What operational risk is · RiskAtoms Academy

By the end you will be able to

1State the Basel definition of operational risk and where its edges are: legal risk in, strategic and reputational risk out.
2Place a loss in one of the seven event types, using the bank's own events and real cases.
3Tell a credit-related boundary event from a market-related one, and say which counts as operational risk.
4Read the shape of RiskAtoms Bank's ten years of losses: many small events, a few that decide everything.

Why it matters

Over ten years RiskAtoms Bank recorded 935 operational losses of £10,000 or more: £240.5m in all, £24.1m a year on average. No one chose to take any of that risk for a return. It came with running a bank: staff, systems, suppliers, customers, floods. And one event, a mis-selling redress provision, was 34% of the total on its own. Market and credit risk are risks a bank takes on purpose. Operational risk is the price of doing anything at all, and it arrives in lumps.

Core explanation

The risk of how a bank works

L2.2.05: Operational risk gave the definition and the seven event types. This module turns them into practice: how a bank records, controls, watches and measures its operational losses. Start with the edges of the definition, because most arguments in practice happen there.

Inside and outside the definition

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel adds two edges. It includes legal risk: fines, penalties and punitive damages from supervisors, and private settlements. It excludes strategic and reputational risk (L2.2.07: Strategic, reputational and model risk). Many banks now speak of non-financial risk: operational risk together with conduct (L2.3.09: Conduct risk), compliance, financial crime and model risk, all managed with the same tools. RiskAtoms Bank uses eleven such categories of its own; L3.7.02: The operational risk framework maps them to the Basel types.

Sort itOperational risk or not?

Each line is something that cost RiskAtoms Bank money, or could. Decide where it belongs.

A regulator fines the bank £26.5m for anti-money-laundering failings in onboarding business customers.
A rival launches a cheaper current account and the bank loses 5% of its customers over a year.
After the October 2025 payments outage the bank pays £18.4m in compensation, scheme charges and recovery costs.
Press coverage of the outage leads savers to move deposits elsewhere, and margin falls.
A fraud ring falsified incomes on 37 buy-to-let mortgages; the loans default and the bank loses £5.8m.
A junior trader's hidden FX options position loses £4.3m when it is found and closed out.
Bank Rate falls and net interest income drops by £263m.

The seven event types, at this bank and in the world

Every operational loss lands in one event type, by what happened, not by its cause or the department. Here are the bank's ten years by type, with its largest event in each and a well-known real case:

RiskAtoms Bank plc, operational losses booked 2016–2025 (illustrative), and real cases
Event type	Events	Net loss	Share	Largest at the bank	A real case
Internal fraud	13	£8.8m	3.7%	Rogue FX options position (£4.3m)	Barings (1995) and Société Générale (2008): unauthorised trading hidden by one trader (L2.2.05: Operational risk)
External fraud	370	£16.8m	7.0%	Business email compromise fraud (£5.1m)	Bangladesh Bank, February 2016: $81 million taken from its account at the New York Fed with bogus SWIFT payment instructions
Employment practices and workplace safety	51	£8.1m	3.4%	Equal pay settlement (£5.2m)	Discrimination, unfair dismissal and equal pay claims; injury at work
Clients, products and business practices	117	£158.3m	65.8%	Mis-selling redress: first provision (£82.0m)	UK payment protection insurance: £38.3bn of refunds and compensation from January 2011 to December 2019 (FCA)
Damage to physical assets	26	£0.9m	0.4%	Flood at an operations centre (£0.6m)	Floods, fires and storms at branches, offices and data centres
Business disruption and system failures	51	£24.9m	10.4%	31-hour payments outage (£18.4m)	TSB, April 2018: a platform migration that disrupted branch, phone, online and mobile banking for months
Execution, delivery and process management	307	£22.6m	9.4%	Early-repayment charge model error (£8.8m)	Knight Capital, 1 August 2012: faulty order-routing code sent more than 4 million orders in 45 minutes and cost more than $460 million (SEC)
All types	935	£240.5m	100%

Two types tell opposite stories. External fraud has the most events (370) but only 7% of the money: card fraud and scams, a steady cost of business. Clients, products and business practices has 117 events and 66% of the money: redress, fines and settlements, rare and large. That contrast runs through the whole module.

