Commission Delegated Regulation (EU) 2018/959 of 14 March 2018 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards of the specification of the assessment methodology under which competent authorities permit institutions to use Advanced Measurement Approaches for operational risk (Text with EEA relevance.)

• (i) that, where the institution adopts robust estimators in the form of generalisations of classical estimators, with good statistical properties including high efficiency and low bias for a whole neighbourhood of the unknown underlying distribution of the data, it can demonstrate that their use does not underestimate the risk in the tail of the loss distribution;

• (j) that the institution assesses the goodness-of-fit between the data and the selected distribution by using diagnostic tools of both a graphical and a quantitative nature, which are more sensitive to the tail than to the body of the data, especially where the data are very dispersed in the tail;

• (k) that, where appropriate, including where the diagnostic tools do not lead to a clear choice for the best-fitting distribution or to mitigate the effect of the sample size and the number of estimated parameters in the goodness-of-fit tests, the institution uses evaluation methods that compare the relative performance of the loss distributions, including the Likelihood Ratio, the Akaike Information Criterion, and the Schwarz Bayesian Criterion;

• (l) that the institution has a regular cycle for controlling assumptions underlying the selected loss distributions, and that where assumptions are invalidated, including where they generate values outside established ranges, the institution has tested alternative methods and that it has properly classified any changes made to the assumptions, in accordance with Commission Delegated Regulation (EU) No 529/2014 [^ntr5-L_2018169EN.01000101-E0005].

Article 32

Determination of aggregated loss distributions and risk measures

For the purposes of assessing that an institution determines the aggregated loss distributions and risk measures in an appropriate manner, as referred to in point (e) of Article 28, competent authorities shall confirm at least the following:

• (a) that the techniques elaborated by the institution for that purpose ensure appropriate levels of precision and stability of the risk measures;

• (b) that the risk measures are supplemented with information on their level of accuracy;

• (c) that, irrespective of the techniques used to aggregate frequency and severity loss distributions, including Monte Carlo simulations, Fourier Transform-related methods, Panjer algorithm and Single Loss Approximations, the institution adopts criteria that mitigate sample and numerical related errors and provides a measure of the magnitude of these errors;

• (d) that, where Monte Carlo simulations are used, the number of steps to be performed is consistent with the shape of the distributions and with the confidence level to be achieved;

• (e) that, where the distribution of losses is heavy-tailed and measured at a high confidence level, the number of steps is sufficiently large to reduce sampling variability to an acceptable level;

• (f) that, where Fourier Transform or other numerical methods are used, algorithm stability and error propagation issues are carefully considered;

• (g) that the institution's risk measure generated by the operational risk measurement system fulfils the monotonic principle of risk, which can be seen in the generation of higher own fund requirements where the underlying risk profile increases and in the generation of lower own funds requirements where the underlying risk profile decreases;

• (h) that the institution's risk measure generated by the operational risk measurement system is realistic from a managerial and economical perspective, and more that the institution applies appropriate techniques to avoid capping the maximum single loss, unless it provides a clear objective rationale for the existence of an upper bound, and to avoid implying the non-existence of the first statistical moment of the distribution;

• (i) that the institution explicitly evaluates the robustness of the outcome of the operational risk measurement system by performing appropriate sensitivity analysis on the input data or its parameters.

SECTION 3 Expected loss and Correlation

Article 33

Expected losses

Competent authorities shall assess an institution's standards relating to expected losses, as referred to in point (a) of Article 322(2) of Regulation (EU) No 575/2013, by confirming that where the institution calculates the AMA own funds requirements only in relation to unexpected losses, it complies with at least the following requirements:

• (a) that the institution's methodology for the estimate of expected losses is consistent with the operational risk measurement system for the estimate of the AMA own funds requirements that comprises both expected losses and unexpected losses, and that the expected loss estimation process is done by operational risk category and is consistent over time;

• (b) that the institution defines the expected loss using statistics that are less influenced by extreme losses, including median and trimmed mean, especially in the case of medium- or heavy-tailed data;

• (c) that the maximum offset for expected loss applied by the institution is bound by the total expected loss and that the maximum offset for expected loss in each operational risk category is bound by the relevant expected loss calculated according to the institution's operational risk measurement system applied to that category;

• (d) that the offsets the institution allows for expected loss in each operational risk category are capital substitutes or that they are otherwise available to cover expected loss with a high degree of certainty over the one-year period;

• (e) that where the offset is something other than provisions, the institution limits the availability of the offset to those operations with highly predictable, stable and routine losses;

• (f) that the institution does not use specific reserves for exceptional operational risk loss events that have already occurred as expected loss offsets;

• (g) that the institution clearly documents how its expected loss is measured and captured, including how any expected loss offsets meet the conditions outlined in points from (a) to (f).

