Response to the European Commission's Third Consultation Paper on Capital Requirements For Banks and Investment Firms
Until March 2003 I was the Director at the British Bankers' Association responsible for operational risk issues. I was prime mover and Founding Chairman of the BBA's Global Operational Database, which has been collecting loss event data for over 3 years from some 30 international banks, and chaired the BBA's Operational Risk Advisory Panel for a number of years. I am now Executive Director of the Operational Risk Research Forum (see www.orrf.org). I am also a non-executive director of SVB Syndicates Limited, a principal underwriter of financial institutions in the Lloyd's of London insurance market.
Given this experience, I hope the Committee will accept my qualification to comment on the Operational Risk Annexes to the latest Consultative Paper from the Commission Services.
Basic Indicator Approach (BIA) (Annex H-2).
The BIA continues to reflect an alpha of 15%. Whilst this, in itself, may produce a level of capital for operational risk which is in line with the Commission's wishes, it is illogical that banks operating the Standardised Approach, with its higher entry standards and more sophisticated approach, should benefit in terms of the level of the minimum regulatory capital charge only in the areas of retail banking, asset management and retail brokerage. I can see no reason - and I cannot recall regulators giving a reason - why the highest beta under the Standardised Approach should not be at least equal to the alpha of the BIA. If the range of betas must be 12% - 18%, the alpha should rise to 18%. Alternatively, if the Commission believe that the alpha should remain at 15%, the Standardised beta range should reduce to 10% - 15%. To do otherwise undermines the wish of regulators to encourage banks "to move along the spectrum of available approaches", a wish which I and many in the industry wholeheartedly support.
Standardised Approach (SA).
The Commission is, by contrast, to be congratulated on the Qualifying Criteria which it has set out (Annex H-3,4) for the SA. These represent acceptable and appropriate requirements which, but for the capital disincentive highlighted above, should encourage organisations to raise the quality of their risk management, which should be the primary aim of the Directive. The requirements differ in their level of prescription in comparison with those outlined in the Basel Committee's recent consultation. Particular improvements in the Commission's paper concern the risk management function, risk reporting, risk assessment and the review of the risk management system. The Basel criteria are, in almost every respect, identical to those prescribed for the Advanced Measurement Approach and are therefore too high a hurdle.
It is to be hoped that the Commission will maintain its approach in the draft Directive and so encourage banks "to move along the spectrum of approaches".
Alternative Standardised Approach (ASA (Annex H-3, 3).
The concept of the ASA, in that it recognises that in many portfolios 'expected' operational and credit risk losses are covered by annuity income, is to be welcomed.
The application of the highest relevant beta, either to retail and commercial banking (i.e. 15%) where these are combined or to the remaining six business lines (i.e. 18%) where these have to be aggregated, is not. Once again, this reduces the incentive for banks to move to the Standardised Approach. Indeed, it is arguable that a bank which cannot split its gross income on the lines proposed by the Committee (difficult though this will be for many) should not be eligible for the Standardised Approach.
Advanced Measurement Approach - qualitative standards.
It is disappointing that the Commission, in line with the Basel Committee, continues to use the word "measurement" with the implied assumption that operational risk can be measured with a similar high degree of accuracy as has been applied to market risk and credit risk. It is accepted that attritional losses, generally related to transactions, lend themselves to this kind of estimation. The critical events and underlying causes of operational risk, which have been the root causes of the major operational loss events of the last decade, do not. Yet these are the events and causes which most threaten capital and against which capital is primarily intended to be held. The issue is not one of semantics, but one of reality and common sense. At this late stage, I would still hope that the Commission could adopt the language of the BIS Sound Practices paper on operational risk and use the word "assess".
Advanced Measurement Approach - quantitative standards.
The point is brought home most forcefully in the paragraphs covering the AMA soundness standard. Paragraph 627 reasonably refers to "potentially severe 'tail' loss events". The use of inverted commas around "tail" indicates an acceptance that the word is being used in its layman's as opposed to its statistical sense. The following sentence then gives the lie to this interpretation with its reference to comparability to a "99.9 percent confidence interval" (Annex H-4, 1.2.1 (a)).
It is simply not possible to estimate operational risk to this level, equivalent to a 1 in 1,000 year event. Operational risk is fundamentally different from credit and market risk. It is rooted in human rather than transactional behaviour and this, if nothing else, works against the comparability being sought by the Commission.
