The U.S. banking regulators will at some point release a proposal to implement the latest changes to the Basel Committee capital framework in the United States. One important novelty of the Basel framework is the introduction of a new capital charge for operational risk, known as the standardized approach for operational risk or “OPE.” If the OPE is implemented in the U.S., it would be the first time that a U.S. standardized approach to calculating risk-weighted assets includes an explicit capital charge for operational risk.
The standards promulgated by the Basel Committee use a simple approach to estimate operational risk and determine the minimum required capital. In essence, the OPE uses a financial-statement-based proxy which is based on certain income and expense balance sheet items. This is called the Business Indicator, or BI. Specifically, as further described herein, the BI component utilizes three different types of income streams (each averaged over the last three years) to determine required operational risk capital: interest component; services component; and financial component.
Although the OPE is a significant improvement over the current advanced measurement approach for several reasons, it comes with some important potential drawbacks. In this note we show that banks with business models that rely more heavily on noninterest income (e.g., capital market activities, custodial services) relative to net interest income will have an inappropriately high BI component and therefore an excessive operational-risk capital requirement.
One important novelty in this note is that we estimate the operational risk losses used in the Dodd-Frank Act stress tests and benchmark them against the operational risk capital requirements derived under the OPE. In this comparison, we assume that the OPE’s capital requirements apply over a one-year horizon and adjust operational risk losses in DFAST accordingly. There are two key advantages to comparing Basel’s capital requirement for operational risk and operational risk losses in DFAST. First, operational risk losses in DFAST are tightly linked to banks’ idiosyncratic business and risk profiles. Second, operational-risk losses in DFAST are derived under severe economic conditions, so those estimates are already biased to the upside.
Our results show that the operational risk capital requirement using the OPE is significantly higher than operational risk losses in the stress tests for almost all large banks. The difference in capital requirements is especially elevated for banks with proportionately higher fee revenue and expenses. To avoid an overstatement of the operational risk capital requirement, we investigate a cap to the BI’s services component, similar to the 2.25-percent cap that already exists on the BI’s interest component. Extending a similar cap to the BI’s services component would be a natural extension of Basel’s OPE methodology. Analysis shows that introducing a cap on the services component equal to 2.25 percent of total assets (adjusted for certain safe assets) would significantly ameliorate concerns about the existing OPE methodology.
A Brief History of Operational Risk in the Basel Framework
The first Basel Capital Accord was released in 1988 and established a risk-sensitive framework to quantify bank assets, thereby initiating what is now usually referred to as risk-weighted assets.[1] Basel I categorized bank assets into five risk categories and assigned risk weights ranging from 0 to 100 percent to each, based on each category’s level of credit risk. The calibration of capital charges in Basel I was designed to reflect these credit risks. The original Basel framework did not separately account for operational risk, but implicitly accounted for it instead in the overall calibration of risk weights and minimum capital ratio requirements. For example, the U.S. banking agencies’ October 2005 advance notice of proposed rulemaking for Basel II implementation in the United States noted that capital charges for operational risk (and interest-rate risk) were embedded in the Basel I risk-based capital rules:
The existing risk-based capital requirements focus primarily on credit risk and generally do not impose explicit capital charges for operational or interest rate risk, which are covered implicitly by the framework. [2]
Operational risk is defined as the risk of losses derived from inadequate or failed internal processes, people, and systems or from external events. The precise types of losses included in this definition have evolved over time. Under Basel I, operational risk generally included any type of unquantifiable risk faced by a bank.[3] In the early 2000s, the BCBS published a set of principles on the management and supervision of operational risk including seven broad types of events that could result in material losses: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery, and process management.[4]
Basel II elevated operational risk to a category of its own and assigned it an explicit capital charge. The revised capital framework included three distinct methodologies to calculate the operational-risk capital charge: the basic indicator approach, the standardized approach, and the advanced measurement approach (AMA). The first two approaches were based on fixed percentages of average operating income, with the standardized approach being slightly more granular across business lines than the basic indicator approach. The AMA modeled operational-risk loss exposure using data on each bank’s historical experience.
Although the Basel Committee defined the AMA operational-risk exposure as the 99.9th percentile of the distribution of aggregate operational-risk losses over a one-year horizon, making such an estimation with any degree of accuracy is impossible, so taking such estimates seriously is silly. In practice, banks could use various models including scenario analysis or extreme value theory to quantify operational risk. However, the lack of concrete guidance led to huge variability in operational-risk charges across jurisdictions, especially since not all jurisdictions were as permissive in terms of allowing banks to use scenario analysis to lower their AMA models’ outputs. The final implementation of the Basel II Accord in the United States only subjected the largest banks to an explicit capital charge for operational risk and required them to use the AMA to determine this charge.
