Revised Guidelines on Computation of Risk-Weighted Amount for Operational Risk

1 Schedule I Revised Guidelines on Computation of Risk-weighted Amount for Operational Risk 6.8. Part V – Computation of Risk-weighted Amount (RWA) for Operational Risk. 6.8.1. Overview 6.8.1.1. Definition of Operational Risk Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk. Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. 6.8.1.2. The Measurement Methodologies The Basel II Framework presents three methods for calculating operational risk capital charges in a continuum of increasing sophistication and risk sensitivity: (i) the Basic Indicator Approach (BIA); (ii) the Standardised Approach (TSA); and (iii) Advanced Measurement Approaches (AMA). In comparison with BIA, other approaches are more advanced methods to determine the required capital for covering operational losses. Hence, the Banks shall with supervisory approval migrate from BIA to other advance approaches subject to complying with qualifying criteria. 6.8.2. Approaches for Calculating Operational Risk 6.8.2.1. A Bank shall use one of the following approaches to calculate its operational RWA: a) The BIA in accordance with item 6.8.3; or b) The TSA in accordance with item 6.8.4; or c) The ASA in accordance with item 6.8.5. 6.8.2.2. A Bank which has been allowed to use TSA or ASA shall not use a simpler approach without the prior written approval of the Director of Bank Supervision (DBS) of CBSL. 6.8.2.3. Once a Bank moves to a simpler approach, such Bank cannot use an advanced approach without the approval of DBS. DBS shall grant such approval subject to

2 requiring the Bank to comply with other conditions prior to migrating to the respective advanced approach. 6.8.2.4. When DBS is not satisfied that a Bank which has adopted TSA or ASA complies with the specified requirements, DBS may require the Bank to use a simpler approach. 6.8.3. The Basic Indicator Approach (BIA) 6.8.3.1. Bank shall calculate its operational risk capital requirement as follows: KBIA = [ Σ (GI 1...n x α . ) ] / n Where; a) KBIA = capital charge for operational risk under BIA b) GI = annual gross income, where positive, over the preceding three years as set out in items 6.8.3.2 to 6.8.3.4 c) n = number of years in the preceding three years when annual gross income is positive d) α = 15%, which is set by BCBS. 6.8.3.2. Bank shall calculate its gross income as the sum of its net interest income and non￾interest income, taking into account the following adjustments: a) gross of any provisions/impairments (including unpaid interest); b) gross of operating expenses, including fees paid to outsourcing service providers, in contrast to fees paid for services that are outsourced, fees received by Banks that provide outsourcing services shall be included in the definition of gross income. but excluding￾a) any realized profits/losses arising from the sale of securities in the banking book. Securities in the banking book shall be the securities that are classified as “held to maturity” or “available for sale”, in accordance with Sri Lanka Accounting Standard - LKAS 39; b) any income or expenses not derived from the ordinary activities of the Bank and not expected to recur frequently or regularly, i.e., sale of fixed assets, income derived from insurance recoveries, etc.

3 6.8.3.3. If the annual gross income/capital charge for any given year is negative or zero, it should be excluded from both the numerator and denominator when calculating the average capital charge. 6.8.3.4. A Bank shall calculate its annual gross income for the most recent year by aggregating the gross income of the last four financial quarters and follow same to calculate annual gross income for each of the two years preceding the most recent year. Table 20 provides an illustration of the calculation of the annual gross income for the previous three years, for a Bank calculating its operational RWA as at end June 2014. Table 20 Illustration of Calculation of Annual Gross Income Third Year Second Year First Year Gross Income for financial quarter ending Jun’14 (GI3a) Jun’13 (GI2a) Jun’12 (GI1a) Mar’14 (GI3b) Mar’13 (GI2b) Mar’12 (GI1b) Dec’13 (GI3c) Dec’12 (GI2c) Dec’11 (GI1c) Sep’13 (GI3d) Sep’12 (GI2d) Sep’11 (GI1d) Total GI3 = GI3a + GI3b

