CBE Regulation Book 3.1 - Capital Adequacy Standard Operational Risks Using The Standard Method

Chapter One: Capital Adequacy Standard
Section Five: Operational Risks Using The Standard Method
In the framework of the Central Bank of Egypt's strategy to strive towards applying international best practices in the field of banking supervision, the Central Bank of Egypt issued a decision in its meeting held on December 27, 2020, as follows:

"Banks are committed to applying the following supervisory instructions issued regarding operational risks using the Standard Method instead of the Basic Indicator Approach, within the framework of implementing the Basel III regulatory package, with banks granted a period to align their positions until December 31, 2021, after which the adoption of the Standard Method for calculating the regulatory capital requirement to cover operational risks becomes mandatory."

First: General Framework:
-1 Introduction
In the framework of the continued efforts of the Central Bank of Egypt to study and apply the latest and best international practices in banking supervision to enhance the performance of the Egyptian banking sector and strengthen the financial positions of banks operating in Egypt and improve their risk management practices to enhance their competitiveness at the local, regional, and international levels and to support their resilience against potential financial crises, the Central Bank of Egypt decided to apply the new Standardized Approach (SA) for calculating operational risks to replace the currently used Basic Indicator Approach. The issuance of these instructions comes within the framework of implementing the post-financial crisis Basel III regulatory package issued on December 7, 2017.

Firstly,

All banks are required to use this unified approach to calculate capital requirements and cover operational risks.
The Standardized Approach addresses several weaknesses in the four approaches previously used by the Basel Committee as follows:

• Simplifying the supervisory framework, as this unified approach will replace the four approaches previously permitted by the Basel Committee for calculating the required capital to cover operational risks.

Mr. Tawfik, Governor of the Central Bank of Egypt, dated January 4, 2021. 1 Letter

• Combining all indicators related to the bank's financial position, represented in the "Business Indicator (BI)" (and the bank's historical operational losses) to calculate the required capital to cover operational risks, resulting in a framework more sensitive to risks.
• Reducing the subjectivity of calculation methods and enhancing the comparability of results between banks and different countries.

-2 Scope of Application
These instructions apply to all banks operating in the Arab Republic of Egypt and subject to the supervision of the Central Bank of Egypt as follows:

• They are assessed as a banking group, which is the entity that conducts banking activities through its economic subsidiaries as a single economic unit – regardless of legal boundaries between the bank and its subsidiaries – as a consolidated group. The banking group includes the bank and all its branches inside and outside the country and all other financial subsidiaries owned by the bank (or the bank and its related parties) with an ownership percentage exceeding 50% of shareholders' equity or any percentage that enables control over that entity. For the purposes of the aforementioned, the banking group is assessed as a consolidated group. As for banks that do not have subsidiaries – with all their branches inside and outside the country – and banks that are subsidiaries of foreign banks, they are assessed individually.

Second: Definitions

• Operational Risks
  Are the risks to which a bank may be exposed due to deficiencies in its internal supervisory system or internal operational system, or failure and incompetence of employees and human resources in performing their duties with efficiency, or delays in electronic operational systems, or due to external events and incidents, including forgery and fraud. This definition includes legal risks and excludes strategic risks and reputational risks.

• Legal/Compliance Risks
  Applicable to banks
  Are the risks resulting from lawsuits, penalties, and sanctions imposed in case of failure to comply with contractual and legal obligations or failure to comply with supervisory instructions, or due to their implementation in a manner inconsistent with the text or spirit of those texts, which do not reflect the rights and contractual obligations of the bank and/or the counterparty clearly and correctly.

• Business Indicator (BI)
  Is a simple indicator for calculating operational risks, calculated based on the bank's financial position data (balance sheet) and consists of three components: Net Interest Income, Leasing and Financial Leasing Revenues, and Distributed Profits (ILDC) and Financial Shock Component (FC) and Service Component (SC).

• Weighted Business Indicator Component (BIC)
  Is the product of the Business Indicator (BI) in the supervisory coefficient (α), which is determined based on the size of the bank's activity, which reflects the Business Indicator.

