Application Process to Adopt the Advanced Measurement Approach for Measuring Banks' Operational Risk Exposure

South African Reserve Bank
From the Office of
the Registrar of Banks

Ref: 15/8/2
G7/2014

2014-07-23

To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies

Guidance Note G7/2014 issued in terms of section 6(5) of the Banks Act, 1990

Application process to adopt the advanced measurement approach for measuring banks’ operational risk exposure

## Executive summary

In terms of regulation 33(9) of the Regulations relating to Banks (the Regulations), banks, branches of foreign institutions and controlling companies (hereinafter collectively referred to as ‘banks’) are required to obtain prior written approval from the Registrar of Banks to adopt the advanced measurement approach (AMA) for measuring their exposure to operational risk.

The purpose of this guidance note is to inform all banks of the process to be followed and the information to be submitted when applying to adopt the AMA. This guidance note relates to all future applications to obtain the relevant approval from the Registrar and does not require banks that received approval previously to reapply.

### 1. Guidance on submitting an application to adopt the advanced measurement approach

#### 1.1
All banks intending to adopt the AMA are required to submit a duly completed AMA application pack, attached hereto as Annexure A. The required information is stipulated in the various sections of the application pack and includes a duly completed declaration signed by the applicant bank’s chief executive officer.

#### 1.2
This guidance note relates to all future applications to obtain the relevant approval from the Registrar and does not require banks that received approval previously to reapply.

PO Box 8432 Pretoria 0001 · 370 Helen Joseph Street Pretoria 0002 · South Africa · Tel +27 12 3133911/0861 12 7272 · Fax +27 12 3133758 · www.reservebank.co.za

2

#### 1.3
Banks should notify this Office of its intention to apply for approval to adopt the AMA at least six months prior to submitting a formal written application.

#### 1.4
This Office requires a period of up to 18 months to consider the aforesaid application. Upon instruction by this Office, applicant banks will also be required to perform a BA return reporting parallel run during the above-mentioned application period.

#### 1.5
In accordance with the requirements specified in regulation 33(4) of the Regulations, banks are hereby reminded that once a bank has adopted one of the more sophisticated approaches for the measurement of the bank’s exposure to operational risk, the bank shall not revert to a simpler approach without the prior written approval of the Registrar.

### 2. Acknowledgement of receipt

Two additional copies of this guidance note are enclosed for use by your institution’s independent auditors. The attached acknowledgement of receipt, duly completed and signed by both the chief executive officer of the institution and the said auditors, should be returned to this Office at the earliest convenience of the aforementioned signatories.

René van Wyk
Registrar of Banks

Enc. 4

The previous guidance note issued was Guidance Note G6/2014, dated 22 July 2014.

Annexure A

Application to adopt the advanced measurement approach for measuring banks’ operational risk exposure

Page 1 of 14

### 1. Introduction

This document sets out the information to be submitted to the Office of the Registrar of Banks (this Office) of the South African Reserve Bank (SARB) by a bank, for permission to adopt the advanced measurement approach (AMA) for measuring banks’ exposure for operational risk.

A duly completed application should contain as a minimum the following:

#### 1.1
Responses to the various requests for information, which could include any additional information that this Office may require during the approval process.

#### 1.2
The declarations and signatures form as per the requirements set out in section E below.

> **Note**
> The submission of a signed application by an applicant bank confirms the applicant bank’s consent that any information provided as part of the application can be shared with other regulators for the purposes of the approval process.

All information is to be submitted both in electronic format (via CD or USB drive) and hard copy.

### 2. Scope of application

The application process applies to all banks wishing to use the AMA to calculate their operational risk capital requirement.

In the event that the applicant bank envisages using a partial use AMA¹ to calculate its operational risk capital requirement for identified operations, the scope of this application will only apply to those group operations and not to the operations on an approach other than the AMA.

Where the applicant bank intends adopting a hybrid AMA,² one AMA model is, for example, used at a controlling company consolidated level with AMA capital being allocated to legal entities, thus meaning that the legal entities do not have standalone AMA models. In this case, applicant banks still need to complete the entire application pack.

