Operational Risk & the Regulatory Environment

1. Operational Risk & the Regulatory Environment Simon Hills Director - Prudential Capital team

2. Operational Risk & the Regulatory Environment What is Prudential Capital regulation for? • enhancing stability of the financial system • protecting depositors • advancing financial institutions‘ risk management • ensuring level-playing field by further aligning regulatory practices But: • capital is expensive • trade-off between stability and efficiencyof banking system

3. Operational Risk & the Regulatory Environment Basel I • Relatively crude risk weighting system • Inadequate incentives for risk mitigation (and some perverse incentives) • Some categories of risk not covered at all • Market developments not properly reflected – • new products • avoidance/mitigation techniques

4. Operational Risk & the Regulatory Environment Basel 2 • More flexible, risk sensitive system • Overall capital broadly unchanged under standard approach, but with incentives for better risk management • Competitive equality • Emphasis on banks’ own internal control, management and risk assessment, with supervisory evaluation • Market discipline

5. Operational Risk & the Regulatory Environment Structure of new Accord: the three pillars • Pillar I – minimum capital requirement • Pillar II – supervisory review • Pillar III – market discipline

6. Operational Risk & the Regulatory Environment • Replaces Basel 1 which requires banks to hold 8% of funds lent in capital • Capital required to cover credit, market and operational risk • Operational risk charge covers expected and unexpected losses – but not catastrophic loss • Must quantity operational risk – and assess the quality of Operational Risk management in order to ensure that banks that manage risk well see a reduction in regulatory capital

7. Operational Risk & the Regulatory Environment Operational risk Risk of loss from inadequacy/failure of internal processes/systems people or external events: includes legal risk but not strategic and reputation risk • “Basic indicator” and “standardised” approaches based on income (differentiated by business line in standardised approach) • “Advanced measurement approach” uses risk measure generated by bank’s internal operational risk measurement system • AMA permitted only where specified standards satisfied

8. Operational Risk & the Regulatory Environment Problems with Quantification • Inadequate or insufficient data to build a well populated database • Need to apply imprecise measures for frequency and impact • No quantifiable size of exposure amount due to impossibility of forecasting how different risk issues will combine to produce a major operational loss event

9. Operational Risk & the Regulatory Environment Problems with Quantification • Can’t know when portfolio of risks is complete • Context dependent – reduction in relevance of historic loss data • Not an exact science! • Main benefit – to prioritise management actions and assess Cost benefit of mitigation measures

10. Operational Risk & the Regulatory Environment The Basic Indicator Approach • Hold capital for operational risk equal to 15% of average annual gross income over the previous three years • Gross income is net interest income + net non-interest income + gross of provisions and before profits/losses from sale of securities in the banking book, extraordinary items and insurance income. • No specific qualitative requirements but banks using the approach are encouraged to comply with the requirements of the Sound Practices paper

11. Operational Risk & the Regulatory Environment The Standardised Approach • Under the Standardised approach the institution divides its activities into 8 business lines. • Each business line has a beta factor based on the perceived “riskiness” of each activity. • The capital charge for each business line will be found by multiplying the gross income by the beta factor. • The resulting figures will be added together to find the overall capital charge. • A qualitative assessment of the OR management framework will be carried out by Regulators before this approach can be used and certain governance standards must be met.

12. Operational Risk & the Regulatory Environment Business Lines and Beta Factors • Corporate Finance 18% • Trading and Sales 18% • Retail Banking 12% • Commercial Banking 15% • Payment and Settlement 18% • Agency Services 15% • Asset Management 12% • Retail Brokerage 12%

13. Operational Risk & the Regulatory Environment The Advanced Measurement Approaches • Under the AMA, the regulatory capital requirement will equal the risk measure generated by the bank’s internal operational risk management system using the quantitative and qualitative criteria for the AMA. • The methodology developed by the bank will need to be approached by the regulator before use. • Under the AMA the capital charge may be reduced by up to 20% to reorganise the mitigating effect of insurance.

14. Operational Risk & the Regulatory Environment Firms must track internal loss data and meet the following standards: • 5 year observation period (3 years initially). • Reviewed regularly to ensure consistency with current activities. • Mapped to the Basel loss categorisation. • Comprehensive above a threshold. • Appropriately and consistently assigned. • Consistent, defined boundaries with other risk types

15. Operational Risk & the Regulatory Environment • What are the characteristics of the loss events? • What are the key factors in determining size and frequency of loss? • Why was the tail event more significant? • Can we think of other scenarios that could give rise to similarly significant losses? • Is there anything we can do to stop these events? • Is it our belief that the dataset represents a “typical” year? • Are we capturing the full range of potential loss events in the histogram? Does this reflect our full risk profile? • Do the losses that have occurred fully illustrate our risk exposures?

16. Operational Risk & the Regulatory Environment Conclusions • Management not Measurement • Imprecise science • Integrate measurement into Operational Risk Management framework • Use data to inform decisions • Control framework • Evaluate mitigation • Prioritise corrective action • Low frequency/High impact events drive operational risk capital!