Minimum Capital Requirements for Operational Risk

Minimum Capital Requirements for Operational Risk
No: 44047144 Date(g): 27/12/2022 | Date(h): 4/6/1444 Status: In-Force

1. Introduction
Basel Committee on Banking Supervision issued a document on Basel III: Finalizing post-crisis reforms in December 2017. Which includes the revised standardized approach as the sole approach for calculating operational risk capital requirements. A key objective of the revisions is to reduce excessive variability of risk-weighted assets (RWAs) whereby enhancing the resilience and soundness of Saudi Arabia’s banking system.
This updated framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H.
This Framework supersedes any conflicting requirements in previous circulars in this regard; (SAMA Detailed Guidance Document regarding the Basel II framework issued via circular no. BCS290 dated 12 June 2006).

2. Scope of Application

2.1	This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis.
2.2	This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators.

3. Definitions

The following terms and phrases used in this document shall have the corresponding meanings unless otherwise stated:
Operational risk	the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk but excludes strategic and reputational risk.
Legal risk	includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements.
The standardized approach methodology components
(1) the Business Indicator (BI)	a financial-statement-based proxy for operational risk;
(2) the Business Indicator Component (BIC)	calculated by multiplying the BI by a set of regulatory determined marginal coefficients or percentages; and
(3) the Internal Loss Multiplier (ILM)	a scaling factor that is based on a bank’s average historical losses and the BIC.
Gross loss	a loss before recoveries of any type.
Net loss	the loss after taking into account the impact of recoveries.
Recovery	an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party¹.

¹ Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.

4. Implementation Timeline
This framework will be effective on 01 January 2023.

5. SAMA Reporting Requirements
SAMA expects all Banks to report the operational risk weighted assets (RWAs) and capital charge, using SAMA’s Q17 reporting template, within 30 days after the end of each quarter.

6. Disclosure
In addition to the disclosure requirements under Pillar 3, all banks with a BI greater than SAR 4.46 billion, or which use internal loss data in the calculation of Operational Risk Capital (ORC), are required to disclose their annual loss data for each of the ten years in the ILM calculation window. Loss data is required to be reported on both a gross basis and after recoveries and loss exclusions. All banks are required to disclose each of the BI sub-items for each of the three years of the BI component calculation window.

7. Policy Requirements

7.1 The Standardized Approach

The Banks must calculate minimum ORC requirements based on the Standardized Approach by multiplying the BIC and the ILM:
ORC = BIC x ILM
Where-
	(a)	Business Indicator Component (BIC) is calculated as the sum of:
		(i)	12% of the Bank’s BI;
		(ii)	if the Bank’s BI exceeds SAR 4.46 billion, 3% of the amount by which the BI exceeds SAR 4.46 billion; and
		(iii)	if the Bank’s BI exceeds SAR 133.8 billion, 3% of the amount by which the BI exceeds SAR 133.8 billion;²
BI is elaborated in section 7.2
	(b)	Internal Loss Multiplier (ILM) is calculated as follow:

The explanation of ILM is given in section 7.3
Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.

² For example, given a BI of SAR 140 billion, BIC = (SAR 140 billion x 12%) + [(SAR 140 billion – SAR 4.46 billion) x 3%] + [(SAR 140 billion – SAR 133.8 billion) x 3%] = (SAR 140 billion x 12%) + (135.54 billion x 3%) + (6.2) x 3%) = SAR 21.05 billion.

7.2 The Business Indicator
The Business Indicator (BI) comprises of three components: the interest, leases and dividend component (ILDC); the services component (SC), and the financial component (FC). The BI is calculated as follow:

BI = ILDC + SC + FC

ILDC, SC and FC are calculated by the following formula:

Where:

A bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2.

(Abs) is the absolute value of the terms within the brackets. The absolute value of net items must be calculated first for each financial year, and the average of the past three consecutive financial years must be calculated based on the absolute value of net items for each financial year.

The definitions for each of the components of the BI are provided in Annexure 1.