• GI3c + GI3d GI2 = GI2a + GI2b
• GI2c + GI2d GI1 = GI1a + GI1b
• GI1c + GI1d where GI = Gross Income 6.8.4. The Standardised Approach (TSA) 6.8.4.1. Any Bank can use the Standardised Approach for computation of capital charge of operational risk with the prior approval of DBS subject to complying with qualifying criteria set out in item 6.8.4.4. 6.8.4.2. A Bank adopting TSA shall classify their business activities into eight business lines, namely, corporate finance, trading and sales, payment and settlement, agency services, asset management, retail brokerage, retail banking and commercial banking. The definition of these business lines are provided in detail in Table 21.

4 Table 21 Mapping of Business Lines Level 1 Level 2 Activity Groups 1 Corporate Finance Corporate Finance Mergers and acquisitions, underwriting, privatisations, securitisation, research, debt (government, high yield), equity, syndications, Initial Public Offering, secondary private placements. Government Finance Merchant Banking Advisory Services 2 Trading & Sales Sales Fixed income, equity, foreign exchanges, credit products, funding, own position securities, lending and repos, brokerage, debt, prime brokerage and sale of Government bonds to retail investors. Market Making Proprietary Positions Treasury 3 Payment and Settlement External Clients Payments and collections, inter-bank Funds transfer (RTGS, EFT etc.), clearing and settlement. 4 Agency Services Custody Escrow, securities lending (customers) corporate actions, depository services. Corporate Agency Issuer and paying agents. Corporate Trust Debenture trustee. 5 Asset Management Discretionary Fund Management Pooled, segregated, retail, institutional, closed, open, private equity. Non￾Discretionary Fund Management Pooled, segregated, retail, institutional, closed, open. 6 Retail Brokerage Retail Brokerage Execution and full service. 7 Retail Banking Retail Banking Retail lending and deposits, banking services, trust and estates. Private Banking Private lending (personal loans) and private (institutional) deposits, banking services, trust and estates, investment advice. Card Services Merchant/commercial/corporate cards, private labels and retail. 8 Commercial Banking Commercial Banking Lending including project finance, corporate loans, real estate, trade finance including export and import loans, letter of credit, bills.

5 Level 1 Level 2 Activity Groups of exchange, leasing, factoring and guarantees. Deposits and other repayable funds 6.8.4.3. The Bank shall calculate its operational risk capital requirement by taking the three￾year average of the simple summation of the operational risk capital requirements across each of the business lines in each year as follows: K TSA = {Σ years 1-3 max[Σ(GI 1-8 x β 1-8 ),0]}/3 Where: a) KTSA = capital charge for operational risk under TSA b) GI1-8 = annual gross income in a given year, calculated in accordance with item 6.8.3.2 and 6.8.3.4 under BIA, for each of the eight business lines set out in Table 21 above c) β 1-8 = fixed beta factor (Table 22 below) as set out by BCBS, relating the level of required capital to the level of the gross income for each of the eight business lines. Table 22 Beta (β) factors for each business line No. Business Line β Factors 1 Corporate finance (β1 ) 18% 2 Trading and sales (β2 ) 18% 3 Payment and settlement (β3 ) 18% 4 Agency services (β4 ) 15% 5 Asset management (β5 ) 12% 6 Retail brokerage (β6 ) 12% 7 Retail banking(β7 ) 12% 8 Commercial banking(β8 ) 15% d) In any given year, negative capital charges (resulting from negative gross income) in any business line may be set off against positive capital charges in other business lines. However, where the aggregate operational risk capital charges across all business lines within a given year is negative, then the operational risk capital charges for the Bank for that

