Master Direction on Minimum Capital Requirements for Operational Risk

Notification Marquee

RbiAnnouncementWeb

Asset Publisher

Back

Published on June 26, 2023

LISTEN

PDF ( 1328481 )

Master Direction on Minimum Capital Requirements for Operational Risk

RBI/DOR/2023-24/103
DOR.ORG.REC.22/21.06.050/2023-24

June 26, 2023

Reserve Bank of India – Master Direction on Minimum Capital Requirements for Operational Risk

In exercise of the powers conferred by Section 35A of the Banking Regulation Act, 1949, the Reserve Bank of India being satisfied that it is necessary and expedient in the public interest to do so, hereby issues the Directions hereinafter specified. These Directions require a specified Commercial Bank (covered under ‘Applicability’) to hold sufficient regulatory capital against its exposures arising from operational risk.

Part A

1. Short Title and Commencement

These Directions shall be called the Reserve Bank of India (Minimum Capital Requirements for Operational Risk) Directions, 2023.

2. Effective Date

2.1 The effective date of implementation of these Directions shall be communicated separately.

2.2 All existing approaches viz. Basic Indicator Approach (BIA), The Standardised Approach (TSA)/ Alternative Standardised Approach (ASA) and Advanced Measurement Approach (AMA) for measuring minimum operational risk capital (ORC) requirements shall be replaced by the new Standardised Approach (hereafter referred to as the ‘Basel III Standardised Approach’) with coming into effect of these Directions.

2.3 Until then, the minimum operational risk regulatory capital requirements shall be computed in accordance with the instructions contained in paragraph 9 of ‘Master Circular – Basel III Capital Regulations’ issued vide circular DOR.CAP.REC.15/21.06.201/2023-24 dated May 12, 2023, as amended from time to time.

3. Applicability

3.1 The provisions of these Directions shall apply to all Commercial Banks (excluding Local Area Banks, Payments Banks, Regional Rural Banks, and Small Finance Banks).

3.2 The scope of application shall be in accordance with paragraph 3 of ‘Master Circular – Basel III Capital Regulations’ issued vide circular DOR.CAP.REC.15/21.06.201/2023-24 dated May 12, 2023, as amended from time to time.

3.3 The provisions contained in Part A of these Directions are mandatory. Banks are encouraged to comply with the guidelines listed in Part B. Part C and Part D contain Frequently Asked Questions (FAQs) and Illustrations, respectively (for general guidance of banks).

4. Definitions

4.1 In these Directions, unless the context otherwise requires,

4.1.1 “Commercial Banks” means all banking companies¹, corresponding new banks, and State Bank of India as defined under subsections (c), (da), and (nc) respectively of Section 5 of the Banking Regulation Act, 1949 (hereinafter referred to as ‘Bank(s)’)

4.1.2 “Gross loss” means a loss before recoveries of any type.

4.1.3 “Net loss” means the loss after taking into account the impact of recoveries.

4.1.4 “Operational risk” means the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk², but excludes strategic and reputational risk.

4.1.5 “Recovery” is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party.³

4.2 All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Banking Regulation Act, 1949 or the Reserve Bank of India Act, 1934, or Glossary of Terms published by Reserve Bank or as used in commercial parlance, as the case may be.

5. Components of Basel III Standardised Approach (Basel III SA)

5.1 Basel III SA calculation methodology is based on the following components:

5.1.1 the Business Indicator (BI), which is a financial-statement-based proxy for operational risk;

5.1.2 the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of marginal coefficients (αi); and

5.1.3 the Internal Loss Multiplier (ILM), which is a scaling factor that is based on a bank’s average historical losses and the BIC.

5.2 Business Indicator (BI)

The BI shall be the summation of the following three constituents,

BI = ILDC+SC+FC

Where,

ILDC is the Interest, Lease and Dividend Component;

SC is the Services Component; and

FC is the Financial Component.

5.3 Computation of ILDC, SC and FC

The ILDC, SC and FC shall be computed as per the formula below, where a bar above a term indicates that it is calculated as the average over three years⁴: t, t-1 and t-2, and:

Where,

Max=Maximum,

Min=Minimum, and

Abs= Absolute value of sub-components irrespective of their signs (+ or -)

The description for each of these constituents of the BI is provided in Annex 1.

5.4 Business Indicator Component (BIC)

The BIC shall be calculated by multiplying the BI with the marginal coefficients (αi), (which increase with the size of the BI) as shown in Table 1 below.

Table 1
BI ranges and marginal coefficients
Bucket	BI Range (in ₹ crore)	BI Marginal Coefficients (αi)
1	≤8000	12%
2	8000	15%
3	>240000	18%

5.5 Internal Loss Multiplier (ILM)

5.5.1 A bank’s internal operational risk loss experience affects the calculation of ORC through the ILM. The ILM shall be calculated as given below,

Where the Loss Component (LC) is equal to 15 times average annual operational risk losses as mentioned in paragraph 5.5.2.

