EBA formally provides its Basel III advice

Following the publication of 'Call for advice on Basel III implementation: key findings from the impact assessment and policy recommendations' on 2 July, on 5 August, the EBA formally delivered its advice to the European Commission on the implementation of the Basel III framework. Specific policy advice for operational risk is available here, and you can read our analysis of their 2 July announcement in this post.

In an extensive document, the EBA included both quantitative and qualitative recommendations, supported by an econometric study and a capital impact assessment based on 189 banks. In this article I've pulled out some of the key points and highlights from their recommendations. The EBA have refer to the SMA as the BCBS SA, so I've used that terminology here too.

Highlights and key points

The paper confirms the use of loss data throughout the BCBS SA, extending this option to qualifying smaller institutions. Long awaited clarification is also given on the potential exclusion of losses from the calculation.

Significantly, there are a range of qualitative recommendations that are designed to address parts of operational risk regulation and frameworks on which the BCBS SA is not necessarily dependent. Materially, this includes the requirement to use “AMA like” inputs (e.g. external data) within ICAAP; the extension of risk taxonomies to explicitly capture ICT, Model and Legal risks; a focus on collecting near misses; and operational risk gains.

The EBA continues to suggest a phased approach for implementation, but no specific dates are given.

Quantitative recommendations

The qualitative recommendations cover the specific implementation of the BCBS SA that the EBA is proposing.

Use of loss data (the ILM) in the BCBS SA framework is confirmed and potentially extended to smaller institutions

As a starting point, the EBA sought to harmonise the implementation of BCBS SA across the EU where possible, and specifically to ensure a level playing field, it recommends that decisions around the use of loss data with the calculation should be the same for all banks.

They performed analysis on the capital impact when losses are included or excluded, and performed wider analysis on the conceptual use of loss data as an indicator for future losses. The empirical analysis, which was based on the 2016 federal reserve research by F. Curti and M. Migueis (Predicting operational loss exposure using past losses), included:

• Improvements in data quality
• An additional incentive to reduce future losses
• Alignment between P1 and P2 practices, as loss data is used in each case

Based on this assessment, they recommend that internal loss data should be used in the calculation.

The EBA have given significant thought to the option of extending the ILM to smaller (Bucket 1) banks. They recommended discretion to allow the ILM to be used by smaller institutions after taking into account: 

• The increased supervisory burden, comparability, data challenges and capital arbitrage
• The high BI threshold for Bucket 2 (EUR 1bn)
• The benefits of a stronger link between capital incentives and operational risk management

Further regulation is suggested to clearly articulate the criteria for allowing smaller banks to use the ILM.

Phased in approach, but details to be confirmed

For larger institutions (Bucket 2 and 3) the EBA notes that they may benefit from a more gradual introduction of the BCBS SA. A phased-in solution would not only smooth any capital cliff effects, but potentially improve the quality of the loss data. No specific details of implementation timing were given.

Greater guidance on losses, but some flexibility on thresholds and time periods

Some clarification on losses which span multiple years, but do not reach the materiality threshold of €20k, is given in the document.

As a default, losses which total above €20k will be included, but the EBA recommends giving permission to use a higher threshold of €100k where it is beneficial. The argument given is that, for some institutions, a higher threshold can be more risk sensitive, as smaller losses are more within the expected range and are managed and priced for accordingly.

Exclusions of loss events is possible but thorough justification needed

Substantial guidance is given for how individual losses deemed no longer relevant can be excluded from the calculation. This clarifies an area which was open-ended during BCBS consultations.

The EBA recommends increasing the materiality threshold for the consideration of exclusions. To exclude an individual loss which refers to ongoing activities, each one must be at least 15 per cent of the average annual loss (an increase from 5 per cent in the BCBS paper), but for divested businesses losses have a 0 per cent threshold – meaning that they can all be excluded.

However, all losses are subject to a minimum retention period of three years, and the EBA sets out thorough evidence and strong justifications banks need to provide to supervisors to exclude each loss.

Qualitative recommendations

The EBA also provided a series of qualitative recommendations, which are designed to supplement other aspects of the operational risk framework.

Although largely outside the scope of the BCBS SA, it appears that the process of changing the capital framework is also being used as an opportunity to provide clarification and align exiting regulation.  

ICT, legal and model risk identified as key in an extended risk taxonomy

The EBA sees the introduction of the BCBS SA as an opportunity to address some perceived limitations in the definition of operational risk and “harmonise the manner by which banks and supervisors classify operational risk subcategories and related losses”.

Specifically, it recommends that ICT (cyber and data security), legal and model risks are identified as key sub-categories of operational risk. The paper acknowledges that more work is to be done in this area, but it suggests one method of extending an operational risk taxonomy to include these risks would be via the use of a flag (referred to as a distinct dimension). This approach of tagging to capture new risks or themes is something that ORX has seen extensively in its ongoing work on operational risk taxonomies.

As well as supporting improved risk management, clearer identification of these risks is an important step in accurately calculating some items with the BI component of the BCBS SA.

Loss data governance, and the need for near misses and gains

Guidance is given around the expectations on loss data that is used to support the BCBS SA. Some of this is driven by the results of a qualitative questionnaire on loss data collection within EU institutions.

Usefully, it appears that wherever possible the EBA links to existing requirements (e.g. CDR 959/2018), and notes any extensions that are needed. Specific notice is given to credit and market risk boundary events, and the requirement to collect near misses and operational risk gains.

Higher requirements on governance, reporting and control of operational risk principally apply to larger institutions (Bucket 2 and 3 banks), but the EBA introduces the concept of a larger Bucket 1 bank (between €750 and €1000 M) for whom extra scrutiny is needed.

Periodic supervisory reviews of data quality (every 2 or 3 years) are also recommended.

ICAAP and Pillar 2 draws external data and scenarios from the AMA

In a widely debated area, the EBA sets out the impact that the BCBS SA will have on existing ICAAP and Pillar 2 processes. As anticipated, the expectations for ICAAP build on elements of the AMA, requiring the use of internal data, external data and scenario analysis. Business environment and internal control factors (BEICF), which historically played a very minor role in capital models, are switched to key risk indicators.

Table 1: Recommendation 34

In adopting the BCBS SA on operational risk, a provision should be introduced requiring institutions to use internal data, scenario analysis, external data and key risk indicators in their ICAAP, to ensure (i) greater effectiveness in the management and control of operational risk; (ii) a more granular measurement of operational risk exposure, including its forward-looking perspective; and (iii) better allocation of operational risk own funds across the organisation and more informative supervisory decisions on Pillar 2 add-ons on operational risk.

Business indicator — FINREP mapping

To help support consistent calculation of the Business Indicator, the EBA when possible provides a mapping from BI elements to FINREP definitions.