• Loss Component (LC)
  Is the average net value of losses resulting from operational risks over 10 years or a minimum of 5 previous years, multiplied by 15 times (which represents a fixed coefficient determined by the Basel Committee).

• Internal Loss Multiplier (ILM)
  Is a weighting coefficient based on the relative relationship between the bank's average historical operational losses and the Weighted Business Indicator Component, used to monitor the bank's historical operational losses over a specific period.

• Aggregated Losses
  Are a group of losses resulting from a single operational event, which are added together on the date of loss calculation and treated as a single loss.

• Deferred Losses
  Are losses resulting from operational risk events that have a significant financial impact and are recorded in suspense accounts for a specific period, and their impact has not yet been reflected in the profit and loss accounts.

• Periodic Losses
  Are negative economic losses or effects recorded in the financial statements in a specific accounting period due to events related to operational risks and affecting cash flows or financial statements for previous financial periods.

• Gross Losses
  Is the actual value of losses before any deduction of recoveries.

• Recoverable Amounts
  Are subsequent events related to the original loss event, but separated in time from the date of any incoming cash flow from a third party. Recoveries may include funds obtained from insurance companies, amounts recovered from fraudulent transactions, and funds recovered from perpetrators of fraud crimes.

• Net Losses
  Is the actual value of losses after deducting the effect of recoveries.

Third: Qualitative Requirements for Operational Risk Management:
Banks are required to adopt the qualitative requirements contained in these instructions regarding operational risks to develop and improve policies and procedures related to these risks, which include the basic principles that banks must implement (as a minimum) to achieve more effective and prudent management of operational risks, as follows:

-1 Establishing an independent department or unit for operational risk management

• The bank must establish a separate department or independent unit for operational risk management operating under the scope of the bank's risk management, with its main duties being the identification, prevention, monitoring, and mitigation of operational risks and limiting their impact.

-2 Responsibilities of the Board of Directors

• The Board of Directors must have full knowledge and understanding of the key aspects of operational risks as one of the risks with a nature different from other types of risks that need to be managed.
• Approving the general framework for operational risk management and reviewing it periodically, and ensuring that the general framework for operational risks is clear, specified, and covers all aspects related to operational risks.
• Approving policies and procedures related to operational risks, which define all aspects related to the management of operational risks.
• Ensuring the effectiveness of operational risk management.
• Ensuring that the general framework for operational risk management is subject to a comprehensive and effective internal review by the bank's internal audit department, which must be completely independent of the operational risk management department.
• Maintaining the independence of the internal audit department and ensuring that it provides accurate information on the performance and units of operational risk management to the Board of Directors or its committees.

-3 Responsibility of the Bank's Senior Management

• Senior management is responsible for implementing the general framework for operational risk management approved by the Board of Directors.

• Developing policies and procedures related to operational risks concerning all products, systems, operations, and banking systems.

• Determining and distributing authorities and procedures for different capital holders and taking necessary measures to hold holders and employees accountable.

• Ensuring that policies and procedures related to operational risks have been communicated and clarified to all employees in the work units concerned with these risks.

• Ensuring that all bank employees have the necessary expertise and technical skills to perform the duties and systems entrusted to them.

• Ensuring coordination between responsibilities in the operational risk management department and responsibilities in other main risk management departments (credit risk, market risk, liquidity risk, etc.).

• Ensuring the documentation of all procedures and policies related to operational risks, and organizational regulations related to the information technology system.

• Establishing an emergency plan to face the possibility of the bank being exposed to difficult conditions or occurring disruptions that lead to the cessation of activity for a period, as mentioned in item (8) below.

-4 Responsibility of the Operational Risk Unit/Department

• Establishing an effective framework for operational risks in terms of identification, assessment, monitoring, control, and reporting of operational risks as part of the overall risk management performance at the bank, approved by the Board of Directors, and reporting to supervisory authorities accordingly.2
• Identifying and assessing operational risks related to all current or new banking products, systems, and operations (before launching or issuing them).
• Implementing a specific system to monitor and follow up on operational risks and actual operational losses.
• Providing policies and procedures for assessing major operational risks and mitigating them, ensuring these policies and procedures are reviewed periodically.

