Preparing for New Financial Regulations
Visage will
publish a series of articles on the effects of Basel II and the
new US regulations on
Financial Institutions and in particular Operational Risk. Banks
and Financial Institutions have been managing operational risks
since their inceptions. Currently, regulatory capital is
attributed to operational risks implicitly through other charges
(i.e., credit and market risk). Basel II and the new US
regulations are requesting an explicit charge for operational
risks. These requirements will put additional strain on
financial institutions as the US attempts to mitigate the risks
that has caused the recent financial turmoil in the US markets.
We support this
move as the transparency associated with separate attribution
for operational risk, particularly under the Advanced
Measurement Approach (AMA) will serve to assist banks to more
proactively head off the effects (e.g., costs, reputation damage
and resulting share price depreciation, etc,) of reported events
others have borne.
While in the
immediate term general banks, as described in the notice of
proposed rulemaking issued by the Board of Governors of the
Federal Reserve System March 30, 2006, may be focusing the
majority of their Basel efforts on credit risk approach
alternatives, we thought it would be helpful to outline our
views in respect of operational risk and the options available
for calculating operational risk capital for attribution. While
the less sophisticated approaches are simpler to apply, we are
of the view that over the longer-term all banks should consider
AMA particularly since we believe the implementation benefits
outweigh the investment costs. Accordingly, we summarize below
the important aspects of AMA.
Available Approaches
Under Pillar
I, Basel II allows banks to choose among three options for
attributing operational risk capital: (1) Basic Indicator (BI);
(2) Standardized; and (3) AMA. The first two options attribute
capital based upon a bank’s gross income. BI takes total gross
income of the bank and multiplies it by a percentage while
Standardized breaks down gross income among business lines
(e.g., retail banking, wealth management, corporate finance,
commercial banking, sales & trading, etc.) and assigns specific
percentages.
AMA allows a
bank to attribute operational risk capital based upon its own
program driven by: (1) internal loss event data collected, (2)
internally-constructed scenarios simulating internal loss events
if they have not occurred or data has not been collected, (3)
relevant external loss data from reliable sources, and (4) the
output (i.e., stratified risks and deficiencies) arising from
the bank’s risk and control self-assessment (RCSA) process. We
believe AMA is superior to BI or Standardized for reasons such
as: (1) using a percentage of revenue for capital attribution
can incent behavior dilutive to shareholders, depositors and
other stakeholders, and (2) AMA principles are consistent with
safety and soundness, motivate internal control
structure-oriented behavior (i.e., the internal control
structure is comprised of people, process and systems), reflect
risk and should minimize the operational risk charge.
AMA adoption
can, however, be challenging for banks because it may require
cultural changes including but not limited to: (1) complete,
accurate and timely operational risk event data collection, (2)
operational loss and capital attribution and allocation
preciseness for events and quality control enhancement
opportunities, and (3) application of AMA operational risk
metrics for employee performance scorecards as contributors in
determining incentive compensation. To assist in a cultural
transformation, operational risk information reported to the
Board and senior management can focus the organization on
understanding and enhancing day-to-day operational risk
management at the bank.
AMA was not
able be used for regulatory filings prior to January 1, 2008,
although internal use of AMA principles was encouraged
beforehand, and a four-quarter parallel reporting period was
required. Thereafter, a three-year phase-in period includes
amortizing floors against minimum operational risk capital
levels. Under Pillar II, supervisors may exercise their
authority to add operational risk capital to banks that do not
appear to be providing adequate levels. We support the use of
Pillar II powers particularly in that it could serve as further
incentive for banks to choose and diligently implement the AMA
option. It is important to remember that because the current
regulatory capitalization regime does not include an explicit
capital charge for operational risk, realizing the benefits of
optimizing the balance between AMA implementation and minimizing
the incremental operational risk charge should be considered by
banks. Pillar III requires banks to publicly disclose how they
manage and measure operational risks. Except for a reference to
Standardized and BI, the next few articles will be focused on
AMA. Further articles planned include Reputational Risk,
Outsourcing Risk and Business Continuity Implications of
Operational Risk.
