10. Operational Risk
Sub-sections ( 10.1 to 10.4.7) have been updated by Basel Framework, issued by SAMA circular No (44047144), dated 04/06/1444 H, Corresponding To 27/12/2022 G, Refer to the Minimum Capital Requirements for Operational Risk Framework.10.1. Introduction
10.1.1 Scope and application
This section sets out the framework for measuring capital requirements for operational risk of banks. It describes the framework in terms of the availability and choice of measurement approaches; the qualifying criteria for adoption of the more advanced approaches; and the measurement methodologies under each of the available approaches.
10.1.2 Four approaches are being made available by SAMA for measuring capital charge for operational risk.
• The Basic Indicator Approach (BIA);
• The Standardized Approach (STA); and
• The Alternative Standardized Approach (ASA)
• The Advanced Management Approaches (AMA)
10.1.3 A bank is expected to use the BIA unless it has prior approval of SAMA to adopt a more advanced approach. Banks proposing to apply the BIA approach must have internal operational risk management systems in compliance with the requirements set out in the paper issued by the Basel committee in 2003 entitled “Sound Practices for the Management and Supervision of Operational Risk”.
10.1.4 Banks proposing to use the STA, ASA or AMA must satisfy SAMA that they meet the minimum qualifying criteria set out in section 2 below.
10.1.5 The risk-weighted exposure for operational risk of a bank will be summed together with the risk-weighted exposures for credit and market risk to yield the total risk- weighted exposures which will then be used to calculate the Capital Adequacy Ratio (CAR).
10.2. Qualifying Criteria for the Standardised Approach (STA), Alternative Standardised Approach (ASA), and Advance Management Approaches (AMA)
10.2.1 Subject to meeting the minimum qualifying requirements, banks may seek SAMA’s approval to use either the STA, or ASA or AMA approaches.
10.2.2 To use the STA, ASA or AMA which are more advanced approaches for measuring the capital charge for operational risk, a bank must have in place adequate internal operational risk management systems that are commensurate with the nature, volume and complexity of its business activities. In particular, it should meet the criteria set out in Basel II document.
1. Standardized Approach
In order to qualify for the Standardized Approach or the Alternative Standardized Approach a bank must satisfy SAMA that the conditions described in Para’s 660 to 663 of Basel II Document have been fully met or complied with.
2. Advance Management Approaches (AMA)
In order to qualify for the AMA, banks must satisfy SAMA that the requirements under Para’s 664 to Para 679 of Basel II Document are satisfied.
10.3. Measurement Methodologies
10.3.1 BIA, STA or AMA
Gross income is used as a broad indicator for the scale of a bank's operational risk exposure. The capital charge is calculated by multiplying gross income by a factor (denoted as alpha or beta). The factor serves as a proxy for the relationship between operational losses and the gross income of a bank. In the BIA gross income is measured on an aggregate basis, whereas in the STA or ASA gross income is measured for each business line, not the whole bank. The detailed measurement methodologies for each of the approaches are described in Basel II document from Para 645 to 659.
10.3.2 Advance Measurement Approach (AMA)
While the AMA as an approach incorporates extensive and sophisticated data assembly and models, the Agency has permitted its use as an option. Consequently, banks planning to implement the AMA should refer to the measurement methodology relative to data and models and other minimum measurement standards described in the Basel document from Para 664 to Para 679.Further guidance in this area would be made available in due course by SAMA.
10.4. Partial Use
[680-683] The new Basel framework permits a Basic Indicator Approach, a Standardized Approach and an Advanced Management Approach (AMA). SAMA initially expects banks to move to the Basic Indicator or the Standardized Approach and thereafter to the more advanced AMA approach supervisor. However, the new Basel framework also permits banks to use an AMA for some parts of its operations and the Basic Indicator Approach or Standardized Approach for the balance (“partial use”), on both a transitional and permanent basis, subject to certain conditions.
