Capital Adequacy Requirements (CAR) Chapter 3 – Operational Risk

Protected B - External / Protégé B - Externe
Guideline
Subject: Capital Adequacy Requirements (CAR)
Chapter 3 – Operational Risk
Effective Date: November 2025 /January 2026
For institutions with a fiscal year ending October 31 or December 31, respectively.
I. Introduction
The Capital Adequacy Requirements (CAR) for banks (including federal credit unions), bank holding companies, federally regulated trust companies and federally regulated loan companies are set out in nine chapters, each of which has been issued as a separate document. This document should be read in conjunction with the other CAR chapters. The complete list of CAR chapters is as follows:
Chapter 1 Overview of Risk-based Capital Requirements
Chapter 2 Definition of Capital
Chapter 3 Operational Risk
Chapter 4 Credit Risk - Standardized Approach
Chapter 5 Credit Risk - Internal Ratings-Based Approach
Chapter 6 Securitization
Chapter 7 Settlement and Counterparty Risk
Chapter 8 Credit Valuation Adjustment (CVA) Risk
Chapter 9 Market Risk
Please refer to OSFI’s Corporate Governance Guideline for OSFI’s expectations of institution Boards of Directors in regard to the management of capital and liquidity.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 2
Protected B - External / Protégé B - Externe
Table of Contents
Page
3.1 Definition of operational risk...............................................................................................3
3.2 Measurement methodologies...............................................................................................3
3.3 The Simplified Standardized Approach...............................................................................4
3.4 The Standardized Approach.................................................................................................5
3.4.1 Components of the Standardized Approach....................................................................5
3.4.2 Minimum standards for the use of loss data under the standardized approach...............7
3.4.3 General criteria on loss data identification, collection and treatment .............................8
3.4.4 Specific criteria on loss data identification, collection and treatment.............................9
3.4.5 Exclusion of losses from the Loss Component .............................................................11
3.4.6 Exclusions of divested activities from the Business Indicator......................................13
3.4.7 Inclusion of BI items and operational loss events related to mergers and acquisitions 13
Annex 3-1: Definition of Business Indicator components.........................................................15
Annex 3-2: Detailed Loss Event Type Classification................................................................18

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 3
Protected B - External / Protégé B - Externe
Chapter 3 – Operational Risk

1. The requirements related to the Standardized Approach in this chapter (section 3.4) are
   drawn from the Basel Committee on Banking Supervision (BCBS) Basel Framework published on the Bank for International Settlements (BIS) website.1 For reference, the Basel paragraph numbers that are associated with the text appearing in this chapter are indicated in square brackets at the end of each paragraph.2

3.1 Definition of operational risk
2. Operational risk is defined as the risk of loss resulting from inadequate or failed internal
processes, people and systems or from external events. This definition includes legal risk,3 but excludes strategic and reputational risk. [Basel Framework, OPE 10.1]
3.2 Measurement methodologies
3. There are two methodologies for calculating operational risk capital:
(i) the Standardized Approach (SA); and,
(ii) the Simplified Standardized Approach (SSA).
4. Domestic Systemically Important Banks (D-SIBs) must use the Standardized Approach.
5. Category I Small and Medium Sized Deposit-Taking Institutions (SMSBs) with annual
Adjusted Gross Income4 greater than $1.5 billion5 must also use the Standardized Approach. a) Category I SMSBs must calculate Adjusted Gross Income at each fiscal year-end. If annual Adjusted Gross Income is greater than $1.5 billion, the institution must notify OSFI within 60 days of the end of the fiscal year, and use the Standardized Approach for operational risk in the following fiscal year. b) Once a Category I institution crosses the $1.5 billion threshold, it must use the Standardized Approach for a minimum of two years. If, after two years, annual Adjusted Gross Income falls below $1.5 billion, the institution must notify OSFI and may revert to the Simplified Standardized Approach.6
6. Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion may apply
to OSFI to use the SA if they have a minimum of five years of high-quality loss data (i.e. data meeting the minimum standard for loss data collection as outlined in section 3.4.2). If approved, 1 The Basel Framework 2 Following the format: [Basel Framework, XXX yy.zz]. 3 Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. 4 Adjusted Gross Income is defined in paragraph 9 of this chapter 5 All dollar values in this guideline are in Canadian dollars unless otherwise noted. 6 For example, if fiscal 2024 Adjusted Gross Income is greater than $1.5 billion for the first time, the institution must use the Standardized Approach starting in fiscal Q1 2026 and continue using the SA until, at a minimum, the end of fiscal 2027.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 4
Protected B - External / Protégé B - Externe an institution is not permitted to set the Internal Loss Multiplier (ILM) to less than one until OSFI has determined that they have 10 years of high-quality loss data.
7. All other SMSBs must use the SSA.
3.3 The Simplified Standardized Approach
8. Institutions using the SSA must hold capital for operational risk (ORC) equal to 15% of
average annual Adjusted Gross Income (AGI) over the previous 12 fiscal quarters:

ORCSSA = (AGI previous 12 fiscal quarters / 3) × 15% Where:
ORCSSA = the operational risk capital charge under the Simplified Standardized Approach AGI previous 12 fiscal quarters = Adjusted Gross Income over the previous 12 fiscal quarters Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC.
9. Adjusted Gross Income is defined as the sum of the following:
a) The lesser of (i) the absolute value of net interest income, and (ii) 2.25% of interest earning assets; b) Dividend income; c) The absolute value of fee and commission income; d) The absolute value of other income; e) The absolute value of net profit/loss (trading book); and f) The absolute value of net profit/loss (banking book). Adjusted Gross Income should (i) be gross of any provisions; (ii) be gross of operating expenses, and (iii) exclude extraordinary or irregular items as well as income derived from insurance. Institutions should refer to the reporting instructions in OSFI’s Capital Adequacy Return for the specific line items in OSFI’s P3 (Income Statement) and M4 (Balance Sheet) returns that should be used for each of the components of Adjusted Gross Income in the definition above.
10. Newly incorporated institutions having fewer than 12 quarters of financial information
should calculate the operational risk capital charge using available Adjusted Gross Income data to develop proxies for the missing portions of the required three years’ data.
11. Adjusted Gross Income should be adjusted to reflect acquired businesses and merged
entities. Since the Adjusted Gross Income calculation is based on a rolling 12-quarter average, the most recent four quarters of Adjusted Gross Income for the acquired business or merged entity should be based on actual Adjusted Gross Income amounts reported by the acquired business or merged entity. If three years of historical financial data is not available for the acquired business or merged entity, the Adjusted Gross Income for the previous year may be used as a proxy for each of the other two years.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 5
Protected B - External / Protégé B - Externe
12. When an institution using the SSA makes a divestiture, Adjusted Gross Income may be
adjusted, with OSFI approval, to reflect this divestiture.
3.4 The Standardized Approach
13. The standardized approach methodology is based on the following components:
a) the Business Indicator (BI) which is a financial-statement-based proxy for operational risk; b) the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of regulatory determined marginal coefficients; and c) the Internal Loss Multiplier (ILM), which is a scaling factor that is based on an institution’s average historical losses and the BIC. [Basel Framework, OPE 25.1]
14. Operational risk capital requirements under the Standardized Approach (ORCSA) are
calculated by multiplying the BIC and the ILM, as shown in the formula below. Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC. ORCSA = BIC x ILM [Basel Framework, OPE 25.2]
3.4.1 Components of the Standardized Approach
15. The BI comprises three components: the interest, leases and dividend component
(ILDC), the services component (SC), and the financial component (FC).
[Basel Framework, OPE 25.3]
16. The BI is defined as:
BI = ILDC + SC+ FC
In the formula below, a bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2, and:
7
𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 = 𝑀𝑀𝑀𝑀𝑀𝑀 [𝐴𝐴𝐴𝐴𝐴𝐴(𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 – 𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 𝐼𝐼 𝐸𝐸𝐸𝐸𝐸𝐸 ) ; 2.25% 𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 𝐼𝐼 𝐸𝐸𝐸𝐸 𝐸𝐸 𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴]

