D10/2015: Changes to AMA Operational Risk Management and Measurement System

From the Office of the Registrar of Banks Ref: 15/8/3 D10/2015 2015-11-30 To: All banks, controlling companies, branches of foreign institutions, eligible institutions and auditors of banks or controlling companies Directive 10/2015 issued in terms of section 6(6) of the Banks Act 94 of 1990 Matters related to changes to the AMA operational risk management and measurement system used for the calculation of required capital for operational risk Executive summary The use of the advanced measurement approach (AMA) for the calculation of a bank’s required capital for operational risk is subject to the prior written approval of the Registrar, which, in turn, imposes specific duties on the Office of the Registrar of Banks (this Office), including a duty to: • develop a set of review procedures for ensuring that banks’ systems and controls are adequate to serve as the basis for the capital calculations; and • focus on compliance with the minimum regulatory requirements as a means of ensuring the overall integrity of a bank’s ability to provide prudential inputs to the capital calculator. The Regulations relating to Banks (the Regulations), among other things, set out the minimum requirements for banks that adopted the AMA for the management and measurement of their exposure to operational risk. To enable this Office to discharge its supervisory responsibilities effectively with respect to the aforesaid, this directive sets out the requirements for the approval and notification of changes to AMA banks’ existing operational risk management and measurement system.

2

1. Introduction 1.1 This directive requires banks to classify changes to the AMA operational risk management and measurement system into one of the following categories (as outlined in Diagram 1 below): (a) material changes (including extensions), which require prior written approval from this Office; (b) non-material changes requiring prior notification (i.e. changes of a lesser materiality, but still of a degree of materiality that requires notification to this Office before their implementation); and (c) non-material changes requiring post notification (i.e. changes of such a low level of materiality, that they need only be brought to the attention of this Office at regular intervals, after their implementation). Diagram 1: AMA changes decision tree 1.2 The directive also sets out the documentation to be submitted by banks to this Office to assess banks compliance with specified minimum requirements. 2.1 Definition of material changes (including extensions) 2.1.1 AMA banks are required to obtain the prior written approval from this Office in terms of the qualitative or quantitative provisions of paragraphs 2.1.2 to 2.1.4 of this directive, that deem a change to be material.

3 2.1.2 The assessment of materiality shall consist of a qualitative base, which shall include: Definition of material changes to the AMA operational risk management and measurement system 2.1.2.1 Changes in the organisational and operational structure of the independent risk management function for operational risk, which reduce the ability of the operational risk management function to oversee and inform the decision making processes of the business and support units they monitor. 2.1.2.2 Changes to the measurement system if they fulfil any of the following criteria:

(a) change the architecture of the measurement system regarding the combination of the four data elements of internal and external loss data, scenario analysis, business environment and internal control factors; (b) change the logics and drivers of the methodology for allocating the operational risk capital between the different entities of a group. 2.1.2.3 Changes to the procedures relating to internal and external data, scenario analysis and business environment and internal control factors where they:

(a) reduce the level of controls regarding the completeness and quality of operational risk data collected; (b) change the external data sources to be used within the measurement system unless the data is comparable and representative for the operational risk profile. 2.1.2.4 Changes to the overall method on how insurance contracts and/or other risk transfer mechanisms are recognized within the calculation of the AMA capital requirement. Definition of extensions to the AMA operational risk management and measurement system 2.1.2.5 First-time introduction of measures to capture expected losses in the banks’ business practices as an offset. 2.1.2.6 First-time introduction of operational risk mitigation techniques such as insurance or other risk transfer mechanisms. 2.1.2.7 First-time recognition of correlations in operational risk losses. 2.1.2.8 First-time introduction of methodology for allocating operational risk capital among the different entities of the group. 2.1.2.9 The introduction of the AMA within parts of the bank or group of institutions not yet covered by the approval or the approved roll out plan.

