Skip to main content
  • X. Operational Risk

    • I. Introduction

      1.This Standard articulates specific requirements for the calculation of the operational risk capital requirement for banks in the UAE. It is based closely on requirements of the framework for capital adequacy developed by the Basel Committee on Banking Supervision (BCBS), specifically as articulated in Basel II: International Convergence of Capital Measurement and Capital Standards, June 2006, and subsequent revisions and clarifications thereto.

      2.Banks are required to calculate operational risk capital charges according to the methods and criteria addressed in this Standard.

      3.Capital requirements for Operational Risk apply on a consolidated basis for all banks in the UAE. Banks should follow the requirements of all other applicable Central Bank Standards to determine overall capital adequacy requirements.

    • II. Definitions

      In general, terms in this Standard have the meanings defined in other Regulations and Standards issued by the Central Bank. In addition, for this Standard, the following terms have the meanings defined in this section.

      1. a.Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Operational risk includes legal and compliance risk but excludes strategic and reputational risk.
      2. b.Gross income: net interest income plus net non-interest income, as defined by the Central Bank and/or applicable accounting standards. This measure should:
        • Be gross of any provisions (e.g., for unpaid interest);
        • Be gross of operating expenses, including fees paid to outsourcing service providers but excluding fees received by banks that provide outsourcing services (i.e., such outsourcing fees received shall be included in the definition of gross income);
        • Exclude realised profits/losses from the sale of securities in the banking book (such as securities classified as “held to maturity” and “available for sale” under IFRS, which typically constitute items of the banking book); and
        • Exclude extraordinary or irregular items as well as income derived from insurance.
      3. c.Loans and advances: drawn amounts on credit facilities provided by banks to borrowers.
    • III. Requirements

      • A. Approaches

        4.Banks can apply one of two methods for calculating the Pillar 1 capital requirement for operational risk as below:

        1. (i)Basic Indicator Approach (BIA); or
        2. (ii)Standardised Approach (SA).

        5.The Standardised Approach includes the Alternative Standardised Approach (ASA), which is a simplified version of the Standardised Approach that may be appropriate to small domestic banks focusing on retail or commercial banking activities.

        6.Banks are encouraged to move from the BIA to SA as they develop more sophisticated operational risk measurement systems and practices. Qualifying criteria for the Standardised Approach are presented below in Section B.

        7.Internationally active banks and banks with significant operational risk exposures (for example, specialised processing banks) are expected to use the SA.

        8.The Central Bank will review the capital requirement produced by the operational risk approach used by a bank (whether BIA or SA) for general credibility, especially in relation to a bank’s peer. In the event that credibility is lacking, the Central Bank will consider appropriate supervisory action under Pillar 2.

        9.A bank is required to use the same approach, either the BIA or the SA, for all parts of its operations. The use of SA is subject to qualification by the Central Bank on the basis of the qualification criteria outlined in Section B.

        10.A bank using the SA is not allowed without supervisory approval to choose to revert to the BIA once it has been approved for the SA. However, if the Central Bank determines that a bank using SA no longer meets the qualifying criteria for this approach, it may require the bank to revert to the BIA.

        1.The Basic Indicator Approach (BIA)

        11.Banks using the BIA shall hold capital for operational risk equal to the average over the previous three years of a fixed percentage (denoted alpha) of positive annual gross income. Figures for any year in which annual gross income is negative or zero shall be excluded from both the numerator and denominator when calculating the gross income average.

        12.The capital requirement shall be calculated as follows:

        KBIA = [∑(GI1..n × α)]/n

        where:

         
        KBIA=The capital charge under the BIA;
        GI=Annual gross income, where positive, over the previous three years;
        n=Number of the previous three years for which gross income is positive; and
        α=15%, relating the industry wide level of required capital to the industry wide level of the indicator.

        2.The Standardised Approach (SA)

        13.In the SA, banks’ activities are divided into eight business lines, including corporate finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services, asset management, and retail brokerage. The business lines are defined in the table under Paragraph 12.

