The Federal Reserve has stated that as part of this year’s Comprehensive Capital Analysis and Review (CCAR) stress test, it will “conduct a series of sensitivity analyses using alternative scenarios and certain adjustments to portfolios to credibly reflect current economic and banking conditions.”[1] While speculation on how it might do so has focused on credit risk – for example, what alternative unemployment and GDP assumptions it might use – a look at operational risk would seem equally warranted if the goal is to credibly reflect banking conditions.
While operational risk is rarely discussed as a key component of the CCAR stress test, it actually plays a substantial role and is a major driver of stress-based capital requirements. For 2019, the Federal Reserve reported that it presumed $123 billion in operational losses across the 18 participating banks.[2] So it is a number worth analyzing as part of any sensitivity analysis.
BACKGROUND
Operational Risk ≠ Operational Risk Capital
Any analysis must begin with understanding the great difference between actual operational risk and operational risk capital. When bankers – or those at any other corporation – think about operational risk, they think about breakdowns in internal procedures, people and systems – basically, something breaking, whether that is a server or a phone system. They institute processes – here’s to all the old six sigma black belts at General Electric — controls and backup systems to make sure that customers continue to be served. The primary operational risk to banking is now universally viewed as cyber security.
Operational risk capital has little to do with operational risk. What most people think of as operational breakdowns produce very low losses. But operational risk capital in practice is about fines imposed by government agencies and resulting civil liability. Cyber events have produced low losses. Thus, for example, aggregate projected losses from operational risk events in the 2016 stress tests declined more than $30 billion as a result of settlements and court rulings on private-label mortgage securities that had occurred around that time[3] – not because of a demonstrated improvement in operational risk management at the relevant banks. In some sense, operational risk capital requirements are attributable to operational risk in the sense that someone at the company did something wrong, but these requirements really depend more on the economic, enforcement and litigation climate than, say, whether the firm has good backup systems – at least in part because an operational risk loss at one bank can increase the capital requirement at another.
The operational risk loss – the fine or civil settlement – generally comes years after the triggering event, whether that is a bid rigging conspiracy or a computational error on a credit card statement or the failure to obtain a proper real estate appraisal. Still, while fines and civil settlements generally lag the events that produced them by years, banks do not wait for the judgment to occur before charging it against income; rather, they are required by accounting rules to establish a litigation reserve when the amount of the loss is material and reasonably estimable. So, in practice, the CCAR operational risk charge is an estimate of how much in litigation reserves each bank will be required to book over the next nine quarters. That is a sensitivity analysis the Fed could conduct.
THE FEDERAL RESERVE’S APPROACH
By its own account, the Federal Reserve uses two models to calculate an operational risk capital charge for each bank: a linear regression model and a historical simulation model.[4] The details of the models and how they are combined are secret, but the Federal Reserve outlines its basic approach.
We will not attempt a critique of the models here, at least in part because so little about them is disclosed. (For example, with the linear regression model, the variables include the 10-year Treasury yield, Dow Jones Total Stock Market Index, and the 3-month Treasury bill rate; it is unclear if or how those variables inform a prediction of operational loss.) We suspect, and some anecdotal evidence suggests, that it is the historical simulation model that drives the charge.
Also, we can perhaps gain some insight into how the stress test accounts for operational loss by looking at how the Federal Reserve treats operational risk for purposes of its other, static capital measures. There, the focus is solely on historical losses, both at the individual bank and for the broader industry.[5] There is no use of a linear regression model.
These “AMA” (Advanced Measurement Approach) models are generally considered unreliable, and for some banks, the regulators add to any modeled results a “supervisory overlay” — that is, they effectively ignore the model’s output and “plus up” the number with no analytical or evidentiary basis. In March 2016, the Basel Committee, including the U.S. regulators, proposed an alternative, simpler and more intuitive model, the Standardized Measure Approach (“SMA”); the Basel Committee adopted the approach in December 2017.[6] The U.S. regulators have never adopted it, and have not explained why.
In essence, it seems fairly clear that, whether directly or indirectly, the Federal Reserve’s CCAR operational risk charge has been designed and calibrated to reflect the large enforcement and litigation losses incurred by large U.S. banks in the enforcement and litigation frenzy that came in the wake of the last financial crisis — calculated not on the basis of the current AMA regulatory framework, nor on the basis of the improved SMA methodology the Federal Reserve approved in its role as Basel Committee representative, but instead on the basis of subjective judgement.
TURNING TO CURRENT CONDITIONS
For purposes of a sensitivity analysis to reflect current economic and banking conditions, one fact would seem to stand out: the current health crisis and resulting economic downturn is attributable to a virus. Banks have served as sources of strength during this crisis, not a source of weakness. In the 2007-09 global financial crisis, enforcement and litigation actions forced banks to pay much of the costs of the crisis, in many cases because banks acquired firms like Countrywide and Bear Stearns that had a major role in causing it; as a result, banks paid hundreds of billion in fines and judgments.[7] There is no parallel in this crisis. No U.S. bank is going to acquire the Wuhan Institute of Virology.
Of course, some banks are already being sued as a result of the current economic crisis – for example, for their role in providing small business loans through the Paycheck Protection Program. To date, all reported court decisions have favored the banks. But regardless, even in a worst-case scenario, this is a far cry from banks being at the center of the crisis, as the banking industry was in 2007-09, and as the CCAR operational risk scenario appears to presume for this crisis.
