Journal of Operational Risk

Marcelo Cruz

Editor-in-chief

Welcome to the second issue of Volume 20 of The Journal of Operational Risk.

In the United States, since the new administration took over in January 2025, significantly more attention has been paid to the cryptoassets ecosystem, and to how strategic these assets can be to a country. There are obviously tremendous risks associated with these decentralized assets, which operate largely beyond central bank supervision. Operational risks in the cryptocurrency markets arise from weaknesses in technology, governance and human processes that underpin trading, custody and asset management. These risks include vulnerabilities such as smart contract bugs, cybersecurity breaches and mismanagement of private keys, all of which can lead to significant or even irreversible losses. The recent passage of the Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act 2025) in the United States, which establishes a regulatory framework for stablecoins, marks a significant step toward addressing some of these risks – particularly those tied to liquidity, transparency and reserve backing. However, the broader crypto ecosystem remains exposed to operational challenges due to inconsistent global regulation, fragmented infrastructure and a reliance on relatively immature platforms. Human error – such as mistyped transactions or flawed governance decisions – continues to exacerbate these risks. As institutional adoption continues to grow, the need for standardized controls and robust compliance frameworks to mitigate the complex operational threats in this rapidly evolving space is becoming increasingly urgent.

The editorial board would be interested to have papers submitted that discuss cryptoassets, their risks and operational challenges, as well as applications of machine learning (ML) techniques and artificial intelligence (AI) – one of the industry’s hot topics. Papers on cyber and IT risks (not just on their quantification but also on better ways to manage them) and on enterprise risk management (ERM) and everything this broad subject encompasses (eg, establishing risk policies and procedures, implementing firm-wide controls, risk aggregation, revamping risk organization, internal audit) would also be very welcome. Analytical papers on operational risk measurement are also keenly sought, particularly those that focus on stress testing and managing operational risk.

These are certainly exciting times! The Journal of Operational Risk, as the leading publication in this area, aims to be at the forefront of OpRisk discussions and we welcome papers that shed light on all of the above topics.

RESEARCH PAPERS

In the issue’s first paper, “The role of banks’ digital transformation in operational risk management: evidence from China”, Wanrui Dai and Liangrong Song investigate the impact of banks’ digital transformation on operational risk using panel data for Chinese listed commercial banks from 2013 to 2021. They show that banking digital transformation and its subareas (except for management digitalization) significantly lower operational risk. This effect is stronger for regional banks and those facing less capital regulation pressure. Further, the operational risk reduction from banks’ digital transformation is mainly driven by their traditional and financial businesses rather than nontraditional ones. More importantly, digitalization-induced bank operational risk mitigation enhances the banks’ market value. The authors’ findings should provide practitioners and regulators with both novel insights into the role of banks’ digital transformation in operational risk governance and a useful reference for other countries that wish to decrease bank risk losses and alleviate capital pressure by digital means.

The second paper in the issue, “Risk measures associated with insurance losses in Ghana” by Charles Kwofie, Williams Kumi, Henry Otoo, Sampson Takyi Appiah and Eric Ocran, notes that value-at-risk (VaR) and tail value-at-risk (TVaR) have been used extensively in the financial sector to estimate the worst possible losses for a given portfolio. However, in the view of the authors, not much has been done to apply these concepts in insurance. Insurers are interested to know, on average, the largest possible claim an insurance company can pay in order to readjust its annual premium rate for compensating possible losses. To this end, Kwofie et al’s study estimates the VaR and TVaR of an example insurance company in Ghana using motor insurance losses (claims). In order to identify which continuous distribution function best fits this claims data, the authors fit the data to a number of different distributions and then test their goodness-of-fit using the Kolmogorov–Smirnov test. They find that the lognormal distribution is the best fit, so they then estimate VaR and TVaR using the lognormal distribution function. Analysis of variance (ANOVA) is used to check whether there are statistically significant differences between the estimates obtained from the two risk measures.

