Guidance Notice for Applications to Use an Advanced Measurement Approach for Operational Risk

13 June 2006 BA 17 – FR 2413 1/2006 (Please always use this reference) Guidance Notice for applications to use an Advanced Measure￾ment Approach for operational risk Introduction Institutions, groups of institutions and financial holding groups1 within the meaning of sections 1 (1b) and 10a (2) and (3) of the German Banking Act (Kreditwesengesetz) 2 are authorised to use an Advanced Measurement Approach to calculate the capital charge for operational risk. The prior approval of the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, hereinafter referred to as BaFin) is required. An Advanced Approach for measuring the regulatory capital requirement (hereinafter referred to as an Advanced Measurement Approach, or AMA) for operational risk incorporates the entirety of all the methods, instruments and processes used, in particular, the review, controlling and monitoring processes, as well as the IT systems that are used in this context. The following document describes this type of approach. Pursuant to section 338 (5) of the Solvency Regulation, the use of an Advanced Measurement Approach will be permitted only as of 1 January 2008. From 1 January 2007 until they receive approval to use an AMA, institutions will have to calculate their capital charge for operational risk using either the Basic Indicator Approach (BIA) in accordance with sec￾tion 3, chapter 2 of the Solvency Regulation, or the Standardised Ap￾proach (TSA) in accordance with section 3, chapter 3 of the Solvency Regulation.3 The requirements that must be fulfilled before approval to

1 This text will hereinafter refer only to “institutions”. The provisions apply analogously for groups of institutions and financial holding groups, provided that no special arrangements are made for these institutions. 2 See also sections 2 and 3 of the Solvency Regulation (Solvabilitätsverordnung) draft of 31 March 2006. 3 Principle I may be used until 31 December 2007. If, in 2007, an institution partly uses an IRB Ap￾proach or a Standardised Approach for credit risk, then a pro rata capital requirement for operational risk must also be calculated (section 339 (10) sentence 1 No 3 of the Solvency Regulation).

Page 2 | 9 use an AMA can be granted are laid down in the revised EU Directives 2000/12/EC and 93/6/EEC and have been translated into German law in section 3, chapter 4 of the Solvency Regulation as well as through the Banking Act. Although the absence of relevant binding EU legislation means that the new capital rules cannot be fully translated into German law as part of the Solvency Regulation until a later date, supervisors have, however, already offered to conduct approval examinations before the Solvency Regulation comes into effect. This instruction sheet provides prospective applicant institutions with information on how to apply and about the approval procedure. The forms that need to accompany the application can be obtained from the websites of BaFin and the Deutsche Bundesbank. Institutions interested in applying an AMA to calculate their regulatory minimum capital requirements need to cooperate closely with banking supervisors in order to obtain timely approval. Institutions wishing to use an AMA are therefore requested to submit their applications as soon as possible. Applications are generally processed on a first-come, first￾served basis. 1 Basic principles Supervisors are forthwith accepting applications for approval to use an AMA. A written application to request approval to use an AMA to calculate the capital charge for operational risk must be submitted by the institution. An application for approval to jointly use an AMA to calculate the capital charge for the operational risk of a group and its affiliated institutions must be submitted by the superordinated institution. In this case, it is not necessary for each of the subordinated institutions to submit sepa￾rate approval applications. This also applies to subordinated institutions domiciled in the European Economic Area. A superordinated institution can also apply to use an AMA exclusively for calculating the capital charge for the group’s operational risk. In this case, the affiliated institu￾tions have to comply with the respective provisions governing the indi￾vidually selected approach.