As an aside, to the extent that operational risk capital is concerned with actual operational risk, banks’ operational performance under current conditions is rather instructive of how poorly the Fed’s operational risk capital predictions perform. With nearly all banking industry employees working remotely, and all banking activity shifting to digital interfaces, it seems safe to say that the banking industry is currently undergoing the single largest operational stress event in memory — yet there have been no significant or widespread operational breakdowns at banks.[8]
REALITY CHECK
Such a change seems overdue in any event. In its most recent annual banking loss report, ORX published aggregate operational risk loss data for its participating banks, which include many of the largest banks from around the globe, namely almost all domestic global systemically important banks (GSIBs), all of the foreign GSIBs and several of the U.S. regional banks subject to CCAR. Some of the operational risk loss data published in ORX’s annual report is summarized below:[9]
Cumulative loss data:
| Year | Number of Banks | Total Loss (billions) | Average Loss per Bank |
| 2014 | 80 | $45.20 | $565 million |
| 2015 | 85 | $30.90 | $364 million |
| 2016 | 92 | $29.90 | $325 million |
| 2017 | 96 | $18.90 | $197 million |
| 2018 | 97 | $15.10 | $156 million |
| Average | $28.00 | $321 million | |
| CCAR 2019 | 18 | $123.00 | $6,833 million |
Thus, for the average CCAR bank, the operational risk losses assumed by the Federal Reserve in its stress test are nearly 10 times higher than the average nine-quarter loss. While the average loss does not help measure the tail risk for losses, 10 times the average loss seems exceptionally conservative.[10] We encourage the Fed to release the information on operational loss distributions that informs its analysis.
CONCLUSION
Thus, as part of its sensitivity analysis, the Federal Reserve could consider that its approach to operational risk losses is unsupportable in the current crisis, and possibly in any environment. Put another way, the Federal Reserve could consider that the CCAR banks collectively are holding about $100 billion in capital that will not be needed for operational risk losses and thus can be used for credit losses.
Disclaimer: The views expressed do not necessarily reflect those of the Bank Policy Institute’s member banks, and are not intended to be, and should not be construed as, legal advice of any kind.
[1] Board of Governors of the Federal Reserve System, Supervision and Regulation Report (May 2020), at 18 (hereinafter Supervision and Regulation Report), https://www.federalreserve.gov/publications/files/202005-supervision-and-regulation-report.pdf
[2] Board of Governors of the Federal Reserve System, Dodd-Frank Act Stress Test 2019: Supervisory Stress Test Results, 23 (June 2019), https://www.federalreserve.gov/publications/files/2019-dfast-results-20190621.pdf
[3] Board of Governors of the Federal Reserve System, Dodd-Frank Act Stress Test 2016: Supervisory Stress Test Results 20 (June 2016), https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20160623a1.pdf
[4] Dodd-Frank Act Stress Test 2020: Supervisory Stress Test Methodology, 23-24 (March 2020). https://www.federalreserve.gov/publications/files/2020-march-supervisory-stress-test-methodology.pdf
[5] See, e.g., Board of Governors of the Federal Reserve System, “Supervisory Guidance for Data, Modeling, and Model Risk Management Under the Operational Risk Advanced Measurement Approaches,” BCC 14-1 (June 30, 2014), https://www.federalreserve.gov/bankinforeg/basel/files/bcc1401.pdf
[6] Basel Committee on Banking Supervision, Consultative Document, Standardised Measurement Approach for operational risk (March 2016), https://www.bis.org/bcbs/publ/d355.pdf; Basel Committee on Banking Supervision, Basel III: Finalising post-crisis reforms (December 2017), https://www.bis.org/bcbs/publ/d424.pdf
[7] Steve Goldstein, “Here’s the staggering amount banks have been fined since the financial crisis,” MarketWatch (Feb. 24, 2018), https://www.marketwatch.com/story/banks-have-been-fined-a-staggering-243-billion-since-the-financial-crisis-2018-02-20; Reuters, “Banks paid $321 billion in fines since financial crisis: BCG” (Mar 2., 2017),
[8] See Supervision and Regulation Report at 6 (“Depending on their size, complexity, and geographic location, banks are facing differing levels of operational challenges as a result of current governmental containment measures. In response to social distancing measures, many banks have reduced or eliminated access to branch lobbies, but continue to transact with customers via drive-through tellers or online and mobile channels. Some have temporarily decreased hours or closed certain branch locations. Many banks have drawn on business continuity plans to allow employees to work from home. Banks with an international presence (either branch or back office operations) have had to navigate local government restrictions on activity.”); see also Board of Governors of the Federal Reserve System, Financial Stability Report, at 60 (May 2020), https://www.federalreserve.gov/publications/files/financial-stability-report-20200515.pdf.
[9] The report is available for download at https://managingrisktogether.orx.org/loss-data/annual-banking-loss-report
[10] Although operational losses in CCAR are meant to approximate tail outcomes, not average outcomes, losses related to operational risk events in CCAR 2019 are almost twice as high as the nine-quarter total operational risk losses for many of the largest global banks on average.