4 2.1.3 The assessment of materiality shall also consist of a quantitative base, which shall include: 2.1.3.1 a change (including extensions) that results in an increase or decrease in capital of 10% or more of the AMA operational risk model at any of the following levels:

• the ‘bank in the Republic’ capital (excluding capital floors) for operational risk;
• the ‘bank consolidated’ capital (excluding capital floors) for operational risk;
• the ‘controlling company consolidated’ capital (excluding capital floors) for operational risk; 2.1.4 For the purposes of paragraph 2.1.3, and taking into consideration paragraph 2.3.2, the impact of any change (either individually or cumulative) shall be assessed as a ratio calculated as follows: (a) in the numerator, the difference in the capital for operational risk associated with the scope of application of the AMA operational risk model before and after the proposed change; (b) in the denominator, the overall capital for operational risk before the proposed change. The calculation shall refer to the same point in time. The determination of the impact on the capital shall refer only to the impact of the change to the AMA operational risk model, that is, the impact of the change should be isolated. Therefore the operational risk profile shall be assumed to remain constant. 2.1.5 Changes (including extensions) that are not classified as material, when assessing the materiality of the proposed change in accordance with paragraphs 2.1.2 to 2.1.4 above will be classified as non-material change as set out in paragraph 2.2 below. 2.2 Definition of non-material changes 2.2.1 Requiring prior notification to this Office Non-material changes to the AMA operational risk management and measurement system falling under paragraphs 2.2.1.1 to 2.2.1.7, shall be brought to the attention of this Office at least 15 working days before their implementation. This Office will assess the proposed changes and notify the bank of any objections or conditions it may have regarding the implementation thereof.

5 2.2.1.1 Changes to the way the operational risk management and measurement system is integrated into the day-to-day management process through operational risk processes and, where the changes have one of the following characteristics: (a) significantly change the extent to which the operational risk management and measurement system contributes to and results in a reduction in the depth of management information in the banks’ risk management and related decision making processes, including the approval of new products, systems and processes and definition of the operational risk tolerance; (b) reduce the scope, groups of recipients and frequency of the reporting system for informing all relevant parts of the institution about the results of the operational risk management and measurement system and decisions taken in response to material operational risk events. 2.2.1.2 Changes in the organisational and operational structure of the independent risk management function for operational risk if they fulfil any of the following criteria: (a) lead to a reduction in budget or headcount of more than 10%. (b) reduce the hierarchical level of the operational risk management function or of its head; (c) lead to a relevant reduction in the duties and responsibilities of the operational risk management function; (d) extend the duties and responsibilities of the operational risk management function, unless no conflicts of interests exist and appropriate additional resources are provided to the operational risk management function;

2.2.1.3 Changes to validation processes and the internal review if the changes alter the logic and methodologies used for internally validating or reviewing the AMA framework.

2.2.1.4 Changes to the calculation of the operational risk capital requirement due to changes in one of the following: (a) structure and characteristics of the data set used for the calculation of the operational risk capital requirement (the ‘calculation data set’), including any of the following: (i) the definition of gross loss amount to be used within the calculation data set; (ii) the reference date of loss events to be used within the calculation data set;

6 (iii) the method used to determine the length of the time series of loss data to be used within the calculation data set; (iv) the criteria to group losses caused by a common operational risk event or by related events over time; (v) the number or the type of risk classes, or equivalent, over which the operational risk capital requirement is calculated; (vi) the method for setting the threshold for the level of losses above which the model is fitted to the data; (vii) where applicable, the method for setting the threshold for differentiating the body and tail regions of the data, when fitted by different methods; (viii) the processes and criteria for assessing the relevance, for scaling or for doing other adjustments to the operational risk; (ix) change the external data sources to be used within the measurement system unless already classified as material according to paragraph 2.1. (b) the criteria for the inclusion, selection, update and review of used distributions and methods for the estimation of their parameters; (c) criteria and procedures for the determination of the aggregated loss distributions and for the calculation of the pertinent operational risk measure at the regulatory confidence level; (d) methodology for the determination of expected losses and their capturing within internal business practices; (e) methodology about how correlations in operational risk losses across individual operational risk estimates are recognised. 2.2.1.5 Changes to the standards relating to internal data, scenario analysis and business environment and internal control factors if they: (a) change the internal processes and criteria for collecting internal loss data, including any of the following: (i) increase of the threshold for the collection of internal loss data; (ii) methods or criteria for the exclusion of activities or exposures from the scope of the internal data collection. (b) significantly change the policies and methodologies related to: (i) scenario analysis; and (ii) business environment and internal control factors.