7.3 The Internal Loss Multiplier

7.3.1	A bank’s internal operational risk loss experience affects the calculation of operational risk capital through the Internal Loss Multiplier (ILM). The ILM is defined as below, where the Loss Component (LC) is equal to 15 times average annual operational risk losses incurred over the previous 10 years:

7.3.2	The ILM is equal to one where the Loss Component (LC) and Business Indicator Component (BIC) are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, a bank with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, a bank with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology.
7.3.3	The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data. As part of the transition to the standardized approach, banks that do not have 10 years of high-quality loss data may use a minimum of five years of data to calculate the Loss Component, however, the term for transition will require SAMA’s approval. Banks that do not have five years of high-quality loss data must calculate the capital requirement based solely on the BI Component. Further, those Banks that do not have high-quality annual loss data for 5 years are required to approach SAMA to seek approval either to use loss data for the period less than five years or use ILM greater than 1 or as advised by SAMA.
7.3.4	The Banks with a BI less than or equal to SAR 4.46 billion must set the ILM equal to 1 in the calculation of ORC requirement (that is, calculate ORC based solely on the BIC), unless the Bank has obtained the SAMA’s written approval to calculate the ILM in accordance with paragraph 7.3.1 for the calculation of ORC. SAMA will not grant such approval unless the Bank meets all the criteria set out in sections 8 to 12.

7.4 Minimum Standards for the Use of Loss Data Under the Standardized Approach

7.4.1	The Banks with a BI greater than SAR 4.46 billion are required to use loss data as a direct input into the operational risk capital calculations. Banks, which do not meet the loss data standards, as mentioned in section 6 to 10 of this document, are required to hold capital that is at a minimum equal to 100% of the BIC. In such cases, SAMA may require the bank to apply an ILM which is greater than 1. The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting multipliers, must be publicly disclosed in Pillar 3.
7.4.2	The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the bank’s operational loss exposure. The qualitative requirements for loss data collection are outlined in sections 8 and 9.

8. General Criteria on Loss Data Identification, Collection and Treatment

The proper identification, collection and treatment of internal loss data are essential prerequisites to capital calculation under the standardized approach. The general criteria for the use of the LC are as follows:
	a)	Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period. When the bank first moves to the standardized approach, a five-year observation period is acceptable on an exceptional basis when good-quality data are unavailable for more than five years.
	b)	Internal loss data are most relevant when clearly linked to a bank’s current business activities, technological processes and risk management procedures. Therefore, a bank must have documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions.
	c)	For risk management purposes, and to assist in supervisory validation and/or review, SAMA will request a bank to map its historical internal loss data into the relevant Level 1 supervisory categories as defined in annexure 2 and to provide this data to SAMA. The bank must document criteria for allocating losses to the specified event types.
	d)	A bank’s internal loss data must be comprehensive and capture all material activities and exposures from all appropriate subsystems and geographic locations. The minimum threshold for including a loss event in the data collection and calculation of average annual losses is set at SAR 44,600 for the purpose of the calculation of average annual losses, SAMA may increase the threshold to SAR 446,000 for the banks where the BI is greater than SAR 4.46 billion).
	e)	A side from information on gross loss amounts, the bank must collect information about the reference dates of operational risk events, including the date when the event happened or first began (“date of occurrence”), where available; the date on which the bank became aware of the event (“date of discovery”); and the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognized in the bank’s profit and loss (P&L) accounts (“date of accounting”). In addition, the bank must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event.³ The level of detail of any descriptive information should be commensurate with the size of the gross loss amount.
	f)	Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set.
	g)	Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardized approach for operational risk.
	h)	Banks’ Internal Audit function must conduct independently review of the comprehensiveness and accuracy of the loss data at least on annul basis and submit the report to the Audit Committee.

³ Tax effects (eg reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of the standardized approach for operational risk.

9. Specific Criteria on Loss Data Identification, Collection and Treatment

9.1 Building of the Standardized Approach Loss Data Set
In order to build an acceptable loss data set from the available internal data, a bank must develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses.

9.2 Gross Loss, Net Loss, and Recovery Definitions

9.2.1	Banks must be able to identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Banks should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the bank receives payment. Receivables do not count as recoveries. Verification of payments received to net losses must be provided to SAMA upon request.
9.2.2	The following items must be included in the gross loss computation of the loss data set:
	a)	Direct charges, including impairments and settlements, to the bank’s P&L accounts and write-downs due to the operational risk event;
	b)	Costs incurred as a consequence of the event including external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event;
	c)	Provisions or reserves accounted for in the P&L against the potential operational loss impact;
	d)	Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L (“pending losses”).⁴ Material pending losses should be included in the loss data set within a time period commensurate with the size and age of the pending item; and
	e)	Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods (timing losses”).⁵ Material “timing losses” should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period and give rise to legal risk.
9.2.3	The following items should be excluded from the gross loss computation of the loss data set:
	a)	Costs of general maintenance contracts on property, plant or equipment;
	b)	Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and
	c)	Insurance premiums.
9.2.4	Banks must use the date of accounting for building the loss data set. The bank must use a date no later than the date of accounting for including losses related to legal events in the loss data set. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L.
9.2.5	Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment.