2 The meaning of reporting to supervisory authorities is reporting to the bank's internal supervisory body (represented by the inspection and internal audit sector) or the external supervisory body (represented by the Central Bank of Egypt) in case of approving any new framework for operational risks or in case of making any modifications to the current framework.

• Preparing periodic reports containing information related to operational risks for senior management and the Board of Directors to assist them in managing operational risks, ensuring these reports include suggestions for corrective measures to be taken.
• Identifying early warning indicators that enable the identification of potential sources of operational risks and predicting the probability of exposure to losses.
• Identifying external and internal threats and potential failure in the performance of individuals, operations, and systems continuously, and immediately assessing factors that may hinder the performance of key operations, and managing risks resulting from this in light of expected operational resilience.

-5 Disclosure

• The bank must disclose its general framework for operational risk management in a manner that allows stakeholders to determine the extent of the bank's ability to identify, assess, monitor, and control operational risks.
• The bank must disclose in sufficient detail the volume of losses resulting from operational risks, allowing all market parties to assess the methods followed by the bank in managing operational risks.
• The volume of disclosed data and information related to operational risks must be commensurate with the size of the bank and its methods, systems, and general risk framework.

-6 Aggregation of Loss Data Related to Operational Risks

• All banks must classify actual losses resulting from operational risks according to the following events, in light of the standard table in Annex No. (3).
  1/6 Internal fraud.
  2/6 External fraud.
  3/6 Fraud involving payment cards.
  4/6 Violation of labor laws, safety, occupational health, and violation of supervisory instructions.
  5/6 Practices resulting in damage to the bank's customers.
  6/6 Damage to physical assets.
  7/6 Business disruption and system failure.
  8/6 Execution, delivery, and process management.

-7 Methods of Measuring Operational Risks

• Banks must commit to using the new Standardized Approach for calculating operational risks as a supervisory method for calculating the required capital to cover these risks for the purpose of issuing the capital adequacy standard (Firstly).
• Banks may use other methods for calculating operational risks for the purpose of internal risk management.

-8 Emergency Plan / Business Continuity Plans

• The bank must have a written, documented, and approved emergency plan, to ensure the bank's ability to work continuously and mitigate losses in case of stopping operations.
• Emergency plans must be periodically reviewed by individuals independent of those responsible for establishing and managing these plans, and their reports must be submitted to senior management and the Board of Directors for review.
• The plan must include at least the following:
• Definition of disasters, crises, and appropriate methods to limit their effects in case of occurrence.
• Identification of key functions and operations that include business continuity.
• Definition of decision-making procedures and how to adhere to them.
• Identification of a manager responsible for the business continuity plan.
• Identification of work priorities and decision-making procedures for each key development, and key/alternative emergency procedures and system locations.
• Conducting periodic tests for the business continuity plan in light of a group of accepted hypothetical scenarios to test the bank's ability to perform its basic operations under emergency and non-normal conditions, and to ensure the validity of the established plan and inform all employees of it.

-9 Management of Service Providers and External Outsourcing Entities – Commitment

• At least the following must be included in the policy of outsourcing external services:

• That it is done under a written contract – subject to legal review – between the external service provider and the bank.

• Establishing appropriate criteria to determine the external service provider's ability to perform duties with the required efficiency and adhere to contractual obligations.

• Including what is stipulated in the governance instructions regarding conflict of interest.

• The bank must include in its contract with external service providers the following:

• Quality of service performance contracted for and adherence to agreed standards and procedures in case of emergencies.

• Commitment of the service provider to ensure full confidentiality of information regarding the bank and customers.

• The ability to terminate the contract with the service provider from the bank's side if necessary, such as obtaining commitments without requiring any financial commitment from the bank, with the importance of having alternatives that guarantee the continuity of service provision to customers through a business continuity plan.

