OSFI published two documents to consult on the management of operational risk capital data for institutions required, or for those applying, to use the Basel III standardized approach for operational risk capital in Canada. The documents set out data maintenance expectations for institutions using the standardized approach for operational risk data and an assessment tool for the operational risk capital data. OSFI also proposed to rescind the existing governance and data maintenance implementation notes for the standardized approach/advanced measurement approach institutions as well as the self-assessment template on implementation of the revised Capital Adequacy Requirements (CAR) guideline in 2023. These would be replaced by the aforementioned proposed data maintenance expectations and the related assessment tool. The comment period for this consultation ends on July 30, 2021.
The document on data maintenance expectations outlines data management principles that OSFI expects institutions using the standardized approach to adhere to, which include the BCBS principles for effective risk data integration and risk data reporting. These principles include governance, data architecture and IT infrastructure, accuracy and integrity, completeness, timeliness, adaptability, accuracy, comprehensiveness, clarity and usefulness, frequency, and distribution. In addition, OSFI expects that data used in the calculation of operational risk capital institutions will have:
- Documentation outlining the end-to-end systems and data flows, including key controls for critical failure points, to support the data management processes required to calculate operational risk capital
- Established policies and documented procedures for the storage, retention, and archiving, including, where applicable, the procedures for logical/physical deletion of loss data and destruction of data storage media and peripherals
- Processes to maintain backups of relevant data files/stores and databases in a manner that can facilitate ready retrieval in the event of information calls on the institutions’ compliance and ongoing supervisory assessments
- Processes to ensure that the electronic versions of all relevant data are accessible in a format that provides flexibility to enable searching, aggregation and reporting
These criteria should be used in assessing, both initially and on an ongoing basis, an institution’s data used in the calculation of operational risk capital. OSFI will consider the institution’s risk profile and complexity when assessing its compliance with these criteria. Additional details on the OSFI expectations can be found in the assessment tool. The assessment tool summarizes the detailed expectations based on Chapter 3 of the draft CAR guideline, Aggregation and Risk Reporting (RDARR) principles, and the data maintenance expectations. Together, the data maintenance expectations and assessment tool aim to ensure that institutions effectively manage the current and historical operational risk capital data.
In this context, OSFI has reviewed the existing implementation notes and self-assessment templates for institutions using standardized approach/advanced measurement approach, in light of the new requirements for the Basel III standardized approach. The regulator found that many of the qualifying requirements for standardized approach/advanced measurement approach (for example: scenario analysis, external data, business environment, and internal control factors) are not part of the new standardized approach, which uses internal operational loss data as a direct input as part of the capital charge calculation. Moreover, many of the operational risk management expectations found in the implementation notes have been updated and incorporated into other Basel standards as well as OSFI guidance (for example, Guideline E-21 on operational risk management and the corporate governance guideline). Thus, OSFI is proposing to rescind the existing governance and data maintenance implementation notes for the standardized approach/advanced measurement approach institutions as well as the self-assessment template, upon implementation of the revised Capital Adequacy Requirements guideline in 2023.
Comment Due Date: July 30, 2021
Keywords: Americas, Canada, Banking, Operational Risk, CAR Guideline, Standardized Approach, Reporting, Basel, Regulatory Capital, Data Assessment Tool, OSFI
Previous ArticleNGFS on Addressing Financial Stability Issues from Biodiversity Loss
The European Banking Authority (EBA) published four draft principles to support supervisory efforts in assessing the representativeness of COVID-19-impacted data for banks using the internal ratings based (IRB) credit risk models.
The European Council and the European Parliament (EP) reached a provisional political agreement on the Corporate Sustainability Reporting Directive (CSRD).
The Prudential Regulation Authority (PRA) launched a consultation (CP6/22) that sets out proposal for a new Supervisory Statement on expectations for management of model risk by banks.
The European Commission (EC) published the Delegated Regulation 2022/954, which amends regulatory technical standards on specification of the calculation of specific and general credit risk adjustments.
The Bank for International Settlements (BIS) Innovation Hub updated its work program, announcing a set of projects across various centers.
The European Insurance and Occupational Pensions Authority (EIOPA) published two consultation papers—one on the supervisory statement on exclusions related to systemic events and the other on the supervisory statement on the management of non-affirmative cyber exposures.
Certain members of the U.S. Senate Committee on Banking, Housing, and Urban Affairs issued a letter to the Securities and Exchange Commission (SEC)
The European Insurance and Occupational Pensions Authority (EIOPA) published a consultation paper on the advice on the review of the securitization prudential framework in Solvency II.
The Bank for International Settlements (BIS) published bulletins on lending in decentralized finance (DeFi) system, on blockchain scalability and fragmentation of crypto, and on extractable value and market manipulation in crypto and decentralized finance.
The Prudential Regulation Authority (PRA) issued a statement on PRA buffer adjustment while the Bank of England (BoE) published a notice on the statistical reporting requirements for banks.