Master Direction on Minimum Capital Requirements for Operational Risk

भारतीय ररज़र्व बैंक RESERVE BANK OF INDIA _________________________ ______________________ www.rbi.org.in RBI/DOR/2023-24/103 DOR.ORG.REC.22/21.06.050/2023-24 June 26, 2023 Reserve Bank of India – Master Direction on Minimum Capital Requirements for Operational Risk In exercise of the powers conferred by Section 35A of the Banking Regulation Act, 1949, the Reserve Bank of India being satisfied that it is necessary and expedient in the public interest to do so, hereby issues the Directions hereinafter specified. These Directions require a specified Commercial Bank (covered under ‘Applicability’) to hold sufficient regulatory capital against its exposures arising from operational risk. Part A 1. Short Title and Commencement These Directions shall be called the Reserve Bank of India (Minimum Capital Requirements for Operational Risk) Directions, 2023. 2. Effective Date 2.1 The effective date of implementation of these Directions shall be communicated separately. 2.2 All existing approaches viz. Basic Indicator Approach (BIA), The Standardised Approach (TSA)/ Alternative Standardised Approach (ASA) and Advanced Measurement Approach (AMA) for measuring minimum operational risk capital (ORC) requirements shall be replaced by the new Standardised Approach (hereafter referred to as the ‘Basel III Standardised Approach’) with coming into effect of these Directions. 2.3 Until then, the minimum operational risk regulatory capital requirements shall be computed in accordance with the instructions contained in paragraph 9 of ‘Master Circular – Basel III Capital Regulations’ issued vide circular DOR.CAP.REC.15/21.06.201/2023-24 dated May 12, 2023, as amended from time to time.3. Applicability 3.1 The provisions of these Directions shall apply to all Commercial Banks (excluding Local Area Banks, Payments Banks, Regional Rural Banks, and Small Finance Banks). 3.2 The scope of application shall be in accordance with paragraph 3 of ‘Master Circular – Basel III Capital Regulations’ issued vide circular DOR.CAP.REC.15/21.06.201/2023-24 dated May 12, 2023, as amended from time to time. 3.3 The provisions contained in Part A of these Directions are mandatory. Banks are encouraged to comply with the guidelines listed in Part B. Part C and Part D contain Frequently Asked Questions (FAQs) and Illustrations, respectively (for general guidance of banks). 4. Definitions 4.1 In these Directions, unless the context otherwise requires, 4.1.1 “Commercial Banks” means all banking companies1, corresponding new banks, and State Bank of India as defined under subsections (c), (da), and (nc) respectively of Section 5 of the Banking Regulation Act, 1949 (hereinafter referred to as ‘Bank(s)’) 4.1.2 “Gross loss” means a loss before recoveries of any type. 4.1.3 “Net loss” means the loss after taking into account the impact of recoveries. 4.1.4 “Operational risk” means the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk2, but excludes strategic and reputational risk. 1 Includes banks incorporated outside India licensed to operate in India (‘Foreign Banks’) but excludes Local Area Banks, Payments Banks, Regional Rural Banks, and Small Finance Banks. 2 Legal risk shall include, but not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. 24.1.5 “Recovery” is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party.3 4.2 All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Banking Regulation Act, 1949 or the Reserve Bank of India Act, 1934, or Glossary of Terms published by Reserve Bank or as used in commercial parlance, as the case may be. 5. Components of Basel III Standardised Approach (Basel III SA) 5.1 Basel III SA calculation methodology is based on the following components: 5.1.1 the Business Indicator (BI), which is a financial-statement-based proxy for operational risk; 5.1.2 the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of marginal coefficients (α i); and 5.1.3 the Internal Loss Multiplier (ILM), which is a scaling factor that is based on a bank’s average historical losses and the BIC. 5.2 Business Indicator (BI) The BI shall be the summation of the following three constituents, BI = ILDC+SC+FC Where, ILDC is the Interest, Lease and Dividend Component; SC is the Services Component; and FC is the Financial Component. 3 Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers. 35.3 Computation of ILDC, SC and FC The ILDC, SC and FC shall be computed as per the formula below, where a bar above a term indicates that it is calculated as the average over three years4: t, t-1 and t-2, and: 4    𝐼 𝐿 𝐷 𝐶 = 𝑀 𝑖 𝑛 𝐴 𝑏 𝑠 𝐼 𝑛 𝑡 𝑒 𝑟 𝑒 𝑠 𝑡 𝐼 𝑛 𝑐 𝑜 𝑚 𝑒 − 𝐼 𝑛 𝑡 𝑒 𝑟 𝑒 𝑠 𝑡 𝐸 𝑥 𝑝 𝑒 𝑛 𝑠 𝑒 ; 2 .2 5 % × 𝐼 𝑛 𝑡 𝑒 𝑟 𝑒 𝑠 𝑡 𝐸 𝑎 𝑟 𝑛 𝑖 𝑛 𝑔 𝐴 𝑠 𝑠 𝑒 𝑡 𝑠 + 𝐷 𝑖 𝑣 𝑖 𝑑 𝑒 𝑛 𝑑 𝐼 𝑛 𝑐 𝑜 𝑚 𝑒 𝑆 𝐶 = 𝑀 𝑎 𝑥 𝑂 𝑡 ℎ 𝑒 𝑟 𝑂 𝑝 𝑒 𝑟 𝑎 𝑡 𝑖 𝑛 𝑔 𝐼 𝑛 𝑐 𝑜 𝑚 𝑒 ; 𝑂 𝑡 ℎ 𝑒 𝑟 𝑂 𝑝 𝑒 𝑟 𝑎 𝑡 𝑖 𝑛 𝑔 𝐸 𝑥 𝑝 𝑒 𝑛 𝑠 𝑒 𝑀 𝑎 𝑥 𝐹 𝑒 𝑒 𝐼 𝑛 𝑐 𝑜 𝑚 𝑒 ; 𝐹 𝑒 𝑒 𝐸 𝑥 𝑝 𝑒 𝑛 𝑠 𝑒 𝐹 𝐶 = 𝐴 𝑏 𝑠 𝑁 𝑒 𝑡 𝑃 & 𝐿 𝑇 𝑟 𝑎 𝑑 𝑖 𝑛 𝑔 𝐵 𝑜 𝑜 𝑘 + 𝐴 𝑏 𝑠 ( 𝑁 𝑒 𝑡 𝑃 & 𝐿 𝐵 𝑎 𝑛 𝑘 𝑖 𝑛 𝑔 𝐵 𝑜 𝑜 + 𝑘 ) Where, Max=Maximum, Min=Minimum, and Abs= Absolute value of sub-components irrespective of their signs (+ or -) The description for each of these constituents of the BI is provided in Annex 1. 5.4 Business Indicator Component (BIC) The BIC shall be calculated by multiplying the BI with the marginal coefficients (α i), (which increase with the size of the BI) as shown in Table 1 below. BI ranges and marginal coefficients Table 1 Bucket BI Range (in ₹ crore) BI Marginal Coefficients (α i) 1 ≤8000 12% 2 8000<BI≤240000 15% 3 >240000 18% 4 BI components considered in the ORC calculations should be higher of those calculated on a (i) rolling quarter basis, and (ii) financial year (FY) basis. Example: Suppose a bank is calculating the ORC requirements for November 2022. It has higher BI on an FY basis considering financials of FY22, FY21, and FY20 than on a rolling quarter basis considering financials for the 12 months period each ending Sep 22, Sep 21, and Sep 20. The bank should hold ORC requirements considering the financials of FY22, FY21, and FY20 for BI computation.5.5 Internal Loss Multiplier (ILM) 5.5.1 A bank’s internal operational risk loss experience affects the calculation of ORC through the ILM. The ILM shall be calculated as given below, Where the Loss Component (LC) is equal to 15 times average annual operational risk losses as mentioned in paragraph 5.5.2. 