        Principles for business line mapping:

        14.The principles that banks shall apply for mapping their own business lines into the regulatory eight business lines as defined by the SA for the purpose of calculating the minimum capital required for operational risk are listed below.

        Mapping of Business Lines
         

        Level 1Level 2Activity Groups
        Corporate FinanceCorporate FinanceMergers and acquisitions, underwriting, privatisations, securitisation, research, debt (government and high yield), equity, syndications, IPO, secondary private placements
        Municipal/Government Finance
        Merchant Banking
        Advisory Services
        Trading and SalesSalesFixed income, equity, foreign exchanges, commodities, credit, funding, own position securities, lending and repos, brokerage, debt, prime brokerage
        Market Making
        Proprietary Positions
        Treasury
        Retail BankingRetail BankingRetail lending and deposits, banking services, trust and estates
        Private BankingPrivate lending and deposits, banking services, trust and estate, investment advice
        Card ServicesMerchant/commercial/corporate cards, private labels and retail
        Commercial BankingCommercial BankingProject finance, real estate, export finance, trade finance, factoring, leasing, lending, guarantees, bills of exchange
        Payment and SettlementExternal ClientsPayments and collections, funds transfer, clearing and settlement
        Agency ServicesCustodyEscrow, depository receipts, securities lending (customers) corporate actions
        Corporate AgencyIssuer and paying agents
        Corporate Trust 
        Asset ManagementDiscretionary Fund ManagementPooled, segregated, retail, institutional, closed, open, private equity
        Non-Discretionary Fund ManagementPooled, segregated, retail, institutional, closed, open
        Retail BrokerageRetail BrokerageExecution and full service

         

        1. (i)All activities must be mapped into the eight level 1 business lines in a mutually exclusive and jointly exhaustive manner;
        2. (ii)Any banking or non-banking activity which cannot be readily mapped into the business line framework, but which represents an ancillary function must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective mapping criteria must be used;
        3. (iii)When mapping gross income, if an activity cannot be mapped into a particular business line then the business line yielding the highest charge must be used. The same business line equally applies to any associated ancillary activity;
        4. (iv)Banks may use internal pricing methods to allocate gross income between business lines provided that total gross income for the bank (as would be recorded under the BIA) still equals the sum of gross income for the eight business lines;
        5. (v)The mapping of activities into business lines for operational risk capital purposes must be consistent with the definitions of business lines used for regulatory capital calculations in other risk categories (i.e., credit and market risk). Any deviations from this principle must be clearly motivated and documented;
        6. (vi)The mapping process used must be clearly documented. In particular, written business line definitions must be clear and detailed enough to allow third parties to replicate the business line mapping. Documentation must, among other things, clearly motivate any exceptions or overrides and be kept on record;
        7. (vii)Processes must be in place to define the mapping of any new activities or products;
        8. (viii)Senior management is responsible for the mapping policy (which is subject to the approval by the board of directors); and
        9. (ix)The mapping process to business lines must be subject to independent review.

        Supplementary business line mapping guidance:

        15.There is a variety of valid approaches that banks may use to map their activities to the eight business lines, provided the approach used meets the business line mapping principles set out above. The following is therefore an example of one possible approach that could be used by a bank to map its gross income and it is hereby presented for guidance only.

        1. (i)Gross income for retail banking consists of net interest income on loans and advances to retail customers and SMEs treated as retail, plus fees related to traditional retail activities, net income from swaps and derivatives held to hedge the retail banking book, and income on purchased retail receivables. To calculate net interest income for retail banking, a bank takes the interest earned on its loans and advances to retail customers less the weighted average cost of funding of the loans (from whatever source — retail or other deposits).
        2. (ii)Similarly, gross income for commercial banking consists of the net interest income on loans and advances to corporate (plus SMEs treated as corporate), interbank and sovereign customers and income on purchased corporate receivables, plus fees related to traditional commercial banking activities including commitments, guarantees, bills of exchange, net income (e.g., from coupons and dividends) on securities held in the banking book, and profits/losses on swaps and derivatives held to hedge the commercial banking book. The calculation of net interest income is based on interest earned on loans and advances to corporate, interbank and sovereign customers less the weighted average cost of funding for these loans (from whatever source).
        3. (iii)For trading and sales, gross income consists of profits/losses on instruments held for trading purposes (i.e., in the mark-to-market book), net of funding cost, plus fees from wholesale brokerage.
        4. (iv)For the other five business lines, gross income consists primarily of the net fees/commissions earned in each of these businesses. Payment and settlement consists of fees to cover provision of payment/settlement facilities for wholesale counterparties. Payment and settlement losses related to bank’s own activities should also be incorporated in the loss experience of the affected business line. Asset management is management of assets on behalf of others.