6 year is deemed to be zero (input to the numerator for that year will be zero). e) Within each business line, gross income is a broad indicator that serves as a proxy for the scale of business operations and thus the likely scale of operational risk exposure within each of these business lines. f) Each beta factor serves as a proxy for the industry-wide relationship between the operational risk loss experience for a given business line and the aggregate level of gross income for that business line. g) Gross income should be measured for each business line and not for the whole institution, i.e., in commercial banking, the indicator is the gross income generated in the commercial banking business line. However, the sum of the gross income of the eight business lines should be equal to the gross income of the Bank. 6.8.4.4. Qualifying criteria 6.8.4.4.1. The Board of Directors and senior management shall actively involve in the oversight of the operational risk management of the Bank. 6.8.4.4.2. The Bank shall have an operational risk management system that is conceptually sound and is implemented with integrity, and with clear responsibilities assigned to an operational risk management function. A Bank shall ensure that operational risk management function: i. develops strategies to identify, assess, monitor, control and mitigate operational risk; ii. codifies bank-level policies and procedures concerning operational risk management and control; and iii. designs and implements the operational risk assessment methodology and operational risk-reporting system of the Bank. 6.8.4.4.3. The Bank shall have sufficient resources in the use of TSA in the major business lines as well as the control and audit area. 6.8.4.4.4. The Bank shall have a system for regular reporting of operational exposures, including material operational losses to management of the business units, senior management and the Board of Directors. 6.8.4.4.5. Operational risk management system of the Bank should be well documented. It must have a routine in place for ensuring compliance with a documented set

7 of internal policies, controls and procedures concerning the operational risk management system, which must include policies for the treatment of non￾compliance issues. 6.8.4.4.6. Operational risk management process and assessment system should be subject to the validation and regular independent review at least annually. These reviews must include both the activities of the business units and of the operational risk management function. 6.8.4.4.7. A Bank shall develop specific policies and have a prudent documented procedure for mapping its current business activities to the appropriate business lines in accordance with items a), b), c) and Table 21 above. a) The senior management shall be responsible in developing the mapping policy, which shall be subject to the approval of the Board of Directors. These mapping policies should be reviewed and adjusted in line with new business activities as appropriate. b) A Bank shall comply with the following principles when mapping its business activities to the appropriate business lines: i. Subject to item ii below, each activity or business of a Bank shall be mapped into eight Level 1 business lines (refer Table 21) in a mutually exclusive and jointly exhaustive manner. ii. Any banking or non-banking activity or product that cannot be readily mapped into any business line and which is ancillary to and supports a business line shall be allocated to the business line it supports. If the activity supports more than one business line, an objective criterion shall be used to allocate the annual gross income. iii. Any activity which cannot be readily mapped into any business line shall be allocated to the business line with the highest beta factor, i.e., 18%. iv. Banks may use internal pricing methods to allocate gross income between business lines provided that total gross income for the Bank (as would be recorded under BIA) still equals the sum of gross income for the eight business lines. v. Once an activity has been mapped to a particular business line, the activity shall be mapped to the same business line consistently over time.

8 vi. The mapping of activities into business lines for operational risk capital purposes must be consistent with the definitions of business lines used for regulatory capital calculations in other risk categories, i.e. credit and market risk. vii. Processes must be in place to define the mapping of any new activities or products. viii. The mapping process shall be subject to regular independent reviews by the internal or external auditors of a Bank. c) Supplementary business line mapping guidelines: There are a variety of valid approaches that Banks can use to map their activities to the eight business lines, provided the approach used meets the business line mapping principles. The following is a possible approach that could be used by a Bank to map its gross income: i. Gross income for retail banking consists of net interest income on loans and advances to retail customers and SMEs treated as retail, plus fees related to traditional retail activities, net income from swaps and derivatives held to hedge the retail banking book, and income on purchased retail receivables. To calculate net interest income for retail banking, a Bank takes the interest earned on its loans and advances to retail customers less the weighted average cost of funding of the loans (from whatever source – retail or other deposits). ii. Similarly, gross income from commercial banking consists of the net interest income on loans and advances to corporate (plus SMEs treated as corporate), interbank and sovereign customers and income on purchased corporate receivables, plus fees related to traditional commercial banking activities including commitments, guarantees, bills of exchange, net income (e.g. from coupons and dividends) on securities held in the banking book, and profits/losses on swaps and derivatives held to hedge the commercial banking book. Again, the calculation on net interest income is based on interest earned on loans and advances to corporate, interbank and sovereign customers less the weighted average of funding for these loans (from whatever source).