5.5.2 The calculation of average losses in the LC shall be based on 10 years of high- quality operational risk annual loss data. However, banks that do not have 10 years of high-quality loss data but have five years and above of high-quality loss data shall make use of such available high-quality loss data of five years and above to calculate the LC. 5.6 Operational Risk Capital 5.6.1 For banks in (a) bucket 1, and (b) buckets 2 and 3 that do not have 5 years of high-quality operational risk annual loss data The ORC requirements shall be equal to BIC, as defined in paragraph 5.4: ORC = BIC The Reserve Bank (Department of Supervision) may however require banks in buckets 2 and 3 to calculate ORC requirements using fewer than five years of loss data if the ILM is greater than 1 and the supervisor believes that these losses are representative of the bank’s operational risk exposure. In such cases, ORC requirements shall be calculated in accordance with paragraph 5.6.2. 5.6.2 For banks in buckets 2 and 3 having 5 years and above of high-quality operational risk annual loss data The ORC requirements shall be calculated by multiplying the BIC (as defined in paragraph 5.4) by the ILM (as defined in paragraph 5.5): 5Banks in buckets 2 and 3 which do not meet the five years of high-quality loss data criteria shall be required to hold ORC at a minimum equal to the BIC (as defined in paragraph 5.4). The Reserve Bank (Department of Supervision) may however require the bank to apply an ILM which is greater than 1 to calculate ORC requirements. The exclusion of loss data due to non-compliance with the high-quality loss data criteria, and the application of any resulting multipliers, shall be publicly disclosed in accordance with the Pillar 3 requirements. 5.7 Risk-Weighted Assets The risk-weighted assets (RWA) for operational risk shall be calculated by multiplying the ORC by 12.5. 6. Calculation of ORC within a banking group 6.1 At the consolidated level, the ORC calculations shall be based on fully consolidated BI figures, which net all the intragroup income and expenses. 6.2 The ORC calculations at a sub-consolidated level shall be based on BI figures for the banks consolidated at that particular sub-level. 6.3 The ORC calculations at the subsidiary level shall be based on BI figures from the subsidiary. 6.4 A sub-consolidated bank or a subsidiary of the bank shall use only the losses it has incurred at that particular sub-consolidated or subsidiary level for the ORC calculations. 6.5 When BI figures for sub-consolidated or subsidiary level reach bucket 2, banks shall use loss experience in the ORC calculations as mentioned in paragraph 5.6.2. 6.6 In case a subsidiary of a bank belonging to bucket 2 or higher does not meet the high-quality loss data criteria (as given in paragraph 9 of Part A) or does not have five years and above of high-quality operational risk annual loss data, the subsidiary shall calculate the ORC requirements as mentioned in paragraph 5.6.2 or paragraph 5.6.1 as the case may be. 67. Inclusion of BI items related to acquisitions and mergers BI items from acquired businesses or merged entities over the three years period prior to the date of acquisition/merger shall be included in the calculation of BI component for ORC immediately after the acquisition/merger5 and shall be publicly disclosed in accordance with the Pillar 3 requirements. 8. Exclusion of divested activities from the BI Divested activities shall be excluded from the calculation of the BI used for the calculation of ORC only after the Reserve Bank’s (Department of Supervision) approval. Such exclusions shall be publicly disclosed in accordance with the Pillar 3 requirements. 9. High-quality loss data identification, collection, and treatment for banks in buckets 2 and 3 9.1 Identification and collection of the operational risk loss data shall be guided by the criteria provided in paragraph 1 of Annex 2. 9.2 Inclusion of losses related to acquisitions and mergers Operational risk losses of acquired businesses or merged entities over the ten years period prior to the acquisition/merger shall be included in the calculation of LC component of ILM for ORC, immediately after the acquisition/merger and shall be publicly disclosed in accordance with the Pillar 3 requirements. 9.3 Exclusion of losses 9.3.1 Losses shall be excluded from the calculation of the ILM used for the calculation of ORC only after the Reserve Bank’s (Department of Supervision) approval. Banks may request the Reserve Bank (Department of Supervision) to exclude6 certain operational loss events that are no longer relevant to their risk 5 For example: Suppose bank A is merged with bank B with effect from July 1, 2021, BI for bank B calculated in July 2021 shall also include the financials of bank A (merged entity) for the (i) FY21, FY20, and FY19, or (ii) 12 month period each ending June 2021, June 2020, and June 2019, whichever is higher. 6 For example: Banks may suffer operational risk losses related to the reform of benchmark reference rates, particularly if they do not adequately prepare for the transition to the new rates. Losses may be incurred over 7profiles. The exclusion of loss events shall be rare and supported by strong justification. In evaluating the relevance of operational loss events to the bank's risk profile, the Reserve Bank (Department of Supervision) will evaluate whether the cause of the loss event could occur in other areas of the bank’s operations. Taking settled legal exposures and divested businesses as examples, the Reserve Bank expects the bank’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products. 