7 2.2.1.6 Changes to the standards relating to insurance and other risk transfer mechanisms, if the changes fulfil one of the following conditions: (a) cause a relevant alteration of the level of coverage provided; (b) alter the processes and criteria for calculating the haircuts in the amount of insurance recognition, introduced to capture the uncertainty of payment, the mismatches in coverage and the policy’s residual and cancellation terms, where less than one year. 2.2.1.7 Relevant changes to the IT systems used to process the AMA, including the collection of data and their administration, reporting procedures and the operational risk model and the general risk management standards, which reduce the integrity and availability of the data or IT systems. 2.2.2 Post notification to this Office Non-material changes to the AMA operational risk management and measurement system other than those described in paragraph 2.2.1 shall be brought to the attention of this Office after their implementation at least on a bi-annual basis aligned with the Model Descriptive Statistics submission to this Office as at June and December each year. 2.3 Principles of categorisation changes 2.3.1 The classification referred to in paragraph 1 above, shall be carried out in accordance with the requirements specified in paragraph 2.1 and paragraph 2.2 of this directive. 2.3.2 Where banks are required to calculate the quantitative impact of any change in capital requirements, they shall do so by applying the following methodology: (a) for the purpose of the assessment of the quantitative impact banks shall use the most recent data available; (b) for changes having no direct quantitative impact, such as organisational changes, internal process changes or risk management process changes, no quantitative impact - as specified in paragraph 2.1.2 of this directive - for AMA needs to be calculated. 2.3.3 For the purposes of the classification referred to in paragraph 2.3.1, one material change shall not be split into several changes of lower materiality, since this Office requires from banks to assess the cumulative impact of changes over time. As such, several changes of lower materiality may be viewed as one material change. 2.3.4 In case of doubt, banks shall assign changes to the category of the highest potential materiality.

8 2.3.5 Where this Office has previously provided written approval in relation to a material extension or change, banks shall calculate the capital based on the approved extension or change from the date specified in the new written approval (which shall replace the prior one). The non-implementation of an extension or change for which written approval from this Office has been given, shall require a new written approval from this Office. 2.3.6 In case of delay of the implementation of an extension or change for which written approval from this Office has been granted, the bank shall notify this Office and present to the satisfaction of this Office a plan for a timely implementation of the approved change, which it shall apply within a period to be agreed with this Office. 2.3.7 Where a change is classified as one requiring prior notification to this Office, and where, subsequent to the notification, banks decide not to implement the extension or change, banks shall notify this Office of such development, without undue delay. 2.4 Documentation 2.4.1 Material changes to the AMA For changes classified as requiring this Office’s approval, banks shall submit, together with the application, the following documentation: (a) description of the change, its rationale and objective; (b) proposed implementation date; (c) scope of application affected by the change; (d) supporting documentation (e.g. model documentation and results); (e) reports of the banks’ independent review or validation; (f) confirmation that the change has been approved through the institution’s approval processes by the relevant bodies; including the approval committee or relevant delegated bodies and date of approval; (g) the quantitative impact of the change on the capital requirements; (h) the bank’s current and previous version number of the internal model which is subject to approval. 2.4.2 Non-Material Changes For changes classified as requiring notification either before or after implementation, banks shall submit, together with the notification, the documentation specified in sub-paragraphs (a), (b), (c), (d), (f) and (g) of paragraph 2.4.1 above.

9 3. Acknowledgement of receipt 3.1 Two additional copies of this directive are enclosed for the use of your institution’s independent auditors. The attached acknowledgement of receipt, duly completed and signed by both the chief executive officer of the institution and the said auditors, should be returned to this Office at the earliest convenience of the aforementioned signatories. N Maree Acting Deputy Head The previous directive issued was Directive 9/2015, dated 22 October 2015.