The most recent Basel Accord replaces all three Basel II methodologies for operational risk with a new standardized measurement approach. The OPE presents a unified, non-model-based approach that aims to maintain risk-sensitivity of the framework but overcome some limitations of prior approaches. In essence, the OPE combines information from financial statements and historical losses to calculate an operational-risk capital charge.
The Standardized Approach for Operational Risk
The new standardized approach for operational risk calculates operational-risk capital requirements in three steps. First, it estimates a financial-statement-based proxy for operational risk (the BI), using a bank’s income and expense items as inputs. The BI is defined as the sum of three components: (1) the interest, leases, and dividend component; (2) the services component; and (3) the financial component. Each component is calculated based on the income generated by the relevant activities. A complete derivation of each of the three components is contained in the Appendix.
Second, the OPE multiplies a bank’s BI by a coefficient that increases as the BI rises to generate the Business Indicator Component (BIC). For instance, a bank with a BI between €1 billion and €30 billion is subject to a coefficient of 15 percent, whereas a bank with a BI more than €30 billion is subject to a coefficient of 18 percent. In the last step, the BIC is multiplied by a scaling factor, or internal loss multiplier (ILM), that depends on each bank’s average historical losses over the last 10 years. Throughout this analysis, we will assume the ILM is equal to 1, which is permissible in the Basel framework.[5]
Third, the risk-weighted-assets associated with operational risk are defined as:
Exhibit 1 plots the RWA for operational risk relative to total RWA as currently defined. The bar chart uses data on bank income statements between 2018 and 2020, since the BI is calculated using an average of financial data over a three-year period (see the Appendix for details). Although which U.S. banks will be subject to OPE under the Basel proposal is still unknown, we have included all banks with more than $100 billion in assets and therefore subject to the Fed’s stress tests.[6]
As shown in the chart, the share of RWA for operational risk across large banks varies widely. Specifically, the share of operational risk in total RWA varies from 6.7 percent for Citizens Financial Group (CFG) to 48.3 percent for American Express (AXP). As the purple portions of the bars show, the services component generates a significant share of RWA for operational risk, especially for banks that tend to have the highest operational risk capital requirement.[7]
Exhibit 2 breaks out the services component for banks for which the share of RWAs generated from the services component is highest and shows the portions of RWA generated from investment banking, fiduciary services, credit card and payments fees, and other fees and services. The portion of the services component generated by credit card and payments fees alone would account for nearly 40 percent of AXP’s RWA. For UBS, investment banking fees generate an operational risk-based RWA that would account for about 20 percent of the firm’s aggregate RWA. For DB, income from other fees and services would also generate nearly 20 percent of its aggregate RWA.
The services component of the OPE drives these outsized operational risk charges because the BI formula generates higher RWAs from noninterest income than from interest income. Specifically, the operational risk capital requirement tied to interest income offsets interest income with interest expense and is no higher than 2.25 percent of interest-earning assets. By contrast, the operational risk capital charge tied to noninterest income does not offset revenues with expenses and it is uncapped. The decoupling between the interest and services components penalizes banks with a business mix tilted toward noninterest income in the absence of any evidence of higher operational risk. In addition, the differences in capital requirements across the interest and services components misaligns the risk of banking products that generate both interest income and noninterest revenue, such as credit cards.
This overstatement of risk for banks whose business mix is tilted towards noninterest revenues, could be corrected by capping the BI’s services component at 2.25 percent of a banking institution’s total assets (less reserve balances, Treasuries, and Agency MBS to mitigate procyclicality).[8] For some lines of business, it would also be logical to offset fee income with fee expense because the product generating the two flows is the same (e.g., credit card fees are aligned with credit card member rewards). However, for other firms, the fee income source is mainly from investment banking and fiduciary fees while the major source of expenses comes from brokerage and clearing activities. In this latter case, offsetting fee income with fee expenses is less straightforward because there is less of a comparable relationship between services offered and services used. That said, this is a topic that deserves further analysis beyond the one done in this note.
Losses Associated with Operational Risk Events in the Federal Reserve Stress Tests
The Federal Reserve’s stress tests estimate losses associated with operational risk events for banks above $100 billion in assets using banks’ own historical data on operational risk losses. Those projections offer a robust reality check against the capital requirements for operational risk calculated in Exhibit 1. The level of losses associated with operational risk events in the stress tests depends significantly on the severity of the stress scenarios. In addition, since the losses in the stress tests are derived using banks’ own historical data, analyzing the correlation between OPE’s capital charges and operational risk losses in the Fed’s stress tests is also useful.