5.5.2 The calculation of average losses in the LC shall be based on 10 years of high-quality operational risk annual loss data. However, banks that do not have 10 years of high-quality loss data but have five years and above of high-quality loss data shall make use of such available high-quality loss data of five years and above to calculate the LC.

5.6 Operational Risk Capital

5.6.1 For banks in (a) bucket 1, and (b) buckets 2 and 3 that do not have 5 years of high-quality operational risk annual loss data

The ORC requirements shall be equal to BIC, as defined in paragraph 5.4:

The Reserve Bank (Department of Supervision) may however require banks in buckets 2 and 3 to calculate ORC requirements using fewer than five years of loss data if the ILM is greater than 1 and the supervisor believes that these losses are representative of the bank’s operational risk exposure. In such cases, ORC requirements shall be calculated in accordance with paragraph 5.6.2.

5.6.2 For banks in buckets 2 and 3 having 5 years and above of high-quality operational risk annual loss data

The ORC requirements shall be calculated by multiplying the BIC (as defined in paragraph 5.4) by the ILM (as defined in paragraph 5.5):

Banks in buckets 2 and 3 which do not meet the five years of high-quality loss data criteria shall be required to hold ORC at a minimum equal to the BIC (as defined in paragraph 5.4). The Reserve Bank (Department of Supervision) may however require the bank to apply an ILM which is greater than 1 to calculate ORC requirements. The exclusion of loss data due to non-compliance with the high-quality loss data criteria, and the application of any resulting multipliers, shall be publicly disclosed in accordance with the Pillar 3 requirements.

5.7 Risk-Weighted Assets

The risk-weighted assets (RWA) for operational risk shall be calculated by multiplying the ORC by 12.5.

6. Calculation of ORC within a banking group

6.1 At the consolidated level, the ORC calculations shall be based on fully consolidated BI figures, which net all the intragroup income and expenses.

6.2 The ORC calculations at a sub-consolidated level shall be based on BI figures for the banks consolidated at that particular sub-level.

6.3 The ORC calculations at the subsidiary level shall be based on BI figures from the subsidiary.

6.4 A sub-consolidated bank or a subsidiary of the bank shall use only the losses it has incurred at that particular sub-consolidated or subsidiary level for the ORC calculations.

6.5 When BI figures for sub-consolidated or subsidiary level reach bucket 2, banks shall use loss experience in the ORC calculations as mentioned in paragraph 5.6.2.

6.6 In case a subsidiary of a bank belonging to bucket 2 or higher does not meet the high-quality loss data criteria (as given in paragraph 9 of Part A) or does not have five years and above of high-quality operational risk annual loss data, the subsidiary shall calculate the ORC requirements as mentioned in paragraph 5.6.2 or paragraph 5.6.1 as the case may be.

7. Inclusion of BI items related to acquisitions and mergers

BI items from acquired businesses or merged entities over the three years period prior to the date of acquisition/merger shall be included in the calculation of BI component for ORC immediately after the acquisition/merger⁵ and shall be publicly disclosed in accordance with the Pillar 3 requirements.

8. Exclusion of divested activities from the BI

Divested activities shall be excluded from the calculation of the BI used for the calculation of ORC only after the Reserve Bank’s (Department of Supervision) approval. Such exclusions shall be publicly disclosed in accordance with the Pillar 3 requirements.

9. High-quality loss data identification, collection, and treatment for banks in buckets 2 and 3

9.1 Identification and collection of the operational risk loss data shall be guided by the criteria provided in paragraph 1 of Annex 2.

9.2 Inclusion of losses related to acquisitions and mergers

Operational risk losses of acquired businesses or merged entities over the ten years period prior to the acquisition/merger shall be included in the calculation of LC component of ILM for ORC, immediately after the acquisition/merger and shall be publicly disclosed in accordance with the Pillar 3 requirements.

9.3 Exclusion of losses

9.3.1 Losses shall be excluded from the calculation of the ILM used for the calculation of ORC only after the Reserve Bank’s (Department of Supervision) approval. Banks may request the Reserve Bank (Department of Supervision) to exclude⁶ certain operational loss events that are no longer relevant to their risk profiles. The exclusion of loss events shall be rare and supported by strong justification. In evaluating the relevance of operational loss events to the bank's risk profile, the Reserve Bank (Department of Supervision) will evaluate whether the cause of the loss event could occur in other areas of the bank’s operations. Taking settled legal exposures and divested businesses as examples, the Reserve Bank expects the bank’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products.