        Capital Calculation under the Standardised Approach:

        16.Within each business line, gross income is a broad indicator that serves as a proxy for the scale of business operations and thus the likely scale of operational risk exposure within each of these business lines. The capital charge for each business line is calculated by multiplying gross income by a factor (denoted by beta) assigned to that business line. Beta serves as a proxy for the industry-wide relationship between the operational risk loss experience for a given business line and the aggregate level of gross income for that business line. It should be noted that in the SA gross income is measured for each business line, not the whole institution, (e.g., in corporate finance, the indicator is the gross income generated in the corporate finance business line).

        17.The total capital charge is calculated as the three-year average of the simple summation of the regulatory capital charges across each of the business lines in each year. In any given year, negative capital charges (resulting from negative gross income) in any business line may offset positive capital charges in other business lines without limit. However, where the aggregate capital charge across all business lines within a given year is negative, then the input to the numerator for that year shall be zero. The total capital charge may be expressed as:

        1

        where:

         
        KTSA=The capital charge under the SA;
        GI1-8=Annual gross income in a given year, as defined above in the BIA, for each of the eight business lines; and
        β1-8=A fixed percentage relating the level of required capital to the level of the gross income for each of the eight business lines.
         

        The values of the betas are detailed below.

        Business LinesBeta Factors
        Corporate finance (β1)18%
        Trading and sales (β2)18%
        Retail banking (β3)12%
        Commercial banking (β4)15%
        Payment and settlement (β5)18%
        Agency services (β6)15%
        Asset management (β7)12%
        Retail brokerage (β8)12%

         

        Capital Calculation under the Alternative Standardised Approach:

         

        18.The Central Bank may allow a bank to use the ASA provided the bank is able to satisfy the Central Bank that this alternative approach provides an improved basis for capturing its operational risk. Once a bank has been allowed to use the ASA, it will not be allowed to revert to use of the SA without the permission of the Central Bank. Large diversified banks in major markets are not authorized to use the ASA.

        19.Under the ASA, the operational risk capital charge and methodology are the same as for the SA except for two business lines — retail banking and commercial banking. For these business lines, loans and advances — multiplied by a fixed factor ‘m’ — replaces grossincome as the exposure indicator. The betas for retail and commercial banking are unchanged from the SA. The ASA operational risk capital charge for retail banking (with the same basic formula for commercial banking) can be expressed as:

        KRB = βRB × m × LARB

        where

         
        KRB=The capital charge for the retail banking business line;
        βRB=The beta for the retail banking business line;
        LARB=Total outstanding retail loans and advances (non-risk weighted and gross of provisions), averaged over the past three years; and
        m=0.035.
         

        20.For the purposes of the ASA, total loans and advances in the retail banking business line consists of the total drawn amounts in the following credit portfolios: retail, SMEs treated as retail, and purchased retail receivables.

        21.For commercial banking, total loans and advances consists of the drawn amounts in the following credit portfolios: corporate, sovereign, bank, specialised lending, SMEs treated as corporate and purchased corporate receivables. The book value of securities held in the banking book should also be included.

        22.Under the ASA, banks may aggregate retail and commercial banking (if they wish to) using a beta of 15%.

        23.Similarly, those banks that are unable to disaggregate their gross income into the other six business lines can aggregate the total gross income for these six business lines using a beta of 18%, with negative gross income treated as described in paragraph 15 above.

        24.As under the SA, the total capital charge for the ASA is calculated as the simple summation of the regulatory capital charges across each of the eight business lines.

