CRD Operational Risk

Art. 4(1)(52) CRR defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events — including legal risk. The Basel categories cover seven event types: internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, and execution/delivery/process management. ICT risks (cyber attacks, system outages) also fall under operational risk and are additionally regulated by DORA.

The CRR currently provides three approaches: the Basic Indicator Approach (BIA, Art. 315§316 CRR) at a flat 15% of gross income, the Standardised Approach (TSA, Art. 317§320 CRR) with business-line-specific beta factors (12–18%), and the Advanced Measurement Approach (AMA, Art. 321§324 CRR) based on internal models. Under the Basel III finalisation, the new Standardized Measurement Approach (SMA) will replace all three. The SMA combines a Business Indicator Component (BIC) with an Internal Loss Multiplier (ILM) to improve comparability across institutions.

The Standardized Measurement Approach (SMA) replaces BIA, TSA, and AMA with a single unified approach. Institutions must calculate a Business Indicator from three income components (interest/leasing/dividend component, services component, financial component). Above a Business Indicator of EUR 1 billion, an Internal Loss Multiplier (ILM) based on ten years of loss history applies. For banks this means: building or improving their loss database to cover at least ten years, upgrading data quality processes, and recalculating capital requirements. Institutions currently using BIA may face higher capital charges after transition, while AMA users may see lower ones.

A CRR-compliant loss database captures all operational loss events above a defined threshold (typically EUR 10,000) and maps them to the seven Basel event categories and eight business lines. Required fields include: event date, discovery date, booking date, gross loss, recoveries, insurance proceeds, affected unit, and root-cause category. For the SMA ILM calculation, a minimum ten-year history is needed. The database should be supplemented with near-miss events and external loss data (e.g. ORX consortium). Clear collection guidelines, regular data quality reviews, and a governance process for classification and validation are essential.

Key Risk Indicators (KRIs) and Risk Control Self Assessments (RCSAs) are the core steering instruments of an OpRisk framework. KRIs are quantitative early-warning indicators — such as number of failed transactions, IT availability rate, or staff turnover in key positions — with defined thresholds (green/amber/red) and escalation processes. RCSAs are structured self-assessments where business units systematically review processes for risks and control effectiveness. Both instruments feed into scenario analysis and capital planning.

ICT risks (cyber attacks, IT outages, third-party disruptions) are a subset of operational risk. Since January 2025, DORA (Digital Operational Resilience Act) imposes additional requirements: an ICT risk management framework, incident reporting within 4/24/72 hours, regular Threat-Led Penetration Tests (TLPT), ICT third-party risk management, and a register of information on all ICT service providers. Integrating DORA into the existing OpRisk framework requires: extending the risk taxonomy with ICT-specific categories, adding IT-related KRIs, supplementing scenario analysis with cyber scenarios, and aligning incident processes between OpRisk and DORA reporting.