5.25 R, and must be able to provide this data to the FSA3 upon request. Loss events which affect the entire firm may be allocated to an additional business line 'corporate items' due to exceptional circumstances.3 The firm must have documented, objective criteria for allocating losses to the specified business lines and event types. A firm'soperational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the ORCR, as long as they continue to be treated as credit risk for the purposes of calculating the capital resources requirement. Operational risk losses that are related to market risks must be included in the scope of the capital requirement for operational risk.

4. (4)

   A firm's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. A firm must be able to demonstrate that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. A firm must define appropriate minimum loss thresholds for internal loss data collection.

5. (5)

   Aside from information on gross loss amounts, a firm must collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event.

6. (6)

   A firm must have specific criteria for assigning loss data arising from an event in a centralised function or an activity that spans more than one business line, as well as from related events over time.

7. (7)

   A firm must have documented procedures for assessing the ongoing relevance of historical loss data, including those situations in which judgement overrides, scaling or other adjustments may be used, to what extent they may be used and who is authorised to make such decisions.

   [Note:BCD Annex X Part 3 points 13 to 18]

1. (1)

   This rule sets out the quantitative standards that a firm'soperational risk measurement system must meet with respect to external data.

2. (2)

   A firm'soperational risk measurement system must use relevant external data, especially when there is reason to believe that the firm is exposed to infrequent, yet potentially severe, losses. A firm must have a systematic process for determining the situations for which external data should be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use should be regularly reviewed, documented and subject to periodic independent review.

   [Note:BCD Annex X Part 3 point 19]

1. (1)

   This rule sets out the quantitative standards that a firm'soperational risk measurement system must meet with respect to scenario analysis.

2. (2)

   A firm must use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments must be validated and re-assessed through comparison to actual loss experience to ensure their reasonableness.

   [Note:BCD Annex X Part 3 point 20]

1. (1)

   This rule sets out the quantitative standards that a firm'soperational risk measurement system must meet with respect to business environment and internal control factors.

2. (2)

   A firm'sfirm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile.

3. (3)

   A firm must be able to justify the choice of each factor as a meaningful driver of risk, based on experience and involving the expert judgment of the affected business areas.

4. (4)

   The sensitivity of risk estimates to changes in the factors and the relative weighting of the various factors must be well reasoned. In addition to capturing changes in risk due to improvements in risk controls, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume.

5. (5)

   A firm must document this framework and make it subject to independent review within the firm and make it available for review by supervisors.

6. (6)

   Over time, a firm must validate and re-assess the process and the outcomes through comparison to actual internal loss experience and relevant external data.

   [Note:BCD Annex X Part 3 points 21 to 24]

1. (1)

   A firm may recognise the impact of insurance for the purposes of its operational risk measurement system subject to the conditions set out in this rule and BIPRU 6.5.27 R.

2. (2)

   The provider must be authorised to provide insurance or re-insurance.

3. (3)

   The provider must have a minimum claims paying ability rating by an eligible ECAI associated with credit quality step 3 or above under the rules for the risk weighting of exposures to firms under the standardised approach to credit risk .

   [Note:BCD Annex X Part 3 points 25 to 26]

1. (1)

   A firm must ensure that its insurance and its insurance framework meet the conditions in this rule.

2. (2)

   The insurance policy must have an1 initial term of no less than one year. For policies with a residual term of less than one year the firm must make appropriate haircuts to reflect the declining residual term of the policy, up to a full 100% haircut for policies with a residual term of 90 days or less.

3. (3)

   The insurance policy must have a minimum notice period for cancellation of the contract of 90 days.

4. (4)

   The insurance policy must contain no exclusions or limitations based upon supervisory actions or, in the case of a failed firm, that preclude the firm, its receiver or liquidator from recovering for damages suffered or expenses incurred by the firm, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the firm. The insurance policy may exclude coverage for any fine, penalty or punitive damages resulting from actions by a competent authority or third country competent authority.

5. (5)

   The risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of the ORCR.

6. (6)

   The insurance must be provided by a third party entity. In the case of insurance through captives and affiliates, the exposure must be laid off to an independent third party entity, for example through reinsurance that meets the eligibility criteria.

7. (7)

   The framework for recognising insurance must be well reasoned and documented.

8. (8)

   The methodology for recognising insurance must capture the following elements through discounts or haircuts in the amount of insurance recognition:

   1. (a)

      the residual term of a policy, where less than one year, as noted in (2);

   2. (b)

      a policy's cancellation terms, where less than one year;

   3. (c)

      mismatches in coverage of insurance policies; and

   4. (d)

      the uncertainty of payment.

9. (9)

   The capital alleviation arising from the recognition of insurances and other risk transfer mechanisms3 must not exceed 20% of the capital requirement before the recognition of risk mitigation techniques.

   [Note:BCD Annex X Part 3 points 27 to 29]

A firm may recognise a risk transfer mechanism other than insurance to the extent that a noticeable risk mitigating effect is achieved and the risk transfer mechanism is included in the firm'sAMA permission.

[Note:BCD Annex X Part 3 point 25]3

Where an EEA parent institution and its subsidiary undertakings or an EEA parent financial holding company and its subsidiary undertakings use an advanced measurement approach on a unified basis for the parent undertaking and its subsidiary undertakings, the qualifying criteria set out in BIPRU 6.5 may be met by the parent undertaking and its subsidiary undertakings considered together where permitted by the AMA permission.

[Note:BCD Article 105(4)]