9.3.2 Exclusion of losses shall be subject to a materiality threshold (i.e., the excluded loss event shall be greater than 5% of the bank’s average losses). In addition, losses can only be excluded after being included in the bank’s operational risk loss database for a minimum period (i.e., three years). Losses related to divested activities shall not be subjected to such minimum operational risk loss database retention period. 9.3.3 The total loss amount and number of exclusions shall be publicly disclosed in accordance with the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions. 10. Disclosure 10.1 All the BI sub-items for each of the three years of the BI component calculation window shall be disclosed in accordance with the Pillar 3 requirements. 10.2 For banks in buckets 2 and 3, annual loss data for each of the last ten years or each of the years for which annual loss data is available, shall be disclosed in accordance with the Pillar 3 requirements. Loss data shall be reported net of recoveries, both before and after loss exclusions. an extended period of time if banks fail to identify and remediate relevant legacy contracts prior to the discontinuation of a benchmark reference rate. To minimise the risk of operational risk losses, banks should consider the effects of a benchmark rate reform on their businesses in a timely manner and make necessary preparations for the transition to alternative reference rates. In doing so, they should maintain a close dialogue with the Reserve Bank (Department of Supervision) regarding their plans and transition progress, including any identified impediments. 810.3 The disclosures on general qualitative information on a bank’s operational risk framework and quantitative information on BI sub-items and its sub-components as also loss data shall be made as prescribed in Annex 3. 11. Timelines for Compliance Banks shall comply with the instructions contained in these Directions with effect from the date, which will be communicated by the Reserve Bank of India, separately. 12. Repeal Provisions 12.1 With the coming into effect of these Directions, the instructions/guidelines contained in the following circulars issued by the Reserve Bank stand repealed: Sr No Title Circular number and date 1. Implementation of The Standardised DBOD.No.BP.BC.84/21.06.001 Approach (TSA) for Calculation of Capital /2009-10 dated March 31, 2010 Charge for Operational Risk 2. Implementation of the Advanced DBOD.No.BP.BC.88/21.06.014 Measurement Approach (AMA) for /2010-11 dated April 27, 2011 Calculation of Capital Charge for Operational Risk 3. Revisions to Basel II-Advanced DBOD.No.BP.BC.43/21.06.017 Approaches of Operational Risk-TSA and /2014-15 dated October 16, AMA 2014 4. Paragraph 9 on ‘Capital charge for DOR.CAP.REC.15/21.06.201/2 Operational Risk’ and Table- DF-8 on 023-24 dated May 12, 2023 ‘Operational Risk’ of Master Circular- Basel III Capital Regulations 12.2 Notwithstanding the repeal under paragraph 12.1 of the repealed provisions, anything done or any action taken or purported to have been done or taken, or any direction given or any proceeding taken or any penalty or fine imposed under the repealed enactments shall, insofar as it is not inconsistent with the provisions of these Directions, be deemed to have been done or taken under the corresponding provisions of these Master Directions. 9Annex 1 Description of constituents of Business Indicator7 – ILDC, SC and FC BI P&L or Description Typical sub-items constituents balance sheet items Interest Interest income from • Interest income from loans and income all financial assets and advances, assets available for sale, other interest income assets held to maturity, trading (includes interest assets, financial leases and operating income from financial leases and operating leases • Interest income from hedge and profits from leased accounting derivatives assets) • Other interest income • Profits from leased assets Interest Interest expenses from • Interest expenses from deposits, expenses all financial liabilities debt securities issued, financial and other interest leases, and operating leases expenses (includes • Interest expenses from hedge interest expense from accounting derivatives Interest, lease financial and operating • Other interest expenses and dividend leases, losses, • Losses from leased assets depreciation and • Depreciation and impairment of impairment of, and operating leased assets losses from, operating leased assets) Interest Total gross outstanding loans and advances, interest bearing earning securities including government securities, and leased assets assets (i.e. all outstanding credit obligations in the balance sheet, (balance including credit obligations on non-accrued status e.g. non- sheet item) performing assets shall be included in interest earning assets) measured at the end of each financial year. Dividend Dividend income from investments in stocks and funds not income consolidated in the bank’s financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures. Fee and Income received from Fee and commission income from: commission providing advice and • Securities (issuance, origination, income services. Includes reception, transmission, execution of income received by orders on behalf of customers) the bank as an • Clearing and settlement; Asset Services outsourcer of financial management; Custody; Fiduciary services. transactions; Payment services; Structured finance; Servicing of securitisations; Loan commitments and guarantees given; and foreign transactions 7 An indicative mapping of BI items with schedules and line items of the prescribed financial statements format shall be given in due course. 