Where applications are made by banks with international activities, this Office reserves the right to share the information contained in the application pack with other regulators as needed to support the approval process.

¹ A partial use AMA indicates that a bank uses the AMA for some parts of its operations, and either the basic indicator approach (BIA) or the standardised approach (TSA) for the remainder of its operations, as envisaged in regulation 33(5) of the Regulations.
² A hybrid AMA entails the attribution of group operational risk capital to legal entities by means of an allocation mechanism as envisaged in regulation 33(9)(c) of the Regulations.

Page 2 of 14

### 3. Stages of the application process

#### 3.1 Stage 1 (comprising sections A-E below)

##### 3.1.1
The first stage of the application process is the completion of the application pack, which requires the applicant bank to provide:
- 3.1.1.1 summary information on its plans for AMA implementation;
- 3.1.1.2 its approach in a number of key areas such as governance;
- 3.1.1.3 details on how it has met the AMA qualitative and quantitative requirements as contained in the Regulations and related directives and guidance notes; and
- 3.1.1.4 detailed information covering the specific details of the AMA model.

##### 3.1.2
During this stage the application pack is to be signed off by the chief executive officer of the applicant bank. Information gathered from this stage will enable this Office to determine the scope of the supervisory review work with regard to the assessments of the applicant bank’s AMA application. As such, the application pack should enable this Office to:
- 3.1.2.1 understand what work has been undertaken by the applicant bank and confirm that it has a credible strategy in its roll-out plan for complying with relevant legislation; and
- 3.1.2.2 identify, from an AMA perspective, the key areas of risk on which this Office’s resources should focus.

##### 3.1.3
For this first stage this Office requires high-level, summarised information. The type of information provided would broadly be at the same level as information provided to senior management or the board to give them an overview of a project.

This Office expects applicant banks to clearly highlight any material gaps identified against the regulatory framework,³ which should include detailed reasons for non-compliance as well as initiatives/actions taken to address these gaps where appropriate. Moreover, this Office requests applicant banks to provide a list of all the relevant internal documents (with brief descriptions of their contents) that could be considered relevant to the application. This Office may request the applicant bank to submit copies of selected documents in the second stage of the approval process.

This Office anticipates that the answers to a number of questions may differ across business lines and regions in the case of internationally active banks. In these cases, this Office requires applicant banks to highlight these differences in their responses.

It may also be appropriate to distinguish between an applicant bank’s current framework and its anticipated framework at implementation. Banks are thus requested to highlight this in the relevant questions.

³ The regulatory framework includes the Banks Act, the Regulations and relevant directives and guidance notes.

Page 3 of 14

An applicant bank should identify the links between the information provided in different sections and ensure that this information is relatively straightforward to reconcile. For example, given that there are links between the roll-out plan in section A and the self-assessment gap analysis in section B, this Office expects information contained in these two sections to be reconcilable.

### 3.2 Stage 2

#### 3.2.1
During stage 2, this Office may request further detailed information on particular topics based on its review of all information received during stage 1. This Office expects that most of this information will already be contained in internal documents and can therefore be delivered quickly.

This Office has the right to undertake on-site visits to applicant banks as part of its follow-up work where deemed necessary. If this Office considers the findings to be satisfactory and consistent with the information already supplied to it, it may assume that other areas not reviewed in detail are of a similar standard and as such can rely on the applicant bank’s senior management to reflect the particulars for the application. However, if this Office identifies concerns, further review work may be conducted or ultimately the application could be declined, depending on the severity and scale of the concerns identified.

#### 3.2.2
Applicant banks need to be aware of the following administrative arrangements designed to allow this Office to deal with applications efficiently:
- 3.2.2.1 Information requested from applicant banks is expected to be provided within a reasonable time frame as specified by this Office. Should the information requested by this Office not be provided timely, it could result in a delay in the processing of the application.
- 3.2.2.2 It is important to note that the information requested is for the application process only. Information that will be required on an ongoing basis, which may be similar to the information requested in this application, will be discussed and specified separately through various platforms, for example during on-site reviews.

### 4. Section A: High-level overview and implementation plans

The information requested is to provide this Office with a high-level overview of the applicant bank’s AMA application and implementation plans.