9.3.2 Exclusion of losses shall be subject to a materiality threshold (i.e., the excluded loss event shall be greater than 5% of the bank’s average losses). In addition, losses can only be excluded after being included in the bank’s operational risk loss database for a minimum period (i.e., three years). Losses related to divested activities shall not be subjected to such minimum operational risk loss database retention period.

9.3.3 The total loss amount and number of exclusions shall be publicly disclosed in accordance with the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions.

10. Disclosure

10.1 All the BI sub-items for each of the three years of the BI component calculation window shall be disclosed in accordance with the Pillar 3 requirements.

10.2 For banks in buckets 2 and 3, annual loss data for each of the last ten years or each of the years for which annual loss data is available, shall be disclosed in accordance with the Pillar 3 requirements. Loss data shall be reported net of recoveries, both before and after loss exclusions.

10.3 The disclosures on general qualitative information on a bank’s operational risk framework and quantitative information on BI sub-items and its sub-components as also loss data shall be made as prescribed in Annex 3.

11. Timelines for Compliance

Banks shall comply with the instructions contained in these Directions with effect from the date, which will be communicated by the Reserve Bank of India, separately.

12. Repeal Provisions

12.1 With the coming into effect of these Directions, the instructions/guidelines contained in the following circulars issued by the Reserve Bank stand repealed:

Sr No	Title	Circular number and date
1.	Implementation of The Standardised Approach (TSA) for Calculation of Capital Charge for Operational Risk	DBOD.No.BP.BC.84/21.06.001/2009-10 dated March 31, 2010
2.	Implementation of the Advanced Measurement Approach (AMA) for Calculation of Capital Charge for Operational Risk	DBOD.No.BP.BC.88/21.06.014/2010-11 dated April 27, 2011
3.	Revisions to Basel II-Advanced Approaches of Operational Risk-TSA and AMA	DBOD.No.BP.BC.43/21.06.017/2014-15 dated October 16, 2014
4.	Paragraph 9 on ‘Capital charge for Operational Risk’ and Table- DF-8 on ‘Operational Risk’ of Master Circular- Basel III Capital Regulations	DOR.CAP.REC.15/21.06.201/2023-24 dated May 12, 2023

12.2 Notwithstanding the repeal under paragraph 12.1 of the repealed provisions, anything done or any action taken or purported to have been done or taken, or any direction given or any proceeding taken or any penalty or fine imposed under the repealed enactments shall, insofar as it is not inconsistent with the provisions of these Directions, be deemed to have been done or taken under the corresponding provisions of these Master Directions.

Annex 1

Description of constituents of Business Indicator⁷ – ILDC, SC and FC

BI constituents	P&L or balance sheet items	Description	Typical sub-items
Interest, lease and dividend	Interest income	Interest income from all financial assets and other interest income (includes interest income from financial and operating leases and profits from leased assets)	• Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets, financial leases and operating leases • Interest income from hedge accounting derivatives • Other interest income • Profits from leased assets
	Interest expenses	Interest expenses from all financial liabilities and other interest expenses (includes interest expense from financial and operating leases, losses, depreciation and impairment of, and losses from, operating leased assets)	• Interest expenses from deposits, debt securities issued, financial leases, and operating leases • Interest expenses from hedge accounting derivatives • Other interest expenses • Losses from leased assets • Depreciation and impairment of operating leased assets
	Interest earning assets (balance sheet item)	Total gross outstanding loans and advances, interest bearing securities including government securities, and leased assets (i.e. all outstanding credit obligations in the balance sheet, including credit obligations on non-accrued status e.g. non-performing assets shall be included in interest earning assets) measured at the end of each financial year.
	Dividend income	Dividend income from investments in stocks and funds not consolidated in the bank’s financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures.
Services	Fee and commission income	Income received from providing advice and services. Includes income received by the bank as an outsourcer of financial services.	Fee and commission income from: • Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers) • Clearing and settlement; Asset management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitisations; Loan commitments and guarantees given; and foreign transactions
	Fee and commission expenses	Expenses paid for receiving advice and services. Includes outsourcing fees paid by the bank for the supply of financial services, but not outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources)	Fee and commission expenses from: • Clearing and settlement; Custody; Servicing of securitisations; Loan commitments and guarantees received; and Foreign transactions
	Other operating income	Income from ordinary banking operations not included in other BI items but of similar nature (income from operating leases shall be excluded)	• Rental income from investment properties • Gains from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations
	Other operating expenses	Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events (expenses from operating leases shall be excluded)	• Losses from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations • Losses incurred as a consequence of operational loss events (e.g. fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years • Expenses related to establishing provisions/reserves for operational loss events
Financial	Net profit (loss) on the trading book	• Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences.
Financial	Net profit (loss) on the banking book	• Net profit/loss on financial assets and liabilities measured at fair value through profit and loss • Realised gains/losses on financial assets and liabilities not measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortised cost) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences

Note: The following P&L items do not contribute to any of the items of the BI:

Income and expenses from insurance or reinsurance businesses
Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased
Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)
Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)
Expenses of premises and fixed assets (except when these expenses result from operational loss events)
Depreciation/amortisation of tangible and intangible assets (except depreciation related to operating lease assets, which shall be included in financial and operating lease expenses)
Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events
Expenses due to share capital repayable on demand
Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)
Changes in goodwill recognised in profit or loss
Corporate income tax (tax based on profits including current tax and deferred tax).

