One Year and 99.9 Percent

The first requirement is that the model must hold capital for a one-year horizon at 99.9 percent confidence level. In other words, the capital held must be sufficient to cover all operational risk losses in one year with a certainty of 99.9 percent.

This is the equivalent of asking for a bank to hold operational risk capital that will protect it from a 1-in-1,000-year fat-tail event.

Given the continuing evolution of analytical approaches for operational risk, the Committee is not specifying the approach or distributional assumptions used to generate the operational risk measure for regulatory capital purposes. However, a bank must be able to demonstrate that its approach captures potentially severe “tail” loss events. Whatever approach is used, a bank must demonstrate that its operational risk measure meets a soundness standard comparable to that of the internal ratings-based approach for credit risk (i.e., comparable to a one year holding period and a 99.9th percentile confidence interval).¹⁵

Model Governance

The second requirement is that the model must be subject to full model governance.

In the development of operational risk measurement and management systems, banks must have and maintain rigorous procedures for operational risk model development and independent model validation.¹⁶

Model Design

The third requirement concerns the design of the AMA model and several stipulations that must be met.

The first stipulation is that the model must represent the operational risk framework as outlined in Basel II and supporting guidance.

Any internal operational risk measurement system must be consistent with the scope of operational risk defined in OPE10.1 and the loss event types defined in Table 1.¹⁷

In effect, this means that calculations should be made for all seven risk categories. Some firms calculate capital at the top of the firm and then allocate operational risk capital down into the business lines. Others calculate capital at the business line. Table 12.1 shows a matrix for capital calculations using the Basel business lines. However, a firm might have different headings in the first column to better represent their own business line structure.

The second stipulation is that the model must capture all expected and unexpected losses and may only exclude expected losses under certain strict criteria.

Supervisors will require the bank to calculate its regulatory capital requirement as the sum of expected loss (EL) and unexpected loss (UL), unless the bank can demonstrate that it is adequately capturing EL in its internal business practices. That is, to base the minimum regulatory capital requirement on UL alone, the bank must be able to demonstrate to the satisfaction of its national supervisor that it has measured and accounted for its EL exposure.¹⁸

The third stipulation is that the model must provide sufficient detail and granularity to ensure that fat-tail events are captured.

A bank's risk measurement system must be sufficiently “granular” to capture the major drivers of operational risk affecting the shape of the tail of the loss estimates.¹⁹

The fourth stipulation is that the bank must sum all calculated cells or defend any correlation assumptions that are made in its AMA model.

Risk measures for different operational risk estimates must be added for purposes of calculating the regulatory minimum capital requirement. However, the bank may be permitted to use internally determined correlations in operational risk losses across individual operational risk estimates, provided it can demonstrate to the satisfaction of the national supervisor that its systems for determining correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates (particularly in periods of stress). The bank must validate its correlation assumptions using appropriate quantitative and qualitative techniques.²⁰

The fifth stipulation simply reinforces the requirement that all four elements must be in the model.

Any operational risk measurement system must have certain key features to meet the supervisory soundness standard set out in this section. These elements must include the use of internal data, relevant external data, scenario analysis and factors reflecting the business environment and internal control systems.²¹

Finally, the bank must weight these four elements appropriately.

A bank needs to have a credible, transparent, well-documented and verifiable approach for weighting these fundamental elements in its overall operational risk measurement system.²²

The Basel rules also provide many qualitative requirements that must be met in order for a bank to qualify for an AMA model for Basel II. Many of these have been discussed in prior chapters, for example the rules regarding the collection and use of loss data, the challenges of scenario analysis, and the use of BEICF from RCSA and KRI elements in the operational risk framework.

While the four elements must be considered in the capital calculation methodology, many banks use some of these elements to allocate capital, to stress-test their models, or to adjust their models rather than using them to provide direct inputs into the capital calculation. Regulators have accepted many different models for AMA and the modeling of operational risk capital is developing rapidly as different approaches are tried and tested by the banking industry.

Many firms, however, spent many years wrestling with building and receiving approval for their AMA models, and the most recent guidance has removed the AMA option. At the time of this writing, this sunsetting of the AMA model was to occur in 2023, but that date has been moved out several times.

As a result, the AMA is still currently a viable approach to calculating operational risk capital under existing Basel II rules and so we will consider some of the modeling options that are available below.

Step 1: Modeling Frequency

In order to develop a model of expected operational risk losses, the first step is to determine the likely number of events per year. This is the frequency of events.

The most popular distribution selection for modeling frequency is the Poisson distribution. This allows for a fairly simple approach to modeling frequency. In a Poisson distribution, there is only a single parameter (λ), which represents the average number of events in a given year. Both the mean and the variance are represented by this single parameter in a Poisson distribution. In more complex cases, a negative binomial distribution may be used, which allows for different values for the mean and variance.