#### 4.1 General

A1. A summary of the rationale for the application.

A2. A brief explanation of the scope of application, including but not limited to:
- entities covered/rationale for partial use (if any);
- explanation and rationale for omissions from the AMA application;
- a list of significant subsidiaries including the current and proposed operational risk measurement approach (whether a stand-alone AMA, allocation from the group model or a simpler approach); and
- details of planned significant changes to the structure or organisation in future which could affect the application.

Page 4 of 14

A3. Whether the application is for solo or consolidated use.

A4. A list of entities within the consolidated group.

A5. If consolidation by aggregation is being utilised, please provide the details of the foreign approval on which the aggregation is based.

A6. A copy of the AMA roll-out plan, which should include the planned roll-out timelines of the AMA approach in a Gantt chart or any similar manner which clearly sets out the roll-out plan and timelines. Where relevant, the AMA model roll-out for material offshore subsidiaries should be included.

A7. Contact particulars of the person in the applicant bank with regard to the AMA application.

#### 4.2 Structure

The information requested in this section aims to furnish this Office with details on the structure of the applicant bank from an operational risk management and capital allocation perspective. The explanation on the structure of the applicant bank should cover as a minimum the following:

A8. The organisational design of the group, including business lines and control functions.

A9. A description of the group and legal entity structures.

A10. The organisation of business units and reporting lines.

A11. Explanation of how the AMA implementation is organised with respect to the division of responsibilities and capacity allocated.

A12. An overview of the management committee structure.

A13. The role of internal audit.

A14. The role of external audit.

A15. The role of independent third parties, if applicable.

A16. The regulatory structure of the group – home regulator and other relevant regulators.

A17. The reporting structures. This should include an explanation of how and with what frequency will operational risk-specific project management structures and committees report upwards to risk management, internal audit and board functions.

A18. A list of the key documents relevant to the AMA, including a brief description of their contents and last update date.

A19. An outline of any significant changes planned.

Page 5 of 14

### 5. Section B: Overview of the applicant bank’s own self-assessment against relevant standards

#### 5.1
The information requested in this section is designed to provide this Office with an overview of the applicant bank’s own self-assessment conducted against the AMA minimum standards. This Office proposes to take the comprehensiveness and quality of the work undertaken as part of the self-assessment into account when scoping the supervisory review work.

#### 5.2
This Office expects that as part of stage 1 as explained above applicant banks will produce evidence to demonstrate that it has met the required AMA minimum requirements according to the relevant requirements specified in regulations 33, 34 and 39 of the Regulations.

This Office recommends that applicant banks initially submit the following completed annexures with regard to the work undertaken to meet the AMA qualifying criteria:

B1. Confirmation that self-assessments have taken place and been reviewed by signatory.
- Annexure B – Operational risk self-assessment template.
- Annexure C – Principles for the Sound Management of Operational Risk⁴ template.
- Annexure D – Supervisory Guidelines for the Advanced Measurement Approaches⁵ template.

B2. A brief description of the self-assessment processes applicant banks have undertaken, including how self-assessments against each relevant qualitative and quantitative standard were carried out, and details of any parallel runs undertaken prior to the application, including the results and remedial runs taken for unsatisfactory performance against the relevant standard. This section should also include a description of the governance processes followed in terms of completion of the self-assessments.

B3. Exception-based results of self-assessments, including an indication of the applicant bank’s view of materiality. Outline the steps being taken by the applicant bank to comply with relevant principles and when it expects that these steps will have been completed.

### 6. Section C: Summary of the applicant bank’s approach in a number of key areas

This section is designed to give this Office a summary of the applicant bank’s approach in a number of key areas including, but not limited to, governance, use and validation of the AMA. This Office is of the opinion that an applicant bank’s approach in these areas will be important in determining whether the AMA application is ultimately approved. These are areas that this Office intends to pay particular attention to in its supervisory review work; however, this could be expanded to focus on additional areas if this Office considers it necessary.

⁴ Available at http://www.bis.org/publ195.htm.
⁵ Available at http://www.bis.org/publ196.htm.

Page 6 of 14