Skip to main content
Entire section Custom print Text Only Rich Text Print

B. Qualifying Criteria for the SA and the ASA

C 52/2017 STA Effective from 1/12/2022

25.In order to qualify for use of the SA or ASA, a bank shall satisfy the Central Bank that, at a minimum:

  1. (i)Its board of directors and senior management, as appropriate, are actively involved in the oversight of the operational risk management framework;
  2. (ii)It has an operational risk management system that is conceptually sound and is implemented with integrity; and
  3. (iii)It has sufficient resources in the use of the approach in the major business lines as well as the control and audit areas.

26.The Central Bank may insist on a period of initial monitoring of a bank’s SA or ASA before it is used for regulatory capital purposes.

27.A bank shall develop specific policies and have documented criteria for mapping gross income for current business lines and activities into the standardised framework. The criteria shall be reviewed and adjusted for new or changing business activities as appropriate. These criteria shall be compliant with the principles for business line mapping that are set out above in paragraph 12.

28.Banks shall also meet the following additional criteria:

  1. (i)The bank shall have an operational risk management system with clear responsibilities assigned to an operational risk management function. The operational risk management function shall be responsible for developing strategies to identify, assess, monitor and control/mitigate operational risk; for codifying firm-level policies and procedures concerning operational risk management and controls; for the design and implementation of the firm’s operational risk assessment methodology; and for the design and implementation of a risk-reporting system for operational risk;
  2. (ii)As part of the bank’s internal operational risk assessment system, the bank shall systematically track relevant operational risk data including material losses by business line. Its operational risk assessment system shall be closely integrated into the risk management processes of the bank. Its output shall be an integral part of the process of monitoring and controlling the banks operational risk profile. For instance, this information shall play a prominent role in risk reporting, management reporting, and risk analysis. The bank shall have techniques for creating incentives to improve the management of operational risk throughout the firm;
  3. (iii)The bank shall have regular reporting of operational risk exposures, including material operational losses, to business unit management, senior management, and to the board of directors. The bank shall have procedures for taking appropriate action according to the information within the management reports;
  4. (iv)The bank’s operational risk management system shall be well documented. The bank shall have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operational risk management system, which shall include policies for the treatment of noncompliance issues;
  5. (v)The bank’s operational risk management processes and assessment system shall be subject to validation and regular independent review. These reviews shall include both the activities of the business units and of the operational risk management function; and
  6. (vi)The bank’s operational risk assessment system (including the internal validation processes) shall be subject to regular review by external auditors and/or the Central Bank.

Additional Qualifying criteria specifically for the ASA

29.Large diversified banks are not allowed to use the ASA.

30.To be permitted to use the ASA, a bank shall demonstrate to the Central Bank that it meets all the following conditions:

  1. (i)Its retail or commercial banking activities shall account for at least 90% of its income;
  2. (ii)The gross income is not a reliable operational risk exposure indicator; for instance a significant proportion of its retail or commercial banking activities comprise loans associated with a high default probability and therefore interest rate income is inflated and operational risk may be overstated; and
  3. (iii)A bank should be able to demonstrate to the Central Bank that the ASA provides a more appropriate basis than the SA for calculating its capital requirement for operational risk.

31.The Central Bank may determine additional qualifying criteria for the ASA.