      • B. Qualifying Criteria for the SA and the ASA

        25.In order to qualify for use of the SA or ASA, a bank shall satisfy the Central Bank that, at a minimum:

        1. (i)Its board of directors and senior management, as appropriate, are actively involved in the oversight of the operational risk management framework;
        2. (ii)It has an operational risk management system that is conceptually sound and is implemented with integrity; and
        3. (iii)It has sufficient resources in the use of the approach in the major business lines as well as the control and audit areas.

        26.The Central Bank may insist on a period of initial monitoring of a bank’s SA or ASA before it is used for regulatory capital purposes.

        27.A bank shall develop specific policies and have documented criteria for mapping gross income for current business lines and activities into the standardised framework. The criteria shall be reviewed and adjusted for new or changing business activities as appropriate. These criteria shall be compliant with the principles for business line mapping that are set out above in paragraph 12.

        28.Banks shall also meet the following additional criteria:

        1. (i)The bank shall have an operational risk management system with clear responsibilities assigned to an operational risk management function. The operational risk management function shall be responsible for developing strategies to identify, assess, monitor and control/mitigate operational risk; for codifying firm-level policies and procedures concerning operational risk management and controls; for the design and implementation of the firm’s operational risk assessment methodology; and for the design and implementation of a risk-reporting system for operational risk;
        2. (ii)As part of the bank’s internal operational risk assessment system, the bank shall systematically track relevant operational risk data including material losses by business line. Its operational risk assessment system shall be closely integrated into the risk management processes of the bank. Its output shall be an integral part of the process of monitoring and controlling the banks operational risk profile. For instance, this information shall play a prominent role in risk reporting, management reporting, and risk analysis. The bank shall have techniques for creating incentives to improve the management of operational risk throughout the firm;
        3. (iii)The bank shall have regular reporting of operational risk exposures, including material operational losses, to business unit management, senior management, and to the board of directors. The bank shall have procedures for taking appropriate action according to the information within the management reports;
        4. (iv)The bank’s operational risk management system shall be well documented. The bank shall have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operational risk management system, which shall include policies for the treatment of noncompliance issues;
        5. (v)The bank’s operational risk management processes and assessment system shall be subject to validation and regular independent review. These reviews shall include both the activities of the business units and of the operational risk management function; and
        6. (vi)The bank’s operational risk assessment system (including the internal validation processes) shall be subject to regular review by external auditors and/or the Central Bank.

        Additional Qualifying criteria specifically for the ASA

        29.Large diversified banks are not allowed to use the ASA.

        30.To be permitted to use the ASA, a bank shall demonstrate to the Central Bank that it meets all the following conditions:

        1. (i)Its retail or commercial banking activities shall account for at least 90% of its income;
        2. (ii)The gross income is not a reliable operational risk exposure indicator; for instance a significant proportion of its retail or commercial banking activities comprise loans associated with a high default probability and therefore interest rate income is inflated and operational risk may be overstated; and
        3. (iii)A bank should be able to demonstrate to the Central Bank that the ASA provides a more appropriate basis than the SA for calculating its capital requirement for operational risk.

        31.The Central Bank may determine additional qualifying criteria for the ASA.

    • IV. Review Requirements

      32.Bank calculations of operational risk capital requirements under this Standard shall be subject to appropriate levels of independent review and challenge by third parties. Reviews shall cover business line mapping and allocation of gross income and loans and advances to the regulatory-defined business lines.

    • V. Risk Weighted Assets

      33.A bank must calculate the RWA for operational risk by multiplying the total capital requirement for operational risk as calculated above by the factor 12.5:

      Operational Risk RWA = Capital Charge × 12.5
       

    • VI. Shari’ah Implementation

      34.Banks offering Islamic financial services engaging in Shari’ah with respect to operational risks as approved by their internal Shari’ah control committees should calculate the Operational risk capital in accordance with provisions set out in this standard/guidance and in the manner acceptable by Shari’ah. This is applicable until relevant standards and/or guidance in respect of these transactions are issued specifically for banks offering Islamic financial services