9 iii. For trading and sales, gross income consists of profits/losses on instruments held in the trading book, net of funding cost, plus fees from wholesale broking. iv. For the other five business lines, gross income consists primarily of the net fees/commissions earned in each of these businesses. Payment and settlement consists of fees to cover provision of payment/settlement facilities for wholesale counterparties. Asset management is management of assets on behalf of others. 6.8.5. The Alternative Standardised Approach (ASA) 6.8.5.1. A Bank may, with the prior approval of DBS, use ASA to calculate its operational risk capital requirement. A Bank shall not use ASA to calculate its operational risk capital requirement unless it complies with all qualifying criteria set out in item 6.8.4.2 under TSA. 6.8.5.2. Under ASA, the operational risk capital requirement/methodology is the same as under TSA, except for two business lines, retail banking and commercial banking business lines. For these business lines, use outstanding amount of loans and advances after multiplying by a fixed factor ‘m’ (0.035) as the exposure indicator which replaces gross income. 6.8.5.3. A Bank which has adopted ASA shall not use TSA or BIA without the prior approval of DBS. 6.8.5.4. The Bank shall calculate operational risk capital requirement under ASA as follows: KASA = {Σ years 1-3 max[Σ(GI1-6 x β1-6 ),0]} /3 + (β7 x m x LAr ) + (β8 x m x LAc ) Where: a) K ASA = capital charge for operational risk under ASA b) GI 1-6 = annual gross income in a given year calculated in accordance with item 6.8.3.2 under BIA, for each of the eight business lines set out in Table 21, except for retail banking and commercial banking business lines c) β 1-8 = fixed beta factor as set out in Table 22 d) m = 0.035 e) LAr = total outstanding loans and advances of the retail banking business line

10 f) LAc = total outstanding loans and advances of the commercial banking business line. 6.8.5.5. For the purposes of the ASA, total outstanding loans and advances shall be as follows: a) Retail banking business line consists of the total on-balance sheet outstanding amount of the retail, SMEs treated as retail, residential mortgages and purchased retail receivables, credit portfolios. b) Commercial business line consists of the total on-balance sheet outstanding amount of the corporate, sovereign, bank, specialised lending, SMEs treated as corporate and purchased corporate receivables, credit portfolios and the book value of securities held in the held-to-maturity and available-for-sale categories. 6.8.5.6. For the purpose of determining LAr and LAc , a Bank shall take a simple average of the total outstanding loans and advances of the relevant business line over the 12 most recent financial quarters without gross of any provisions/impairment charges. 6.8.6. Specific Instruction for completion of Part V 6.8.6.1. Part V(a): Computation of Risk-weighted Amount for Operational Risk 6.8.6.1.1. Gross Income/ Loans and Advances (WBRC 11.5.1.7.0.0) Gross income: The value of gross income for each year in respect of BIA (WBRC 11.5.1.1.0.0), business lines of TSA (WBRC 11.5.1.2.1.0 to 11.5.1.2.8.0) and business lines of ASA (WBRC 11.5.1.3.1.1 to 11.5.1.3.1.6) is automatically shown based on the data provided in the Part V (b) as follows; Gross income = Interest Income (WBRC 11.5.2.3.0.0) - Interest Expenses (WBRC 11.5.2.4.0.0) + Non Interest Income (WBRC 11.5.2.5.0.0) (+/-) Realised Profits/losses from the Sale of Securities in the Banking Book (WBRC 11.5.2.6.0.0) (+/-) Extraordinary/Irregular Item of Income (WBRC 11.5.2.7.0.0).