The Poisson distribution works well for a situation where there is a whole number of events and where the probability in one time period is the same as in another time period. The Poisson distribution is built from the use of the average number of events using the following formula.

where:

In an LDA model, λ can be obtained simply by observing the number of events per year in the internal loss data history and calculating the average.

The Poisson distribution that is derived from this approach represents the probability of a certain number of events occurring in a single year. As can be seen in Figure 12.3, lower lambdas produce more skewed and leptokurtic²⁵ annual loss distributions than higher lambdas.

Step 2: Modeling Severity

The next step in modeling expected operational risk losses is to determine the likely size of an event given the fact that an event has occurred. This is the severity of an event.

Unlike frequency, severity need not be an integer but can fall anywhere along a continuum. When a loss occurs, it might be $1.50, or it might be $133,892.25 or any other value. The severity distribution establishes the probability of an event occurring over a wide range of values, from zero to very, very large losses.

The most common and least complex approach to modeling severity is to use a lognormal distribution, although low-frequency losses may fit better to other options such as Generalized Gamma, Transformed Beta, Generalized Pareto, or Weibull. Regulators take a keen interest in how well the selected distribution demonstrates “goodness of fit”—or in other words, how certain you are that the sample comes from the population with the claimed distribution. When selecting which approach to use, the AMA guidelines also provide the following guidance (emphasis added):

The selection of probability distributions should be consistent with all elements of the AMA model. In addition to statistical goodness of fit, Dutta and Perry (2007) have proposed the following criteria for assessing a model's suitability:

• realistic (e.g., it generates a loss distribution with a realistic capital requirements estimate, without the need to implement “corrective adjustments” such as caps),
• well specified (e.g., the characteristics of the fitted data are similar to the loss data and logically consistent),
• flexible (e.g., the method is able to reasonably accommodate a wide variety of empirical data) and
• simple (e.g., it is easy to implement and it is easy to generate random numbers for the purpose of loss simulation).

The process of selecting the probability distribution should be well-documented, verifiable and lead to a clear and consistent choice. To this end, a bank should generally adhere to the following:

1. Exploratory Data Analysis (EDA) for each ORC to better understand the statistical profile of the data and select the most appropriate distribution;
2. Appropriate techniques for the estimation of the distributional parameters; and
3. Appropriate diagnostic tools for evaluating the quality of the fit of the distributions to the data, giving preference to those most sensitive to the tail.²⁶

Whichever distribution is selected, the probability density function for severity will have a fat tail, that is, very large events (beyond three standard deviations of the mean) are more likely to occur than in a normal distribution. It will also be skewed to the right, as can be seen in the example in Figure 12.4.

Step 3: Monte Carlo Simulation

Once the frequency and severity distributions have been established, the next step is to use these distributions to generate many more data points in order to better estimate the capital needed to ensure with 99.9 percent certainty that likely losses for the next year are covered by appropriate capital.

Monte Carlo simulation provides a method by which frequency and severity distributions can be combined to produce many more data points that have the same characteristics as the observed data points. Excel can handle this process using built-in functionality, but often much more powerful statistical modeling tools are used.

First, a data point is selected from the frequency distribution. This gives us the number of events that are predicted to occur in year one. Values nearer the mean of the frequency distribution will be selected more often than values far from the mean. In this example, let us say that the number 50 is selected. Therefore, in year one the model assumes there were 50 events.

Next, the size of each of those 50 events is selected from the severity distribution. Again, values with a higher probability in the severity distribution will be selected more often than values with a lower probability. This will produce 50 losses for year one.

The value of all 50 losses is then added together to give the total value of losses for year one.

This process is repeated for year two, and then over and over again, a million times, thus giving the modeler many additional years of representative data. The data is then placed in size order, the largest total year loss, to the smallest total year loss.

Finding the 99.9 percent confidence level is simply a case of selecting the one thousandth item in the ordered list. That value represents, with 99.9 percent certainty, the maximum loss that will be experienced in a single year.

This process is represented in Figure 12.5.

Correlation

Once all of the cells of the operational risk capital matrix have been populated, with a calculated capital amount for each risk category, and possibly also for every business line, then all of the cells must be simply added together to produce the total capital required. However, firms can take advantage of correlation assumptions between cells if these assumptions can be defended.

Risk measures for different operational risk estimates must be added for purposes of calculating the regulatory minimum capital requirement. However, the bank may be permitted to use internally determined correlations in operational risk losses across individual operational risk estimates, provided it can demonstrate to the satisfaction of the national supervisor that its systems for determining correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates (particularly in periods of stress). The bank must validate its correlation assumptions using appropriate quantitative and qualitative techniques.²⁷

Some firms have found the ORX data useful for this purpose. ORX data contains loss data for all risk categories for all firms that are consortium members. If a correlation matrix can be established for that large pool of data it might be possible to use those same assumptions for the internal AMA model of a member firm. With no correlation assumptions, the additive nature of the model can produce very high capital results. As a result there is an enormous amount of work (internally and with consulting firms) currently under way in the industry, as firms attempt to better support correlation assumptions for use in operational risk capital modeling.