• 𝐷𝐷 𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼
  𝑆𝑆 = 𝑀𝑀 �𝐹𝐹 𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 ; 𝐹𝐹 𝐸𝐸𝐸𝐸𝐸𝐸 �
• 𝑀𝑀 [𝑂𝑂 ℎ 𝑂𝑂 𝐼𝐼 𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 ; 𝑂𝑂 ℎ 𝑂𝑂 𝐸𝐸𝐸𝐸𝐸𝐸 ]
  7 Abs() represents the absolute value of the term or calculation within the brackets. The absolute value of net items (e.g. interest income – interest expense) should be calculated first year by year. Only after this year by year calculation should the average of the three years be calculated.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 6
Protected B - External / Protégé B - Externe
𝐹𝐹 = 𝐴𝐴𝐴𝐴𝐴𝐴(𝑁𝑁 𝑃𝑃& 𝑇𝑇 𝐵𝐵 𝐵𝐵) + 𝐴𝐴𝐴𝐴𝐴𝐴(𝑁𝑁 𝑃𝑃& 𝐵𝐵) [Basel Framework, OPE 25.4 and Basel Framework, OPE 25.5]
17. The definitions for each of the components of the BI are provided in Annex 3-1.
[Basel Framework, OPE 25.6]
18. The Business Indicator Component (BIC) is calculated as follows:
8 a) 12% of BI, plus b) 3% of BI above $1.5 billion (if any), plus c) 3% of BI above $45 billion (if any). [Basel Framework, OPE 25.7]
19. An institution’s internal operational risk loss experience affects the calculation of
operational risk capital through the ILM. The ILM is defined as:
𝐼𝐼𝐼𝐼 = 𝑙𝑙 �exp(1) − 1 + �
𝐵𝐵 �
0.8
� where the Loss Component (LC) is equal to 15 times average annual operational risk losses, net of recoveries, incurred over the previous 10 years. The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, an institution with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, an institution with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology. [Basel Framework, OPE 25.8 and Basel Framework, OPE 25.9]
20. The calculation of average losses in the Loss Component must be based on 10 years of
high-quality annual loss data (i.e. data meeting the minimum standard for loss data collection as outlined in section 3.4.2). Institutions that do not have ten years of high-quality loss data must calculate the capital requirement using an ILM greater than or equal to one. In these cases, OSFI will require an institution to calculate capital requirements using fewer than 10 years of losses if the ILM using the available high-quality loss data is greater than 1 and OSFI believes the losses are representative of the institution’s operational loss exposure. [Basel Framework, OPE 25.10] 8 For example, if an institution had a BI = $50 billion, the BIC = ($50B x 0.12) + [($50B -$1.5B) x 0.03] + [($50B - $45B) x 0.03] = $7.605 B.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 7
Protected B - External / Protégé B - Externe
21. ORC is to be calculated and reported quarterly. Financial information used in the
calculation of the BI should be up to and including the institution’s most recent fiscal quarter￾end. Operational risk losses used in the calculation of the LC may be reported on a one-quarter lag.
22. Institutions should perform a reconciliation between the BI and Net Interest Income and
Non-Interest Income9 for the previous three years. This information should be available to OSFI upon request.
23. At the consolidated level, the SA calculations use fully consolidated BI figures, which
net all the intragroup income and expenses.
[Basel Framework, OPE 10.4]
24. A subsidiary institution using the SA should use its own consolidated income and loss
experience in the calculation of BI and LC for the SA calculations, and is subject to the minimum standards for the use of loss data in the following sections. [Basel Framework OPE, 10.5 and Basel Framework, OPE 10.6]
3.4.2 Minimum standards for the use of loss data under the standardized approach
25. Institutions using the SA are required to use loss data as a direct input into the
operational risk capital calculations. The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the institution’s operational loss exposure. The minimum loss data standards are outlined in sections 3.4.3, 3.4.4,
