Capital Adequacy Guideline: Measurement of Operational Risk 2015-01

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 1 MEASUREMENT OF OPERATIONAL RISK INTRODUCTION

1. This Guideline is applicable to all entities that are incorporated in Barbados and licensed under the Financial Institutions Act, Cap. 324A of the Laws of Barbados and the International Financial Services Act, Cap 325 of the Laws of Barbados. It sets out the rules which the Central Bank of Barbados (Bank) requires licensees to apply in calculating their regulatory capital requirements for operational risk.
2. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk1 , but excludes strategic and reputational risk.
3. The principles in this Guideline are based on the Basic Indicator and Standardised Approach options outlined in the Basel Committee on Banking Supervision (Committee) Revised Framework on Capital Measurement and Capital Standards. The Guideline is intended for use at both the consolidated and solo levels but the specific application of approaches will depend on the complexity and range of activities undertaken by individual licensees.
4. The Bank’s initial standard for all of its licensees is the Basic Indicator Approach. As they develop more sophisticated operational risk measurement systems and practices, licensees should consider adopting the Standardised Approach. However, such licensees must first seek and obtain approval from the Bank before implementation2 . It should be noted, however, that the Bank will not be allowing the use of the Alternative Standardised Approach. However, the use of Advanced Measurement Approaches will be considered at a later stage.
5. A licensee shall not, without supervisory approval, revert to the Basic Indicator Approach once it has been approved for the Standardised Approach. However, if the Bank determines that the licensee no longer meets the qualifying criteria for the Standardised approach, it may require the licensee to revert until it meets the conditions specified by the Bank for returning to the Standardised Approach.

1 Legal risk includes, but is not limited to, exposures to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. 2 Licensees should send a letter to the Director of Bank Supervision requesting approval to use the Standardised Approach.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 2 6. Licensees are required to submit to the Bank, quarterly returns3 of the calculation of their operational risk equivalent assets as part of their overall capital adequacy returns. The risk equivalent assets are calculated by multiplying the capital charges computed under the Basic Indicator or Standardised approach by 12.5 and bringing them into the capital calculations at both the solo and consolidated levels. A. The Basic Indicator Approach 7. Licensees using the Basic Indicator Approach must hold capital for operational risk equal to the average over the previous three years of a fixed percentage (denoted alpha) of positive annual gross income. For the purposes of calculation, these three years should consist of 12 rolling quarters with Year 1 representing the four most historical quarters and Year 3 running up to and including the current quarter (i.e. the quarter for which the capital adequacy ratios are being calculated). 8. Figures for any year in which annual gross income is negative or zero should be excluded from both the numerator and denominator when calculating the average.4 The charge may be expressed as follows: KBIA = [  (GI1…n x ) ] / n where: KBIA = the capital charge under the Basic Indicator Approach GI = annual gross income, where positive, over the previous three years N = number of the previous three years for which gross income is positive α = 15%, which is set as a standard level of charge. 9. Gross income5 is defined as net interest income plus net non-interest income. It is intended that this measure should:

3 The Bank will review the capital requirement produced by the operational risk approach used by a bank for general credibility, especially in relation to a firm’s peers. In the event that credibility is lacking, appropriate supervisory action under Pillar 2 will be considered. 4 If negative or zero gross income distorts a licensee’s capital charge, the Bank will consider appropriate supervisory action under Pillar 2. 5 An example of the calculation of Gross Income is set out in Annex 1.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 3 a. be gross of any provisions (e.g. for unpaid interest); b. be gross of operating expenses, including fees paid to outsourcing service providers6 ; c. exclude reversals of provisions and write-offs; d. exclude realised profits/losses from the sale of securities in the banking book; and e. exclude extraordinary or irregular items such as income or expenses arising from the sale of fixed assets or from natural disasters; f. exclude income derived from insurance recoveries. 10. Licensees with fewer than 12 quarters of gross income data may seek guidance from the Bank on how existing data may be extrapolated for the calculation. 11. Licensees should perform a reconciliation between gross income reported on the capital adequacy return and the amounts reported on the income statement regulatory return. In addition, the Bank expects licensees to perform a reconciliation between the gross income amount reported on the capital adequacy return and amounts reported on the audited financial statements. This reconciliation should identify any items that are excluded from the operational risk calculation as per the definition of gross income but are included in the Income Statement regulatory return or audited financial statement and should be available to the Bank upon request. B. The Standardised Approach 12. In the Standardised Approach, a licensee’s activities are divided into eight business lines: corporate finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services, asset management, and retail brokerage. The qualifying criteria for the Standardised Approach are presented in Annex 2 and the business lines are defined in detail in Annex 3. 13. Within each business line, gross income is a broad indicator that serves as a proxy for the scale of business operations and thus the likely scale of operational risk exposure within each of these business lines. The capital charge for each business line is calculated by multiplying gross income by a factor (denoted beta) assigned to that business line. Beta serves as a proxy for the industry-wide relationship between the operational risk loss experience for a given business line and the aggregate level of gross income for that business line. It should be noted that in the Standardised Approach gross income is measured for each business line, not the whole institution, i.e. in corporate finance, the indicator is the gross income generated in the corporate finance business line.