Page 3 | 9 Substantial changes to the AMA, eg considerable amendments to the model, the inclusion of new organisational units in the AMA, the first￾time recognition of insurance in the model or the first-time use of an exclusively group-level AMA to calculate the capital charges for subordi￾nated institutions through capital allocation, are to be coordinated with BaFin. Depending on the type of change and on the type of approval that has already been granted, it may be necessary to re-apply for ap￾proval. The partial use4 of an AMA in combination with either the BIA or the TSA within an institution, a group of institutions or a financial holding group is permitted subject to the conditions of section 293 of the Solvency Regulation and to prior authorisation from BaFin. An appropriate overall risk management structure whose quality is, at the least, consistent with the minimum requirements for risk management (circular 18/2005), is to be introduced even in those organisational units that are not initially included in the AMA. The operational risk of these organisational units must additionally be given due recognition by the independent central unit responsible for the management of operational risk. 2 How applications are examined The AMA approval procedure begins when an institution submits an ap￾plication for approval to BaFin. Even institutions using AMA models de￾veloped in joint projects (eg within an association) must each submit a complete application and are examined individually. In such cases, the banking supervisors will take their findings with regard to other institu￾tions using the same model into consideration when examining individ￾ual applications. First of all, the supervisors check that all of the required application documents have been submitted. The content check is also carried out on-site at the respective institution. The examination covers compliance with the requirements for

4 See section 293 of the Solvency Regulation.

Page 4 | 9

• the organisational and operational structure of the system for identifying, measuring, monitoring, reporting and managing op￾erational risks (sections 279-282 of the Solvency Regulation);

• the suitability of the AMA for calculating the capital charge for operational risk, including the quality of the input data (section 278 (4) and sections 284-292 of the Solvency Regulation);

• the internal procedures for validation the risk measurement sys￾tem (section 283 and section 284 (4) of the Solvency Regula￾tion); and

• the reliability and integrity of the relevant IT systems and, if necessary, the feasibility of the time schedule (section 293 of the Solvency Regulation). The decision on whether to grant approval is usually based on the re￾sults of an examination carried out at the applicant institution. BaFin sends the examination report to the institution. In addition, supervisors offer the institution the possibility of a meeting to discuss the result of the examination. The applicant institution assumes the costs of the approval procedure, including the costs of the examination. Costs arise from the moment the application is submitted. Approval is given by means of written notification. The applicant institu￾tion is allowed to use the AMA for calculating the capital charge for the operational risk only after this notification of initial approval has been delivered, although approval can be subject to compliance with addi￾tional requirements specified in the notification. Once approval has been granted, the institution must adhere to the re￾quirements outlined in the Solvency Regulation and, as appropriate, the terms specified in the time schedule at all times. Adherence as well as the fulfilment of any additional requirements laid down in the notification will be monitored by supervisors in subsequent follow-up checks. BaFin must be informed of any exceptional circumstances which cause the in￾stitution to deviate from the time schedule.

Page 5 | 9 3 Preconditions for approval If the applicant institution submits an application, including the accom￾panying documentation and, as appropriate, a time schedule for the im￾plementation of the AMA, which is consistent with the requirements of the Solvency Regulation and with those outlined in these guidelines, BaFin mandates an AMA approval examination at the institution. An on-site AMA approval examination can be carried out only if the insti￾tution has had all of the necessary organisational and operational measures and processes relating to the AMA in place for a reasonable pe￾riod of time prior to the examination, been using the AMA to be examined as a key instrument for measuring and managing operational risk for a reasonable period of time prior to the examination, and satisfied itself that the AMA is suitable for measuring and manag￾ing operational risk and for calculating the regulatory capital charge for operational risk. The internal review of the AMA stipulated in the third paragraph com￾prises, in particular, the suitability of the organisational and operational structure re￾garding the procedures used to identify, measure, monitor, report and manage the operational risk, the implementation and application of the procedures to identify, measure, monitor, report and manage operational risk, the relevance/quality of the data used, the quantitative and qualitative procedures for validating the model, and