Article 34

Correlation

Competent authorities shall assess an institution's standards relating to correlation, as referred to in point (d) of Article 322(2) of Regulation (EU) No 575/2013, by confirming that where the institution calculates the AMA own funds requirements by recognising less than full correlation across individual operational risk estimates, it complies with at least the following requirements:

• (a) that the institution carefully considers any form of linear or non-linear dependence, relating to all the data, either to the body or to the tail, across two or more operational risk categories or within an operational risk category;

• (b) that the institution supports its correlation assumptions, to the greatest extent possible, on an appropriate combination of empirical data analysis and expert judgement;

• (c) that losses within each operational risk category are independent of each other;

• (d) that where the condition of point (c) is not met, dependent losses are aggregated together;

• (e) that, only where neither of the conditions of points (c) or (d) can be met, dependence within the operational risk categories is appropriately modelled;

• (f) that the institution carefully considers dependence between tail events;

• (g) that the institution does not base the dependence structure on Gaussian or Normal-like distributions;

• (h) that all assumptions regarding dependence used by the institution are conservative given the uncertainties relating to dependence modelling for operational risk, and that the degree of conservatism used by the institution increases as the rigour of the dependence assumptions and the reliability of the resulting own funds requirements decrease;

• (i) that the institution properly justifies the dependence assumptions it uses and that it regularly performs sensitivity analyses with the view to assessing the effect of the dependence assumptions on its AMA own funds requirements.

SECTION 4 Capital allocation mechanism

Article 35

Consistency of the operational risk measurement system

Competent authorities shall assess an institution's standards relating to the internal consistency of the operational risk measurement system, as referred to in point (e) of Article 322(2) of Regulation (EU) No 575/2013, by confirming at least the following:

• (a) that the institution's capital allocation mechanism is consistent with the institution's risk profile and with the overall design of the operational risk measurement system;

• (b) that allocation of the AMA own funds requirements takes into account potential internal differences in risk and quality of operational risk management and internal control between the parts of the group to which the AMA own funds requirements are allocated;

• (c) that there is no observable current or foreseen practical or legal impediment to the prompt transfer of own funds or repayment of liabilities;

• (d) that the allocation of the AMA own funds requirements from the consolidated group level downwards to the parts of the group involved in the operational risk measurement system relies on sound and to, the maximum extent, risk sensitive methodologies.

CHAPTER 4 INSURANCE AND OTHER RISK TRANSFER MECHANISMS

Article 36

General principles

Competent authorities shall assess an institution's compliance with the requirements relating to the impact of insurance and ORTM within an AMA, as referred to in the last sentence of point (e) of Article 322(2) and in Article 323 of Regulation (EU) No 575/2013, by confirming at least the following:

• (a) that the insurance provider meets the authorisation requirements referred to in Article 323(2) of Regulation (EU) No 575/2013, in accordance with Article 37;

• (b) that the insurance is provided via a third party, as referred to in point (e) of Article 323(3) of Regulation (EU) No 575/2013, in accordance with Article 38;

• (c) that the institution avoids the multiple counting of risk mitigation techniques, as referred to in point (e) of Article 322(2) of Regulation (EU) No 575/2013, in accordance with Article 39;

• (d) that the risk mitigation calculation appropriately reflects the insurance coverage, as referred to in point (d) of Article 323(3) of Regulation (EU) No 575/2013, and that the framework for recognising insurance is well reasoned and documented, as referred to in point (f) of Article 323(3) of that Regulation, including the following:

• (i) the insurance coverage relates to the institution's operational risk profile, in accordance with Article 40;

• (ii) the institution uses a sophisticated risk mitigation calculation, in accordance with Article 41;

• (iii) the risk mitigation calculation is aligned to the institution's operational risk profile in a timely fashion, in accordance with Article 42.

• (e) that the institution's methodology for recognising insurance captures all the relevant elements through discounts or haircuts in the amount of insurance recognition, as referred to in points (a) and (b) of Article 323(3) and in Article 323(4) of Regulation (EU) No 575/2013, in accordance with Article 43;

• (f) that the institution demonstrates that a noticeable risk mitigating effect is achieved with the introduction of the ORTM, as referred to in the second sentence of Article 323(1) of Regulation (EU) No 575/2013, in accordance with Article 44.