10BI P&L or Description Typical sub-items constituents balance sheet items Fee and Expenses paid for Fee and commission expenses from: commission receiving advice and • Clearing and settlement; Custody; expenses services. Includes Servicing of securitisations; Loan outsourcing fees paid commitments and guarantees by the bank for the received; and Foreign transactions supply of financial services, but not outsourcing fees paid for the supply of non- financial services (e.g. logistical, IT, human resources) Other Income from ordinary • Rental income from investment operating banking operations not properties income included in other BI • Gains from non-current assets and items but of similar disposal groups classified as held for nature (income from sale not qualifying as discontinued operating leases shall operations be excluded) Other Expenses and losses • Losses from non-current assets and operating from ordinary banking disposal groups classified as held for expenses operations not sale not qualifying as discontinued included in other BI operations items but of similar • Losses incurred as a consequence nature and from of operational loss events (e.g. fines, operational loss penalties, settlements, replacement events (expenses from cost of damaged assets), which have operating leases shall not been provisioned/reserved for in be excluded) previous years • Expenses related to establishing provisions/reserves for operational loss events Net profit  Net profit/loss on trading assets and trading liabilities (loss) on (derivatives, debt securities, equity securities, loans and the trading advances, short positions, other assets and liabilities) book  Net profit/loss from hedge accounting  Net profit/loss from exchange differences. Net profit  Net profit/loss on financial assets and liabilities measured at Financial (loss) on fair value through profit and loss the banking  Realised gains/losses on financial assets and liabilities not book measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortised cost)  Net profit/loss from hedge accounting  Net profit/loss from exchange differences 11Note: The following P&L items do not contribute to any of the items of the BI:  Income and expenses from insurance or reinsurance businesses  Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased  Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)  Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)  Expenses of premises and fixed assets (except when these expenses result from operational loss events)  Depreciation/amortisation of tangible and intangible assets (except depreciation related to operating lease assets, which shall be included in financial and operating lease expenses)  Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events  Expenses due to share capital repayable on demand  Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)  Changes in goodwill recognised in profit or loss  Corporate income tax (tax based on profits including current tax and deferred tax). 12Annex 2 1. What shall be the criteria for identification and collection of the operational risk loss data (high-quality loss data)? There shall be general criteria and specific criteria for identification and collection of the operational risk loss data as delineated below: 1.1 General criteria on loss data identification, collection and treatment 1.1.1 Internal loss data are most relevant when clearly linked to a bank’s current business activities, risk management procedures, and technological processes. Therefore, a bank shall document procedures and processes for the identification, collection, and treatment of internal loss data. Such procedures and processes shall be subjected to validation before the use of the loss data in the operational risk capital measurement methodology and independent reviews, by internal and/or external auditors (at least annually) as per the board-approved policy of the bank. 1.1.2 For risk management purposes, and to assist in supervisory validation and/or review, Reserve Bank (Department of Supervision) may require a bank to map its historical internal loss data into the relevant Level 1 and 2 supervisory categories as defined in Annex 4 and to provide this data to Reserve Bank (Department of Supervision). The criteria for allocating losses to the specified event types shall be documented. 1.1.3 A bank’s internal loss data shall be comprehensive and capture all activities and exposures from all appropriate subsystems and geographic locations. Such loss data shall also include the operational risk-related losses emanating from outsourced activities8. The minimum threshold for including a loss event in the data set is set at ₹1,00,0009. 8 e.g. Operational risk-related losses emanating from Direct Sales Agents/Direct Marketing Agents, Business Correspondents, etc. appointed by the bank. 9 Some operational loss events result in multiple accounting impacts, which can be loss impacts or recoveries. To determine whether an operational loss event should be included in the Loss Component calculation dataset, the net loss amount of the event shall be calculated by summing all the loss impacts and subtracting all recoveries pertaining to the event, inside the ten-year calculation window. The accounting date of the impacts is used to 131.1.4 In addition to the information on gross loss amounts, the bank shall collect information about the reference dates of operational risk events, including the date when the event happened (“date of occurrence”), where available; the date on which the bank became aware of the event (“date of discovery”); and the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognised in the bank’s profit and loss (P&L) accounts (“date of accounting”). The bank shall also collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event10. The details of any descriptive information shall be commensurate with the size of the gross loss amount. 