• The service provider's commitment not to make any changes to the outsourced services without obtaining the bank's prior consent.

• Adherence to procedures specified by the bank regarding the supervision of outsourced services, including periodic reporting to the bank's management regarding their performance level.

• Commitment of the service provider, from the contracts signed with the bank's counterparties, to provide information related to the services outsourced to them and in accordance with disclosure and information transparency provisions.

• Commitment of the service provider, from the contracts signed with the bank's counterparties, to inform the bank of any events that may have a significant impact on the counterparties' ability to perform the duties entrusted to them with the required efficiency.

• Commitment of the service provider, from the contracts signed with the Central Bank of Egypt – if required from them – to provide information related to the outsourced duties, including field inspection.

• The bank must manage the duties and services provided by external parties that are directly related to the bank's basic and vital duties.

-10 Governance
3 Banks must utilize their governance structure to establish, monitor, and implement effective methods for operational resilience in a manner that enables response, treatment, and recovery from catastrophic events and extracting lessons learned to mitigate their negative impact on the performance of basic and vital duties during such events.

Operational Resilience: Is the bank's ability to maintain basic and vital operations during periods of disruption. It enables the identification and protection of potential threats and failures, response and adaptation, recovery, and learning from external events to mitigate their impact on continuing basic and vital operations. The bank must also consider the risks it faces comprehensively and its maximum capacity to bear risks and its general risk framework.

-11 Mapping Interconnections and Interdependencies Once the bank identifies its basic and vital duties, it must map the interconnections and interdependencies inside and outside the bank, whether at the level of employees, information systems, or operational processes, to identify the operational resilience required to implement its basic and vital processes.

-12 Incident Management
The bank must establish, develop, and implement incident recovery plans that may disrupt the execution of its basic and vital duties. These plans must be consistent with its ability to bear risks and its general framework continuously based on its risks. They must also be developed to extract lessons learned from previous incidents.

-13 Information Technology, Communications, and Cybersecurity The bank must ensure the strength of its information technology, communications, and cybersecurity systems and that they are subject to protection programs and repair any deficiencies that occur, and that they are tested periodically and regularly to ensure the provision of information to users at the appropriate time to maintain continuity and mitigate the performance of the bank's basic and vital processes.

-14 Supervisory Reports and Data

• The bank is committed to annual reporting to the Central Bank of Egypt regarding actual loss events related to operational risks according to the loss data aggregation matrix (Annex No. 2) and according to the definitions and illustrative examples contained in Annex No. (3).
• Losses related to operational risks exceeding 50,000 Egyptian pounds are reported, except for losses related to payment card fraud, which becomes a minimum threshold of 1,000 Egyptian pounds.
• The bank is committed to providing a detailed report of operational loss events reaching one million Egyptian pounds or more, which is called a detailed event report, including its causes and the corrective measures taken by the bank (Annex No. 4).

Fourth: Quantitative Requirements to Face Operational Risks – The Standardized Approach (SA) Banks must use the Standardized Approach to calculate capital requirements to cover operational risks, replacing the Basic Indicator Approach, Firstly, from Basel standards (the minimum regulatory capital requirement), as the Standardized Approach is one of the components of the Basel 3 regulatory package framework, based on two main pillars: the bank's revenue level and operational expenses, and the volume of historical operational losses related to the bank, assuming a direct relationship between these two elements and the volume of operational risks.

The calculation of capital requirements to cover operational risks under the Standardized Approach depends on the following:
a. Business Indicator (BI-Indicator Business): An indicator for calculating operational risks calculated based on the bank's financial statements. b. Weighted Business Indicator Component (Business Indicator Component - BIC): Calculated as the product of the Business Indicator (BI) by a group of supervisory coefficients (αi), which are determined based on the size of the bank's activity, which reflects the Business Indicator.
c. Internal Loss Multiplier (ILM - Multiplier Loss Internal): A weighting coefficient used to calculate the bank's sensitivity to operational risks, based on the relative relationship between the bank's average historical operational losses and the Weighted Business Indicator Component (BIC).

