Measurement and capital adequacy—operational risk

Banking Supervision Department Policy and Regulation Division June 19, 2024 Circular No. C-06-2785 Attn: Banking corporations and acquirers Re: Measurement and capital adequacy—operational risk (Proper Conduct of Banking Business Directive no. 206) Introduction

1. In accordance with the policy of adopting accepted international standards on issues regarding Banking Supervision, the Supervisor of Banks decided to adopt the Basel Committee standard from December 2017 on the issue of calculating capital requirements in respect of operational risk (chapters OPE10 and OPE25 in the Basel Committee codification). In view of this decision, the Banking Supervision Department is updating Proper Conduct of Banking Business Directive no. 206 on the issue of calculating capital requirements regarding operational risk.
2. The numbering of the Directive’s sections is in line with the numbering of the Basel framework (Chapter 1 is aligned with Chapter OPE10 and Chapter 2 is aligned with Chapter OPE25).1
3. The regulation was not accompanied by publication of a RIA report under the Principles of Regulation Law, 5782-2021, (hereinafter, “the Law”) in view of the exemption established in Section 34(c)(4), as it is the adoption of an international rule that applies to banks. The regulation will not be subject to retrospective examination in accordance with Section 36 of the Law, but it will be subject to periodic review from time to time, to the extent that there will be updates in the international rule on which it is based.
4. In accordance with the above, after consulting with the Advisory Committee on Banking Business Affairs and with the approval of the Governor, I have decided to update the Directive and replace it with a new Directive, the main points of which are as follows: Chapters of the updated directive
5. Definitions and group application (Chapter 1) (a) Definition of operational risk Explanatory remarks: A definition of operational risk was added to the new Directive, instead of a referral to the definition of this term in Proper Conduct of Banking Business Directive no. 350; the essence of the definition remained unchanged.

1 The footnote numbers are also aligned with Basel, except for footnotes added to connect the Business Indicator sections with the Reporting to the Public directives.

(b) Definition of the Business Indicator components Explanatory remarks: The calculation of the capital requirement in respect of operational risk was redefined in the Directive. The calculation is based on, among other things, the Business Indicator, which serves as an estimate of operational risk on the basis of the financial statements. The Business Indicator Components are specified in Section 1.2 of the Directive. The Business Indicator Component definitions will be based on the guidelines in the Reporting to the Public Directives of the Supervisor of Banks. (c) Application of the standardized approach in a banking group 6. Risk weighted assets calculation in respect of operational risk—the Standardized Approach (Chapter 2) (a) Standardized approach components (Sections 2.1 to 2.11) Explanatory remarks: The Standardized approach components include the business indicator component, arrived at by multiplying the total business indicator and coefficients established in the Directive (Table 1), as well as the Internal Loss Multiplier, which is based on the banking corporation’s average historical losses and is defined according to the equation in Section 2.8 of the Directive. (b) Minimum standards for the use of loss data under the standardized approach (Sections 2.12 and 2.13) (c) General criteria on loss data identification, collection, and treatment (Sections 2.14– 2.22) (d) Specific criteria on loss data identification, collection, and treatment (Sections 2.23– 2.29) (e) Exclusion of losses from the Loss Component (Sections 2.30–2.32) (f) Exclusion of divested activities from the Business Indicator (Section 2.33) (g) Inclusion of losses and BI items related to mergers and acquisitions (Section 2.34) (h) Noting that the disclosure requirements related to loss data are to be provided within the framework of Reporting to the Public directives (Section 2.35) Explanatory remarks The Directive includes guidelines regarding the banking corporation’s historical loss data, when to use them, how to collect them, and what items of information should be collected. The Directive includes guidelines for handling certain occurrences that are not part of routine activity, where for some of the cases the guidelines are subject to the approval of the Supervisor. Loss data must be disclosed in accordance with requirements that will be included in the Reporting to the Public Directives. The Supervisor of Banks has not yet finally determined his stance on certain sections regarding which the Basel Committee assigned a Supervisory discretion. When a supervisory stance will be established with finality regarding these issues, the Directive will be updated accordingly. For example, the following sections in the Directive are likely to be updated: 2.11, 2.17, and 2.32.

7. Collecting internal loss data by a banking corporation in bucket 1 (Section 3.1) A clarification of the expectation that even though a banking corporation in bucket 1 is not required to use loss data in the calculation of capital in respect of operational risk, a banking corporation with a business indicator equal to or exceeding NIS 3.5 billion, is required to collect internal loss data, in accordance with the requirements included in the Directive, in order to be prepared for a switch to bucket 2 and for risk management needs. A banking corporation with a business indicator that is smaller than NIS 3.5 billion is not required to collect internal loss data in accordance with the specific requirements of this Directive, unless the Supervisor determined otherwise in its case, for reasons that will be documented. This represents an addition to the Basel Committee standard. Explanatory remarks The addition clarifies the expectation regarding the collection of internal loss data where it is not required to use loss data in calculating the capital in respect of operational risk. It should be clarified that a banking corporation that is not required to collect internal loss data pursuant to this Directive, still has a general obligation to collect information on operational losses in line with Proper Conduct of Banking Business Directives dealing with risk management, such as Proper Conduct of Banking Business Directive no. 350 on Operational Risk Management.
8. Frequency of calculating the risk weighted assets in respect of operational risk (Section 3.2) The expectation regarding the frequency of the calculation was clarified. The calculation is to be based on calendar year data, but it is to be carried out once a quarter on the basis of updated year over year data. The Supervisor of Banks may establish a different frequency for a specific banking corporation under exceptional circumstances. Explanatory remarks Chapter 2 of the Directive specifies the method of calculating the risk-weighted assets in respect of operational risk on the basis of annual data. Section 3.2 adds detailed guidelines regarding the frequency of the calculation. Commencement
9. The amendments to this Directive as set forth in this Circular shall go into effect on January 1, 2026; however, 9.1 Regarding the requirement to calculate risk weighted assets in respect of operational risk—the standardized approach, notwithstanding the provisions of Section 2.10 of the Directive, until December 31, 2028, the Internal Loss Multiplier (ILM) shall be established as 1 (one). The Supervisor of Banks shall publish, in 2028 at the latest, the path of including the Internal Loss Multiplier. 9.2 Regarding the requirement to collect loss data (in accordance with Sections 2.14–2.32, and 2.34 of the Directive):

(a) The banking corporation shall collect loss data regarding the years 2024 and 2025, approximated as closely as possible to the method required in the Directive. (b) Regarding the exclusion of losses from the loss component (in accordance with Sections 2.30–2.32 of the Directive), the banking corporation is to assume that there are no exclusions to the requirement to collect loss data (in the future there may be exclusions in respect of the calculation of risk weighted assets for operational risk). (c) Regarding the losses related to mergers and acquisitions (in accordance with Section 2.34 of the Directive), there is no need to include businesses and entities that were merged before 1.1.2026. The section will apply from this point onward. Update 10. Updated Proper Conduct of Banking Business Directive file pages are attached. Following is the update: Remove page Insert page (7/12) [3] 206-1-21 (06/24) [4] 206-1-21 Respectfully, Daniel Hahiashvili Supervisor of Banks