Annex 2

1. What shall be the criteria for identification and collection of the operational risk loss data (high-quality loss data)?

There shall be general criteria and specific criteria for identification and collection of the operational risk loss data as delineated below:

1.1 General criteria on loss data identification, collection and treatment

1.1.1 Internal loss data are most relevant when clearly linked to a bank’s current business activities, risk management procedures, and technological processes. Therefore, a bank shall document procedures and processes for the identification, collection, and treatment of internal loss data. Such procedures and processes shall be subjected to validation before the use of the loss data in the operational risk capital measurement methodology and independent reviews, by internal and/or external auditors (at least annually) as per the board-approved policy of the bank.

1.1.2 For risk management purposes, and to assist in supervisory validation and/or review, Reserve Bank (Department of Supervision) may require a bank to map its historical internal loss data into the relevant Level 1 and 2 supervisory categories as defined in Annex 4 and to provide this data to Reserve Bank (Department of Supervision). The criteria for allocating losses to the specified event types shall be documented.

1.1.3 A bank’s internal loss data shall be comprehensive and capture all activities and exposures from all appropriate subsystems and geographic locations. Such loss data shall also include the operational risk-related losses emanating from outsourced activities⁸. The minimum threshold for including a loss event in the data set is set at ₹1,00,000⁹.

1.1.4 In addition to the information on gross loss amounts, the bank shall collect information about the reference dates of operational risk events, including the date when the event happened (“date of occurrence”), where available; the date on which the bank became aware of the event (“date of discovery”); and the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognised in the bank’s profit and loss (P&L) accounts (“date of accounting”). The bank shall also collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event¹⁰. The details of any descriptive information shall be commensurate with the size of the gross loss amount.

1.1.5 While building a loss data set from a foreign subsidiary of a bank, loss impacts denominated in a foreign currency shall be converted using the same exchange rate that is used to convert them in the bank’s financial statements of the period in which the loss impacts are accounted for.

1.1.6 Operational loss events related to credit risk and that are accounted for in credit RWA shall not be included in the operational loss data set. Operational loss events that relate to credit risk but are not accounted for in credit RWA shall be included in the operational loss data set.

1.1.7 Operational risk losses related to market risk shall be included in the operational loss data set. Few examples of such losses are risk posed due to fat- finger error¹¹, the crash of algorithm in algorithmic trading, unauthorised trading activities, frequent breaches in trading limit, unauthorised remote access for settling the positions, etc.

1.1.8 Banks shall have processes to independently review the accuracy and comprehensiveness of loss data.

1.2 Specific criteria on loss data identification, collection and treatment

1.2.1 Building loss data set

Building an acceptable loss data set from the available internal data requires that the bank develops policies and procedures to address several features, including gross loss definition, reference date and grouped losses.

1.2.2 Gross loss, net loss, and recovery

1.2.2.1 Banks shall identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Banks shall use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the bank receives payment. Receivables do not count as recoveries. The data and evidence on recoveries used to net off losses shall be provided to the Reserve Bank (Department of Supervision) upon request.

1.2.2.2 The following items shall be included in the gross loss computation of the loss data set:

Direct charges, including impairments and settlements, to the bank’s P&L accounts and write-downs due to the operational risk event;
Costs incurred as a consequence of the event including external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event (without considering recovery, depreciation, and provision);
Provisions¹² or reserves accounted for in the P&L against the potential operational loss impact;
Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory or suspense accounts and are not yet reflected in the P&L (“Pending losses”). Pending losses of ₹1,00,000 and above shall be included in the loss data set within a time period commensurate with the age of the pending item; and
Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods (“Timing losses”).¹³ Timing losses of ₹1,00,000 and above shall be included in the loss data set when they are due to operational risk events that span more than one financial accounting period.

1.2.2.3 The following items shall be excluded from the gross loss computation of the loss data set:

Costs of general maintenance contracts on property, plant or equipment;
Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and
Insurance premiums.

1.2.2.4 Banks shall use the date of accounting for building the loss data set including losses related to legal events. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L.

1.2.2.5 Losses caused by a common operational risk event¹⁴ or by related operational risk events¹³ which occur over time, but posted to the accounts over several years, shall be allocated to the corresponding years of the loss database, in line with their accounting treatment.

