Loss data

Half of RiskAtoms Bank's operational losses are booked within 50 days of the event. Yet 73% of the money is booked more than a year after the event happened. The typical loss is £31,976; the largest is £82m. Loss data is the only hard evidence an operational risk team has, and almost every number in it depends on how it was collected.

Internal loss dataInternal loss data: the bank's own record of its operational loss events, collected above a threshold. is the bank's diary of things that went wrong. The business records each event; the second line checks it is complete (L3.7.02: The operational risk framework). Here are two records from the book:

Gross, recoveries and net

The gross lossGross loss: the loss before any recoveries. includes direct charges, write-downs, provisions, settlements and costs such as external legal fees and repairs. It leaves out lost income, insurance premiums and money spent on improvements afterwards. A recoveryRecovery: a later, separate inflow linked to the event, such as an insurance payout or funds recalled from a fraudster's bank. It counts only once received. is a later inflow linked to the event; it counts only once received. Over ten years the bank's operational losses were £259.6m gross, with £7.4m back from insurers and £11.7m from other recoveries, leaving £240.5m netNet loss: gross loss less recoveries.. 321 of the 935 events had some recovery.

The three dates

Each record carries a date of occurrenceDate of occurrence: when the event happened or, for a long-running one, began., a date of discoveryDate of discovery: when the bank found out about it. and a date of accountingDate of accounting: when the loss, reserve or provision was first booked in the profit and loss account. The Basel loss data set uses this date.. The gaps between them differ hugely by type:

Outages and floods are found the same day. External fraud is booked in about 39 days. Conduct losses take 749 days in the middle case, and the big ones far longer: the mis-sold packaged accounts were first sold in 2012, found 2,023 days later and provided for 167 days after that. Each date answers a different question. Accounting: what hit the profit and loss account this year? Occurrence: when did the control fail? Discovery: how fast do we find our failures? Dated by occurrence, £120.8m of the losses belong to 2012, before the data even starts. And recent years always look better than they are: losses that occurred in 2025 total £27.5m so far, but some have not been found yet.

Thresholds, near misses and boundary events

The bank records every loss from £10,000 gross, below the £20,000 the book uses for the loss component (Basel sets €20,000; the book keeps the round number in pounds), so it learns from small failures. The thresholdCollection threshold: the gross loss above which every event must be recorded. Basel's minimum for the loss component is €20,000; banks often collect from lower. barely changes the total: moving to £20,000 drops 27% of the events but only 1.2% of the money; at £100,000 it keeps 14% of the events and 91% of the money. Around the losses sit other records:

• 131 near missesNear miss: an event that could have caused a loss but did not. Recorded for learning; not a loss., with a potential loss the bank estimates at £54.9m in all. The 2021 Basel principles list near misses in the event data set.
• 38 rapidly recoveredRapidly recovered loss: in this book, a loss recovered in full within five working days. Recorded, net loss zero. losses (£1.47m gross), a convention of this book.
• 41 credit-boundary events (£7.3m), recorded but left out, and 26 market-related ones (£5.2m), counted in (L3.7.01: What operational risk is).
• One groupedGrouping: losses from one root cause, such as several provisions for one mis-selling programme, are linked as one event even when booked in different years. event in two records: the redress programme's first provision (£82m, 2018-02) and its top-up (£38m, 2019-07).

The shape: many small losses, a few that decide everything

A histogram (M-D02: Histograms and empirical distributions) of the 935 losses on size bands shows the problem. Each band is a few times wider than the one before, so this compares shares, not densities:

86% of the events are under £100,000 and make up 9% of the money. The 4 losses of £10m or more are 0.4% of the events and 69% of the money. That is a fat right tail (M-C08: Skewness and fat tails): the mean loss, £277,676, is 8.7 times the median. The concentration curve shows how fast the largest events take over:

The largest event is 34% of ten years' losses, the largest five 72%, the largest ten 81%. The other 925 events share what is left. This is why ten years of a bank's own data says little about the next 1-in-100-year loss, and why external data and scenarios exist.