6 In contrast to fees paid for services that are outsourced, fees received by licensees that provide outsourcing services shall be included in the definition of gross income.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 4 14. The total capital charge is calculated as the three-year average of the simple summation of the regulatory capital charges across each of the business lines in each year. In any given year, negative capital charges (resulting from negative gross income) in any business line may offset positive capital charges in other business lines without limit. However, where the aggregate capital charge across all business lines within a given year is negative, then the input to the numerator for that year will be zero. The total capital charge may be expressed as: KTSA = { years 1-3 max GI1-8 x 1-8), 0]3 where: KTSA = the capital charge under the Standardised Approach GI1-8 = annual gross income in a given year, as defined above in the Basic Indicator Approach, for each of the eight business lines. β1-8 = a fixed percentage relating the level of required capital to the level of the gross income for each of the eight business lines. 15. The values of the betas are detailed below. Business Lines Beta Factors Corporate finance (β1) Trading and sales (β2) Retail banking (β3) Commercial banking (β4) Payment and settlement (β5) Agency services (β6) Asset management (β7) Retail brokerage (β8) 18% 18% 12% 15% 18% 15% 12% 12%

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 5 Annex 1 Example of Basic Indicator Approach Calculation Statutory Income Data Operational Risk Income Calculation $ $ Net Interest Income 80 80 Interest Income 200 200 Interest Expense 120 120 Non-Interest Income 75 65 Fees and Commissions 30 30 Dividend Income 15 15 Trading Income 15 15 Realised gains- banking book 10 Other 5 5 Less Operating expenses -40 Less Provisions -12 Less Taxes -8 Net Income 95 Gross Income 145

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 6 Annex 2 Qualifying Criteria: The Standardised Approach

1. In order to qualify for use of the Standardised Approach, a licensee must satisfy the Bank that, at a minimum: a. Its board of directors and senior management, as appropriate, are actively involved in the oversight of the operational risk management framework; b. It has an operational risk management system that is conceptually sound and is implemented with integrity; and c. It has sufficient resources in the use of the approach in the major business lines as well as the control and audit areas.
2. The Bank will have the right to insist on a period of initial monitoring of the licensee’s Standardised Approach before it is used for regulatory capital purposes.
3. A licensee must develop specific policies and have documented criteria for mapping gross income for current business lines and activities into the standardised framework. The criteria must be reviewed and adjusted for new or changing business activities as appropriate. The principles for business line mapping are set out in the Annex 4.
4. In addition to the general requirements set out in paragraph 1 above, banks seeking permission to use the Standardised Approach must meet the following criteria: a. The licensee must have an operational risk management system with clear responsibilities assigned to an operational risk management function. The operational risk management function is responsible for developing strategies to identify, assess, monitor and control/mitigate operational risk; for codifying firm-level policies and procedures concerning operational risk management and controls; for the design and implementation of the firm’s operational risk assessment methodology; and for the design and implementation of a risk￾reporting system for operational risk. b. As part of the licensee’s internal operational risk assessment system, the licensee must systematically track relevant operational risk data including material losses by business line. Its operational risk assessment system must be closely integrated into the risk management processes of the licensee. Its output must be an integral part of the process of monitoring and controlling the licensee’s operational risk profile. For instance, this information must play a prominent role in risk reporting, management reporting, and risk analysis. The licensee must have techniques for creating incentives to improve the management of operational risk throughout the firm.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 7 c. There must be regular reporting of operational risk exposures, including reporting of material operational losses, to business unit management, senior management, and to the board of directors. The licensee must have procedures for taking appropriate action according to the information within the management reports. d. The licensee’s operational risk management system must be well documented. The bank must have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operational risk management system, which must include policies for the treatment of non-compliance issues. e. The licensee’s operational risk management processes and assessment system must be subject to validation and regular independent review. These reviews must include both the activities of the business units and of the operational risk management function. f. The licensee’s operational risk assessment system (including the internal validation processes) must be subject to regular review by external auditors and/or the Bank. 5. In considering a licensee’s ability to comply with the requirements set out in paragraphs 1 and 4 above, the Bank offers the following guidance on its approach: a. The size and complexity of an institution may not warrant the existence of a specific unit dedicated to operational risk management as stated in subsection (a) above. However, the licensee must be able to demonstrate to the Bank how its operational risk management framework is appropriate based on the size and complexity of its operations. Where an independent unit does not exist, the responsibility must be assigned to individuals within the licensee, who are independent from the relevant business line; b. All licensees must be able to track and report relevant operational risk data including material risk losses by significant business line. The sophistication of the tracking and reporting techniques must be appropriate for the size and complexity of the licensee; c. Licensees must develop regular reporting of operational risk exposures within the institution and to the board of directors. The frequency and content of this reporting must be appropriate for the reporting structure, nature and complexity of the licensee; d. Processes for ensuring compliance with a documented set of internal policies, controls and procedures concerning the management of operational risk must be developed; and