Annex 3

Disclosure requirements for operational risk

Template ORA: General Qualitative information on a bank’s operational risk framework¹⁵

Frequency of disclosure- Annual

Banks shall describe:

1. Their policies, frameworks and guidelines for the management of operational risk.

2. The structure and organisation of their operational risk management and control function.

3. Their operational risk measurement system (i.e. the systems and data used to measure operational risk in order to estimate the operational risk capital charge).

4. The scope and main context of their reporting framework on operational risk to executive management and to the Board of Directors.

5. The risk mitigation and risk transfer used in the management of operational risk. This includes mitigation by policy (such as the policies on risk culture, risk appetite, and outsourcing), by divesting from high-risk businesses, and by the establishment of controls. The remaining exposure can then be absorbed by the bank or transferred. For instance, the impact of operational losses can be mitigated with insurance.

Template OR 1¹⁶: Historical losses

Frequency of disclosure: Annual

Minimum threshold for collection of loss data: ₹1,00,000

Banks are expected to supplement the template with narrative commentary explaining the rationale in aggregate, for new loss exclusions since the previous disclosure. Banks should disclose any other material information, in aggregate, that would help inform users as to its historical losses or its recoveries, with the exception of confidential and proprietary information, including information about legal reserves.

(Amount in ₹ crore)

T-1

T-2

T-3

T-4

T-5

T-6

T-7

T-8

T-9

Ten year average

Total amount of operational losses net of recoveries (no exclusion)

Total number of operational risk losses

Total amount of excluded operational risk losses

Total number of exclusions

Total amount of operational losses net of recoveries and net of excluded losses

For columns a to j, T denotes the end of the annual reporting period, T–1 the previous year-end, etc. e.g., if T denotes FY 2021-22, T-9 will denote FY 2012-13. Column (k) refers to the average annual losses.

Loss amounts and the associated recoveries should be reported in the year in which they were recorded in financial statements.

Template OR 2: Business Indicator and Sub components

Frequency of disclosure: Quarterly

(Amount in ₹ crore)
		a	b	c
	Business Indicator (BI) and its sub components	T	T-1	T-2
1	Interest, lease, and dividend component
1a	Interest and lease income
1b	Interest and lease expenses
1c	Interest earning assets
1d	Dividend Income
2	Services component
2a	Fee and commission income
2b	Fee and commission expenses
2c	Other operating income
2d	Other operating expenses
3	Financial Component
3a	Net P&L on the trading book
3b	Net P&L on the banking book
4	BI
5	Business Indicator Components (BIC)

Disclosure on the BI

6a	BI gross of excluded divested activities
6b	Reduction in BI due to excluded divested activities

BI components considered in the ORC calculations should be higher of those calculated on a (i) rolling quarter basis, and (ii) FY basis. For details, refer to footnote no 4, Part A.

Template OR3: Minimum required operational risk capital

Frequency of disclosure: Quarterly

(Amount in ₹ crore)
1	Business indicator component (BIC)
2	Internal loss multiplier (ILM)
3	Minimum required operational risk capital (ORC)
4	Operational risk RWA

Annex 4

Detail loss event type classification

Event-type category (Level 1)	Definition	Categories (Level 2)	Activity examples (Level 3)
Internal fraud	Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party	Unauthorised activity	Transactions not reported (intentional) Transaction type unauthorised (with monetary loss) Mismarking of position (intentional)
Internal fraud		Theft and fraud	Fraud / credit fraud / worthless deposits Theft / extortion /embezzlement / robbery Misappropriation of assets Malicious destruction of assets Forgery Check kiting Smuggling Account takeover / impersonation etc. Tax non-compliance / evasion (wilful) Bribes / kickbacks Insider trading (not on firm’s account)
External fraud	Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party	Theft and fraud	Theft / robbery Forgery Check kiting
External fraud		Systems security	Hacking damage Theft of information (with monetary loss)
Employment practices and workplace safety	Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events	Employee relations	Compensation, benefit, termination issues Organised labour activity
		Safe environment	General liability (slip and fall etc.) Employee health and safety rules events Workers compensation
		Diversity and discrimination	All discrimination types
Clients, products and business practices	Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product.	Suitability, disclosure and fiduciary	Fiduciary breaches / guideline violations Suitability / disclosure issues (know-your-customer etc.) Retail customer disclosure violations Breach of privacy Aggressive sales Account churning Misuse of confidential information Lender liability
		Improper business or market practices	Antitrust Improper trade / market practices Market manipulation Insider trading (on firm’s account) Unlicensed activity Money laundering
		Product flaws	Product defects (unauthorised etc.) Model errors
		Selection, sponsorship and exposure	Failure to investigate client per guidelines Exceeding client exposure limits
		Advisory Activities	Disputes over performance of advisory activities
Damage to physical assets	Losses arising from loss or damage to physical assets from natural disaster or other events	Disasters and other events	Natural disaster losses Human losses from external sources (terrorism, vandalism)
Business disruption and system failures	Losses arising from disruption of business or system failures	Systems	Hardware Software Telecommunications Utility outage / disruptions
Execution, delivery and process management	Losses from failed transaction processing or process management, from relations with trade counterparties and vendors	Transaction capture, execution and maintenance	Miscommunication Data entry, maintenance or loading error Missed deadline or responsibility Model / system misoperation Accounting error / entity attribution error Other task misperformance Delivery failure Collateral management failure Reference data maintenance
		Monitoring and reporting	Failed mandatory reporting obligation Inaccurate external report (loss incurred)
		Customer intake and documentation	Client permissions / disclaimers missing Legal documents missing / incomplete
		Customer / client account management	Unapproved access given to accounts Incorrect client records (loss incurred) Negligent loss or damage of client assets
		Trade Counterparties	Non-client counterparty misperformance Miscellaneous non-client counterparty disputes
		Vendors and Suppliers	Outsourcing Vendor disputes