3.4.5 and 3.4.7.
10 The quality of institutions’ loss data will be reviewed by OSFI periodically. [Basel Framework OPE, 25.12]
26. Institutions using the SA that do not meet the loss data standards11 are required to hold
capital that is at a minimum equal to 100% of the BIC (i.e. ILM greater than or equal to one). The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting adjustment to the ILM, must be publicly disclosed. [Basel Framework OPE, 25.13] 9 Net Interest and Non-Interest Income is line 22 from OSFI’s P3 return. 10 Institutions are also required to meet OSFI’s Data Maintenance Expectations for Institutions Using the Standardized Approach for Operational Risk Capital Data 11 This includes Category I SMSBs with annual Adjusted Gross Income less than $1.5 billion that have been approved to use the SA, but do not have 10 years of high-quality loss data. These institutions must receive OSFI approval before they can set ILM<1 in the calculation of ORCSA.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 8
Protected B - External / Protégé B - Externe
3.4.3 General criteria on loss data identification, collection and treatment
27. The proper identification, collection and treatment of internal loss data are essential
prerequisites to the capital calculation under the standardized approach. The general criteria for the use of the LC are as follows:
[Basel Framework, OPE 25.14] a) Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period. [Basel Framework, OPE 25.15] b) Internal loss data are most relevant when clearly linked to an institution’s current business activities, technological processes and risk management procedures. Therefore, an institution must have robust, documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. At a minimum, this would include effective and independent challenge by the institution’s second line of defense, and periodic independent review by the third line of defense. [Basel Framework, OPE 25.16] c) For risk management purposes, and to assist in supervisory validation and/or review, institutions should map historical internal loss data into the relevant Level 1 supervisory categories as defined in Annex 3-2 and to provide this data to OSFI upon request. The institution must document criteria for allocating losses to the specified event types. [Basel Framework, OPE 25.17] d) An institution’s internal loss data must be comprehensive and capture all material12 activities and exposures from all appropriate subsystems and geographic locations. 13 [Basel Framework, OPE 25.18] e) For the purposes of the operational risk capital calculation, the minimum threshold, net of recoveries, for including a loss event in the data collection and calculation of average annual losses is set at $30,000. 14 [Basel Framework, OPE 25.18] 12 10 years of actual or estimated loss data must be included for all parts of an institution. Estimation of more than 10% of an institution’s total loss data over the past 10 years using the methodology detailed in paragraph 40(a) is only permitted on a temporary basis. Where this is the case, the institution must inform OSFI and come below the 10% threshold in a timely manner in order to continue to meet the loss data standards. (see
section 3.4.7).
13 The financial impacts of events that an institution is responsible for should be included in the dataset as operational losses. For outsourced activities, the financial impacts of events that are paid by the outsourcer (rather than by the institution) are not operational losses to the institution. [Basel Framework, OPE 25.18 FAQ#1] 14 Loss impacts denominated in a foreign currency should be converted using the same exchange rate that is used to convert the institution’s financial statements of the period the loss impacts were accounted for. [Basel Framework, OPE 25.18 FAQ#2]