One key challenge is that bank-level losses associated with operational risk events in the stress tests are not disclosed but are included in the noninterest expense projections. Fortunately, the projections of noninterest expense are publicly available. The Federal Reserve provides a description of the models used to generate the projections of noninterest expense without operational risk losses in the stress tests. Moreover, those projections rely entirely on data from banks’ FR Y-9C regulatory reports, which are publicly available. Therefore, we estimate losses associated with operational risk events in the stress tests as the difference between the Federal Reserve’s projections of noninterest expense and the projections based on our own models and publicly available data. In addition, the Federal Reserve also publishes aggregate operational risk losses in the stress tests for all firms—another useful datapoint to help calibrate our estimates.
The supervisory stress test methodology document states that the Federal Reserve uses three regression equations to project the components of noninterest expense in the stress tests: compensation expense; fixed assets expense; and all other noninterest expense, excluding operational risk losses and OREO expenses.[9] The supervisory models are estimated using data from the FR Y-9C. These data are publicly available, so it is therefore possible to approximate some of the assumptions the Federal Reserve uses in its projections, excluding operational risk losses and OREO expenses. The projections are based on autoregressive models that relate each specific noninterest expense subcomponent (expressed as a share of total assets) to macroeconomic variables, previous values of the expenses, bank fixed effects, and other bank-specific variables.
The Federal Reserve’s description of expense models offers useful information about the functional form of the regression models, but it does not say precisely which macroeconomic or bank-specific variables are included in each regression. Based on an analysis of DFAST 2020 results, we find that compensation expenses and other noninterest expenses are positively correlated with stock returns, while real GDP growth drives some of the variation in expenses of premises and fixed assets.
The Federal Reserve uses banks’ own historical data on operational risk losses to develop two different modelling approaches during its stress testing exercise: a linear regression model and a historical simulation model. The regression model correlates operational risk losses with macroeconomic variables such as BBB spreads, the house price index, and the unemployment rate. Operational losses are estimated for the full sample of banks. The share of losses allocated to a given firm is a function of the size of the firm, measured by the total assets of each bank.
The historical simulation model attempts to capture historical variation in operational risk losses across seven different types of operational risk events based on data the Fed receives directly from the firms. The projected operational risk losses used in the Fed’s stress tests are calculated as an average of losses obtained from each model.
We will also follow a similar approach and average the projections for operational risk losses from the regression model with those obtained by allocating aggregate projected operational risk losses from the stress tests using bank size. Next, we divide our estimate by 2.25 percent to transform a nine-quarter projection into a yearly estimate, to ensure the OPE and the estimates from the stress test results conform to the same time horizon. Finally, we multiply the stress test projections by 12.5 to transform the operational risk losses into a risk-weighted assets metric.
An appropriate strategy to assess the overall calibration of the OPE is to compare operational risk losses in the stress tests with the operational risk capital requirement calculated using the OPE. Also, our estimates make a conservative assumption and assume the tax rate to be zero; the assumption is conservative because bank profits are typically below zero under stress.[10] Operational risk losses are a reasonable proxy for capital needs, because losses feed directly to bank capital through declines in net income and retained earnings. Since operational risk losses in the stress tests are estimated conditional on a stress scenario, it is also reasonable to compare the aggregate and bank-specific operational risk losses directly with the capital requirements calculated using OPE. Had those losses not been derived under stress conditions, it would be more appropriate to look at the distribution of operational risk losses and compare the tail of the distribution to OPE’s capital requirement.
First, the minimum aggregate operational risk capital under OPE being nearly twice as high as the aggregate operational risk losses in DFAST 2020 as shown in Panel A in Exhibit 3. Cumulative operational risk over the nine quarters of the projection horizon equaled $144 billion in aggregate for the 33 banks. Annualizing those losses to a one-year horizon yields losses of $64 billion under the Federal Reserve’s severely adverse scenario in DFAST 2020. In addition, the OPE methodology results in higher operational risk capital requirements for 31 of the 33 firms that participated in the 2020 stress tests.
Second, as shown in Panel B in Exhibit 3, there are some sizable outliers for minimum operational risk capital under OPE relative to DFAST. The x-axis measures the annualized losses associated with operational risk events in the Fed’s stress tests, and the y-axis represents the share of RWA for operational risk under the OPE. In addition, the correlation between the OPE capital requirement and operational risk losses in DFAST is low because the dots lie vertically on the top of each other. More precisely, the correlation between OPE’s operational risk capital requirement and operational-risk losses in the stress tests is only 29 percent. The correlation would jump to 59 percent if AXP, foreign-bank organizations with an elevated capital markets presence (UBS, CS, DB, BARC), and STT were excluded from the sample.