Article 37

Authorisation equivalence of the insurance provider

For the purposes of assessing the authorisation requirements of the insurance provider as referred to in Article 36(a), competent authorities shall consider that an undertaking authorised in a third country fulfils the requirements of authorisation, where that undertaking satisfies prudential requirements that are equivalent to those applied in the Union, including the requirements referred to in Article 323 of Regulation (EU) No 575/2013.

Article 38

Provision of the insurance via a third party

Article 39

Multiple counting of risk mitigation techniques

For the purposes of assessing that the insurance coverage for the purposes of AMA own funds requirements avoids the multiple counting of risk mitigation techniques, as referred to in Article 36(c), competent authorities shall confirm that an institution has taken reasonable steps to ensure that neither the institution nor any of the entities included in the scope of the consolidation is knowingly re-insuring contracts that cover operational risk events forming the object of the initial insurance arrangement entered into by the institution.

Article 40

Insurance risk mapping process

• (a) estimates the probability of insurance recovery and the possible timeframe for the receipt of payments by insurers, including the likelihood of a claim being litigated, the length of that process and current settlement rates and terms, based on the experience of its insurance risk management team, supported where necessary by appropriate external expertise including claims counsel, brokers and carriers;

• (b) uses the estimates resulting from point (a) to assess the performance of insurance in the event of an operational risk loss and designs this process with the view to assessing the insurance response for all relevant loss and scenario data being entered into the operational risk measurement system;

• (c) maps the insurance policies based on their assessment resulting from point (b) to the institution's own operational risks at the maximum level of detail, using all the information sources available, including internal data, external data and scenario estimates;

• (d) employs the appropriate expertise and conducts this mapping with transparency and consistency;

• (e) assigns the appropriate weight to the past and expected performance of insurance through an assessment of the components of the insurance policy;

• (f) obtains formal approval from the appropriate risk body or committee;

• (g) periodically re-examines the insurance mapping process.

Article 41

Use of a sophisticated risk mitigation calculation

For the purposes of assessing that an institution uses a sophisticated risk mitigation calculation, as referred to in point (ii) of Article 36(d), competent authorities shall confirm that the modelling approach for incorporating the insurance coverage within the AMA meets at least the following:

• (a) it is consistent with the operational risk measurement system adopted to quantify the gross-of-insurance losses;

• (b) it is transparent in its relationship with the actual likelihood and impact of losses used in the institution's overall determination of its AMA own funds requirements, and is also consistent with that relationship.

Article 42

Alignment of the risk mitigation calculation with the operational risk profile

For the purposes of assessing that the risk mitigation calculation is aligned with an institution's operational risk profile in a timely fashion, as referred to in point (iii) of Article 36(d), competent authorities shall confirm at least the following:

• (a) that the institution has reviewed the use of insurance and has recalculated the AMA own funds requirements, as appropriate, where the nature of the insurance has changed significantly or where there is a major change in the institution's operational risk profile;

• (b) where material losses are incurred, affecting the insurance coverage, that the institution recalculates the AMA own funds requirements with an additional margin of conservatism;

• (c) where there is an unexpected termination or reduction of the insurance coverage, that the institution is prepared to immediately replace the insurance policy on equivalent or improved terms, conditions and coverage, or to increase its AMA own funds requirements to a gross-of-insurance level;

• (d) that the institution calculates capital gross- and net-of-insurance, at a level of granularity such that any erosion in the amount of insurance available, including by payment of a material loss, or a change in insurance coverage, can be immediately recognised for its effect on the AMA own funds requirements.

Article 43

Capture of all the relevant elements

• (a) that the institution investigates the various factors that create the risk that the insurance provider will not make the payments as expected and decrease the effectiveness of the risk transfer, including the ability of the insurer to pay in a timely manner and the ability of the institution to identify, analyse and report the claim in a timely manner;

• (b) that the institution investigates how the various factors referred to in point (a) have affected the mitigating impact of insurance on the operational risk profile in the past and how they may affect it in the future;

• (c) that the institution reflects the uncertainties referred to in point (a) in its AMA own funds requirements, through appropriately conservative haircuts;