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 9
Protected B - External / Protégé B - Externe f) Aside from information on gross loss amounts, the institution must collect information about the reference dates of operational risk events, including:

• the date when the event happened or first began (“date of occurrence”), where
  available;
• the date on which the institution became aware of the event (“date of discovery”);
  and
• the date (or dates) when a loss event results in a loss, reserve or provision against
  a loss being recognized in the institution’s profit and loss (P&L) accounts (“date of accounting”). In addition, the institution must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event. 15 The level of detail of any descriptive information should be commensurate with the size of the gross loss amount. [Basel Framework, OPE 25.19] g) Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set. [Basel Framework, OPE 25.20] h) Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardized approach for operational risk. [Basel Framework, OPE 25.21] i) Institutions must have processes to independently review the comprehensiveness and accuracy of loss data. At a minimum, this would include effective and independent challenge by the institution’s second line of defense, and periodic independent review by the third line of defense. [Basel Framework, OPE 25.22]
  3.4.4 Specific criteria on loss data identification, collection and treatment

28. Building an acceptable loss data set from the available internal data requires that the
    institution develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses. [Basel Framework, OPE 25.23]
29. Gross loss is a loss before recoveries of any type. Net loss is defined as the loss after
    taking into account the impact of recoveries. The recovery is an independent occurrence, related 15 Tax effects (e.g. reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of the standardized approach for operational risk.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 10
Protected B - External / Protégé B - Externe to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party. 16 [Basel Framework, OPE 25.24]
30. Institutions must be able to identify the gross loss amounts, non-insurance recoveries,
and insurance recoveries for all operational loss events. Institutions should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the institution receives payment. Receivables do not count as recoveries. Verification of recovery payments received to net losses must be provided to OSFI upon request. [Basel Framework, OPE 25.25]
31. The following items must be included in the gross loss computation of the loss data set:
a) Direct charges, including impairments and settlements, to the institution’s P&L accounts and write-downs due to the operational risk event; b) Costs incurred as a consequence of the event including:
(i) external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers); (ii) costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event; and (iii) uncollected revenue due to an operational risk event that can be quantified based on the contractual obligations of the institution’s client or customer. c) Provisions or reserves accounted for in the P&L against the potential operational loss impact; 17 d) Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L (“pending losses”); 18 and e) Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial 16 Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers. 17 When an institution makes a provision due to an operational loss event, such provision must be considered an operational loss immediately for the calculation of the Loss Component. When a charge-off (such as a settlement) eventually takes place later, only the difference between the initial provision and the charge-off (if any) should be added to the operational loss calculation. There should be no double counting of the same financial impacts in the calculation of operational losses. For example, if an institution takes a $1 million provision for a legal event in 2018, this should be included in the loss data for 2018. If the legal event is settled for $1.2 million in 2019, an additional $200,000 should be included in
2019. [Basel Framework, OPE 25.26 FAQ#1] 18 For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these
events are recognized through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across institutions or countries.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 11
Protected B - External / Protégé B - Externe accounting periods (“timing losses”). 19 Timing losses should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period.20 21 [Basel Framework, OPE 25.26]
32. The following items should be excluded from the gross loss computation of the loss data
set:
a) Costs of general maintenance contracts on property, plant or equipment; b) Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and c) Insurance premiums. [Basel Framework, OPE 25.27]
33. Institutions must use the date of accounting for building the loss data set.
22 This includes using the date of accounting for including losses related to legal events in the loss dataset. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L. [Basel Framework, OPE 25.28]
34. Losses caused by a common operational risk event or by related operational risk events
over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment. [Basel Framework, OPE 25.29]
3.4.5 Exclusion of losses from the Loss Component
35. Institutions may request OSFI approval to exclude certain operational loss events that
are no longer relevant to the institution’s risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss 19 Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to-market errors). While these events do not represent a true financial impact on the institution, (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution’s financial statements. 20 For example, when an institution refunds a client that was overbilled due to an operational failure, if the refund is provided in the same financial accounting period as the overbilling took place and thus no misrepresentation of the institution’s financial statements occurs, there is no operational loss. However, if the refund occurs in a subsequent financial accounting period to the overbilling, it is considered a timing loss and should be included in the loss dataset if it exceeds the $30,000 minimum threshold (note that in this case the prior overbilling cannot be netted against the payment to the client as a recovery). [Basel Framework, OPE 25.26 FAQ #2] 21 For timing losses that are accounting errors, institutions must determine the threshold for inclusion of these events in the loss data set. This threshold may be greater than $30,000 but must be below the level used by the institution’s external auditor for determining the summary of material misstatements within the annual financial statement audit. Accounting errors do not include errors in the mark-to-market valuation of financial assets or timing errors that involve third parties (e.g. customer over-billing or underpayment to third parties), which must be included in the loss data set when the amount of the timing loss exceeds $30,000. 22 For losses from uncollected revenue (paragraph 31(b)(iii)), institutions may use either the date in which the revenue should have been collected, or the date on which the decision was made not to collect the revenue.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 12
Protected B - External / Protégé B - Externe events to the institution’s risk profile, OSFI will consider whether the cause of the loss event could occur in other areas of the institution’s operations.23 Taking settled legal exposures and divested businesses as examples, OSFI would expect the organization’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products. [Basel Framework, OPE 25.30]
36. The total loss amount and number of exclusions must be disclosed in accordance with
the Pillar 3 requirements with appropriate narratives, including total loss amount and number of exclusions. [Basel Framework, OPE 25.31]
37. A request for loss exclusions is subject to a materiality threshold such that the excluded
loss event should be greater than 5% of the institution’s average annual losses over the past 10 years. Loss events below the materiality threshold are not eligible for exclusion and should remain in the institution's operational risk loss database. In addition, losses can only be eligible for exclusion after being included in an institution’s operational risk loss database for a minimum of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period. [Basel Framework, OPE 25.32] 23 This includes consideration of the extent to which the loss event was due to the lack of effective operational risk management policies, practices or controls within the institution.