All together, these findings suggest that the capital requirement for the services component is overstated in OPE.
Adjustment to BI’s Services Component
The current specification of OPE disproportionately penalizes business models with a high percentage of noninterest income in total revenues for two main reasons. First, unlike the interest component, the services component does not offset revenues with expenses. Second, there is no cap on the BI’s services component. The solution we discuss in this section is to introduce a cap to the BI’s services component similar to the one already in place for the interest component.
A cap tied to total assets is preferable to one tied to interest-earning assets, since the services component covers noninterest income. Furthermore, deducting deposits at Federal Reserve Banks, U.S. Treasuries, and Agency MBS from total assets would better reflect operational risk and reduce the procyclicality of the cap. We know that during economic downturns, the Federal Reserve tends to expand its balance sheet as it conducts asset purchases. This causes a large influx of reserve balances into the banking system, since only banks can hold deposits at Federal Reserve Banks. In addition, banks typically use their excess liquidity to purchase Treasury securities and Agency MBS.
A cap on the BI’s services component equal to 2.25 percent of total adjusted assets would be binding for 15 out of the 33 CCAR banks.[11] That is approximately the same number of banks bound by the BI’s cap on the interest component. In Exhibit 4, we plot the adjusted RWA for operation risk for all the banks in the sample. In the revised formulation, AXP has a capital charge near 10 percent of RWA instead of 48 percent, as shown in Exhibit 1. Foreign-bank organizations with high capital markets presence (UBS, DB, CS, and BARC) would also benefit by having a cap on the services component. In addition, the correlation between the adjusted OPE capital charge and operational risk losses in the stress tests would increase from 29 to 53 percent. Finally, the Basel III capital requirement for operational risk would decline from $112 billion to $99 billion, or 11.6 percent. Still, the Basel III operational risk capital requirement would exceed operational-risk losses in the stress tests over a one-year horizon.
Conclusion
The OPE methodology to calculate capital charges for operational risk in the Basel III endgame proposal offers a simplified, non-model, financial-statement-based approach that resolves some problems related to the large variability in capital charges under the previous methodologies introduced by Basel. Although the calculation allows for calibration based on actual historical losses, a misalignment of certain requirements leads to capital charges significantly and inappropriately higher than operational risk losses in the Fed’s stress tests, especially for banks with business models tilted toward noninterest revenues. This problem could largely be corrected by imposing a cap on BI’s services component. Furthermore, deducting reserves, Treasuries and agency MBS securities would not only further enhance accuracy but also make the requirement less procyclical.
To view the research note with the appendix, click here, or click the download button below.
[1] “History of the Basel Committee.” Bank for International Settlements. Available at https://www.bis.org/bcbs/history.htm.
[2] Risk-Based Capital Guidelines; Capital Adequacy Guidelines; Capital Maintenance: Domestic Capital Modifications, 70 Fed. Reg. 61,068 at 61,071 (Oct. 2005).
[3] Power, Michael. “The Invention of Operational Risk.” Review of International Political Economy, October 2005. Available at (PDF) The Invention of Operational Risk (researchgate.net)
[4] See “Sound Practices for the Management and Supervision of Operational Risk,” Basel Committee on Banking Supervision, February 2003. Available at https://www.bis.org/publ/bcbs96.pdf.
[5] According to the definition of ILM, it is more likely for the ILM to exceed 1 than to be lower than 1.
[6] This set of banks represent the largest cohort that allows us to compare Basel’s operational-risk requirement with losses associated with operational risk events in the Fed’s stress tests.
[7] The operational risk requirement is higher for larger banks, so relative to revenues the outliers are the largest banks followed by AXT.
[8] The argument to also exclude Treasuries and Agency MBS in addition to deposits at Federal Reserve Banks is that in a downturn loan demand is weak and banks hold a larger share of their portfolios in securities.
[9] The Federal Reserve excludes operational risk losses and OREO expenses from all other noninterest expense because there is a separate supervisory model that estimates losses from fraud, employee lawsuits, litigation-related expenses, or computer system or other operating disruptions. We removed these types of expenses from all other noninterest expense using the information from the write-in fields for other noninterest expense. We also exclude goodwill impairment losses and amortization expense from noninterest expense.
[10] This assumption also helps simplify the analysis. In practice, banks can use deferred tax assets to lower future taxable income, so negative taxes can increase capital in some cases.
[11] There is no special reason to choose 2.25 percent, except that it is identical to the cap on the interest, leases, and dividend component.