The Business Indicator BI

The first building block of the new Standardized Approach is the business indicator (BI). As stated earlier, the BI is a financial-statement-based proxy for operational risk.

The BI comprises three components: the interest, leases, and dividend component (ILDC); the services component (SC); and the financial component (FC).

The BI is calculated as follows:

³¹

The three factors that make up the BI are derived as outlined below.

First, the ILDC is derived as follows:

where:

Secondly, the services component (SC) is derived as follows:

where:

Finally, the financial component (FC) is derived as follows:

where:

The definitions of what makes up each of these indicators is outlined in the annex of the latest Basel guidance, as shown in Table 12.3.

Business Indicator Component: BIC

The next step in the new Standardized Approach calculation is to derive the BIC from the BIs as follows:

To calculate the BIC, the BI is multiplied by the marginal coefficients (αi). The marginal coefficients increase with the size of the BI as shown in Table 1. For banks in the first bucket (i.e. with a BI less than or equal to €1bn) the BIC is equal to BI × 12%. The marginal increase in the BIC resulting from a one unit increase in the BI is 12% in bucket 1, 15% in bucket 2 and 18% in bucket 3. For example, given a BI = €35bn, the BIC = (1 × 12%) + (30 – 1) × 15% + (35 – 30) × 18% = €5.37bn.³²

Internal Loss Multiplier: ILM

The final step in calculating capital for operational risk using the new Standardized Approach is to derive the Internal Loss Multiplier (ILM). It is clear at this point that the only element of the operational risk framework that now has a direct input into the capital calculation is the operational loss experience of the bank itself.

In this way, the new approach removes the qualitative elements of scenario analysis and of business environment and internal control factors and simply asks: (1) What does your bank do (BIC)? and (2) How many losses have you experienced (ILM)?

The internal loss multiplier is derived as follows:

Where the loss component (LC) = 15 times average annual operational risk losses incurred over the previous 10 years.

The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data. The qualitative requirements for loss data collection are outlined in paragraphs 19 to 31. As part of the transition to the standardised approach, banks that do not have 10 years of high-quality loss data may use a minimum of five years of data to calculate the Loss Component. Banks that do not have five years of high-quality loss data must calculate the capital requirement based solely on the BI Component. Supervisors may however require a bank to calculate capital requirements using fewer than five years of losses if the ILM is greater than 1 and supervisors believe the losses are representative of the bank's operational risk exposure.³³ [emphasis added]

This is a significant change from the original Basel requirements regarding the use of internal loss data in capital calculations, as the period of losses has been expanded from five years of experienced losses (three at the outset) to 10 years. The structure of the calculation ensures that a bank's loss experience directly influences its capital requirement.

The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, a bank with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, a bank with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology.³⁴

This means that large events will have a long-term impact on the capital requirements of a bank, and in effect, they will be punished for their errors even long after they may have fixed the underlying control failures that led to those errors. Conversely, a bank that has a low level of losses will be able to benefit from lower capital regardless of whether its current control environment is flawed.

While this does not appear to directly incentivize banks to ensure that they have a strong control framework, the BCBS has determined that this is in fact a more consistent and measurable approach than the AMA has proven to be.

The new guidance also provides comprehensive requirements for the collection of internal loss data as discussed in Chapter 7. These are outlined fully in Sections 5 and 6 of the 2017 BCBS document “OPE 25 – Basel III: Finalizing post-crisis reforms.”

As a large event might have a high impact on capital long after the control weaknesses have been remediated, it is possible for a bank to petition for the removal of certain operational risk events under the new framework as follows:

Exclusion of losses from the Loss Component

• 27. Banking organisations may request supervisory approval to exclude certain operational loss events that are no longer relevant to the banking organisation's risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the bank's risk profile, supervisors will consider whether the cause of the loss event could occur in other areas of the bank's operations. Taking settled legal exposures and divested businesses as examples, supervisors expect the organisation's analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.
• 28. The total loss amount and number of exclusions must be disclosed under Pillar 3 with appropriate narratives, including total loss amount and number of exclusions.
• 29. A request for loss exclusions is subject to a materiality threshold to be set by the supervisor (for example, the excluded loss event should be greater than 5% of the bank's average losses). In addition, losses can only be excluded after being included in a bank's operational risk loss database for a minimum period (for example, three years), to be specified by the supervisor. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period.³⁵

As can be seen, such exclusions will be rare and will only be allowed after a period of inclusion in the capital calculation (e.g., three years) and with strong evidence that it is appropriate to now exclude the loss. If granted, the exclusion must be noted in the disclosures of that bank.