⁴ For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these events are recognized through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across banks.
⁵ Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to- market errors). While these events do not represent a true financial impact on the institution (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution’s financial statements.

10. Exclusion of Losses from the Loss Component

10.1	Banks must obtain SAMA’s approval to exclude certain operational loss events when they are no longer relevant to the bank’s operational risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the bank’s risk profile, SAMA will consider whether the cause of the loss event could occur in other areas of the bank’s operations. Taking settled legal exposures and divested businesses as examples, SAMA expects the bank’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.
10.2	The total loss amount and number of exclusions must be disclosed under Pillar 3 with appropriate narratives, including total loss amount and number of exclusions.
10.3	The Banks will exclude losses where a loss event should be greater than 5% of the bank’s average losses. In addition, losses can only be excluded after being included in a bank’s operational risk loss database for a minimum period of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period.

11. Exclusions of Divested Activities from the Business Indicator
Banks must obtain SAMA’s approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed under Pillar 3.

12. Inclusion of Losses and BI Items Related to Mergers and Acquisitions

12.1	The scope of losses and BI items used to calculate the operational risk capital requirements must include acquired businesses and merged entities over the period prior to the acquisition/merger that is relevant to the calculation of the standardized approach (ten years for losses and three years for BI).
12.2	Losses and BI items from merged entities or acquired businesses should be included in the calculation of ORC immediately after the merger/acquisition, and should be reported in the first update of the bank’s total risk-weighted assets that comes after the merger/acquisition.

13. Application of the Standardized Approach Within a Group

13.1	At the consolidated level, the standardized approach calculations use fully consolidated BI figures, which net all the intragroup income and expenses. The calculations at a sub-consolidated level use BI figures for the banks consolidated at that particular sub-level. The calculations at the subsidiary level use the BI figures from the subsidiary.
13.2	Similar to bank holding companies, when BI figures for sub-consolidated or subsidiary banks where BI is more than SAR4.46 billion, these banks are required to use loss experience in the standardized approach calculations. A sub-consolidated bank or a subsidiary bank uses only the losses it has incurred in the standardized approach calculations (and does not include losses incurred by other parts of the bank holding company).
13.3	In case, a subsidiary of a bank have BI more than SAR 4.46 billion does not meet the qualitative standards for the use of the Loss Component, this subsidiary must calculate the standardized approach capital requirements by applying 100% of the BI Component. In such cases SAMA may require the bank to apply an ILM which is greater than 1.

Annexure 1: Definition of Business Indicator Components

Business Indicator definitions
BI Component	Profit and loss or balance sheet items	Description	Typical sub-items
Interest, lease and dividend	Interest income	Interest income from all financial assets and other interest income (includes interest income from financial and operating leases and profits from leased assets)	• Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets, financial leases and operational leases • Interest income from hedge accounting derivatives • Other interest income • Profits from leased assets
	Interest expenses	Interest expenses from all financial liabilities and other interest expenses (includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets)	• Interest expenses from deposits, debt securities issued, financial leases, and operating leases • Interest expenses from hedge accounting derivatives • Other interest expenses • Losses from leased assets • Depreciation and impairment of operating leased assets
	Interest earning assets (balance sheet item)	Total gross outstanding loans, advances, interest bearing securities (including government bonds), and lease assets measured at the end of each financial year
	Dividend income	Dividend income from investments in stocks and funds not consolidated in the bank's financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures.
Services	Fee and commission income	Income received from providing advice and services. Includes income received by the bank as an outsourcer of financial services.	Fee and commission income from: • Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers) • Clearing and settlement; Asset management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitizations; Loan commitments and guarantees given; and foreign transactions
	Fee and commission expenses	Expenses paid for receiving advice and services. Includes outsourcing fees paid by the bank for the supply of financial services, but not outsourcing fees paid for the supply of non- financial services (eg logistical, IT, human resources)	Fee and commission expenses from: • Clearing and settlement; Custody; Servicing of securitizations; Loan commitments and guarantees received; and Foreign transactions
	Other operating income	Income from ordinary banking operations not included in other BI items but of similar nature (income from operating leases should be excluded)	• Rental income from investment properties • Gains from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37)
	Other operating expenses	Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events (expenses from operating leases should be excluded)	• Losses from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37) • Losses incurred as a consequence of operational loss events (eg fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years • Expenses related to establishing provisions/reserves for operational loss events
Financial	Net profit (loss) on the trading book	• Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences
Financial	Net profit (loss) on the banking book	• Net profit/loss on financial assets and liabilities measured at fair value through profit and loss • Realized gains/losses on financial assets and liabilities not measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortized cost) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences

The following Profit and loss items do not contribute to any of the items of the BI:
	•	Income and expenses from insurance or reinsurance businesses
	•	Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased
	•	Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)
	•	Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)
	•	Expenses of premises and fixed assets (except when these expenses result from operational loss events)
	•	Depreciation/amortization of tangible and intangible assets (except depreciation related to operating lease assets, which should be included in financial and operating lease expenses)
	•	Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events
	•	Expenses due to share capital repayable on demand
	•	Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)
	•	Changes in goodwill recognized in profit or loss
	•	Corporate income tax (tax based on profits including current tax and deferred).

Annexure 2: Detailed Loss Event Type Classification

Detailed loss event type classification
Event-type category (Level 1)	Definition	Categories (Level 2)	Activity examples (Level 3)
Internal Fraud.	Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party.	Unauthorized Activity	Transactions not reported (intentional).
			Trans type unauthorized (with monetary loss).
			Mismarking of position (intentional).
		Theft and Fraud	Fraud / credit fraud / worthless deposits.
			Theft / extortion / embezzlement / robbery.
			Misappropriation of assets.
			Malicious destruction of assets.
			Forgery.
			Check kiting.
			Smuggling.
			Account take-over / impersonation.
			Tax non-compliance / evasion (willful).
			Bribes / kickbacks.
			Insider trading (not on firm's account).
External Fraud.	Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law by a third party.	Theft and Fraud	Theft/ Robbery.
			Forgery.
			Check kiting.
		Systems Security	Hacking damage.
			Theft of information (with monetary loss).
Employment Practices and Workplace Safety.	Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events.	Employee Relations	Compensation, benefit, termination issues.
			Organized labor activity.
		Safe Environment	General liability (slips and falls, etc.).
			Employee health & safety rules events.
			Workers compensation.
		Diversity and Discrimination	All discrimination types.
Clients, Products and Business Practices.	Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product.	Suitability, Disclosure, and Fiduciary	Fiduciary breaches / guideline violations.
			Suitability / disclosure issues (know-your-customer, etc.).
			Retail consumer disclosure violations.
			Breach of privacy.
			Aggressive sales.
			Account churning.
			Misuse of confidential information.
			Lender Liability.
		Improper Business or Market Practices	Antitrust.
			Improper trade / market practices.
			Market manipulation.
			Insider trading (on firm's account).
			Unlicensed activity.
			Money laundering.
		Product Flaws	Product defects (unauthorized, etc.).
			Model Error.
		Selection, Sponsorship, and Exposure	Failure to investigate client per guidelines.
			Exceeding client exposure limits.
		Advisory Activity	Disputes over performance of advisory activities.
Damage to Physical Assets.	Losses arising from loss or damage to physical assets from natural disaster or other events.	Disasters and Other Events	Natural disaster losses.
			Human losses from external sources (terrorism, vandalism).
Business Disruption and System Failures.	Losses arising from disruption of business or system failures.	Systems	Hardware.
			Software.
			Telecommunications.
			Utility outage / disruptions.
Execution, Delivery, and Process Management.	Losses from failed transaction processing or process management, from relations with trade counterparties and vendors.	Transaction Capture, Execution, and Maintenance	Miscommunication.
			Data entry, maintenance or loading error.
			Missed deadline or responsibility.
			Model / system miss-operation.
			Accounting error / entity attribution error.
			Other task miss-performance.
			Delivery failure.
			Collateral management failure.
			Reference Data Maintenance.
		Monitoring and Reporting	Failed mandatory reporting obligation.
			Inaccurate external report (loss incurred).
		Customer Intake and Documentation	Client permissions / disclaimers missing.
			Legal documents missing / incomplete.
		Customer/Client Account Management	Unapproved access given to accounts.
			Incorrect client records (loss incurred).
			Negligent loss or damage of client assets.
		Trade Counterparties	Non-client counterparty miss-performance.
			Miscellaneous non-client counterparty disputes.
		Vendors and Suppliers	Outsourcing.
			Vendor disputes.

Soft Launch