Capital Charges For Operational And Other Risks -- The Regulatory Logic

The existing Basel Accord includes some capital provision for risks other than market and credit risk, such as operational risk, legal risk and so on.

But the extent of the provision for these "other risks", and how this relates to the provision for credit risk, in particular, has never been outlined by the regulators.

Over the last year, consultative papers have been published by the Basel Committee (June) and the European Commission (November) on revisions to the capital adequacy framework for financial institutions.

The EC paper, in particular, makes some concrete suggestions on the methodological approaches that might be used to calculate specific capital charges for operational risks.

Both papers have sparked debate, and raised concerns -- not all of which are necessary.

Clearing up confusions

Before we look at how regulators might calculate capital for "other risks", let's restate some of the key principles and issues:

Capital is intended to cover unexpected losses. Few would argue against the idea that capital serves this function for credit and market loss. Equally, regulators are convinced that capital provisions need to be applied to "other risks".

Capital is not intended to cover extreme risks. It is not generally expected that a bank should have enough capital to back its entire loan portfolio, other than in very exceptional circumstances. Similarly, nobody is saying that banks should hold sufficient capital to protect them against extreme events for "other risks". Rather, as for capital for credit and market risk, there is a balance to be achieved.

It may be possible to double-count capital. Were it to be agreed that the correlation between credit and market risk, on the one hand, and "other risks" on the other, were very low, it might be possible to "double-count" capital, at least to some extent.

Size may be an issue. Small banks may require a certain critical mass of capital to protect themselves against likely one-off hits. Big banks may not require the same proportional amount of capital, given that a certain capital stock already protects them against such one-off hits.

Any regulatory capital held has to be of reasonable proportions. For example, any methodology that requires banks to hold too much capital would need a scaling-down factor at the upper levels.

We have to ensure that any charge is appropriate across the business lines of a complex bank. This may lead to a mixture of capital allocation processes.

Having accepted these general points, supervisors face the problem of assessing how much regulatory capital is required for each bank.

Different approaches to calculating op risk

A number of methodological options, each with its own problems, currently preoccupy banking supervisors:

Supervisors could ask the banks to come up with a figure, as part of their internal capital assessment, and rely on that. There are two principal problems with this approach:

(i) Banks may not arrive at a figure that is significant, given shareholder pressure. And supervisors would have little basis with which to enter into a dialogue with the banks on individual figures; and

(ii) Banks themselves rarely know how much capital should be held for "other risks". Certainly the models currently used to assess this are well below the accuracy and quality level of market-based models, and even credit-based models.

Another option would be to look at process-based figures. This would link capital to possible losses, as modelled on past losses. The problem here is that the industry has not advanced very far in either collecting or benchmarking these figures. So this option would probably take a while to develop -- though exactly how long is unclear. It would also only be of use for process-based "other risks". How would we handle legal and reputational risk, for example?

A final option would be to use some universal financial indicator as a proxy for "other risks". The main aim would be to shift the methodology of capital allocation away from the balance sheet and towards off-balance sheet activities, as denoted by fees and commissions.

A priori

this is an attractive option, but needs a lot of work to ensure that any outcome is reasonable and does not lay too great a capital burden on banks.

The Brussels paper makes some concrete suggestions on this methodological problem. In our internal talks at Basel, we have gone further than this, and are discussing the details and mechanics.

With luck, the basic principles behind the capital calculation for operational risk would be further developed by the summer. It is hoped that they will form part of a second consultative paper that is likely to be provided next autumn.

With all this in mind, I would like to tackle a few issues that may currently be clouding discussions between regulators and the industry.

Additionality. There is a fear in the industry that the "other risks" charge is a way of increasing aggregate capital requirements. In order to clarify the issue, the following points can be made:

(i) There is a commitment to have aggregate capital at least at the current level. So, to put it crudely, "capital" lost through lower charges for market risk and credit risk, will be replaced through the "other risks" charge. However, it should be noted, the degree of actual "loss" that will take place is unclear.

