BIS published a working paper that uses a unique cross-country dataset at the loss event level to document the evolution and characteristics of the operational risk of banks. The paper highlights that better supervision is associated with lower operational losses. It also provides an estimate of losses due to cyber events, which constitute a subset of operational loss events. Cyber losses are a small fraction of total operational losses, but can account for a significant share of total operational value-at-risk.
Representing a significant portion of total bank risks, operational risks are second only to credit risks as a source of losses. Thus, measuring and understanding operational risks, including cyber risks, is critical for both banks and public authorities. The paper uses a unique cross-country dataset from ORX, which is a consortium of financial institutions. The sample contains over 700,000 operational loss events from 2002 until the end of 2017 for a group of 74 large banks with headquarters worldwide. The granularity of the dataset allowed the authors to study the evolution of operational risks through time, compute an operational and cyber value-at-risk for financial intermediaries, document the time lag between occurrence, discovery and recognition of losses, and investigate the link between operational losses, macroeconomic conditions, and regulatory characteristics.
The results of the study show that, after a spike following the Great Financial Crisis, operational losses have fallen in recent years. The spike was largely due to losses arising from improper business practices in large banks that were incurred in the run-up to the crisis but recognized only later. Operational value-at-risk can vary substantially across banks—from 6% to 12% of total gross income—depending on the method used. These numbers are consistent with the actual capital requirements, but notably smaller than the basic indicator approach. The results provide some support for the shift to the standardized approach in Basel III.
The analysis shows that it takes, on average, more than a year for operational losses to be discovered and recognized in the books. However, there is significant variation across regions and event types. For instance, improper business practices and internal fraud events take longer to be discovered. Operational losses are not independent of macroeconomic conditions and regulatory characteristics. The paper shows that credit booms and periods of excessively accommodative monetary policy are followed by larger operational losses. Furthermore, it is to be noted that a higher quality of financial regulation and supervision is also associated with lower cyber losses. Despite representing a relatively minor share of operational losses, cyber losses can account for up to a third of total operational value-at-risk.
Keywords: International, Banking, Operational Risk, Value-at-Risk, Cyber Risk, Standardized Approach, Research, BIS
Previous ArticleISDA Updates List of Derivative Instruments Subject to Margin Rules
BIS published the September issue of the Quarterly Review, which contains special features that analyze the rapid rise in equity funding for financial technology firms, the effectiveness of policy measures in response to pandemic, and the evolution of international banking.
The Basel Committee for Banking Supervision (BCBS) met in September 2021 and reviewed climate-related financial risks, discussed impact of digitalization, and welcomed efforts by the International Financial Reporting Standards (IFRS) Foundation to develop a common set of sustainability reporting standards
The Office of the Comptroller of the Currency (OCC) issued a Cease and Desist Order against MUFG Union Bank for deficiencies in technology and operational risk governance.
The European Commission (EC) published the Delegated Regulation 2021/1527 with regard to the regulatory technical standards for the contractual recognition of write down and conversion powers.
In a response to the questions posed by a member of the European Parliament, the President Christine Lagarde highlighted the commitment of the European Central Bank (ECB) to an ambitious climate-related action plan along with a roadmap, which was published in July 2021.
The Single Resolution Board (SRB) published a Communication on the application of regulatory technical standard provisions on prior permission for reducing eligible liabilities instruments as of January 01, 2022.
The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to provide guidance to authorized deposit-taking institutions on the interpretation of APS 120, the prudential standard on securitization.
The French Prudential Control and Resolution Authority (ACPR) published the corrective version of the RUBA taxonomy Version 1.0.1, which will come into force from the decree of January 31, 2022.
The European Commission (EC) announced that Nordea Bank has signed a guarantee agreement with the European Investment Bank (EIB) Group to support the sustainable transformation of businesses in the Nordics.
The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to clarify the regulatory capital treatment of investments in the overseas deposit-taking and insurance subsidiaries.