1.1.5 While building a loss data set from a foreign subsidiary of a bank, loss impacts denominated in a foreign currency shall be converted using the same exchange rate that is used to convert them in the bank’s financial statements of the period in which the loss impacts are accounted for. 1.1.6 Operational loss events related to credit risk and that are accounted for in credit RWA shall not be included in the operational loss data set. Operational loss events that relate to credit risk but are not accounted for in credit RWA shall be included in the operational loss data set. 1.1.7 Operational risk losses related to market risk shall be included in the operational loss data set. Few examples of such losses are risk posed due to fat- finger error11, the crash of algorithm in algorithmic trading, unauthorised trading determine whether they are inside the ten-year calculation window. If the event’s net total loss amount is equal to or above ₹1,00,000, the loss event shall be included in the calculation dataset. Note that a loss event may not result in a net loss amount above ₹1,00,000 in any individual year and still have to be included in the loss dataset as long as the cumulative impact of the loss event in the ten-year window is equal to or above ₹1,00,000. For example, for a ten-year period (2012 to 2021) window, suppose one loss event results in a loss impact of ₹96,000 in 2012 and ₹7,000 in 2013. This loss event shall be included in the calculation dataset because its total impact inside the calculation window is ₹1,03,000. On the other hand, a loss event that resulted in a loss impact of ₹10,00,000 in 2010 (outside of the ten year window), a loss impact of ₹300,000 in 2013 (inside the calculation window), and a recovery of ₹5,00,000 in 2015 (inside the calculation window) shall not be included in the loss dataset. 10 Tax effects (e.g. reductions in corporate income tax liability due to operational losses) shall not be treated as recoveries. 11 An error caused by a human, as opposed to a computer, in which the wrong information is inputted 14activities, frequent breaches in trading limit, unauthorised remote access for settling the positions, etc. 1.1.8 Banks shall have processes to independently review the accuracy and comprehensiveness of loss data. 1.2 Specific criteria on loss data identification, collection and treatment 1.2.1 Building loss data set Building an acceptable loss data set from the available internal data requires that the bank develops policies and procedures to address several features, including gross loss definition, reference date and grouped losses. 1.2.2 Gross loss, net loss, and recovery 1.2.2.1 Banks shall identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Banks shall use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the bank receives payment. Receivables do not count as recoveries. The data and evidence on recoveries used to net off losses shall be provided to the Reserve Bank (Department of Supervision) upon request. 1.2.2.2 The following items shall be included in the gross loss computation of the loss data set: (a) Direct charges, including impairments and settlements, to the bank’s P&L accounts and write-downs due to the operational risk event; (b) Costs incurred as a consequence of the event including external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event (without considering recovery, depreciation, and provision); 15(c) Provisions12 or reserves accounted for in the P&L against the potential operational loss impact; (d) Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory or suspense accounts and are not yet reflected in the P&L (“Pending losses”). Pending losses of ₹1,00,000 and above shall be included in the loss data set within a time period commensurate with the age of the pending item; and (e) Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods (“Timing losses”).13 Timing losses of ₹1,00,000 and 12 When a bank makes a provision due to an operational loss event, such provision shall be considered as an operational loss immediately. When a charge-off (such as a settlement) eventually takes place later, only the difference between the initial provision and the charge-off (if any) shall be added to the operational loss calculation. Example 1, if a bank makes a provision of ₹ 1 crore for a legal event in FY 2017-18 and then settles the legal event for ₹ 1.20 crore in FY 2018-19, it shall include the provision of ₹ 1 crore in the operational loss data of FY 2017-18 and the additional ₹ 20 lakh in the operational loss data of FY 2018-19 (equal to the ₹ 1.20 crore settlement in FY 2018-19 minus the ₹ 1 crore provision in FY 2017-18). There shall be no double counting of the same financial impacts in the calculation of operational losses. Example 2, If a bank provided ₹2,00,000 for the operational risk loss in FY 2014-15 and the same is included in the loss data set of the year. (i) Scenario 1 If recovery of ₹50,000 happens in FY 2016-17, the bank has to include ₹50,000 as a recovery in FY 2016-17. Thus, loss data is updated without changing the loss originally reported in FY 2014-15. (ii) Scenario 2 Even if recovery of ₹2,50,000 happens in FY 2016-17, the bank has to include ₹2,00,000 only as a recovery in FY 2016-17. Thus, loss data is updated without changing the loss originally reported in FY 2014-15. However, in both scenarios (i) and (ii), the bank cannot include recoveries made against the loss that does not feature in 10 years window i.e. the bank cannot use recoveries of ₹50,000 (scenario 1) and ₹250000 (scenario 2) from FY 2025-26 onwards as the originally reported loss of ₹2,00,000 falls out of 10 years window from FY 2025-26 onwards. 