Is the loss event still relevant to the institution’s risk profile?

Is the loss event related to a divested activity?
Is the loss event greater than 5% of average annual losses over the past ten years? Has the loss event been included in loss data for at least three years? OSFI will approve the exclusion of the loss event. OSFI will not approve the exclusion of the loss event. Institutions should not submit an exclusion request as losses of this size are not eligible. Yes No

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 13
Protected B - External / Protégé B - Externe
3.4.6 Exclusions of divested activities from the Business Indicator
38. Institutions may request OSFI approval to exclude divested activities from the
calculation of the BI. Such exclusions must be disclosed in accordance with the Pillar 3 requirements. [Basel Framework, OPE 25.33]
3.4.7 Inclusion of BI items and operational loss events related to mergers and
acquisitions
39. The measurement of the BI must include BI items that result from acquired businesses
and merged entities. If three years of historical financial data is not available for an acquired business or merged entity, actual BI items for at least the previous year may be used for the BI calculation, and the BI items for the previous year may be used as a proxy for each of the other two years. Alternatively, institutions may use 125% of Adjusted Gross Income of the acquired business or merged entity (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for the acquired business or merged entity’s BI.

[Basel Framework, OPE 25.34]
40. Institutions using the standardized approach must also include historical loss events
from the acquired business or merged entity for the previous 10 years. a) If an acquired business or merged entity does not have historical high-quality loss data for the previous 10 years, the institution must estimate historical loss data for each of the years where data is missing for the purposes of calculating the LC (actual high-quality loss data should be used for those years where available). (i) If the institution’s ILM in the quarter prior to the merger or acquisition was less than or equal to one, operational losses for each missing year should be estimated as 1%24 of the BI of the acquired business or merged entity at the time of acquisition. 25 (ii) If the institution’s ILM in the quarter prior to the merger or acquisition was greater than one, estimated operational losses for each missing year of the acquired business or merged entity in the 10-year window should be estimated as x% of the BI of the acquired business or merged entity at the time of acquisition, 25 where = 𝑎𝑎 𝑙𝑙 𝑓𝑓 ℎ 𝑦𝑦 ℎ 𝑞𝑞 ℎ / 𝑎𝑎 𝐵𝐵 ℎ 𝑞𝑞 ℎ ℎ / 𝑎𝑎 24 1% of BI is the implied level of annual losses for an institution with an ILM=1 and a marginal coefficient of 15%. 25 Institutions may alternatively use 125% of Adjusted Gross Income (detailed in section 3.3) for the year prior to the merger or acquisition as a proxy for BI to calculate BI for an acquired business or merged entity at the time of acquisition.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 14
Protected B - External / Protégé B - Externe b) Post-acquisition or merger, if the collection of actual loss data for the acquired business or merged entity is not feasible immediately, the institution may temporarily estimate operational risk loss amounts for the acquired business or merged entity, using the methodology detailed in paragraph 40(a) above.

