Competent authorities shall assess an institution's standards relating to the core modelling assumptions of the operational risk measurement system, as referred to in points (a) and (c) of Article 322(2) of Regulation (EU) No 575/2013, by verifying at least the following:

1. (a)

   that the institution develops, implements and maintains an operational risk measurement system that is methodologically well founded, effective in capturing the institution's actual and potential operational risk, and reliable and robust in generating AMA own funds requirements;

2. (b)

   that the institution has appropriate policies on the building of the calculation data set, in accordance with Article 29;

3. (c)

   that the institution applies the appropriate level of granularity in its model, in accordance with Article 30;

4. (d)

   that the institution has in place an appropriate process for the identification of loss distributions, in accordance with Article 31;

5. (e)

   that the institution determines the aggregate loss distributions and risk measures in an appropriate manner, in accordance with Article 32.

For the purposes of assessing that an institution has appropriate policies on the building of the calculation data set, as referred to in point (b) of Article 28, competent authorities shall confirm at least the following:

1. (a)

   that specific criteria and examples for the classification and treatment of operational risk events and losses within the calculation data set are defined by the institution, and that such criteria and examples provide a consistent treatment of loss data across the institution;

2. (b)

   that the institution does not use loss net of insurance and ORTM recoveries in the calculation data set;

3. (c)

   that the institution has adopted, for operational risk categories with low frequency of events, an observation period greater than the minimum referred to in point (a) of Article 322(3) of Regulation (EU) No 575/2013;

4. (d)

   that the institution, in the course of building the calculation data set for the purposes of estimating frequency and severity distributions, uses the date of discovery or the date of accounting only, and uses a date no later than the date of accounting for including losses or provisions related to legal risk into the calculation dataset;

5. (e)

   that the institution's choice of the minimum modelling threshold does not adversely impact the accuracy of the operational risk measures and that the use of minimum modelling thresholds that are much higher than the data collection thresholds is limited and, where applied, is properly justified by sensitivity analysis of various thresholds performed by the institution;

6. (f)

   that the institution includes all operational losses above the chosen minimum modelling threshold in the calculation data set and that it uses them, irrespective of their level, for generating the AMA own funds requirements;

7. (g)

   that the institution applies appropriate adjustment rates on the data where inflation or deflation effects are material;

8. (h)

   that losses caused by root event in the form of a common operational risk event or by multiple events linked to an initial operational risk event generating events or losses are grouped and entered into the calculation data set as a single loss by the institution;

9. (i)

   that any possible exceptions to the treatment laid down in point (h) are properly documented and justified to prevent undue reduction of the AMA own funds requirements;

10. (j)

    that the institution does not discard from the AMA calculation data set material adjustments to operational risk losses of single or linked events, where the reference date of these adjustments falls within the observation period and the reference date of the initial, single event or root event referred to in point (h) falls outside such a period;

11. (k)

    that the institution is able to distinguish, for each reference year included in the observation period, the loss amounts pertinent to events discovered or accounted for in that year from the loss amounts pertinent to adjustments or grouping of events discovered or accounted for in previous years.

For the purposes of assessing that an institution applies the appropriate level of granularity in its model, as referred to in point (c) of Article 28, competent authorities shall confirm at least the following:

1. (a)

   that the institution takes into account the nature, complexity and idiosyncrasies of its business activities and the operational risks which it is exposed to, where grouping together risks sharing common factors and defining the operational risk categories of an AMA;

2. (b)

   that the institution justifies its choice of level of granularity of its operational risk categories on the basis of qualitative and quantitative means, and that it classifies operational risk categories based on homogeneous, independent and stationary data;

3. (c)

   that the institution's choice of level of granularity of its operational risk categories is realistic and does not adversely impact the conservatism of the model outcome or of its parts;

4. (d)

   that the institution reviews the choice of level of granularity of its operational risk categories on a regular basis with the view to ensuring that it remains appropriate.

