Guidelines on Operational Risk Mitigation Techniques

22 December 2009
Level of application: AMA institutions
GUIDELINES ON OPERATIONAL RISK MITIGATION TECHNIQUES
1. Introduction
1. Institutions can employ a variety of risk transfer instruments to manage
and mitigate their operational risk. These take the form of insurance contracts and “Other Risk Transfer Mechanisms” (ORTM). The Capital Requirements Directive (CRD) allows institutions that use the AMA to recognise the mitigating effect of these instruments in their AMA capital calculations, subject to certain conditions.
2. The conditions that apply to insurance providers and contracts are set out
in Annex X, Part 3, Paragraphs 26 to 29 of the CRD1 . As for ORTM,
Annex X, Part 3, Paragraph 25 of the CRD states that the impact of ORTM
shall be recognised only if the institution can demonstrate to the satisfaction of the competent authorities that a noticeable risk mitigation effect is achieved.
3. The Guidelines on the Implementation, Validation and Assessment of AMA
and IRB Approaches (the “Validation Guidelines”), issued by CEBS in April 2006, provide only limited additional guidance on these instruments for transferring operational risk. In particular, Paragraph 578 of the Guidelines states that the supervisory authorities expect appropriate standards for the recognition of ORTM, while Paragraph 579 states that outsourced activities should not be considered to be part of ORTM.
4. The main objective of this paper is to provide more complete guidance on
the recognition of insurance within the AMA capital calculation. In particular, after addressing in Section 2 general conditions for the recognition of operational risk mitigation instruments, Section 3.1 deals with the eligibility of protection providers and the characteristics of eligible

Except where noted otherwise, all references to Articles and Annexes of the CRD are references to Directive 2006/48/EC.

products and Section 3.2 covers the issue of haircuts for uncertainty in coverage.
5. The treatment of ORTM is discussed in Section 4. For several reasons - the
most important being the relatively brief experience of institutions and supervisors with this type of protection – CEBS has decided to issue only a limited number of specific guidelines at this stage, and to refer instead, in general, to CRD requirements and CEBS guidelines for insurance, and to relevant sections of the CRD framework for credit risk mitigation (in particular, Part 1, “Eligibility”, and Part 2, “Minimum Requirements”, of
Annex VIII of the CRD). Therefore the guidelines provided on ORTM aim to
ensure convergence of supervisory practices in the area of ORTM by providing a framework which is consistent with the one for insurance products. This also adds to the legal security needed to develop ORTM for the purposes of risk management and capital alleviation within the AMA. Supervisors should bear in mind, however, that stricter conditions could be necessary for the recognition of ORTM within the AMA framework, reflecting differences in the type of protection provided by these instruments, as compared with insurance contracts, and the peculiarities of operational risk relative to credit risk.
6. Finally, institutions and supervisors should keep in mind that – depending
on how the ORTM are structured and how they are classified in the institution’s accounts – they can entail additional risks (such as credit risk and market risk) for the institution buying or selling protection and that these carry regulatory capital implications of their own.
7. CEBS will continue its dialogue with the industry on the development of
ORTM and will closely monitor their use as instruments for operational risk mitigation. As institutions and supervisors gain more knowledge and experience with the use of these instruments for risk management purposes and capital calculation and a range of best practices is identified, CEBS will supplement and/or review these guidelines, and may also recommend adjustments to the relevant regulatory requirements under the CRD framework.
2. General conditions for risk mitigation techniques
8. Annex X, Part 3, Paragraph 29 of the CRD, as amended in July 2009
through the Comitology procedure (the so-called CRD II), states that “the capital alleviation arising from the recognition of insurances and other risk transfer mechanisms shall not exceed 20% of the capital requirement for operational risk before the recognition of risk mitigation techniques”. The new provisions introduced by the CRD II will have to be applied by 31 December 2010 and in the interim supervisors should apply the 20% limit on capital alleviation to both insurance contracts and ORTM, which together should not exceed the 20% limit.
9. Paragraph 580 of the Validation Guidelines states that institutions should
review their use of insurance and ORTM and recalculate the operational risk