Boundary events: when the loss looks like credit or market risk

Some operational failures show up as a different kind of loss. The rules sort them by where the loss is already captured:

Credit-related: a mortgage fraud ring, a forged guarantee, a loan document never signed. The loss appears as a default. If it is already in credit risk capital, it stays there; the operational risk team records it, flags it and leaves it out of operational losses. The book has 41 such events, £7.3m in all.
Market-related: a rogue position, a trade booked the wrong way, a hedge left off after an error. The loss comes from a market move, but nothing about it was an authorised market risk, so it counts as operational risk. The book has 26, £5.2m in all.

The bank also records 131 near misses: a duplicate payment file stopped before release, a fraudulent change of payee caught at call-back. They cost nothing and teach a lot. L3.7.03: Loss data covers how each record is built.

The book: ten years at RiskAtoms Bank

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025, in pounds: ten years of internal loss events of £10,000 or more (2016–2025), an RCSA of 17 key risks and 29 controls, ten key risk indicators over 24 months, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

1,107 records: 935 operational losses, 131 near misses and 41 credit-boundary events. Twelve large events are written in by hand to give the history a story; the rest are drawn at random with a fixed seed.

The years run from £5.1m (2016) to £85.9m (2018), the year the first redress provision was booked. Step through the twelve named events; you will meet each of them again in a later lesson.

TimelineTwelve events that shaped the bank's history

1 / 12

2017-10

Rogue FX options position (£4.3m net)

Unauthorised FX options position hidden by a junior trader, closed out at a loss.

Internal fraud · Fraud · occurred 2017-08-01, discovered 2017-10-12, booked 2017-10-31 · market-related: counted as operational risk.

The formal version

The definition, word by word

Basel Framework, OPE10.1

“Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.” A footnote adds that legal risk includes, but is not limited to, fines, penalties or punitive damages resulting from supervisory actions, as well as private settlements.

Read as a test, a loss is operational if it passes four questions in turn:

Is there a loss? A charge, write-down, refund, provision or settlement, including external legal fees and repair costs (OPE25.26). Insurance premiums and money spent improving things afterwards are excluded (OPE25.27), and lost income is not a charge at all. No loss: at most a near miss.
Did a process, a person, a system or an external event fail? If the firm simply chose a strategy or took a market or credit position that went wrong, it is not operational.
Is it already in credit risk capital? Then it is a credit-related boundary event: the bank records and flags it, but it is left out of the loss data set (OPE25.20). Market-related losses stay in (OPE25.21).
What happened? That picks one of the seven types (OPE25.17, Table 2). The cause, such as a cyber attack, is recorded separately.

Try it

Cut the ten years by event type, by business line and by the bank's own categories, by money and by count. Which line of business carries most of the losses, and why does the order flip when you switch to counting events?

Try itTen years of losses, three ways

Cut by

Measure

Internal fraud

Net loss, ten years£8.82m

Share of all net loss3.7%

Events13

Average net loss per event£678,248

Largest: Unauthorised FX options position hidden by a junior trader, closed out at a loss (OL-2017-080, £4,300,000 net, booked 2017-10-31).

Illustrative book: 935 operational losses of £10,000 or more, booked 2016–2025, net of recoveries; near misses and credit-boundary events left out. Switch between money and count: the order changes completely.

Worked example

Filing the October 2025 payments outage

On 14 October 2025 a delayed database upgrade failed and the payments platform was down for 31 hours. The operational risk team must record it. Decide each answer before you open the step.

One event, filed step by step

Step 1 of 5

1
Is there a loss?
Yes: compensation to customers, payment scheme charges and the cost of recovery, £18,400,000 gross. The money spent afterwards on a better back-out process is not part of it; nor is any income lost while customers could not pay.

Regulatory lens

The definition is in the Basel Framework at OPE10.1. The standardised approach (OPE25) sets out the seven event types, the boundary rules, what counts as a gross loss and how loss data must be collected, because the bank's own losses can feed its capital through the internal loss multiplier. RiskAtoms Bank's £120m redress programme is what pushes that multiplier above 1. The capital calculation is in L3.7.07: Measuring frequency and severity and, in detail, in M4.4: Counterparty, operational and large exposures.