For the purposes of assessing that an institution has an appropriate process for the identification of frequency and severity of the distributions of loss, as referred to in point (d) of Article 28, competent authorities shall confirm at least the following:

1. (a)

   that the institution follows a well specified, documented and traceable process for the selection, update and review of loss distributions and the estimate of their parameters;

2. (b)

   that the process for the selection of the loss distributions results in consistent and clear choices by the institution, properly captures the risk profile in the tail and includes at least the following elements:

   1. (i)

      a process of using statistical tools, including graphs, measures of centre, variation, skewness and leptokurtosis to investigate the calculation data set for each operational risk category with the view to better understand the statistical profile of the data and selecting the most suitable distribution;

   2. (ii)

      appropriate techniques for the estimation of the distribution parameters;

   3. (iii)

      appropriate diagnostic tools for evaluating the distributions to the data, giving preference to those most sensitive to the tail;

3. (c)

   that, in the course of selecting a loss distribution, the institution carefully considers the positive skewness and leptokurtosis of the data;

4. (d)

   that, where the data are much dispersed in the tail, empirical curves are not used to estimate the tail region, but that instead sub-exponential distributions whose tail decays slower than the exponential distributions are used, unless exceptional reasons exist to apply other functions, which are in any case properly addressed and fully justified to prevent undue reduction of AMA own funds requirements;

5. (e)

   that, where separate loss distributions are used for the body and for the tail, the institution carefully considers the choice of the body-tail modelling threshold;

6. (f)

   that documented statistical support, supplemented as appropriate by qualitative elements, is provided for the selected body-tail modelling threshold;

7. (g)

   that, in the course of estimating the parameters of the distribution, the institution either reflects the incompleteness of the calculation data set due to the presence of minimum modelling thresholds in the model or that it justifies the use of an incomplete calculation data set on the basis that it does not adversely impact the accuracy of the parameter estimates and AMA own funds requirements;

8. (h)

   that the institution has in place methodologies to reduce the variability of estimates of parameters and provides measures of the error around these estimates including confidence intervals and p-values;

9. (i)

   that, where the institution adopts robust estimators in the form of generalisations of classical estimators, with good statistical properties including high efficiency and low bias for a whole neighbourhood of the unknown underlying distribution of the data, it can demonstrate that their use does not underestimate the risk in the tail of the loss distribution;

10. (j)

    that the institution assesses the goodness-of-fit between the data and the selected distribution by using diagnostic tools of both a graphical and a quantitative nature, which are more sensitive to the tail than to the body of the data, especially where the data are very dispersed in the tail;

11. (k)

    that, where appropriate, including where the diagnostic tools do not lead to a clear choice for the best-fitting distribution or to mitigate the effect of the sample size and the number of estimated parameters in the goodness-of-fit tests, the institution uses evaluation methods that compare the relative performance of the loss distributions, including the Likelihood Ratio, the Akaike Information Criterion, and the Schwarz Bayesian Criterion;

12. (l)

    that the institution has a regular cycle for controlling assumptions underlying the selected loss distributions, and that where assumptions are invalidated, including where they generate values outside established ranges, the institution has tested alternative methods and that it has properly classified any changes made to the assumptions, in accordance with Commission Delegated Regulation (EU) No 529/2014.

For the purposes of assessing that an institution determines the aggregated loss distributions and risk measures in an appropriate manner, as referred to in point (e) of Article 28, competent authorities shall confirm at least the following:

1. (a)

   that the techniques elaborated by the institution for that purpose ensure appropriate levels of precision and stability of the risk measures;

2. (b)

   that the risk measures are supplemented with information on their level of accuracy;

3. (c)

   that, irrespective of the techniques used to aggregate frequency and severity loss distributions, including Monte Carlo simulations, Fourier Transform-related methods, Panjer algorithm and Single Loss Approximations, the institution adopts criteria that mitigate sample and numerical related errors and provides a measure of the magnitude of these errors;

4. (d)

   that, where Monte Carlo simulations are used, the number of steps to be performed is consistent with the shape of the distributions and with the confidence level to be achieved;

5. (e)

   that, where the distribution of losses is heavy-tailed and measured at a high confidence level, the number of steps is sufficiently large to reduce sampling variability to an acceptable level;

6. (f)

   that, where Fourier Transform or other numerical methods are used, algorithm stability and error propagation issues are carefully considered;

7. (g)

   that the institution's risk measure generated by the operational risk measurement system fulfils the monotonic principle of risk, which can be seen in the generation of higher own fund requirements where the underlying risk profile increases and in the generation of lower own funds requirements where the underlying risk profile decreases;

8. (h)

   that the institution's risk measure generated by the operational risk measurement system is realistic from a managerial and economical perspective, and more that the institution applies appropriate techniques to avoid capping the maximum single loss, unless it provides a clear objective rationale for the existence of an upper bound, and to avoid implying the non-existence of the first statistical moment of the distribution;

9. (i)

   that the institution explicitly evaluates the robustness of the outcome of the operational risk measurement system by performing appropriate sensitivity analysis on the input data or its parameters.