Based on analysis released by the banking agencies, the new operational risk charge accounts for nearly 90 percent of the increase in banks’ capital requirements under the banking agencies’ Basel proposal. The significant increase in capital requirements for operational risk implies that banks are currently undercapitalized in terms of operational risk capital, but the agencies have offered no evidence to suggest that is the case.
In this post, we demonstrate that the capital charge under the proposed new approach is excessive when compared with actual operational risk losses. Specifically, using a comprehensive dataset on operational risk losses dating back to the early 2000s, we show that annual operational risk losses of U.S. banks rarely exceed 30 percent of the capital required under the new standardized approach for operational risk.
Furthermore, large banks are already required to hold capital for operational risk through the Federal Reserve’s annual stress tests and resulting capital charge.[1] The Federal Reserve has proposed no changes to that component of the test.
Therefore, the combination of both the new standardized approach for operational risk and the stress test capital charge would result in a substantial overstatement of capital requirements for operational risk. In fact, the combined effect of these two charges leads to overall capital requirements five times larger than almost all of the largest losses experienced by U.S. banks in the worst year since 2003. Moreover, our estimate suggests banks in the U.S. must allocate nearly 24 percent of their risk-weighted assets for operational risk, whereas the average for banks in other jurisdictions is nearly half of that amount.
Overstatement of this risk has real-world consequences. Because the operational risk capital charge functions as a broad tax affecting all bank activities, including lending, market making, agency services, asset management and underwriting of securities, it will lead to higher borrowing costs for businesses and households, less competition and more migration of financial intermediation activities to nonbanks.
Lack of Perfect Correlation Between Credit, Market and Operational Risks
Operational risk is the risk of direct or indirect loss resulting from fraud, employee lawsuits, litigation-related expenses or computer system or other operating disruptions. Although cyber risk is considered the most significant operational risk faced by banks, government fines and penalties and resulting class-action litigation have produced the largest losses.
It is never possible to predict the exact losses a bank will experience each year. Nevertheless, banks can estimate average annual losses and consider these expected losses as a cost component of doing business. The rationale behind banks maintaining capital is that realized losses occasionally surpass these expected losses. In addition, regulators often specify a confidence level that dictates the overall level of capital required. Typically, this confidence level is set at 99.9 percent, although the proposed capital rule includes no such standard.
To illustrate, at a 99.9 percent confidence level, if a bank anticipates a $1 million loss on a corporate loan but there is a 0.1-percent chance it could face a $5 million loss, then the bank must have $4 million in capital for that loan.
The proposed rule’s calculation of regulatory capital involves summing risk-weighted assets arising from credit risk, market risk, operational risk and derivatives risk. This method presumes that extreme losses in credit, market, operational and derivatives will all occur simultaneously, with a correlation of 1.0. Under the 99.9-percent confidence-interval assumption, it would mean that, if credit risk losses are in the 0.1-percent tail of the distribution of credit losses, the same is true for market risk losses, operational risk losses and losses associated with derivative instruments. This scenario is extraordinarily unlikely and without historical precedent, and not justified in the proposal. Therefore, the introduction of an explicit capital charge for operational risk into the existing capital requirement framework significantly overstates the capital requirements imposed on banks.[2]
But even on its own terms—leaving aside correlation with other risks and the duplicative charge in the stress test—the proposed charge for operational risk is severely overstated, as we will explain.
Overstatement of Capital Requirements Under the New Standardized Approach
Earlier in October, ORX published a report that used 21 years of operational risk loss data to assess the calibration of the new standardized approach for operational risk, including the version included in the U.S. Basel proposal.[3] The report includes both global and regional data on operational risk losses. We focus on operational risk losses in the United States, to better account for differences in legal frameworks, banks’ business models and economic conditions across geographical regions.[4]
The ORX report analyzes data on operational risk losses across various business lines. It also examines the capital adequacy of the expanded risk-based approach for operational risk among U.S. banks. We will describe how historical operational risk losses of U.S. banks compare in relation to the capital charge of the new standardized approach for operational risk.
Exhibit 1 plots the distribution of operational risk losses for each U.S. bank in relation to the capital charge associated with the proposed standardized approach for operational risk under the U.S. proposal. Specifically, it demonstrates that during the global financial crisis, average operational risk losses were always less than 30 percent of the capital required under the new standardized approach for operational risk.[5] Moreover, the ORX loss data are reported at the event level, which means that losses spanning multiple years are consolidated into a single year. Consequently, the operational risk losses shown in Exhibit 1 during the global financial crisis are considerably higher than what banks actually experienced in those years.
As noted, banks are required to maintain capital to cover unexpected losses. Therefore, it is not expected that the median or average of operational risk losses relative to the capital requirement would approach 100 percent. However, we would anticipate the tails of the distribution of operational risk losses scaled by the capital requirement to be closer to 100 percent during the global financial crisis period (or any other, for that matter). Instead, Exhibit 1 shows that the right tail of these losses barely exceeds 30 percent of the proposed operational risk requirement. This indicates that the new operational risk framework is overly calibrated.
Moreover, this analysis does not even account for the additional capital for operational risk that banks need to hold as determined by the results of the stress tests, which we will cover next. So, rather than the standardized capital charge being three times almost all worst-case losses, it is more like five times those losses.