Page 6 | 9 the relevant technical environment. The necessary measures to remedy any deficiencies and the time schedule provided for this must be documented. Existing relevant audit results provided by internal or external auditors may also be used for the internal review. 4 Components of the application Application The application for approval to use the AMA to calculate the capital re￾quirements for operational risk must be submitted in writing to BaFin in triplicate. The application, including the AMA requirements list and the time schedule for the implementation, must all be submitted in German. The accompanying documents must be submitted in an electronically readable format in triplicate. It may be the case that foreign regulatory authorities require the documentation in other languages. If this is the case, BaFin will contact the institution in question regarding the transla￾tion of the documentation. Conventional file formats and data media are to be used. In case of doubt about the suitability of certain file formats, prior coordination of the modalities is recommended. If a group of institutions is submitting an application for approval to use an AMA at a group level, this application must include a list of the affili￾ated institutions that are to be included in the calculation of the capital requirement. For subordinated institutions, the approach that they wish to use for calculating the capital requirement on a single-entity basis is to be given. Where subordinated institutions are domiciled abroad, each host country and its responsible national supervisors must be named. In the case of partial use of an AMA in combination with either the BIA or the TSA, the institution must provide the defining criteria (eg organ￾isational units, regulatory lines of business, legal entities). The institu￾tion must demonstrate that a significant5 percentage of the capital

5 See the recommendations for the partial use of an AMA together with the BIA or TSA, which are avail￾able on the websites of BaFin and the Deutsche Bundesbank.

Page 7 | 9 charge for operational risk is calculated using the AMA. The institution must outline how the capital charge is calculated in the other organisa￾tional units. The application must name a contact person and a deputy. Accompanying documentation The supervisors should be able to use the documentation accompanying the application to carry out a fundamental assessment of the AMA. The supervisors reserve the right to request additional documentation. BaFin may also reject the application for approval if it is not possible to review and assess the application owing to incomplete information. The docu￾mentation usually has to be submitted in German.6 All of the documentation specified in the AMA requirements list must be submitted with the legally binding signed application. The following documentation must be submitted: A AMA requirements list In the AMA requirements list, the institutions must show how they fulfil the individual requirements of the AMA. The require￾ments list is an essential element of the accompanying documen￾tation. This list enables examinations to be conducted efficiently and must be carefully completed in full by the applicant institu￾tion. Any deficiencies identified during the internal review must be indicated,7 along with additional information about how these deficiencies are to be remedied. The supervisor will provide the appropriate form with instructions on how to complete it. B Documentation

6 If the banking supervisors are in agreement, it may also be possible to submit the documentation in English in justified exceptional cases. 7 See section 3.

Page 8 | 9 All of the documents mentioned in the AMA requirements list have to be submitted, along with a list of annexes. This should, at the very least, include the following documentation: • The operational risk framework,8 including the implementation decision, • Organisational charts of the institution’s internal operational structure, primarily outlining which units are responsible for risk management, • A description of how the AMA is used in risk management, • A description of all the components of the AMA model. This gen￾erally includes: o A description of the input into the model, together with all the procedural steps leading up to the model results. o A description of the data types used, including the combi￾nation of the four required elements (internal data, exter￾nal data, scenario analyses, and business environment and internal control factors). o Any implicit assumptions. o A procedure to aggregate the individual risk measures and any relevant corollary assumptions. o A description of the allocation method and the diversifica￾tion effects recognised in the model if regulatory capital is to be allocated to individual institutions. • A description of the internal risk categories (eg internal lines of business, event types) which form the basis of the modelling, as￾signment of the internal risk categories to the business lines and event types defined in the CRD, and, if applicable, assignment of the risk categories of data consortia to internal risk categories. • A description of the internal validation process and the results thereof. • Documentation of the institution’s internal validation of the AMA.

8 Section 279 (2) of the Solvency Regulation.

Page 9 | 9 • Arrangements for the adjustment and refinement of the AMA model and the framework. C Time schedule9 The time schedule for implementing the AMA in all of the signifi￾cant organisational units should not exceed ten years.10 In addi￾tion to specifying the chronological sequence of the planned im￾plementation phases of the AMA in the organisational units, the time schedule should also contain details regarding any planned developments in the operational risk management processes, the refinement of the measurement approach and the implementa￾tion of the IT infrastructure used for operational risk manage￾ment.

9 For institutions requesting approval for the partial use of the AMA in combination with the BIA or the TSA. 10 See section 293 (4) of the Solvency Regulation and the recommendations for the partial use of an AMA together with the BIA or TSA, which are available on the websites of BaFin and the Deutsche Bundesbank.