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 15
Protected B - External / Protégé B - Externe
Annex 3-1: Definition of Business Indicator components
[Basel Framework OPE 10.2]
Business Indicator Definitions
BI
Component
Income
Statement or balance sheet items
Description Typical sub-items
Interest, lease and dividend
Interest income Interest income from all financial assets and other interest income (includes interest income from financial and operating leases and profits from leased assets)

• Interest income from loans and
  advances, assets available for sale, assets held to maturity, trading assets, financial leases and operational leases
• Interest income from hedge
  accounting derivatives
• Other interest income
• Profits from leased assets
  Interest expenses
  Interest expenses from all financial liabilities and other interest expenses (includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets)
• Interest expenses from deposits,
  debt securities issued, financial leases, and operating leases
• Interest expenses from hedge
  accounting derivatives
• Other interest expenses
• Losses from leased assets
• Depreciation and impairment of
  operating leased assets
  Interest earning assets (balance sheet item) 26 Total gross outstanding loans, advances, interest bearing securities (including government bonds), and lease assets measured at the end of each financial year Dividend income Dividend income from investments in stocks and funds not consolidated in the institution’s financial statements, including dividend income from non￾consolidated subsidiaries, associates and joint ventures. Services Fee and commission income Income received from providing advice and services. Includes income received by the institution as an outsourcer of financial services. Fee and commission income from:
• Securities (issuance, origination,
  reception, transmission, execution of orders on behalf of customers)
• Clearing and settlement; Asset
  management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitisations; Loan commitments Fee and commission expenses Expenses paid for receiving advice and services. Includes outsourcing fees paid by the institution for the supply of financial services, but not outsourcing fees paid for the Fee and commission expenses from:
• Clearing and settlement; Custody;
  Servicing of securitisations; Loan commitments and guarantees received; and Foreign transactions 26 For clarity, all outstanding credit obligations, including those of non-accrued status (e.g. non-performing loans), in the balance sheet should be included in the interest-earning assets. [Basel Framework, OPE 10.2 FAQ #1]

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 16
Protected B - External / Protégé B - Externe supply of non-financial services (e.g. logistical, IT, human resources) Other operating income Income from ordinary banking operations not included in other BI items but of similar nature (income from operating leases should be excluded)

• Rental income from investment
  properties
• Gains from non-current assets and
  disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37) Other operating expenses Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events (expenses from operating leases should be excluded)
• Losses from non-current assets and
  disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37)
• Losses incurred as a consequence of
  operational loss events (e.g. fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years
• Expenses related to establishing
  provisions/reserves for operational loss events Financial Net profit (loss) on the trading book
• Net profit/loss on trading assets and trading liabilities (derivatives, debt
  securities, equity securities, loans and advances, short positions, other assets and liabilities)
• Net profit/loss from hedge accounting
• Net profit/loss from exchange differences
  Net profit (loss) on the banking book
• Net profit/loss on financial assets and liabilities measured at fair value
  through profit and loss
• Realized gains/losses on financial assets and liabilities not measured at
  fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortized cost
• Net profit/loss from hedge accounting
• Net profit/loss from exchange differences
  The following P&L items do not contribute to any of the items of the BI:
• Income and expenses from insurance or reinsurance businesses
• Premiums paid and reimbursements/payments received from insurance or reinsurance
  policies purchased (including deposit insurance premiums)
• Administrative expenses, including staff expenses, outsourcing fees paid for the supply of
  non-financial services (e.g. logistical, human resources, information technology - IT), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 17
Protected B - External / Protégé B - Externe

