(a) Qualification to use operational risk mitigants. A [bank] may adjust its estimate of operational risk exposure to reflect qualifying operational risk mitigants if:

(1) The [bank]�s operational risk quantification system is able to generate an estimate of the [bank]�s operational risk exposure (which does not incorporate qualifying operational risk mitigants) and an estimate of the [bank]�s operational risk exposure adjusted to incorporate qualifying operational risk mitigants; and

(2) The [bank]�s methodology for incorporating the effects of insurance, if the [bank] uses insurance as an operational risk mitigant, captures through appropriate discounts to the amount of risk mitigation:

(i) The residual term of the policy, where less than one year;

(ii) The cancellation terms of the policy, where less than one year;

(iii) The policy�s timeliness of payment;

(iv) The uncertainty of payment by the provider of the policy; and

(v) Mismatches in coverage between the policy and the hedged operational loss event.

(b) Qualifying operational risk mitigants. Qualifying operational risk mitigants are:

(1) Insurance that:

(i) Is provided by an unaffiliated company that has a claims payment ability that is rated in one of the three highest rating categories by a NRSRO;

(ii) Has an initial term of at least one year and a residual term of more than 90 days;

(iii) Has a minimum notice period for cancellation by the provider of 90 days;

(iv) Has no exclusions or limitations based upon regulatory action or for the receiver or liquidator of a failed depository institution; and

(v) Is explicitly mapped to a potential operational loss event; and

(2) Operational risk mitigants other than insurance for which the [AGENCY] has given prior written approval. In evaluating an operational risk mitigant other than insurance, [AGENCY] will consider whether the operational risk mitigant covers potential operational losses in a manner equivalent to holding regulatory capital.

(a) If a [bank] does not qualify to use or does not have qualifying operational risk mitigants, the [bank]�s dollar risk-based capital requirement for operational risk is its operational risk exposure minus eligible operational risk offsets (if any).

(b) If a [bank] qualifies to use operational risk mitigants and has qualifying operational risk mitigants, the [bank]�s dollar risk-based capital requirement for operational risk is the greater of:

(1) The [bank]�s operational risk exposure adjusted for qualifying operational risk mitigants minus eligible operational risk offsets (if any); or

(2) 0.8 multiplied by the difference between:

(i) The [bank]�s operational risk exposure; and

(ii) Eligible operational risk offsets (if any).

(c) The [bank]�s risk-weighted asset amount for operational risk equals the [bank]�s dollar risk-based capital requirement for operational risk determined under paragraph (a) or (b) of this section multiplied by 12.5.