The minimum capital requirement to cover operational risks (Capital Risk Operational - ORC) is calculated from the product of the Weighted Business Indicator Component (BIC) and the Internal Loss Multiplier (ILM).

a. Business Indicator Index
The Business Indicator (BI) consists of three components:

• Interest, Leases, and Dividend Component (ILDC)
• Service Component (SC)
• Financial Component (FC)

Accordingly, the Business Indicator (BI) is calculated using the following equation Each component of the Business Indicator index is calculated Based on the average of the previous three years For the items of these elements according to the following equations:

1. Interest, Leases, and Dividend Component:
   = [Average of the absolute value of Net Interest Income from Interest and Leasing Revenues or Average of Interest-bearing Assets * 2.25%] whichever is less + Average of Distributed Profits.

2. Service Component:
   = [Average of Other Operating Revenues or Average of Other Operating Expenses] whichever is greater + [Average of Contracting Revenues or Average of Contracting Expenses] whichever is greater.

3. Financial Component:
   = (Average of the absolute value of Net Income from the Trading Portfolio) + (Average of the absolute value of Net Income from the Non-Trading Portfolio).

Taking into account including the results of assets related to acquisition or merger operations, and excluding the results of assets for subsidiaries of the bank that have been divested or sold.
The absolute value of the item is calculated for each year separately, then the average value is calculated for three years.

Business Indicator (BI) = Interest, Leases, and Dividend Component (ILDC) + Service Component (SC) + Financial Component (FC)

b. Weighted Business Indicator Component
The Weighted Business Indicator Component is calculated from the product of the average value of the Business Indicator over the previous three years in the supervisory weighting coefficient αi, according to the following equation:
BIC = ∑(αi × BIi)
The value of the supervisory weighting coefficient αi is determined based on the average value of the Business Indicator over the previous three years, which is divided into three groups according to the following table:

Group First Group Second Group Third
Average value of Business Indicator (Value in Egyptian Pounds) Less than or equal to 2 billion pounds Greater than 2 billion pounds up to 7 billion pounds Greater than 7 billion pounds Supervisory weighting coefficient αi 12% 15% 18%

Example: Assuming the average value of the Business Indicator at the bank reached 16 billion pounds Thus, the Weighted Business Indicator Component = (1.62 + 0.75 + 0.24) = 2.61 billion pounds 2 billion pounds × 0.24 = 12% 2-7 = 5 billion pounds × 0.75 = 15% 7-16 = 9 billion pounds × 18% = 1.62 billion pounds

c. Internal Loss Multiplier (ILM)
The application of the new Standardized Approach (SA) to calculate capital requirements to cover operational risks is considered a significant step forward in improving the measurement of the sensitivity of operational risks at banks, by combining the Weighted Business Indicator Component (BIC), which reflects the size of the bank's activity, and the Internal Loss Multiplier (ILM), which is calculated from the relative relationship between the bank's average historical operational losses and the Weighted Business Indicator Component (BIC).

The Loss Component (LC) represents the average net value of losses resulting from operational risks over 10 years or a minimum of 5 previous years, multiplied by 15 times (which represents a fixed coefficient determined by the Basel Committee).

After deducting the value of recoveries.

The Internal Loss Multiplier (ILM) is calculated by combining the Loss Component (LC) with the Weighted Business Indicator Component (BIC) using the following equation:
ILM = Ln (exp(1) - 1 + (LC / BIC)^0.8)

By applying the previous equation, one of the following results for the Internal Loss Multiplier can be obtained:

1. Internal Loss Multiplier = 1, when the Loss Component equals the Weighted Business Indicator Component.
2. Internal Loss Multiplier < 1, when the Loss Component is greater than the Weighted Business Indicator Component.
3. Internal Loss Multiplier < 1, when the Loss Component is smaller than the Weighted Business Indicator Component.