• Recovery of administrative expenses including recovery of payments on behalf of
  customers (e.g. taxes debited to customers)
• Expenses of premises and fixed assets (except when these expenses result from
  operational loss events)
• Depreciation/amortization of tangible and intangible assets (except depreciation related to
  operating lease assets, which should be included in financial and operating lease expenses)
• Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given)
  except for provisions related to operational loss events
• Expenses due to share capital repayable on demand
• Impairment/reversal of impairment (e.g. on financial assets, non-financial assets,
  investments in subsidiaries, joint ventures and associates)
• Changes in goodwill recognized in profit or loss
• Corporate income tax (tax based on profits including current tax and deferred).
  [Basel Framework OPE 10.3]

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 18
Protected B - External / Protégé B - Externe
Annex 3-2: Detailed Loss Event Type Classification
[Basel Framework OPE 25.17]
Event-Type Category (Level 1) Definition Categories (Level 2) Activity Examples (Level 3) Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party Unauthorized Activity Transactions not reported (intentional) Transaction type unauthorized (w/monetary loss) Mismarking of position (intentional) Theft and Fraud Fraud / credit fraud / worthless deposits Theft / extortion / embezzlement / robbery Misappropriation of assets Malicious destruction of assets Forgery Check kiting Smuggling Account take-over / impersonation / etc. Tax non-compliance / evasion (wilful) Bribes / kickbacks Insider trading (not on firm’s account) External fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party Theft and Fraud Theft/Robbery Forgery Check kiting Systems Security Hacking damage Theft of information (w/monetary loss) Employment Practices and Workplace Safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events Employee Relations Compensation, benefit, termination issues Organized labour activity Safe Environment General liability (slip and fall, etc.) Employee health and safety rules events Workers compensation Diversity and Discrimination All discrimination types

Banks/BHC/T&L Operational Risk
September 2025 Chapter 3 - Page 19
Protected B - External / Protégé B - Externe
Event-Type Category (Level 1) Definition Categories (Level 2) Activity Examples (Level 3) Clients, Products and Business Practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, Disclosure and Fiduciary Fiduciary breaches / guideline violations Suitability / disclosure issues (KYC, etc.) Retail customer disclosure violations Breach of privacy Aggressive sales Account churning Misuse of confidential information Lender liability Improper Business or Market Practices Antitrust Improper trade / market practices Market manipulation Insider trading (on firm’s account) Unlicensed activity Money laundering Product Flaws Product defects (unauthorized, etc.) Model errors Selection, Sponsorship and Exposure Failure to investigate client per guidelines Exceeding client exposure limits Advisory Activities Disputes over performance of advisory activities Damage to Physical Assets Losses arising from loss or damage to physical assets from natural disaster or other events. Disasters and other events Natural disaster losses Human losses from external sources (terrorism, vandalism) Business disruption and system failures Losses arising from disruption of business or system failures Systems Hardware Software Telecommunications Utility outage / disruptions Execution, Delivery and Process Management Losses from failed transaction processing or process management, from relations with trade counterparties and vendors Transaction Capture, Execution and Maintenance Miscommunication Data entry, maintenance or loading error Missed deadline or responsibility Model / system misoperation Accounting error / entity attribution error Other task misperformance Delivery failure Collateral management failure Reference Data Maintenance Monitoring and Reporting Failed mandatory reporting obligation Inaccurate external report (loss incurred) Customer Intake and Documentation Client permissions / disclaimers missing Legal documents missing / incomplete Customer / Client Account Management Unapproved access given to accounts Incorrect client records (loss incurred) Negligent loss or damage of client assets Trade counterparties Non-client counterparty misperformance Miscellaneous non-client counterparty disputes Vendors and suppliers Outsourcing Vendor disputes