capital charge if the nature of the insurance or the coverage of ORTM changes significantly. If a material loss is incurred which affects the insurance coverage, or if changes in insurance or ORTM contracts create major uncertainty as to their coverage, institutions should recalculate the AMA capital requirement with an additional margin of conservatism, for example by applying haircuts in the modelling exercise. The AMA capital requirement should also be recalculated if there is a major change in the operational risk profile of the institution.
10. Paragraph 581 of the Validation Guidelines requires institutions to notify
their competent authorities of material changes in the coverage of insurance or ORTM. Supervisors will closely monitor the features of insurance products and ORTM and their impact on the coverage of operational risk.
3. Specific conditions for the use of insurance
3.1. Eligibility of providers and characteristics of the products
11. According to Annex X, Part 3, Paragraph 26 of the CRD, in order for
insurance to be recognised for capital purposes, the insurance provider must be authorised by a regulator to provide insurance contracts or re￾insurance contracts. The EU “single passport” provides an explicit mechanism for mutual recognition of EU-regulated undertakings, enabling an EU Member State to accept the authorisation granted by another EU Member State without itself having to verify that the undertaking is appropriately authorised. However, consideration should be given to recognising the risk-mitigating effect of insurance contracts provided by an undertaking authorised by a non-EU regulator if that undertaking satisfies prudential requirements that are equivalent to those applied in the EU and meets the standards set in Paragraphs 26 to 292.
12. The Basel II regulatory framework allows banks to recognise the risk￾mitigating impact of insurance if the insurer has a minimum claims paying
ability rating of A (or equivalent). However, the CRD sets a less stringent standard. Paragraph 26 requires insurers to have a “minimum claims paying ability rating by an eligible ECAI which has been determined by the competent authority to be associated with a credit quality step 3 or above under the rules for the risk weighting of exposures to credit institutions under Articles 78 to 83”. EU supervisors are governed by the CRD, and should therefore allow ratings equivalent to credit quality step 3 or better 3 , based on the long-term claims paying ability rating of the insurer.

All references to Paragraphs 26-29 in these Guidelines refer to Annex X, Part 3 of Directive 2006/48/EC. 3 This view is supported by the response of the CRD Transposition Group (CRDTG) to question n. 95, published in August 2006.

13. Paragraph 27(a) requires that insurance contracts must have an initial term
    of no less than one year. This should be interpreted as requiring the parties to contract for at least one year. The “residual term” should refer to the period remaining on the contract at a given point in time.
14. Paragraph 27(d) states “that the risk mitigation calculations must reflect
    the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of operational risk capital.” The mapping of insurance contracts to operational risk losses (or operational risk sub-categories) should be performed at a sufficiently granular level to demonstrate the relationship between the actual and potential likelihood and magnitude of operational risk losses and the level of insurance coverage. All the information sources available to the institution, including (internal and external) loss data and scenario estimates, should be used for this aim. Calculations should reflect the level of coverage, for example through the determination of a probability of coverage.
15. Paragraph 27(e) states that insurance may be recognised for capital
    purposes only if it is provided by a third-party entity, i.e. an independent entity outside the group of the institution seeking insurance protection. When making this assessment, supervisors should have a complete grasp of the institution’s group structure so as to be able to assess whether the operational risk has in fact been transferred outside the group to an entity in which neither the institution nor any other entities within its group has a relevant interest. In analysing the group structure, supervisors should consider the group definitions given by the CRD, national financial services acts, and corporate group law (where applicable). An institution should also take reasonable steps to ensure that neither it nor any of its subsidiaries is knowingly re-insuring contracts that cover operational risk events that were the object of the initial insurance arrangement entered into by the institution.
    3.2. Haircuts for uncertainty of coverage
16. Institutions that use insurance instruments to transfer operational risk
    should analyse the various factors that create uncertainty in the effectiveness of the risk transfer. They should reflect these uncertainties in their capital calculations through appropriate haircuts.
17. Haircuts should be calculated conservatively. It is up to each institution to
    determine the appropriateness of the haircuts it applies. The CRD provides little detail on how haircuts should be applied, leaving institutions with considerable discretion to develop methods that suit their structure. Supervisors should assess these haircuts carefully, balancing the discretion provided by the CRD against the need to ensure that the general intent of the rules is not circumvented4.

For example the calculation of the haircuts by simple ex-post adjustments may fail to capture the relevant uncertainties of the insurance coverage.

18. The following sub-sections introduce guidelines on haircuts for insurance
    coverage, distinguishing them on the basis of the pertinent elements of uncertainty, namely: maturity, cancellation and uncertainty of payment and mismatches in coverage. a) Maturity
19. Paragraph 27(a)5
    requires institutions with insurance contracts that have less than a year to run, to apply appropriate haircuts reflecting the declining residual term of the policy. This requirement is consistent with the required 99.9 % confidence interval over a one year period and is to be applied within each AMA capital calculation. Supervisors may waive this requirement if the institution has in place a replacement contract that provides insurance cover on equivalent terms or if the current insurance contract has an automatic renewal provision and no cancellation notice has been given6 . However, institutions and supervisors need to be cautious about assuming that institutions can renew their policies on equivalent terms, conditions, and coverage, as some risks covered by the policy may not be included when the policy is renewed 7. b) Cancellation
20. Paragraph 28(b) requires institutions to capture policy cancellation terms,
    when exercisable in less than one year, through haircuts. In some jurisdictions, national insurance regulations or national law grants insurance providers the right to cancel insurance policies. In the case of renewable policies, the renewal assumptions should also take into account the ability of the insurer to cancel the policy during the term or at the renewal date. c) Payment uncertainty and coverage mismatches
21. Paragraph 28(c) requires institutions to apply haircuts for payment
    uncertainty and for mismatches in the coverage of insurance policies.