Part B

Advisory Aspects

1. The banks are encouraged to comply with the:

1.1 ‘Guidance Note on Management of Operational Risk’ issued by the Reserve Bank in October 2005;

1.2 ‘Revisions to the Principles for the Sound Management of Operational Risk’ issued by the Basel Committee on Banking Supervision (BCBS) in March 2021; and

1.3 ‘Principles for Operational Resilience’ issued by the BCBS in March 2021.

Part C

Frequently Asked Questions (FAQs)

1. Whether banks are required to undertake a parallel run with respect to Basel III SA? (Paragraph 2.2 of Part A)

No.

2. What should be the ORC requirements in case the ORC calculated under Basel III SA is lesser than those calculated under Basic Indicator Approach (BIA)? (Paragraphs 2.2 and 2.3 of Part A)

All the existing operational risk approaches would be replaced by Basel III SA with coming into effect of the Directions contained in Part A. Hence, a comparison of ORC requirements calculated using Basel III SA and the discontinued approaches including BIA shall not be required. Hence, banks shall calculate ORC requirements using Basel III SA only.

3. How the ILM should be calculated when a bank does not have ten years of high-quality loss data but has such data for six years? (Paragraph 5.5.2 of Part A)

If a bank has six years of high-quality loss data, it shall make use of such six years of data for ILM calculation provided such loss data meets the criteria delineated in paragraph 9 of Part A. In the following year (7th year), the bank shall make use of seven years of high-quality loss data and would do so for the subsequent three years i.e., up to ten years (subject to meeting the abovementioned criteria) for ILM calculation. Thereafter, it shall use the high-quality loss data for the past ten years.

4. What should the marginal coefficient (αi) be when a sub-consolidated bank or subsidiary bank falling in bucket 2 on a standalone basis migrates to bucket 3 on a group basis? (Paragraph 6.5 of Part A)

If a sub-consolidated bank or subsidiary bank falling in bucket 2 on a standalone basis migrates to bucket 3 on a group basis, it shall use marginal coefficient (αi) as applicable for bucket 2 at that sub-consolidated or subsidiary level, and bucket 3 at the consolidated/ group level.

5. Whether the Income and expenses arising from brokering of insurance products should be included in the BI of a bank? (Note to Annex 1 and Paragraph 1.2.2.3 (c), Annex 2 of Part A)

When a bank acts as an intermediary that brokers insurance products, it shall include the income and expenses attributable to such brokerage into its BI.

6. What is the example of operational loss events related to credit risk and accounted for in credit RWA which does not form part of the operational loss data set? (Paragraph 1.1.6, Annex 2 of Part A)

Credit-related losses owing to any operational risk event such as fraud in an account should not be included in the operational risk loss data set provided that such losses have been provided for or considered in credit RWA as per extant instructions.

However, when a bank securitises its assets i.e. assets that are not on its books, it is still exposed to operational risk due to the presence of clauses such as representations and warranties, clean-up calls in the securitisation agreement, etc. If such losses are crystallised, the bank shall include them in the operational loss data set if they are neither provided for nor considered in credit RWA.

7. How an eligible loss event missed out earlier but identified in subsequent years should be included in the loss data set? (Paragraph 1.2.1 and 1.2.2.5, Annex 2 of Part A)

The Reserve Bank expects that a bank’s data collection and reporting procedures and processes capture all operational risk losses over the threshold of ₹1,00,000. However, if a bank excludes any eligible loss data event due to commission or omission errors or any other reason, it shall include such missed out data in the loss data set in the subsequent year by making necessary corrections for the relevant year. Such data shall be included in the loss data set from the year to which it pertains till ten years from the year of detection of such missed out event.

