On July 27, 2023, the Federal Reserve Board, Federal Deposit Insurance Corporation, and the Office of Comptroller of the Currency (“Agencies”) jointly issued a Notice of Proposed Rulemaking (NPR) for the implementation of the Basel III Endgame that would significantly revise the capital requirements for banking organizations with $100 billion or more in assets.
Among other revisions, the NPR proposes new capital requirements related to operational risk.1 The current requirement, based on the advanced measurement approach (AMA) framework, requires banks to develop internal models to measure operational risk. However, under the NPR, the agencies eliminate the use of internal models for operational risk out of concern that internal models lack transparency and comparability. Internal models present challenges for supervisors and market participants to assess the relative magnitude of operational risk across banking organizations, the adequacy of operational risk capital, and the effectiveness of operational risk management practices.
Updated Provisions Under NPR
- New Capital Requirement – The NPR introduces a capital requirement for operational risk based on a standardized approach. The operational risk capital requirements are a function of a large banking organization’s business indicator component and internal loss multiplier:
- The business indicator is intended to serve as a proxy for a banking organization’s business volume and is based on inputs from the financial statements. It is derived from the three-year rolling average of three income components: 1) interest, lease, and dividends, e.g., lending and investment activities; 2) services, e.g., fee and commission-based activities; and 3) financial, e.g., trading activity.
- The internal loss multiplier is a scaling factor applied to the operational risk capital requirement derived from the business indicator component and is based on the banking organization’s actual historical operational loss experience. The internal loss multiplier is based on the ratio of a banking organization’s average annual net operational losses over the last 10 years to its business indicator component. In the NPR, the Agencies floor the internal loss multiplier at one so that lower historical loss experience cannot decrease operational risk capital requirements.
A large banking organization’s operational risk capital requirement is calculated by multiplying its business indicator component by its internal loss multiplier. The result is then multiplied by 12.5 to arrive at the risk-weighted assets for operational risk. - Independent Operational Risk Function – Banking organizations must have an operational risk management function independent of business line management. This independent operational risk management function is expected to design, implement, and oversee the comprehensiveness and accuracy of operational loss event data collection processes, in addition to overseeing other aspects of the banking organization’s operational risk management.
- Better Review and Documentation – Banking organizations are required to document the procedures used for the identification and collection of operational loss event data. Additionally, they are required to have processes to independently review the comprehensiveness and accuracy of operational loss data and submit these processes to regular independent reviews by internal or external audit functions.
- Stronger Data Collection – Banking organizations must collect operational loss event data for all operational loss events which result in $20,000 or more of gross operational loss.
- Root Cause Analysis – Banking organizations must collect descriptive information about the causes of operational loss events which result in a gross operational loss of $20,000 or more. The level of detail for the descriptive information should be commensurate with the size of the gross loss amount of the operational loss event.
- Timing Losses – Timing losses would constitute an operational loss. A timing loss is the negative financial impact on a banking organization’s financial statements due to having incorrectly booked a positive financial impact in a previous financial statement, e.g., revenue overstatement, accounting, and mark-to-market errors. However, if the overstatement and its correction occur in the same financial statement period there would be no operational loss.
- Insurance Recoveries – Insurance recoveries would be included as part of the internal loss multiplier calculation in the quarter in which they are paid to the banking organization. However, insurance receivables would not be considered recoveries.
- Reporting of Loss Events – Banking organizations must report operational loss events and other relevant operational risk information to business line management, senior management, and the board of directors (or a designated committee of the board).
As implementation of the Basel III Endgame moves forward, banking organizations should become familiar with the proposed regulation, how it applies to their current operations, and implications for reporting on FR Y-14Q, Schedule E (Operational Risk). Whatever shape the final rules take, there will be a significant impact on the global financial market as banking organizations restructure their businesses and reconfigure balance sheets to meet the new capital requirements. Banking organizations should perform an impact assessment to understand the effects that the NPR will have on its regulatory capital requirements, including overlap with its Stress Capital Buffer (SCB), and the costs associated with compliance.
If you have questions or need assistance, please reach out to a professional at FORVIS or submit the Contact Us form below.
- 1Operational risk refers to the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events.