In “A multiplier approach for nonparametric estimation of the extreme quantiles of compound frequency distributions”, our third paper, Helgard Raubenheimer, Tertius de Wet, Charl Pretorius and Pieter Juriaan de Jongh state that operational risk reserves are still widely estimated using the loss distribution approach, the most popular methodology of implementing the Basel advanced measurement approach. The accuracy of the estimation depends heavily on the accuracy with which the extreme quantiles of the aggregate loss distributions are estimated. Various approaches have been proposed to estimate the extreme quantiles of this compound distribution, including estimators based on the single-loss and perturbative approximations that rely on estimating an even more extreme quantile of the underlying severity distribution. However, estimation of these extreme quantiles may be inaccurate due to fitting a parametric severity distribution that fits the bulk of the data well but struggles to capture the tail behavioral characteristics of the distribution that generated the loss data. To circumvent this problem, Raubenheimer et al propose estimating nonparametrically a less extreme or lower quantile of the severity distribution, hopefully with better accuracy, and then multiplying this lower quantile by a certain factor to obtain an estimate of the required extreme quantile of the compound distribution. The factor or multiplier is derived by using extreme value theory and single-loss and perturbative approximations and estimated nonparametrically. The authors evaluate this approach by means of a simulation study. Their findings suggest that the second-order multiplier estimator, based on the second-order perturbative approximation, is a good choice for practical applications.

In the issue’s fourth paper, “Do bank complexities increase the risks? Insights from four Asian countries”, Rayenda Khresna Brahmana, Muhammad Arsalan Hashmi, Abdullah and Nuzhat Jabin Syed observe that, while the Basel III accord recommends diversification for the financial stability of the banking industry, this diversification creates bank complexity, which, in their view, increases bank risk. Their research examines the effect of bank complexity on bank risk within Asian banking systems – in particular those in China, Malaysia, Pakistan and Qatar – and finds that the impact of bank complexity varies across countries and risk measurements. For instance, organizational complexity affects bank risk in China, Malaysia and Pakistan but not in Qatar. Meanwhile, business complexity reduces the risk of financial distress in Qatar and reduces idiosyncratic risk in Malaysia. Geographical complexity increases financial risk in China but not in Malaysia and Qatar, while it increases market risk in Pakistan. The authors’ findings contribute to the literature by suggesting that bank complexity is not always beneficial or disadvantageous for banks in a risk context, and they recall the findings of previous diversification studies. Moreover, this study has implications for policy makers, and it emphasizes the importance of regulatory oversight in managing bank complexity and mitigating regulatory arbitrage.

FORUM PAPER

In “The future of risk and insurability in the era of systemic disruption, unpredictability and artificial intelligence”, Roger Spitz and Olivier Desbiey suggest that in an era defined by systemic disruption, radical unpredictability and the rapid evolution of artificial intelligence, the classical distinction between risk and uncertainty, first articulated by Frank Knight and John Maynard Keynes, needs urgent reexamination. While traditional risk is measurable through probabilistic models, deep uncertainty involves unknowable probabilities and indeterminate outcomes that increasingly defy legacy risk frameworks. The paper explores how the rising frequency of highimpact shocks – technological, geopolitical, financial and epidemiological – exposes the fragility of conventional risk management approaches. It argues for a paradigm shift: from viewing disruption as episodic to understanding it as systemic, whereby interdependent stressors interact to produce cascading, nonlinear impacts. To address this complexity, Spitz and Desbiey propose the antifragile, anticipatory and agility (AAA) framework as a novel approach for uncertainty management. Drawing on insights from complexity science, strategic foresight and adaptive resilience, this framework emphasizes imagination over prediction, and prioritizes managing outcome amplitude over probability. By cultivating organizational shock absorbers and dynamic responsiveness, the AAA framework enables stakeholders to navigate open-ended volatility, to build adaptive capability for decision-making under deep uncertainty, and to seize emergent opportunities across multiple plausible futures, which has critical implications for risk intelligence, insurability and policy design.