Question 6: What exposure indicator is used in the ASA approach?
In the ASA, gross income is replaced by the credit volume in terms of outstanding loans and advances (L&A) multiplied by a factor m (fixed at 0.035), as the exposure indicator for retail and commercial banking business lines. The loans and advances are non-risk weighted and gross of provisions.

Question 7: Why is the volume-based indicator alternative provided?
This volume-based indicator is provided to avoid large differences in the operational risk requirement caused by differences in income margins across banks and jurisdictions in these business lines. Gross income is not an appropriate exposure indicator of the extent of operational risk in retail and commercial lending.

Question 8: Can a bank choose to adopt ASA on its own?
No, the Central Bank must be satisfied that the alternative approach provides an improved basis for calculating the capital charge for operational risk in the bank. Reverting to the SA after adopting ASA is only possible with the approval of the Central Bank.

Question 9: What comprises Commercial Loans and Advances?
Under the ASA, commercial loans and advances will include outstanding amounts (non-risk weighted and gross of provisions) averaged over the past three years, from the following credit portfolios:

Question 10: What comprises Retail Loans?
For the purpose of the ASA, retail loans will include total outstanding amounts (non-risk weighted and gross of provisions) averaged over the past three years in the following credit portfolios:

Question 11: What is the threshold to decide a large diversified bank in terms of assets book size/composition or any other indicators?
Currently, there is no such threshold. The Central Bank will perform an assessment for each bank applying to qualify for ASA. The qualifying criteria provided in paragraph 28 of the Operational Risk section of Standards re Capital Adequacy in the UAE, especially the first one (90% income from retail/commercial banking) are stringent. The Central Bank will review whether the bank meets the 90% standard to determine whether an additional size cut-off is appropriate.

Question 12: Retail or commercial banking activities shall account for at least 90% of its income. Please clarify whether this needs to be seen in the current year or an average of all the 3 years based on which the Operational Risk capital is being computed
Testing the 90% rule across a period of three consecutive years will be more appropriate.

Question 13: "The bank's operational risk management processes and assessment system shall be subject to validation and regular independent review". Can we get clarification on the difference between the validation and the review, and what are the scope and responsible party for each?
Validation of models and tables must be performed by the internal auditor or by the external auditor.

Question 14: In terms of the "regular reporting", is an official ORM meeting required? For example, Operational Risk Business/ Country / Group Committee meetings?
It is up to the bank how it conveys the regular reports to the senior management and the board of directors, but the evidence of these reports were submitted needs to be documented for example senior management signatures on the reports.

Question 15: Is operational risk capital charge revision a quarterly activity going forward or it remains as a yearly activity at the end of the year?
Will it be more adequate if we use current years’ gross income to compute operational risk rather last year's audited numbers only.
If the quarterly income is audited, the bank should use the quarterly data, which means the same quarter in the previous two years needs to be taken into consideration or else, the yearly audited data needs to be incorporated
The standards state only audited numbers need to be used and as such, if the current year’s income is audited, it can be used as part of the computation

Question 16: Elaboration of definition and scope of Operational Risk should be helpful. For example, whether Operational Risk includes other risk types such as Fraud Risk, Business Continuity Risk etc.
The definition and scope of Operational risk is sufficiently elaborated in the Operational Risk Standard of the Capital Adequacy Standards of Banks in the UAE and the Operational Risk Guidance. If operational risks were not sufficiently covered under Pillar I, then the uncovered risk should be part of the Pillar 2 ICAAP calculation.

Question 17: As per the definition of gross income, "income derived from insurance" is to be excluded from the income while computing Operational RWA.
We would request clarification if this also refers to bancassurance i.e.Bank's commission income earned on insurance products that are sold on behalf of insurance companies."
Any income which the bank earns out of the bancassurace should be treated as income derived from insurance.