13 Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to-market errors). While these events do not represent a true financial impact on the institution (net impact over time is zero), if the error continues across more than one financial year, it may represent a material misrepresentation of the institution’s financial statements. Example 1 - when a bank refunds a client that was overbilled due to an operational failure, if the refund is provided in the same financial accounting period as the overbilling took place and thus no misrepresentation of the institution’s financial statements occurs, there is no operational loss. If the refund occurs in a subsequent financial accounting period to the overbilling, it is a timing loss; any operational loss event that exceeds the 16above shall be included in the loss data set when they are due to operational risk events that span more than one financial accounting period. 1.2.2.3 The following items shall be excluded from the gross loss computation of the loss data set: (a) Costs of general maintenance contracts on property, plant or equipment; (b) Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and (c) Insurance premiums. 1.2.2.4 Banks shall use the date of accounting for building the loss data set including losses related to legal events. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L. 1.2.2.5 Losses caused by a common operational risk event14 or by related operational risk events13 which occur over time, but posted to the accounts over several years, shall be allocated to the corresponding years of the loss database, in line with their accounting treatment. threshold of ₹1,00,000 shall be included in the loss data set. In this case, the prior overbilling shall not be considered as a recovery. Example 2- An excess processing fee of ₹1,20,000 charged to a customer in February 2022 and refunded in April 2022 will result in a material misrepresentation of the bank’s financial statements and should be included in the loss data set of FY 2021-22. 14 All operational losses caused by a common underlying trigger or root cause shall be grouped into one operational loss event in a bank’s operational loss event dataset. Two examples of losses with a common underlying trigger or root cause, which should be grouped into a single loss event: (i) A natural disaster causes losses in multiple locations or across an extended time period. (ii) A breach of a bank’s information security results in the disclosure of confidential customer information. As a result, multiple customers incur fraud-related losses that the bank must reimburse. This is sometimes accompanied by remediation expenses such as credit card re-issue or credit history monitoring services. Banks shall have a clear, well-documented policy for determining the criteria for multiple losses to be grouped into an operational loss event. In addition, processes shall be in place to ensure that there is a firm-wide understanding of the loss event grouping policy, that there is appropriate sharing of loss event data across businesses to implement the policy effectively and that there are adequate controls (including independent review) to assess ongoing compliance with the policy. 17Annex 3 Disclosure requirements for operational risk Template ORA: General Qualitative information on a bank’s operational risk framework15 Frequency of disclosure- Annual Banks shall describe: 1. Their policies, frameworks and guidelines for the management of operational risk. 2. The structure and organisation of their operational risk management and control function. 3. Their operational risk measurement system (i.e. the systems and data used to measure operational risk in order to estimate the operational risk capital charge). 4. The scope and main context of their reporting framework on operational risk to executive management and to the Board of Directors. 5. The risk mitigation and risk transfer used in the management of operational risk. This includes mitigation by policy (such as the policies on risk culture, risk appetite, and outsourcing), by divesting from high-risk businesses, and by the establishment of controls. The remaining exposure can then be absorbed by the bank or transferred. For instance, the impact of operational losses can be mitigated with insurance. 15 Refer to Part B of these Directions. 18Template OR 116: Historical losses Frequency of disclosure: Annual Minimum threshold for collection of loss data: ₹1,00,000 Banks are expected to supplement the template with narrative commentary explaining the rationale in aggregate, for new loss exclusions since the previous disclosure. Banks should disclose any other material information, in aggregate, that would help inform users as to its historical losses or its recoveries, with the exception of confidential and proprietary information, including information about legal reserves. (Amount in ₹ crore) a b c d e f g h i j k T T-1 T-2 T-3 T-4 T-5 T-6 T-7 T-8 T-9 Ten year average 1 Total amount of operational losses net of recoveries (no exclusion) 2 Total number of operational risk losses 3 Total amount of excluded operational risk losses 4 Total number of exclusions 5 Total amount of operational losses net of recoveries and net of excluded losses For columns a to j, T denotes the end of the annual reporting period, T–1 the previous year-end, etc. e.g., if T denotes FY 2021-22, T-9 will denote FY 2012-13. Column (k) refers to the average annual losses. Loss amounts and the associated recoveries should be reported in the year in which they were recorded in financial statements. 