Operational Risk in the Stress Tests
The capital requirements for operational risk in the stress tests are not directly reported but can be estimated based on the Federal Reserve’s stress testing disclosures. For instance, in the last year when all banks above $100 billion in assets participated in the stress tests, which was 2022, aggregate cumulative operational risk losses amounted to $188 billion over the nine quarters of the projection horizon. However, this figure overestimates the amount of capital currently held by banks for operational risk, since several banks reach the minimum level of regulatory capital before the end of the stress planning horizon. Therefore, operational risk losses after the trough is reached do not affect a bank’s stress capital buffer and should be excluded from the capital requirement.
To estimate the capital that banks are currently holding for operational risk, we adopt BPI’s stress testing model, which includes an estimate of the operational risk charge, to simulate the trajectory of the common equity tier 1 capital ratio of each bank under the severely adverse scenario for 2022. BPI’s top-down models indicate that the inclusion of operational risk losses in the 2022 stress tests resulted in an average decline of another 118 basis points in the common equity tier 1 capital ratio for each bank. Considering that the aggregate risk-weighted assets of these banks currently amount to $11,670 billion, this equates to an operational risk capital requirement of approximately $138 billion (i.e., $11,670 × 118/10,000; Exhibit 2). Note that we do not think it is appropriate to set the operational charge to zero for banks at the 2.5 percent SCB. Without the operational risk losses in the stress tests, banks could use that added capacity to hold different types of assets, so an opportunity cost for the operational risk charge needs to be factored in.
According to the banking agencies’ proposal, the expanded risk-based approach would raise risk-weighted assets attributable to operational risk by $1,950 billion.[6] The average capital requirement is 7 percent, calculated as the minimum of 4.5 percent plus the 2.5-percent buffer, in addition to the GSIB surcharge. The combined total of these two components corresponds to an average requirement of 8.8 percent across all banks, resulting in an additional $172 billion requirement for common equity tier 1 capital to cover operational risk. In total, the aggregate amount of common equity tier 1 capital that banks would be required to hold for operational risk would be about $310 billion (Exhibit 2).
For the purposes of the calculation of risk-weighted assets, banks are effectively required to set $1,725 billion in risk-weighted assets from the stress tests and another $1,950 billion resulting from the implementation of the Basel Endgame proposal (Exhibit 3). This corresponds to about 23.7 percent of risk-weighted assets allocated for operational risk. In contrast, the latest quantitative impact study released by the Basel Committee reveals that operational risk capital accounts for about 12 percent of the total required capital across all banks included in the BCBS sample. Therefore, U.S. banks would be required to hold nearly twice the amount of capital for operational risk compared with large banks in other jurisdictions.[7]
Conclusion
As we discussed, the proposed operational risk capital charge raises significant concerns. First, it appears unnecessary, since it assumes perfect correlation with credit, market and derivative risks. Second, the capital charge under the new standardized approach appears excessive when compared with actual operational risk losses. Third, as we noted in a prior post, the operational risk charge was not tailored to U.S. banks, and it is particularly punitive for fee-income banks. And finally, banks are already capitalized for operational risk through the stress tests, so the introduction of the new operational risk charge effectively more than doubles the required capital.
Therefore, to avoid an overcapitalization for operational risk, the banking agencies should either remove operational risk losses from the stress tests, make material adjustments to the new standardized approach for operational risk or combine both adjustments.
The economic implications of the new capital charge for operational risk are extremely significant. Using the same methodology as the one employed by the Basel Committee, the operational risk requirement would diminish U.S. GDP by close to $90 billion each year.[8] It acts as a universal tax that affects the entire spectrum of bank intermediation activities. The adoption of this new capital charge for operational risk as proposed would materially raise the cost of bank intermediation and further accelerate the migration of financial intermediation activities toward nonbanks.
[1] The largest banks also must calculate an operational risk charge using the so-called advanced approaches, but these requirements are almost never as binding as the U.S. standardized approach to which the stress tests apply.
[2] Rosenberg and Schuermann estimate that capital requirements could be overstated by about 30 to 40 percent.
[3] ORX is the largest operational risk management association in financial services, owned and driven by member institutions, which include some of the largest global banks. ORX has the largest and most comprehensive dataset on operational risk losses dating back to the early 2000s. The ORX report is available at https://orx.org/resource/basel-iii-and-standardised-approaches-to-capital-2023
[4] The detailed U.S. results are available in a numerical appendix available from ORX on request.
[5] The results provided by ORX assume the internal loss multiplier is floored at 1, as in the U.S. proposal. The upper and lower whiskers extend to the highest and lowest values that are within 1.5 × the interquartile range. The interquartile range is the difference between the upper and lower quartiles. Any outlying points (values above or below the whiskers) have been excluded from the charts by ORX.
[6] See Basel Proposal on page 64,168.
[7] The comparison is not perfect, because the Basel QIS is assessing the requirement in terms of the numerator, whereas we are calculating the requirement in terms of the denominator. However, it is approximately correct.
[8] A 24 percent increase in risk-weighted assets corresponds to roughly a 2.5 percentage point increase in capital requirements. According to a recent survey of the literature published by the BCBS, a one percentage point increase in required capital would lead to a GDP reduction of approximately 16 basis points per year, equivalent to $43 billion. Considering that the banks subject to the proposal account for approximately 80 percent of bank assets, this would translate into an annual reduction in GDP of $86 billion.
