Does Basel’s op risk internal loss multiplier add up?

As they attempt to implement the Basel Committee on Banking Supervision’s giant post-crisis package of capital reforms, US regulators could be dancing in the dark.

Its prudential agencies need to toe a delicate line between trying to produce a final rule that has bipartisan support ahead of the November presidential election – while also avoiding major deviations from the Basel III text that might alienate other global regulators.

One of the obvious ways to square this circle would be to eliminate any components of the July 2023 package that would make the US Basel Endgame tougher than the equivalent rules adopted in Europe.

Republican rule-maker Travis Hill – Federal Deposit Insurance Corporation vice-chair – has already flagged up one such component in the operational risk framework.

I suspect the proposal overstates our ability to understand and predict operational risk

Travis Hill, FDIC

Basel proposes the new standardised approach to op risk should include an internal loss multiplier that would adjust each bank’s capital requirements based on the previous 10 years of historical op risk losses. Yet it also gives individual jurisdictions the discretion to set the multiplier to one – a discretion the European Union has already exercised, but in its first draft, the US has not.

In a response to the proposals in July last year, Hill said he thought it should.

“The proposal states definitively, ‘Higher historical operational losses are associated with higher future operational risk exposure’,” said Hill. “I suspect the proposal overstates our ability to understand and predict operational risk.”

It’s not just a case of political compromise – thanks to industry initiatives, we have the data to analyse whether Hill’s suspicions are correct.

ORX News, which provides Risk.net with monthly data on op risk losses, now has figures going back more than a decade. Its parent, the Operational Riskdata Exchange Association was founded – ironically enough – to collect op risk data for the advanced measurement approach to op risk that was scrapped in Basel III.

Its database allows us to compare the 20 banks that suffered the largest cumulative losses in 2012 versus 2022 (see table).

Of the top 20, seven appear in both the 2012 and 2022 walls of shame. An eighth – Santander – was at 19 in 2022 and just one place outside the top 20 in 2012.

So, here we have our likely offenders, then? Well, maybe not...

All eight of these banks are global systemically important banks. And Basel III’s standardised approach to op risk is built around a business indicator metric – which naturally means the larger a bank’s revenues, the larger its op risk capital requirements will be. If the internal loss multiplier is mainly correlated with a bank’s size, it is merely duplicating the business indicator rather than adding any risk-sensitivity to the capital framework.

Another thing to note about the op risk losses for systemic banks: they are several magnitudes smaller in 2022 than in 2012. This could be down to one-off factors. Many of 2012’s recorded losses were regulatory fines and legal settlements stemming from alleged failings that contributed to the 2008 financial crisis. By 2022, such legacy losses had petered out.

But it could also reflect banks’ efforts to improve their controls in response to past op risk losses. In fact, for op risk managers, this is a particular source of frustration with the multiplier. Steps taken to avoid a repeat of past losses would not be reflected in capital requirements for another 10 years – even though their impact on actual op risk could feed through much sooner.

Fatal fraud

Hill calls out another disadvantage of the backward-looking nature of the multiplier. In the comments made last year, he mused: “I wonder whether the operational risks which we care most about capitalising are those least likely to be captured by the internal loss multiplier.”

It’s a view that drew support from a June 19 panel of op risk managers at Risk Live this year. They pointed out the disconnect between past loss events and the risks that are likely to dominate in future – such as cyber security, the use of artificial intelligence and climate change impact.

If capital requirements are driven by the multiplier, they may not incentivise banks to invest money and effort into managing such emerging operational risks.

Another noticeable absence in the intervening decade is Credit Suisse, which of course features prominently in the 2022 top 20 – but not before. It was arguably  a string of operational risk losses undermining investor and depositor confidence that brought the Swiss bank to the point of near-failure. And it’s exactly the kind of serious problem regulators would want the Basel regime to flag up – but one that the internal loss multiplier may not have been useful in averting.

It’s also far from the only example among historical loss data of critical op risk showing up too late to help shore up bank capital via the ILM. Four of the banks in the 2012 top 20 suffered massive internal frauds by senior executives. None of them – Kazkommertsbank, Stanford International, Banco Cruzeiro do Sul and Access Bank – ultimately survived the experience. Rost Bank, which suffered the top loss in 2022, has already been shut down by the Russian authorities.

Clearly, the internal loss multiplier cannot protect a bank from being destroyed by the very people who are supposed to manage its risks.