These conditions include:
• All operational risks of the bank‘s global, consolidated operations are captured;
• All of the bank‘s operations that are covered by the AMA meet the qualitative criteria for using an AMA, while those parts of its operations that are using one of the simpler approaches meet the qualifying criteria for that approach;
• On implementation date, a significant part of the Banks operational risk should be captured by the AMA, and;
• The Bank must provide a timetable outlining how it intends to roll out the AMA across all but on immaterial part of its operations. A Bank may determine which parts of its operations would use an AMA based on a business line, legal entity, geographical or other internally determined basis.
(Refer para 680-683, International Convergence of Capital Measurement and Capital Standards – June 2006)
10.4.1 Basis for Determining Partial Use
Banks generally tend to manage operational risk on a business line basis. The business line management approach lends itself to a business line approach for partial use purposes. However, there may be valid reasons, such as the cost associated with implementing an AMA relative to the materiality of the risk, to exclude a legal entity that engages in the banks business lines but represents only a small part of each business line. Therefore, SAMA proposes to permit domestic banks to determine partial use on a business line or legal entity basis, or a combination of the two. Any activity that is excluded from the AMA calculation could not be included in the determination of group-wide diversification benefits within the AMA. For simplicity and ease of implementation, SAMA does not propose to make available other bases for determining partial use.
10.4.2 Definition of “Significance” and “Material” for Partial Use Purposes
The operational risk section of the new Basel framework does not define the terms significant and material. It is left to national supervisory authorities to define these terms for their Banks.
SAMA defines “significant” as that part of a bank on operations that represents 75 percent of the Banks operational risk and “material” as that part representing 90 percent. It is proposed that a Banks should have five years from its implementation of an AMA to reach the 90 percent threshold and that it should demonstrate progress in moving from 75 percent to 90 percent during that period. A banks operational risk and these thresholds would be measured in terms of the minimum regulatory capital calculated using the Standardized Approach. This would require an AMA Bank to continue calculating capital using the Standardized Approach for up to 5 years post-implementation. SAMA accepts this proposal as both a practical and reasonable approach to the definition of “significant” and “material” for this section of the new Basel framework.
10.4.3 Partial Use for Banks Using the Standardized Approach
The new Basel framework permits the partial use of operational risk approaches only for banks implementing an AMA. However, the BCBS recognizes that there may be instances where a bank that chooses to adopt the Standardized Approach for its global, consolidated operations is required to implement an AMA for a branch operating in another jurisdiction. In these cases, a bank would be permitted to incorporate that AMA capital amount in its global consolidated capital calculation, with supervisory approval. SAMA proposes to make this flexibility available to its domestic banks, subject to any conditions laid out in the new Basel framework.
Apart from these instances, SAMA requires to permit a banks using the Standardized approach to use Basic Indicator Approach for parts of its operations on a transitional basis only, for a period not exceeding 3 years. SAMA would permit partial use only where the Bank can demonstrate that it is not being implemented for capital arbitrage purposes.
10.4.4 Available Approaches for Partial Use
The new Basel framework allows a bank to adopt partial use between an AMA and the Standardized Approach or an AMA and the Basic Indicator Approach. However, SAMA proposes to permit a bank to choose either the Basic Indicator Approach or the Standardized Approach for a given part of the Bank not using the AMA, and would not restrict a Bank to only one of these approaches. This would be subject to the condition that the Bank is able to demonstrate that this partial use is not intended for capital arbitrage.
The new Basel framework does not specify whether the Alternative Standardized Approach can be used for partial use purposes. For greater clarity, SAMA does propose to allow banks operating in Saudi Arabia to use the Alternative Standardized Approach for any part of its operations in calculating its global, consolidated operational risk capital requirements.
10.4.5 AMA Specific Issues
10.4.6 Recognition of Insurance
[677-679] Consistent with the new Basel framework, SAMA proposes to permit banks using an AMA to recognize the risk mitigating impacts of insurance against operational risk. This amount is limited to 20 percent of the total AMA operational risk capital charge. A bank should meet the conditions stated in the new Basel framework to be eligible to use insurance as a risk mitigant.