For example, suppose a bank missed out on an eligible operational risk event of ₹15 lakh that occurred in the financial year (FY) 2014-15 from inclusion in the loss data set of the year. Subsequently, it detected such a loss event in FY 2018-19. The bank, in its loss data for FY 2018-19 (as per the table given below), shall include such a loss event from FY 2014-15 onwards.

(Amount in ₹ lakh)
Financial Year	Loss data for FY 2018-19 before missed out event	Missed out event of FY 2014-15 detected in FY 2018-19	Loss data for FY 2018-19 considering missed out event
2009-10	50	-	50
2010-11	70	-	70
2011-12	80	-	80
2012-13	60	-	60
2013-14	120	-	120
2014-15	130	15	145
2015-16	140	15	155
2016-17	110	15	125
2017-18	150	15	165
2018-19	100	15	115

The bank shall include such a loss event of ₹15 lakh in the loss data till FY 2027-28 (i.e. 10 years from the year of detection) even though it falls beyond 10-year window (till FY 2023-24) from the year of the missed-out event (FY2014-15).

These FAQs are not to be construed as a legal advice or as enforceable and are issued for information and general guidance purposes only. The Reserve Bank of India will not be held responsible for actions taken and/or decisions made based on these FAQs. For clarifications or interpretations, if any, one may be guided by the relevant circulars and notifications issued from time to time by the Reserve Bank of India.

Part D

Illustrations

1. How items of BI-sub components shall be averaged over three years? (Paragraph 5.3 of Part A)

The absolute value of net items (e.g. interest income – interest expense) shall be calculated first year-by-year. Only after this year-by-year calculation should the average of the three years be calculated. This has been explained in the illustration given below

Illustration-I

Suppose, for a particular bank the values of items of BI sub-components for three years period are as given below:

(Amount in ₹ crore)
Year	Interest Income	Interest Expense	Abs (Interest Income-Interest Expense)
Jan 2018- Dec 2018	3,000	3,500	500
Jan 2019- Dec 2019	3,500	3,200	300
Jan 2020- Dec 2020	4,000	3,600	400

The average of absolute value of the above item of BI sub-component shall be ₹400 crore ((500+300+400)/3)

2. How the BIC shall be calculated? (Paragraph 5.4 of Part A)

For banks in the first bucket (i.e. with a BI less than or equal to ₹8,000 crore), the BIC shall be equal to BI x 12%. The marginal increase in the BIC resulting from a one-unit increase in the BI is 12% in bucket 1, 15% in bucket 2 and 18% in bucket 3. This has been explained in the illustration given below

Illustration-II

If for a particular bank, BI = ₹3,50,000 crore, then BIC shall be calculated as given below

BIC = (8,000 x 12%) + (2,40,000-8,000) x 15% + (3,50,000-2,40,000) x 18% = ₹55,560 crore.

¹ Includes banks incorporated outside India licensed to operate in India (‘Foreign Banks’) but excludes Local Area Banks, Payments Banks, Regional Rural Banks, and Small Finance Banks.

² Legal risk shall include, but not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements.

³ Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.

⁴ BI components considered in the ORC calculations should be higher of those calculated on a (i) rolling quarter basis, and (ii) financial year (FY) basis.

Example: Suppose a bank is calculating the ORC requirements for November 2022. It has higher BI on an FY basis considering financials of FY22, FY21, and FY20 than on a rolling quarter basis considering financials for the 12 months period each ending Sep 22, Sep 21, and Sep 20. The bank should hold ORC requirements considering the financials of FY22, FY21, and FY20 for BI computation.

⁵ For example: Suppose bank A is merged with bank B with effect from July 1, 2021, BI for bank B calculated in July 2021 shall also include the financials of bank A (merged entity) for the (i) FY21, FY20, and FY19, or (ii) 12 month period each ending June 2021, June 2020, and June 2019, whichever is higher.

⁶ For example: Banks may suffer operational risk losses related to the reform of benchmark reference rates, particularly if they do not adequately prepare for the transition to the new rates. Losses may be incurred over an extended period of time if banks fail to identify and remediate relevant legacy contracts prior to the discontinuation of a benchmark reference rate. To minimise the risk of operational risk losses, banks should consider the effects of a benchmark rate reform on their businesses in a timely manner and make necessary preparations for the transition to alternative reference rates. In doing so, they should maintain a close dialogue with the Reserve Bank (Department of Supervision) regarding their plans and transition progress, including any identified impediments.

⁷ An indicative mapping of BI items with schedules and line items of the prescribed financial statements format shall be given in due course.

⁸ e.g. Operational risk-related losses emanating from Direct Sales Agents/Direct Marketing Agents, Business Correspondents, etc. appointed by the bank.

