This section describes features of the AMA framework for determining the risk-based capital requirement for operational risk. The proposed framework remains fundamentally similar to that described in the ANPR. Under this framework, a bank meeting the AMA qualifying criteria would use its internal operational risk quantification system to calculate its risk-based capital requirement for operational risk.
Currently, the agencies' general risk-based capital rules do not include an explicit capital charge for operational risk. Rather, the existing risk-based capital rules were designed to cover all risks, and therefore implicitly cover operational risk. With the introduction of the IRB framework for credit risk in this NPR, which would result in a more risk-sensitive treatment of credit risk, there no longer would be an implicit capital buffer for other risks.
The agencies recognize that operational risk is a key risk in banks, and evidence indicates that a number of factors are driving increases in operational risk. These factors include greater use of automated technology, proliferation of new and highly complex products, growth of e-banking transactions and related business applications, large-scale acquisitions, mergers, and consolidations, and greater use of outsourcing arrangements. Furthermore, the recent experience of a number of high-profile, high-severity losses across the banking industry, including those resulting from legal settlements, highlight operational risk as a major source of unexpected losses. Because the implicit regulatory capital buffer for operational risk would be removed under the proposed rule, the agencies propose to require banks using the IRB framework for credit risk to use the AMA to address operational risk when computing a capital charge for regulatory capital purposes.
As defined previously, operational risk exposure is the 99.9th percentile of the distribution of potential aggregate operational losses as generated by the bank's operational risk quantification system over a one-year horizon. EOL is the expected value of the same distribution of potential aggregate operational losses. The ANPR specified that a bank's risk-based capital requirement for operational risk would be the sum of EOL and UOL unless the bank could demonstrate that an EOL offset would meet supervisory standards. The agencies described two approaches - reserving and budgeting – that might allow for some offset of EOL; however, the agencies expressed some reservation about both approaches. The agencies believed that reserves established for expected operational losses would likely not meet U.S. accounting standards and that budgeted funds might not be sufficiently capital-like to cover EOL.
While the proposed framework remains fundamentally similar to that described in the ANPR and a bank would continue to be allowed to recognize (i) certain offsets for EOL, and (ii) the effect of risk mitigants such as insurance in calculating its regulatory capital requirement for operational risk, the agencies have clarified certain aspects of the proposed framework. In particular, the agencies have re-assessed the ability of banks to take prudent steps to offset EOL through internal business practices.
After further analysis and discussions with the industry, the agencies believe that certain reserves and other internal business practices could qualify as an EOL offset. Under the proposed rule, a bank's risk-based capital requirement for operational risk may be based on UOL alone if the bank can demonstrate it has offset EOL with eligible operational risk offsets, which are defined as amounts (i) generated by internal business practices to absorb highly predictable and reasonably stable operational losses, including reserves calculated in a manner consistent with GAAP; and (ii) available to cover EOL with a high degree of certainty over a one-year horizon. Eligible operational risk offsets may only be used to offset EOL, not UOL.
In determining whether to accept a proposed EOL offset, the agencies will consider whether the proposed offset would be available to cover EOL with a high degree of certainty over a one-year horizon. Supervisory recognition of EOL offsets will be limited to those business lines and event types with highly predictable, routine losses. Based on discussions with the industry and empirical data, highly predictable and routine losses appear to be limited to those relating to securities processing and to credit card fraud. Question 59: The agencies are interested in commenters' views on other business lines or event types in which highly predictable, routine losses have been observed.
In determining its operational risk exposure, the bank could also take into account the effects of risk mitigants such as insurance, subject to approval from its primary Federal supervisor. In order to recognize the effects of risk mitigants such as insurance for risk-based capital purposes, the bank must estimate its operational risk exposure with and without such effects. The reduction in a bank's risk-based capital requirement for operational risk due to risk mitigants may not exceed 20 percent of the bank's risk-based capital requirement for operational risk, after approved adjustments for EOL offsets. A bank must demonstrate that a risk mitigant is able to absorb losses with sufficient certainty to warrant inclusion in the adjustment to the operational risk exposure. For a risk mitigant to meet this standard, it must be insurance that:
(i) is provided by an unaffiliated company that has a claims paying ability that is rated in one of the three highest rating categories by an NRSRO;
(ii) has an initial term of at least one year and a residual term of more than 90 days;
(iii) has a minimum notice period for cancellation of 90 days;
(iv) has no exclusions or limitations based upon regulatory action or for the receiver or liquidator of a failed bank; and
(v) is explicitly mapped to an actual operational risk exposure of the bank.
The bank's methodology for recognizing risk mitigants must also capture, through appropriate discounts in the amount of risk mitigants, the residual term of the risk mitigant, where less than one year; the risk mitigant's cancellation terms, where less than one year; the risk mitigant's timeliness of payment; and the uncertainty of payment as well as mismatches in coverage between the risk mitigant and the hedged operational loss event. The bank may not recognize for regulatory capital purposes risk mitigants with a residual term of 90 days or less.
Commenters on the ANPR raised concerns that limiting the risk mitigating benefits of insurance to 20 percent of the bank's regulatory capital requirement for operational risk represents an overly prescriptive and arbitrary value. Concerns were raised that such a cap would inhibit development of this important risk mitigation tool. Commenters believed that the full contract amount of insurance should be recognized as the risk mitigating value. The agencies, however, believe that the 20 percent limit continues to be a prudent limit.
Currently, the primary risk mitigant available for operational risk is insurance. While certain securities products may be developed over time that could provide risk mitigation benefits, no specific products have emerged to-date that have characteristics sufficient to be considered a capital replacement for operational risk. However, as innovation in this field continues, a bank may be able to realize the benefits of risk mitigation through certain capital markets instruments with the approval of its primary Federal supervisor.
If a bank does not qualify to use or does not have qualifying operational risk mitigants, the bank's dollar risk-based capital requirement for operational risk would be its operational risk exposure minus eligible operational risk offsets (if any). If a bank qualifies to use operational risk mitigants and has qualifying operational risk mitigants, the bank's dollar risk-based capital requirement for operational risk would be the greater of: (i) the bank's operational risk exposure adjusted for qualifying operational risk mitigants minus eligible operational risk offsets (if any); and (ii) 0.8 multiplied by the difference between the bank's operational risk exposure and its eligible operational risk offsets (if any). The dollar risk-based capital requirement for operational risk would be multiplied by 12.5 to convert it into an equivalent risk-weighted asset amount. The resulting amount would be added to the comparable amount for credit risk in calculating the institution's risk-based capital denominator.