• (d) that the institution carefully takes into account the characteristics of the insurance policies, including whether those policies cover only losses that are claimed or notified to the insurer during the policy term, therefore any loss that is discovered after the policy expires is not covered, or whether they cover losses that are incurred during the policy term, even where they are not discovered and the claim is not lodged until after the expiration of the policy, or whether the losses are first-party direct losses or third-party liability losses;

• (e) that the institution considers and fully documents data on insurance pay-outs by loss type in its loss databases and sets haircuts accordingly;

• (f) that the institution has in place procedures for loss identification, analysis and claims processing, with the view to verifying the actual coverage protection provided by the insurer or the ability to receive the claim payment funds within a reasonable timeframe;

• (g) that the institution explicitly quantifies and models separately the haircuts in relation to each of the identified relevant uncertainties instead of applying one single haircut into the calculation covering all uncertainties or an ex post calculation haircut;

• (h) that the institution takes into account the recognition of the insurer's claims-paying ability risk to the maximum extent, by applying appropriate haircuts in the insurance modelling methodology;

• (i) that the institution ensures that the claims-paying ability risk for counterparty default is assessed on the basis of the credit quality of the insurance company responsible under the given insurance contract, irrespective of whether the insurance company's parent institution has a better rating or whether the risk is transferred to a third party;

• (j) that the institution makes conservative assumptions relating to the renewal of insurance policies on the basis of equivalent terms, conditions, and coverage as the original or existing contracts;

• (k) that the institution has processes in place to ensure that the potential exhaustion of insurance policy limits and the price and availability of reinstatements of cover as well as the cases where the coverage of the insurance contract does not match the operational risk profile of the institution are appropriately reflected in its AMA insurance methodology.

• (a) where the institution can demonstrate the existence of continuous cover on equivalent or improved terms, conditions and coverage for at least 365 days;

• (b) where the institution has in place a policy that cannot be cancelled by the insurer, other than for non-payment of premium, or which has a cancellation period of more than one year.

Article 44

Other risk transfer mechanisms

For the purposes of assessing that an institution has demonstrated that a noticeable risk mitigating effect is achieved with the introduction of ORTM, as referred to in Article 36(f), competent authorities shall apply at least the following:

• (a) confirm that the institution has experience in using ORTM instruments and their characteristics, including probability of coverage and timeliness of payment, before these instruments can be recognized in the institution's operational risk measurement system;

• (b) refuse ORTM as eligible risk mitigation instruments of the AMA own funds requirements where the ORTM are held or used for trading purposes rather than for risk management purposes;

• (c) verify the eligibility of the protection seller including whether it is a regulated or unregulated entity, and the nature and characteristics of the protection provided, whether it is funded protection, securitization, guarantee mechanism or derivatives;

• (d) confirm that outsourced activities are not considered part of ORTM;

• (e) confirm that the institution calculates the AMA own funds requirements gross- and net-of-ORTM for each capital calculation, at a level of granularity such that any erosion in the amount of protection available, can be immediately recognised for its effect on capital requirements;

• (f) confirm that where material losses are incurred, affecting the coverage provided by the ORTM or where changes in the ORTM contracts create major uncertainty as to their coverage, the institution recalculates its AMA own funds requirements with an additional margin of conservatism.

CHAPTER 5 FINAL PROVISION

Article 45

Transitional provision

With regard to the assessment of the AMA, referred to in Article 1, of an institution which, on the date of entry into force of this Regulation, is already using an AMA for the purpose of calculating its own funds requirements for operational risk, or of an institution which has already applied for a permission to use an AMA for that purpose, both of the following shall apply:

• (a) this Regulation shall apply from one year after its entry into force;

• (b) Article 34(g) shall apply from two years after its entry into force.

Article 46

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 14 March 2018.

For the Commission

The President

Jean-Claude JUNCKER

[^ntr1-L_2018169EN.01000101-E0001]: OJ L 176, 27.6.2013, p. 1.

[^ntr2-L_2018169EN.01000101-E0002]: Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

[^ntr3-L_2018169EN.01000101-E0003]: Commission Delegated Regulation (EU) 2016/101 of 26 October 2015 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for prudent valuation under Article 105(14), OJ L 21, 28.1.2016, p. 54.

[^ntr4-L_2018169EN.01000101-E0004]: Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

[^ntr5-L_2018169EN.01000101-E0005]: Commission Delegated Regulation (EC) No 529/2014 of 12 March 2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for assessing the materiality of extensions and changes of the Internal Ratings Based Approach and the Advanced Measurement Approach (OJ L 148, 20.5.2014, p. 36).