⁹ Some operational loss events result in multiple accounting impacts, which can be loss impacts or recoveries. To determine whether an operational loss event should be included in the Loss Component calculation dataset, the net loss amount of the event shall be calculated by summing all the loss impacts and subtracting all recoveries pertaining to the event, inside the ten-year calculation window. The accounting date of the impacts is used to determine whether they are inside the ten-year calculation window. If the event’s net total loss amount is equal to or above ₹1,00,000, the loss event shall be included in the calculation dataset. Note that a loss event may not result in a net loss amount above ₹1,00,000 in any individual year and still have to be included in the loss dataset as long as the cumulative impact of the loss event in the ten-year window is equal to or above ₹1,00,000.

For example, for a ten-year period (2012 to 2021) window, suppose one loss event results in a loss impact of ₹96,000 in 2012 and ₹7,000 in 2013. This loss event shall be included in the calculation dataset because its total impact inside the calculation window is ₹1,03,000. On the other hand, a loss event that resulted in a loss impact of ₹10,00,000 in 2010 (outside of the ten year window), a loss impact of ₹300,000 in 2013 (inside the calculation window), and a recovery of ₹5,00,000 in 2015 (inside the calculation window) shall not be included in the loss dataset.

¹⁰ Tax effects (e.g. reductions in corporate income tax liability due to operational losses) shall not be treated as recoveries.

¹¹ An error caused by a human, as opposed to a computer, in which the wrong information is inputted

¹² When a bank makes a provision due to an operational loss event, such provision shall be considered as an operational loss immediately. When a charge-off (such as a settlement) eventually takes place later, only the difference between the initial provision and the charge-off (if any) shall be added to the operational loss calculation.

Example 1, if a bank makes a provision of ₹ 1 crore for a legal event in FY 2017-18 and then settles the legal event for ₹ 1.20 crore in FY 2018-19, it shall include the provision of ₹ 1 crore in the operational loss data of FY 2017-18 and the additional ₹ 20 lakh in the operational loss data of FY 2018-19 (equal to the ₹ 1.20 crore settlement in FY 2018-19 minus the ₹ 1 crore provision in FY 2017-18). There shall be no double counting of the same financial impacts in the calculation of operational losses.

Example 2, If a bank provided ₹2,00,000 for the operational risk loss in FY 2014-15 and the same is included in the loss data set of the year.

(i) Scenario 1

If recovery of ₹50,000 happens in FY 2016-17, the bank has to include ₹50,000 as a recovery in FY 2016-17. Thus, loss data is updated without changing the loss originally reported in FY 2014-15.

(ii) Scenario 2

Even if recovery of ₹2,50,000 happens in FY 2016-17, the bank has to include ₹2,00,000 only as a recovery in FY 2016-17. Thus, loss data is updated without changing the loss originally reported in FY 2014-15.

However, in both scenarios (i) and (ii), the bank cannot include recoveries made against the loss that does not feature in 10 years window i.e. the bank cannot use recoveries of ₹50,000 (scenario 1) and ₹250000 (scenario 2) from FY 2025-26 onwards as the originally reported loss of ₹2,00,000 falls out of 10 years window from FY 2025-26 onwards.

¹³ Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to-market errors). While these events do not represent a true financial impact on the institution (net impact over time is zero), if the error continues across more than one financial year, it may represent a material misrepresentation of the institution’s financial statements.

Example 1 - when a bank refunds a client that was overbilled due to an operational failure, if the refund is provided in the same financial accounting period as the overbilling took place and thus no misrepresentation of the institution’s financial statements occurs, there is no operational loss. If the refund occurs in a subsequent financial accounting period to the overbilling, it is a timing loss; any operational loss event that exceeds the threshold of ₹1,00,000 shall be included in the loss data set. In this case, the prior overbilling shall not be considered as a recovery.

Example 2 - An excess processing fee of ₹1,20,000 charged to a customer in February 2022 and refunded in April 2022 will result in a material misrepresentation of the bank’s financial statements and should be included in the loss data set of FY 2021-22.

¹⁴ All operational losses caused by a common underlying trigger or root cause shall be grouped into one operational loss event in a bank’s operational loss event dataset. Two examples of losses with a common underlying trigger or root cause, which should be grouped into a single loss event:

(i) A natural disaster causes losses in multiple locations or across an extended time period.

(ii) A breach of a bank’s information security results in the disclosure of confidential customer information. As a result, multiple customers incur fraud-related losses that the bank must reimburse. This is sometimes accompanied by remediation expenses such as credit card re-issue or credit history monitoring services.

Banks shall have a clear, well-documented policy for determining the criteria for multiple losses to be grouped into an operational loss event. In addition, processes shall be in place to ensure that there is a firm-wide understanding of the loss event grouping policy, that there is appropriate sharing of loss event data across businesses to implement the policy effectively and that there are adequate controls (including independent review) to assess ongoing compliance with the policy.

¹⁵ Refer to Part B of these Directions.

¹⁶ Not mandatory for banks in bucket 1