10.4.7 Recognition of Internally Determined Correlations
This paragraph describes a series of quantitative standards that will apply to internally generated operational risk measures for purposes of calculating the regulatory minimum capital charge.
(a) Any internal operational risk measurement system must be consistent with the scope of operational risk defined by the Committee in paragraph 644, International Convergence of Capital Measurement and Capital Standards – June 2006, and the loss event types defined in Annex 9, International Convergence of Capital Measurement and Capital Standards – June 2006
(b) Supervisors will require the bank to calculate its regulatory capital requirement as the sum of expected loss (EL) and unexpected loss (UL), unless the bank can demonstrate that it is adequately capturing EL in its internal business practices. That is, to base the minimum regulatory capital requirement on UL alone, the bank must be able to demonstrate to the satisfaction of its national supervisor that it has measured and accounted for its EL exposure.
(c) A bank‘s risk measurement system must be sufficiently “granular” to capture the major drivers of operational risk affecting the shape of the tail of the loss estimates.
(d) Risk measures for different operational risk estimates must be added for purposes of calculating the regulatory minimum capital requirement. However, the bank may be permitted to use internally determined correlations in operational risk losses across individual operational risk estimates, provided it can demonstrate to the satisfaction of the national supervisor that its systems for determining correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates (particularly in periods of stress). The bank must validate its correlation assumptions using appropriate quantitative and qualitative techniques.
(e) Any operational risk measurement system must have certain key features to meet the supervisory soundness standard set out in this section. These elements must include the use of internal data, relevant external data, scenario analysis and factors reflecting the business environment and internal control systems.
(f) A bank needs to have a credible, transparent, well-documented and verifiable approach for weighting these fundamental elements in its overall operational risk measurement system. For example, there may be cases where estimates of the 99.9th percentile confidence interval based primarily on internal and external loss event data would be unreliable for business lines with a heavy-tailed loss distribution and a small number of observed losses. In such cases, scenario analysis, and business environment and control factors, may play a more dominant role in the risk measurement system. Conversely, operational loss event data may play a more dominant role in the risk measurement system for business lines where estimates of the 99.9th percentile confidence interval based primarily on such data are deemed reliable. In all cases, the bank‘s approach for weighting the four fundamental elements should be internally consistent and avoid the double counting of qualitative assessments or risk mitigants already recognized in other elements of the framework.
(Refer para 669, International Convergence of Capital Measurement and Capital Standards – June 2006)
10.4.8 Other Operational Risk National Discretion Issues
SAMA has provided guidance in this area.
National Discretion Items Operational Risk
Reference to Basel-II Document Areas of National Discretion SAMA’s
Position652 (FN 97) Op. Risk: allow a bank to use the ASA. Yes 654 (FN 98) Op. Risk: Treatment of negative gross income. Yes 663 (FN 101) Op. Risk: Impose criteria in Para 663 on non-internationally active banks using SA or ASA. Yes 663 (C ) Reporting format and frequency of Op risk, OP losses, etc., as per banks judgment ensuring completeness and integrity Yes 669 (b) Op. Risk: Calculate regulatory capital requirement as the sum of EL and UL. Yes 669 (d) Op Risk: Use internally determined correlations across individual estimates. Yes 673 Op. Risk: Appropriate de minimum gross loss threshold for internal loss data collection, for example 10,000 SR. Yes 673 Op. Risk: Boundary Issue-definition of operational risk losses that have historically been included in the banks‘ credit databases and that will continue to be treated as credit. Yes 661 Standardized Approach – Initial Monitoring period Yes
2 years673 Threshold for operational risk data collection – banks discretion Yes 650 Intra group fees received from outsourcing be include or excluded Yes 664 AMA - Model validation criteria – Refer to Paras 654 to 679. Yes