(ii) The distribution of capital may actually be more important, or at least as important, as its level. We want to make sure that the capital is in the right place to protect the system.

Credibility. The main point to make here is that the current system of allocating regulatory capital is the least credible approach of all those available, as it is based primarily on the balance sheet. The aim is to incorporate a better indicator of "other risks" in the system. If we do not achieve this, and then enforce the approach through regulatory capital charges, the public credibility of the Basel Accord will diminish. The main point about an "other risks" charge is that it reformulates the methodology of calculating the overall capital requirement. In other words, it shifts part of the calculation according to new criteria. Going forward, this is absolutely key.

Box 1. Questions that can't be dodged Bankers concerned about the direction taken by regulators need to answer some basic questions. If supervisors agree capital relief for credit risk mitigation etc, how are the increased "other risks" (e.g. legal risks) going to be covered? How do we ensure a supervisory level playing field for "other risks" unless we have a minimum capital charge? If there is as yet no generally agreed method of capital allocation for "other risks", how can supervisors rely on banks to devise their own numbers when there are incentives to minimise the calibration? Similarly, how would supervisors ensure a level playing field between banks? Without a minimum capital charge, is there not a danger that operational risk units would become, primarily, a means of minimising the regulatory charge rather than controlling risk? If supervisors apply no explicit capital incentive for banks to develop good "other risks" measurement and mitigation techniques, why should the industry move any faster towards this goal than it has in the last ten years? For example benchmarking could have been completed several years ago in a number of key areas (e.g. settlements). If we do not now make some move towards a better methodology than the present approach, how will we be able to defend the credibility of Basel 2, particularly with reference to players who are important to the system but happen to have a small capital charge? In this context, a top-down approach is much more credible than the current approach.

The industry. Supervisors are not dependent on the industry to give them the formula for an "other risks" methodology. It may be that, for the purposes of regulatory capital, supervisors will devise an approach for identifying higher-risk banks that is not current in the market. This is not surprising, as supervisors and banks are using operational risk methodology for different purposes. There are strong arguments against forcing banks to use current bottom-up operational risk measurement methodologies for capital allocation purposes, when these methodologies are meant primarily to identify and mitigate "other risks".

On the other hand, regulators will remain anxious to take advantage of op risk developments in the industry, with a view to using them for regulatory purposes if appropriate.

Incentives. We want to create incentives for the better management, identification and quantification of "other risks". We will do this with a standardised approach to a minimum charge in pillar one of the regulatory process (defined in Box 2 of this article), with no further charge for banks with excellent systems and controls arising from pillar 2 of the process. And we will lay down an explicit path to a lower, non-standardised charge for banks that have models of some kind. The sooner we get to the latter, the better.

Timing. Given the problems outlined at the start of this piece, it would be remiss of supervisors not to do anything now, and to simply hope that in the medium term the industry will find ways of accurately measuring "other risks" and of setting their own capital. A capital requirement now will encourage the entire industry to do this, while providing interim comfort to the system.

Box 2: Not just capital -- the three pillars of the regulatory approach The issue of operational risk is tackled in the consultative paper published in June by the Basle Committee, and more recently in the consultative document published by the European Commission in November. The June paper, in particular, is often thought to be primarily about credit. Look a little closer and I would suggest that it is also about "other risks" to a major extent. This is clearer if we summarise, in reverse order, the three "pillars" of the regulatory approach discussed in the June paper: The third pillar is about disclosure. The more banks disclose about the way they are run, their systems and controls, their aims and structures, the better the market will be able to assess the appropriate capital response. The second pillar is about supervisory approach. This will involve supervisors looking closely at "other risks" mitigation techniques, and at a bank's internal assessment of capital; and finally The first pillar is about allocating regulatory capital for "other risks".

--Jeremy Quick

Jeremy Quick is Manager of Operational Risk Policy with the Financial Services Authority (FSA) in London. This article is an updated and amended version of a speech first given at an FSA conference in London, December 1999.