16 Not mandatory for banks in bucket 1 19Template OR 2: Business Indicator and Sub components Frequency of disclosure: Quarterly (Amount in ₹ crore) a b c Business Indicator (BI) and its sub components T T-1 T-2 1 Interest, lease, and dividend component 1a Interest and lease income 1b Interest and lease expenses 1c Interest earning assets 1d Dividend Income 2 Services component 2a Fee and commission income 2b Fee and commission expenses 2c Other operating income 2d Other operating expenses 3 Financial Component 3a Net P&L on the trading book 3b Net P&L on the banking book 4 BI 5 Business Indicator Components (BIC) Disclosure on the BI 6a BI gross of excluded divested activities 6b Reduction in BI due to excluded divested activities BI components considered in the ORC calculations should be higher of those calculated on a (i) rolling quarter basis, and (ii) FY basis. For details, refer to footnote no 4, Part A. 20Template OR3: Minimum required operational risk capital Frequency of disclosure: Quarterly (Amount in ₹ crore) 1 Business indicator component (BIC) 2 Internal loss multiplier (ILM) 3 Minimum required operational risk capital (ORC) 4 Operational risk RWA 21Annex 4 Detail loss event type classification Event-type Definition Categories Activity examples (Level 3) category (Level 2) (Level 1) Internal fraud Losses due to Unauthorised Transactions not reported (intentional) acts of a type activity intended to Transaction type unauthorised (with defraud, monetary loss) misappropriate property or Mismarking of position (intentional) circumvent regulations, the Theft and Fraud / credit fraud / worthless deposits law or company fraud policy, excluding Theft / extortion /embezzlement / robbery diversity/ discrimination Misappropriation of assets events, which Malicious destruction of assets involves at least one internal party Forgery Check kiting Smuggling Account takeover / impersonation etc. Tax non-compliance / evasion (wilful) Bribes / kickbacks Insider trading (not on firm’s account) External fraud Losses due to Theft and Theft / robbery acts of a type fraud intended to Forgery defraud, misappropriate Check kiting property or circumvent the Systems Hacking damage law, by a third security party Theft of information (with monetary loss) 22Event-type Definition Categories Activity examples (Level 3) category (Level 2) (Level 1) Employment Losses arising Employee Compensation, benefit, termination practices and from acts relations issues workplace inconsistent with safety employment, Organised labour activity health or safety laws or Safe General liability (slip and fall etc.) agreements, from environment payment of Employee health and safety rules events personal injury claims, or from Workers compensation diversity / discrimination Diversity and All discrimination types events discrimination Clients, Losses arising Suitability, Fiduciary breaches / guideline violations products from an disclosure and and business unintentional or fiduciary Suitability / disclosure issues (know-your- practices negligent failure customer etc.) to meet a professional Retail customer disclosure violations obligation to specific clients Breach of privacy (including fiduciary and Aggressive sales suitability Account churning requirements), or from the nature Misuse of confidential information or design of a product. Lender liability Improper Antitrust business or market Improper trade / market practices practices Market manipulation Insider trading (on firm’s account) Unlicensed activity Money laundering Product flaws Product defects (unauthorised etc.) Model errors 23Event-type Definition Categories Activity examples (Level 3) category (Level 2) (Level 1) Selection, Failure to investigate client per guidelines sponsorship and exposure Exceeding client exposure limits Advisory Disputes over performance of advisory Activities activities Damage to Losses arising Disasters and Natural disaster losses physical assets from loss or other events damage to Human losses from external sources physical assets (terrorism, vandalism) from natural disaster or other events Business Losses arising Systems Hardware disruption and from disruption system failures of business or Software system failures Telecommunications Utility outage / disruptions Execution, Losses from failed Transaction Miscommunication delivery and transaction capture, process processing or execution and Data entry, maintenance or loading error management process maintenance management, Missed deadline or responsibility from relations with trade Model / system misoperation counterparties and vendors Accounting error / entity attribution error Other task misperformance Delivery failure Collateral management failure Reference data maintenance Monitoring Failed mandatory reporting obligation and reporting Inaccurate external report (loss incurred) Customer Client permissions / disclaimers missing intake and documentation Legal documents missing / incomplete 24Event-type Definition Categories Activity examples (Level 3) category (Level 2) (Level 1) Customer / Unapproved access given to accounts client account management Incorrect client records (loss incurred) Negligent loss or damage of client assets Trade Non-client counterparty misperformance Counterparties Miscellaneous non-client counterparty disputes Vendors and Outsourcing Suppliers Vendor disputes 25Part B Advisory Aspects 1. The banks are encouraged to comply with the: 1.1 ‘Guidance Note on Management of Operational Risk’ issued by the Reserve Bank in October 2005; 1.2 ‘Revisions to the Principles for the Sound Management of Operational Risk’ issued by the Basel Committee on Banking Supervision (BCBS) in March 2021; and 1.3 ‘Principles for Operational Resilience’ issued by the BCBS in March 2021. 