Choosing between the Basic Indicator and Standardised Approaches for operational risk capital
Northbridge Bank is a UK retail and commercial bank with a small asset management arm. Its three-year average gross income is £400m, split as retail banking £200m, commercial banking £150m and asset management £50m. It currently calculates operational risk capital using the Basic Indicator Approach: 15% of average gross income. The board is concerned that the resulting figure is too high relative to peers and asks the CRO to examine the Standardised Approach, which the CRO estimates would produce a lower number. The bank's three-year operational losses are £21m, including a £7m remediation for a mis-sold product and a £4m payment processing outage. The regulator has emphasised operational resilience, and the bank has no internal model. Any change of approach needs supervisory approval. The CFO has suggested using any capital saving for a share buyback.
1. Calculate the capital requirement under the Basic Indicator Approach and the Standardised Approach, and explain why the figures differ.
Read the worked answer
Basic Indicator Approach Average gross income over three years = £400m. Capital = 15% × £400m = £60.0m.
Standardised Approach Using the Basel business-line betas:
- Retail banking: £200m × 12% = £24.0m
- Commercial banking: £150m × 15% = £22.5m
- Asset management: £50m × 12% = £6.0m
- Total = £52.5m
Why they differ The TSA does not measure operational risk more accurately than the BIA; it re-weights the same gross income by business line. Retail banking and asset management carry lower betas than commercial banking, so the bank's business mix produces a lower figure. The £7.5m difference (12.5%) is a mapping outcome, not evidence that the bank's operational risk is lower.
Conditions and risks The bank must map income to business lines consistently, avoid double counting and obtain supervisory permission. A mapping that moved commercial income into retail to lower the charge would understate capital and be a regulatory breach. The bank must also check whether the gross income definition and three-year averaging are applied consistently. Under the Basel 3.1 standardised approach the calculation changes again, so the saving may not be permanent. The correct conclusion is that the TSA produces a lower minimum only if the mapping is defensible and approved; it is not a free reduction in risk.
2. Advise the board whether to switch to the Standardised Approach and use the saving for a buyback.
Read the worked answer
Do not decide on the basis of the minimum capital calculation alone. The board is comparing £60m with £52.5m and treating the difference as excess capital. That is the wrong test. Minimum operational risk capital is one input to the firm's overall capital adequacy, alongside credit and market risk, Pillar 2 requirements and the ICAAP/ICARA assessment. The bank has had £21m of operational losses in three years, including a £7m conduct remediation and a £4m outage. Those are symptoms of control and conduct weaknesses that capital does not fix.
Arguments for switching
- The TSA is more risk-sensitive than the BIA in the limited sense that it reflects business mix.
- It may align the bank with peers and reduce the minimum charge if the mapping is approved.
- It creates a more explicit business-line taxonomy that can support risk reporting.
Arguments against or for caution
- The saving is 12.5% and depends on supervisory approval and defensible mapping.
- The transition has costs: data, mapping, validation, governance and supervisory review.
- A buyback reduces the buffer available for conduct remediation, outage investment and stress. It also requires capital planning and supervisory engagement.
- Basel 3.1 will change the approach again, so the bank could incur transition costs twice.
Recommendation Proceed only if the mapping is robust and the regulator is engaged. Use the saving first to strengthen the control environment and operational resilience, and only consider distribution after a forward-looking capital assessment. A buyback justified by a change in calculation method, while losses are material and controls are weak, is difficult to defend to the regulator and to the board.
3. Explain the limits of regulatory capital as a measure of operational risk and what else the board should see.
Read the worked answer
Limits of capital Operational risk capital is a lagging, formula-driven buffer. Under the BIA and TSA it is based on gross income, not on the firm's actual loss experience or control quality. It does not tell the board whether the bank is well controlled, whether conduct risk is rising, or whether a severe but plausible event would exceed the buffer. Capital absorbs losses after they occur; it does not prevent them.
A bank can hold £60m of operational risk capital and still suffer a £70m conduct or cyber event. The capital number also ignores tail shape and correlation: a payment outage, a remediation and a regulatory fine can arrive together.
What the board should see alongside capital
- Operational loss data: actual losses, near misses and trends by event type and business line.
- Scenario analysis: severe but plausible events, including cyber, outsourcing failure, conduct remediation and payment outage, with estimated impacts against capital and liquidity.
- Key risk indicators: control failures, complaints, reconciliation breaks, outsourcing incidents and audit findings.
- Operational resilience testing: important business services, impact tolerances and the results of severe but plausible scenario exercises.
- The control environment: second-line testing results, overdue remediation and repeat findings.
Reasoning The board should use capital as one constraint, not as the primary measure of operational risk. The more important questions are whether the bank can continue to serve customers through disruption, whether conduct outcomes are fair, and whether known control weaknesses are being fixed. The CRO should present a dashboard that links capital, losses, scenarios and resilience, and explain where the minimum calculation is insensitive to the risks the board actually cares about.