Whatever the value of the Loss Component (LC), the Internal Loss Multiplier will not exceed 0.541, according to the part of the equation (-1) exp (Ln, which means that if the bank has no operational losses, the Internal Loss Multiplier will equal 0.541. Thus, in this case, the required capital to cover operational risks will equal half the value of the Weighted Business Indicator Component.

This means that a bank with losses related to operational risks exceeding the average value of the Weighted Business Indicator Component will have deficiencies in its internal supervisory system or in the management of operational risks, and thus it is required to hold higher capital sufficient to cover these risks, while a bank with operational losses lower than the Weighted Business Indicator Component is required to hold less capital commensurate with the limited volume of those risks.

Calculation of Capital Requirements to Cover Operational Risks (ORC - Capital Risk Operational) The capital requirement to cover operational risks is determined as the product of the Weighted Business Indicator Component (BIC) and the Internal Loss Multiplier (ILM). ORC = BIC * ILM

Risk-Weighted Assets related to operational risks are calculated by multiplying the capital requirement for operational risks by 8 times to be included in the capital adequacy standard ratio according to the following equation:
Risk-Weighted Assets for Operational Risks = Capital Requirement for Operational Risks * 8

Conditions to be Met to Allow Including Loss Data in the Equation for Calculating Capital Requirements to Cover Operational Risks -1 The average of losses must be calculated over 10 previous years (or a minimum of 5 years) from the bank's specific loss data to ensure the quality of this data. -2 Banks that have data covering more than 10 previous years are allowed to rely on 5 years as a minimum for calculating the Loss Component as an interim stage until this data meets all the required standards for aggregating internal loss data contained in these instructions. -3 The Central Bank may require the bank to calculate the capital requirement to cover operational risks using internal loss data for less than 10 years if the Internal Loss Multiplier at the bank is greater than 1, and if the bank's losses reflect exposure to a high level of operational risks. -4 Banks whose average value of the Business Indicator exceeds 7 billion pounds must include loss data as a basic component in calculating the capital requirement to cover operational risks. -5 For banks whose average value of the Business Indicator is less than or equal to 7 billion pounds, internal loss data is adopted for those banks when calculating capital requirements - meaning that the Internal Loss Multiplier (ILM) equals 1, and thus the capital requirement equals the Weighted Business Indicator Component (BIC) - and in accordance with the need to aggregate it according to

Fifth: Standards to be Met for Aggregating Internal Loss Data The process of aggregating and processing internal loss data correctly is a basic requirement included in the framework of the Standardized Approach to calculate capital requirements to cover operational risks, and the process of aggregating and processing internal loss data must meet the following standards:
A- General Standards:

1. Documentation of procedures for aggregating historical loss data
   The bank must document the procedures and processes for identifying, aggregating, and processing internal loss data, so that these procedures and processes are not deviated from before including loss data from the perspective of measuring capital requirements to cover operational risks, in addition to reviewing them periodically and continuously by the internal audit department and/or external auditor.
2. Aggregation of data according to supervisory classifications - First Level
   Banks must continue to issue a matrix

The meaning of reporting to supervisory authorities is reporting to the bank's internal supervisory body (represented by the inspection and internal audit sector) or the external supervisory body (represented by the Central Bank of Egypt) in case of approving any new framework for operational risks or in case of making any modifications to the current framework.

Banks must utilize their governance structure to establish, monitor, and implement effective methods for operational resilience in a manner that enables response, treatment, and recovery from catastrophic events and extracting lessons learned to mitigate their negative impact on the performance of basic and vital duties during such events.

The Business Indicator (BI) consists of three components:

• Interest, Leases, and Dividend Component (ILDC)
• Service Component (SC)
• Financial Component (FC)

Taking into account including the results of assets related to acquisition or merger operations, and excluding the results of assets for subsidiaries of the bank that have been divested or sold.

The absolute value of the item is calculated for each year separately, then the average value is calculated for three years.

After deducting the value of recoveries.

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 39,416-character original (61% of the document). The remainder was not translated. The complete original-language text is stored with this document.]