26Part C Frequently Asked Questions (FAQs) 1. Whether banks are required to undertake a parallel run with respect to Basel III SA? (Paragraph 2.2 of Part A) No. 2. What should be the ORC requirements in case the ORC calculated under Basel III SA is lesser than those calculated under Basic Indicator Approach (BIA)? (Paragraphs 2.2 and 2.3 of Part A) All the existing operational risk approaches would be replaced by Basel III SA with coming into effect of the Directions contained in Part A. Hence, a comparison of ORC requirements calculated using Basel III SA and the discontinued approaches including BIA shall not be required. Hence, banks shall calculate ORC requirements using Basel III SA only. 3. How the ILM should be calculated when a bank does not have ten years of high-quality loss data but has such data for six years? (Paragraph 5.5.2 of Part A) If a bank has six years of high-quality loss data, it shall make use of such six years of data for ILM calculation provided such loss data meets the criteria delineated in paragraph 9 of Part A. In the following year (7th year), the bank shall make use of seven years of high-quality loss data and would do so for the subsequent three years i.e., up to ten years (subject to meeting the abovementioned criteria) for ILM calculation. Thereafter, it shall use the high-quality loss data for the past ten years. 4. What should the marginal coefficient (α i) be when a sub-consolidated bank or subsidiary bank falling in bucket 2 on a standalone basis migrates to bucket 3 on a group basis? (Paragraph 6.5 of Part A) If a sub-consolidated bank or subsidiary bank falling in bucket 2 on a standalone basis migrates to bucket 3 on a group basis, it shall use marginal coefficient (αi) as applicable 27for bucket 2 at that sub-consolidated or subsidiary level, and bucket 3 at the consolidated/ group level. 5. Whether the Income and expenses arising from brokering of insurance products should be included in the BI of a bank? (Note to Annex 1 and Paragraph 1.2.2.3 (c), Annex 2 of Part A) When a bank acts as an intermediary that brokers insurance products, it shall include the income and expenses attributable to such brokerage into its BI. 6. What is the example of operational loss events related to credit risk and accounted for in credit RWA which does not form part of the operational loss data set? (Paragraph 1.1.6, Annex 2 of Part A) Credit-related losses owing to any operational risk event such as fraud in an account should not be included in the operational risk loss data set provided that such losses have been provided for or considered in credit RWA as per extant instructions. However, when a bank securitises its assets i.e. assets that are not on its books, it is still exposed to operational risk due to the presence of clauses such as representations and warranties, clean-up calls in the securitisation agreement, etc. If such losses are crystallised, the bank shall include them in the operational loss data set if they are neither provided for nor considered in credit RWA. 7. How an eligible loss event missed out earlier but identified in subsequent years should be included in the loss data set? (Paragraph 1.2.1 and 1.2.2.5, Annex 2 of Part A) The Reserve Bank expects that a bank’s data collection and reporting procedures and processes capture all operational risk losses over the threshold of ₹1,00,000. However, if a bank excludes any eligible loss data event due to commission or omission errors or any other reason, it shall include such missed out data in the loss data set in the subsequent year by making necessary corrections for the relevant year. Such data shall be included in the loss data set from the year to which it pertains till ten years from the year of detection of such missed out event. 28For example, suppose a bank missed out on an eligible operational risk event of ₹15 lakh that occurred in the financial year (FY) 2014-15 from inclusion in the loss data set of the year. Subsequently, it detected such a loss event in FY 2018-19. The bank, in its loss data for FY 2018-19 (as per the table given below), shall include such a loss event from FY 2014-15 onwards. (Amount in ₹ lakh) Missed out event Loss data for FY Loss data for FY of FY 2014-15 2018-19 Financial Year 2018-19 before detected in FY considering missed out event 2018-19 missed out event 2009-10 50 - 50 2010-11 70 - 70 2011-12 80 - 80 2012-13 60 - 60 2013-14 120 - 120 2014-15 130 15 145 2015-16 140 15 155 2016-17 110 15 125 2017-18 150 15 165 2018-19 100 15 115 The bank shall include such a loss event of ₹15 lakh in the loss data till FY 2027-28 (i.e. 10 years from the year of detection) even though it falls beyond 10-year window (till FY 2023-24) from the year of the missed-out event (FY2014-15). These FAQs are not to be construed as a legal advice or as enforceable and are issued for information and general guidance purposes only. The Reserve Bank of India will not be held responsible for actions taken and/or decisions made based on these FAQs. For clarifications or interpretations, if any, one may be guided by the relevant circulars and notifications issued from time to time by the Reserve Bank of India. 29Part D Illustrations 1. How items of BI-sub components shall be averaged over three years? (Paragraph 5.3 of Part A) The absolute value of net items (e.g. interest income – interest expense) shall be calculated first year-by-year. Only after this year-by-year calculation should the average of the three years be calculated. This has been explained in the illustration given below Illustration-I Suppose, for a particular bank the values of items of BI sub-components for three years period are as given below: (Amount in ₹ crore) Year Interest Interest Abs (Interest Income- Income Expense Interest Expense) Jan 2018- Dec 2018 3,000 3,500 500 Jan 2019- Dec 2019 3,500 3,200 300 Jan 2020- Dec 2020 4,000 3,600 400 The average of absolute value of the above item of BI sub-component shall be ₹400 crore ((500+300+400)/3) 2. How the BIC shall be calculated? (Paragraph 5.4 of Part A) For banks in the first bucket (i.e. with a BI less than or equal to ₹8,000 crore), the BIC shall be equal to BI x 12%. The marginal increase in the BIC resulting from a one-unit increase in the BI is 12% in bucket 1, 15% in bucket 2 and 18% in bucket 3. This has been explained in the illustration given below 30Illustration-II If for a particular bank, BI = ₹3,50,000 crore, then BIC shall be calculated as given below BIC = (8,000 x 12%) + (2,40,000-8,000) x 15% + (3,50,000-2,40,000) x 18% = ₹55,560 crore. 31