• Payment uncertainty is the risk that the insurance provider will not
  make the payments expected by the institution in a timely fashion. This can result, for example, from disputes due to differences in the

5 As noted earlier, all references to Paragraphs 26-29 in these Guidelines refer to Annex X, Part 3 of Directive 2006/48/EC. For example, if an insurance contract for two or more years has a clause providing that the parties will negotiate a new two-or-more-year contract before the expiry of the first year, the contract revolves every year, ensuring that there is always at least one year outstanding on the contract. If, in addition the coverage of the policy does not change with renewal, a haircut need not to be applied. For example, the insurer may retain the right to increase the premium, and there is the risk that the premium may be increased to an unacceptably high level if there is a significant loss by the institution (or the industry) which prompts the insurer to revise its pricing. Furthermore, insurers may decide to cease writing business for certain types of risks, as the result of high losses or other industry or legal developments.

interpretation of contractual language, from counterparty default or from unanticipated delays in payment (for example, arising from the claims protocol or the evaluation and settlement processes). Institutions, if necessary, should consider and fully document data on insurance payouts by loss type in their loss databases and set haircuts accordingly. Supervisors should also familiarise themselves with customary claims payment delays which can often exceed one year.

• A haircut for counterparty default should be assessed on the basis of
  the credit quality of the insurance company responsible under the given contract, even if its parent institution has a better rating or the risk is transferred to a third party. Insurers with a lower claims paying ability should attract a higher haircut than insurers with a higher credit quality.
• A coverage mismatch occurs when the coverage of the insurance
  contract does not match the operational risk profile of the institution, such that the cover does not provide the desired mitigating effect and some events are not covered. In particular coverage mismatches of medium to large losses due for instance to high deductibles and limits, or to the exhaustion of policy limits, should be correctly captured and appropriately incorporated into the AMA model by making use of all the available sources (loss data and scenario estimates) and specific data analysis and simulation exercises.

4. Specific conditions for the use of ORTM
5. Paragraph 25 states that ORTM may be recognised for capital purposes only
   if the institution can demonstrate to the satisfaction of its competent authority that it achieves a noticeable risk mitigating effect. Supervisors expect buyers of ORTM protection for which capital alleviation is claimed to use such instruments for risk management, and should not accept ORTM as risk mitigants under the AMA framework if they are held or used for trading purposes. Supervisors should monitor the use of such products closely and assess the intent of the institution in purchasing such instruments when evaluating their risk mitigating effect.
6. Institutions should have experience in using ORTM products before they are
   allowed to recognise these products in their AMA capital calculations. This requirement is intended to encourage institutions to collect data from internal and external sources on the probability of coverage and the timeliness of payment for ORTM instruments. This is particularly necessary for product types or classes with novel characteristics, and is not necessarily required for every product.
7. While ORTM reduces the operational risk exposure of the protection buyer,
   it increases the risk exposure of the protection seller. It is essential that the protection seller should be financially sound, both in terms of solvency and liquidity. Supervisors should be aware of the risks assumed by sellers of ORTM protection and should consider prudential measures if a protection seller acquires significant risk exposures from other institutions. Consideration should be given also to the possibility that the seller of some

forms of ORTM protection may be subject to insurance regulation under national insurance regulations.
25. Supervisors should assess the institution’s use of ORTM in AMA capital
calculations on a case by case basis, considering the eligibility of the protection seller (regulated or unregulated entity) and the nature and characteristics of the protection provided (funded protection, securitisation, guarantee mechanism or derivatives).
26. Such assessments should be based on the relevant requirements of
Paragraphs 26 to 28 and the specific conditions set out in Section 3 of the present Guidelines. Supervisors should also take into consideration relevant sections of the requirements for recognition of credit risk mitigation in Part 1 (“Eligibility”) and Part 2 (“Minimum Requirements”) of Annex VIII of the CRD.
27. When considering these requirements and conditions, supervisors should
bear in mind that stricter qualifying criteria may be required for the eligibility of ORTM providers and the type of ORTM products for the following reasons:

• the peculiarities of operational risk relative to credit risk (e.g., absence
  of underlying assets, greater role of unexpected losses);
• the lack of an efficient, liquid, and structured market for analogous
  products which thus far have been traded outside the banking sector (e.g., catastrophe bonds, weather derivatives); and
• the difficulty in assessing the legal risk of ORTM, even when the terms
  and conditions of the contracts are clearly and carefully spelt out.