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 8 e. Where the size and complexity of the licensee does not warrant the existence of a unit dedicated to operational risk management, independent reviews must focus on the operational risk management processes and may be integrated with the review of the respective business line.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 9 Annex 3 Mapping of Business Lines Level 1 Level 2 Activity Groups Corporate Finance Corporate Finance Mergers and acquisitions, underwriting, privatisations, securitisation, research, debt (government, high yield), equity, syndications, IPO, secondary private placements Municipal/Government Finance Merchant Banking Advisory Services Trading & Sales Sales Fixed income, equity, foreign exchanges, commodities, credit, funding, own position securities, lending and repos, brokerages, debt, prime brokerage Market Making Proprietary Positions Treasury Retail Banking Retail Banking Retail lending and deposits, banking services, trust and estates Private Banking Private lending and deposits, banking services, trust and estates, investment advice Card Services Merchant/commercial/corporate cards, private labels and retail Commercial Banking Commercial Banking Project finance, real estate, export finance, trade finance, factoring, leasing, lending, guarantees, bill of exchange Payment and settlement7 External Clients Payments and collections, funds transfer, clearing and settlement Agency Services Custody Escrow, depository receipts, securities lending (customers) corporate actions Corporate Agency Issuer and paying agents Corporate Trust Asset Management Discretionary Fund Management Pooled, segregated, retail, institutional, closed, open, private equity Non-Discretionary Fund Management Pooled, segregated, retail, institutional, closed, open Retail Brokerage Retail Brokerage Execution and full service

7 Payment and settlement losses related to a bank’s own activities would be incorporated in the loss experience of the affected business line.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 10 Annex 4 Principles for Business Line Mapping

1. All activities must be mapped into the eight level 1 business lines in a mutually exclusive and jointly exhaustive manner.
2. Any banking or non-banking activity which cannot be readily mapped into the business line framework, but which represents an ancillary function to an activity included in the framework, must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective mapping criterion must be used.
3. When mapping gross income, if an activity cannot be mapped into a particular business line then the business line yielding the highest charge must be used. The same business line equally applies to any associated ancillary activity.
4. Licensees’ may use internal pricing methods to allocate gross income between business lines provided that total gross income for the licensee (as would be recorded under the Basic Indicator Approach) still equals the sum of gross income for the eight business lines.
5. The mapping of activities into business lines for operational risk capital purposes must be consistent with the definitions of business lines used for regulatory capital calculations in other risk categories, i.e. credit and market risk. Any deviations from this principle must be clearly motivated and documented.
6. The mapping process used must be clearly documented. In particular, written business line definitions must be clear and detailed enough to allow third parties to replicate the business line mapping. Documentation must, among other things, clearly motivate any exceptions or overrides and be kept on record.
7. Processes must be in place to define the mapping of any new activities or products.
8. Senior management is responsible for the mapping policy (which is subject to the approval by the board of directors).
9. The mapping process to business lines must be subject to independent review.

CAPITAL ADEQUACY GUIDELINE MEASUREMENT OF OPERATIONAL RISK: 2015:01 JUNE 2015 Capital Adequacy Guideline: Measurement of Operational Risk: 2015:01 Bank Supervision Department CENTRAL BANK OF BARBADOS 11 Supplementary Business Line Mapping Guidance There are a variety of valid approaches that licensees can use to map their activities to the eight business lines, provided the approach used meets the business line mapping principles. The following is offered as an example of a possible approach that could be used by a licensee in mapping gross income: Gross income for retail banking consists of net interest income on loans and advances to retail customers and Small and Midsize Enterprises (SMEs) treated as retail, plus fees related to traditional retail activities, net income from swaps and derivatives held to hedge the retail banking book, and income on purchased retail receivables. To calculate net interest income for retail banking, a licensee takes the interest earned on its loans and advances to retail customers less the weighted average cost of funding of the loans (from whatever source ─ retail or other deposits). Similarly, gross income for commercial banking consists of the net interest income on loans and advances to corporate (plus SMEs treated as corporate), interbank and sovereign customers and income on purchased corporate receivables, plus fees related to traditional commercial banking activities including commitments, guarantees, bills of exchange, net income (e.g. from coupons and dividends) on securities held in the banking book, and profits/losses on swaps and derivatives held to hedge the commercial banking book. Again, the calculation of net interest income is based on interest earned on loans and advances to corporate, interbank and sovereign customers less the weighted average cost of funding for these loans (from whatever source). For trading and sales, gross income consists of profits/losses on instruments held for trading purposes (i.e. in the mark-to-market book), net of funding cost, plus fees from wholesale broking. For the other five business lines, gross income consists primarily of the net fees/commissions earned in each of these businesses. Payment and settlement consists of fees to cover provision of payment/settlement facilities for wholesale counterparties. Asset management is management of assets on behalf of others.