The differing natures of the information available - loss events, risk indicators, causal factors, scenario analysis, exposure to natural or unnatural external events - also point to the difficulties of attempting estimations to this level of exactness. In the opinion of numerous academics and actuaries, no distribution exists to fit the nature, let alone volume and pattern, of the data being considered, even if the data are restricted to loss events, which is but a sub-set of the information required properly to assess and manage the risk.
Nor does this level of exactitude help in explaining to an organisation's business line management requirements in respect of scenario analysis.
However the expression is hedged, reference to a confidence interval of 99.9% will be taken as the requirement. This is not acceptable and should be replaced by reference to a more realistic 95% (1 in 20 years) or possibly 98% (1 in 50 years) confidence interval.
AMA - detailed criteria.
The Commission wishes the regulatory capital requirement to cover both expected loss and unexpected loss, subject to a bank's demonstrating that it has accounted for expected (or budgeted?) loss in some other way (Annex H-4, 1.2.1(b)). Given that it is not possible for current distributions to estimate satisfactorily the extreme events which characterise operational risk and highlight the difficulty in its measurement, it would be helpful if the Committee explained that the terms EL and UL are being used in their lay, rather than their statistical sense.
It is highly unlikely that any measurement system will capture the major 'drivers' of operational risk (Annex H-4, 1.2.1 (b)), which may affect the 'tail' of estimates. These are causal and not readily amenable to being exposed via systems which rely heavily on the evidence of past events.
Internal data (H-4, 1.2.2).
It is true that internal data are most relevant when linked to a bank's current business activities. It is disappointing, therefore, that supervisors insist that banks, in addition to building a model in accordance with their own structure, possibly using data obtained from cost centres (which are admittedly referred to by the Commission in a separate bullet) in addition to business units, and possibly using event data other than direct losses (such as profits and/or near misses), should nevertheless be obliged to map historical internal loss data to the event types and business lines identified in Annexes H-3 and H-8. It is unlikely that industry-wide data (as evidenced by the QIS3 results) will offer the level of validation which regulators seek and so justify the additional costs involved for AMA banks. It is interesting, also, that the US regulators' ANPR requires mapping only to the loss-event types and not to business lines. These costs are an additional regulatory burden for banks which, by definition, have satisfied regulators that they are sophisticated enough to be on the AMA. The requirement can only be for regulatory convenience which is insufficient reason for regulators to impose the costs on firms.
It is the nature of operational risk that historic data is especially unhelpful in predicting the future. Most firms, having encountered (or been aware of) a major loss event, will take steps to ensure that it is not repeated. The Commission should not therefore expect that 5 years data represents a similar run of comparable data to that demanded in advanced approaches for credit.
The Commission is to be congratulated, though, in its allowing firms to establish their own de minimis thresholds.
The credit/operational risk boundary.
The requirement to disaggregate operational from credit risk losses for the purposes of internal measurement is a costly and unnecessary requirement which senior management in many banks will find difficult to understand. Previous suggestions by regulators that banks should "track" these losses, perhaps by way of a flag, was one thing and would be acceptable. The specific requirement to record all these losses is excessive.
External data (Annex H-4, 1.2.3).
As the Chairman of the first (and until very recently, only) international pooled industry database, which has now been running for over 3 years, I have consistently pointed out to the Commission and the Basel Committee, both collectively through the EBF's and BBA's responses to earlier consultations, and in conversations with individual members of the Basel Committee Risk Management Group, the serious health warnings with which external data should be treated. I therefore welcome wholeheartedly the realism of the Commission's language on this score and hope that it may be repeated in the Basel Committee's equivalent.
Impact of Insurance (Annex H-4, 2).
As a non-executive Director of one of the lead underwriters of financial institutions in the Lloyd's of London insurance market, I naturally have a considerable interest in the proposals for the acceptance of insurance as a 'mitigant' of the regulatory capital charge. I welcome its continuing availability although I regret that it is no longer available to non-AMA banks.
Through the Operational Risk Research Forum, and for the benefit of the FSA, I recently undertook a survey on issues relating to the eligibility criteria of insurance in relation to operational risk. The survey report is attached. I should be very willing to assist the Commission in any further dialogue or research it undertakes on this issue.
J R W Thirlwell, 23 October 2003