11 This is illustrated further by the example below (Table 23). Table 23 Illustration of Calculation of Annual Gross Income Item Amount￾Rs’ 000 Amount￾Rs’000 Interest Income 200,000 200,000 Less: Interest Expense (100,000) (100,000) Net Interest Income 100,000 100,000 Non-interest Income Fee and Commission Income 50,000 50,000 Dividend Income 30,000 30,000 Gain on sale of fixed assets 40,000 Profit/loss from Trading 20,000 20,000 Realised gains/losses from sale of banking book securities 50,000 Others 10,000 10,000 Non-interest Income 200,000 110,000 Operating Income 300,000 210,000 Less: Operating expenses (100,000) Less: Allowances (50,000) Less: Taxes (30,000) Profit/loss for the period 120,000 Gross Income for the purpose of operational risk capital requirement 210,000 Loans and Advances: The values of loans and advances in respect of retail banking (WBRC 11.5.1.3.2.1) and commercial banking (WBRC 11.5.1.3.2.2) should be filled in accordance with the item 6.8.5.6. 6.8.6.1.2. Capital charges (WBRC 11.5.1.8.0.0) The value of capital charges for each year in respect of BIA, TSA and ASA is calculated as follows; (i) BIA: by multiplying the gross income for each year by α (15%). (ii) TSA: by multiplying the gross income of individual business line for each year by β assigned to each business line. (iii) ASA: by multiplying the gross income of individual business line for each year by β assigned to each business line. In the case of retail banking business line and commercial banking business line, capital

12 charge is calculated by multiplying the yearly average outstanding amount of loans and advances by a fixed factor ‘m’, i.e., 0.035 with the respective β, i.e., 12% and 15%, respectively. 6.8.6.1.3. Capital Charges for Operational Risk (WBRC 11.5.1.9.0.0) The value of capital charges for operational risk in respect of BIA, TSA and ASA is automatically shown as follows; (i) Capital charges for operational risk in respect of each approach is calculated by aggregating the capital charges for the 3 years as reported under WBRC 11.5.1.8.0.0 and 11.5.1.1.0.0 of BIA, WBRC 11.5.1.8.0.0 and 11.5.1.2.0.0 of TSA and WBRC 11.5.1.8.0.0 and 11.5.1.3.0.0 of ASA by dividing that aggregate by 3 (number of years). (ii) Negative capital charge recorded in a given year/s of the these 3 years, shall be considered as a zero value and not used to offset the positive capital charge recorded in other year/s. (iii) In the case of BIA, number of years referred to in (i) above, may change in accordance with the item 6.8.3.3. 6.8.6.1.4. Risk-weighted Amount for operational risk (WBRC 11.5.1.10.0.0) The value of risk-weighted amount for operational risk in respect of BIA (WBRC 11.5.1.10.1.0), TSA (WBRC 11.5.1.10.2.0), and ASA (WBRC 11.5.1.10.3.0) is automatically shown by multiplying the capital charge for operational risk under BIA (WBRC 11.5.1.9.1.0), TSA (WBRC 11.5.1.9.2.0), and ASA (WBRC 11.5.1.9.3.0) by 10, separately. 6.8.6.2. Part V(b): Computation of Gross Income Under Operational Risk 6.8.6.2.1. The reporting of income and expenses items referred to in this Part should be in accordance with the item 6.8.3.4. 6.8.6.2.2. WBRC 11.5.2.1.0.0 is applicable only for BIA, six business lines under WBRC 11.5.2.2.1.0 to 11.5.2.2.6.0 are applicable for both TSA and ASA and two business lines under WBRC 11.5.2.2.7.0 and 11.5.2.2.8.0 are applicable only for TSA.