Spark Atoms

Spark Atom45 minutes, $460 million

On 1 August 2012 Knight Capital's router sent more than 4 million orders while trying to fill 212 customer orders, and traded more than 397 million shares in the first 45 minutes after the open. The loss was more than $460 million. The SEC found that old, unused code had been left in the system and new code was deployed to it incorrectly; Knight paid a $12 million penalty in 2013.

Spark AtomOne update, 8.5 million machines

On 19 July 2024 a faulty content update to CrowdStrike's Falcon security software crashed Windows computers around the world. Microsoft estimated that about 8.5 million devices were affected, less than 1% of all Windows machines; airlines, airports, shops and payment firms were among those hit. For each firm it was an external event at a supplier: third-party risk (L3.7.10: Third-party and outsourcing risk).

Key takeaways

Operational risk is the risk of loss from failed processes, people and systems or from external events. Legal risk is in; strategic and reputational risk are out.
Every loss is filed in one of seven event types by what happened; the cause, such as a cyber attack, is recorded alongside.
Credit-related boundary losses are recorded but left out of operational losses; market-related losses count as operational risk.
RiskAtoms Bank lost £240.5m in ten years over 935 events. External fraud has the most events; clients, products and business practices has 66% of the money.
Losses arrive in lumps: one event is 34% of ten years, and the outage was 63% of 2025.

Reaction

Check what stuck

Glossary

Operational risk: Operational risk: the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events (Basel Framework, OPE10.1). It includes legal risk and excludes strategic and reputational risk.
Legal risk: Legal risk: exposure to fines, penalties or punitive damages from supervisory actions, and to private settlements. Inside operational risk.
Non-financial risk: Non-financial risk: the umbrella many banks use for operational risk together with neighbours such as conduct, compliance, financial crime and model risk, managed with the same tools.
Event type: Event type: one of the seven Basel Level 1 categories that sort an operational loss by what happened, such as external fraud or business disruption.
Loss event: Loss event: one operational failure and the money it cost, recorded with its dates, gross loss, recoveries and net loss.
Gross and net loss: Gross loss: the loss before any recovery. Net loss is what is left after insurance and other recoveries.
Credit-related boundary event: Credit-related boundary event: an operational failure, such as a fraudulent loan application, whose loss shows up as a credit loss. If it is already in credit risk capital, it is recorded but left out of operational risk losses.
Market-related event: Market-related event: an operational failure, such as an unauthorised or mis-booked position, whose loss comes from a market move. It counts as operational risk.
Near miss: Near miss: an event that could have caused a loss but did not, recorded so the bank can learn from it.
Strategic risk: Strategic risk: the risk that the firm's choices of business, product or market turn out wrong. Outside operational risk.
Reputational risk: Reputational risk: the risk that damage to the firm's standing loses it customers, funding or value. Outside operational risk, though the event that caused it may be inside.

Deep Dives & Origins

Deep Dives

Basel Committee on Banking Supervision, Basel Framework, OPE25 Standardised approach, paragraphs 25.17 to 25.29, BIS: event types, boundary events and what goes into a loss. Intermediate.
US Securities and Exchange Commission, “SEC Charges Knight Capital With Violations of Market Access Rule”, press release 2013-222, 16 October 2013. Introductory.

Origins

Basel Committee on Banking Supervision, Basel Framework, OPE10 Definitions and application, paragraph 10.1 and footnote 1, BIS, version effective 1 January 2023.
Basel Committee on Banking Supervision, Basel Framework, OPE25 Standardised approach, BIS, version in force from 1 January 2023 (last updated 5 July 2024).
Financial Conduct Authority, “Monthly PPI refunds and compensation”, data to December 2019.
Financial Conduct Authority, “TSB fined £48.65m for operational resilience failings”, press release, 20 December 2022.
US Securities and Exchange Commission, press release 2013-222, 16 October 2013.
Fortune (Reuters), “Bangladesh Says NY Fed Responsible for Country's Missing $81 Million”, 3 May 2016.
Computer Weekly, “CrowdStrike update snafu affected 8.5 million Windows devices”, July 2024, reporting Microsoft's estimate.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.