External loss data

External loss dataExternal loss data: loss events at other firms, from a data-sharing consortium (anonymised, contributed by members) or from public reports. comes in two kinds. A consortiumLoss data consortium: banks that share anonymised loss records under a common standard so that each can see losses it has not yet had. pools anonymised records from its members under one reporting standard. ORX, which calls itself the largest operational risk association in financial services, says its global banking loss data service has more than 80 participating banks and more than a million loss events; its June 2026 report counted more than 62,000 events in 2025 alone, with gross losses above €13bn. Public data collects losses reported in the news, court records and regulators' notices. Guess each answer before you open it:

Each record's net loss is shown in full:

For the dormant-account fraud: $\text{£}7.6\text{m} - \text{£}3.0\text{m} - \text{£}0.9\text{m} = \text{£}3.7\text{m}$.

The empirical distribution (M-D02: Histograms and empirical distributions) of the $n$ gross losses $x_1, \ldots, x_n$ gives the share at or below any size:

Concentration is about the money, so from here the $x_i$ are net losses, and it needs one new piece of notation: the losses sorted from largest to smallest. Build it one step at a time:

A thin-tailed set of losses would need far more than ten events to reach 81%. With mean $\bar x$ and median $m$, a ratio $\bar x / m = 8.68$ far above 1 is the quickest sign of right skew (M-C08: Skewness and fat tails).

Rebuild the bank's ten years. Date the losses by when they were booked, happened or found; raise the collection threshold; leave out the redress programme. Which choice changes the picture most?

The capital rules use ten years of losses (L3.7.07: Measuring frequency and severity). The operational risk team builds that data set from the book, one filter at a time. Predict each count before you open the step.

Under the standardised approach, a bank's loss data can set its capital through the loss component, so OPE25.12 to 25.35 set strict rules: a €20,000 threshold (supervisors may raise it to €100,000 for larger banks), the three dates with the accounting date for the data set, gross and net loss, recoveries only once received, credit-related losses out and market-related ones in, grouping of related losses, independent review of the data, ten years of history, and yearly disclosure of the losses net of recoveries. The 2021 Basel principles add near misses and, where feasible, external data. The capital itself is in M4.4: Counterparty, operational and large exposures.

• A loss record holds three dates, the gross loss, insurance and other recoveries, the net loss, the event type, the business line, the cause and flags.
• The date decides the story: half the bank's losses are booked within 50 days, yet 73% of the money is booked over a year after the event. Basel uses the accounting date.
• Thresholds change the count far more than the money: £20,000 instead of £10,000 drops 27% of events and 1.2% of losses.
• Operational losses are fat-tailed: the mean is 8.7 times the median, the largest event is 34% of ten years and the largest ten 81%.
• External data, from a consortium or public reports, shows losses a bank has not had yet; it must be scaled and judged for relevance, and public data over-represents large events.

Internal loss data

Internal loss data: the bank's own record of its operational loss events, collected above a threshold.

External loss data

External loss data: loss events at other firms, from a data-sharing consortium (anonymised, contributed by members) or from public reports.

Loss data consortium

Loss data consortium: banks that share anonymised loss records under a common standard so that each can see losses it has not yet had.

Collection threshold

Collection threshold: the gross loss above which every event must be recorded. Basel's minimum for the loss component is €20,000; banks often collect from lower.

Date of occurrence

Date of occurrence: when the event happened or, for a long-running one, began.

Date of discovery

Date of discovery: when the bank found out about it.

Date of accounting

Date of accounting: when the loss, reserve or provision was first booked in the profit and loss account. The Basel loss data set uses this date.

Gross loss

Gross loss: the loss before any recoveries.

Recovery

Recovery: a later, separate inflow linked to the event, such as an insurance payout or funds recalled from a fraudster's bank. It counts only once received.

Net loss

Net loss: gross loss less recoveries.

Near miss

Near miss: an event that could have caused a loss but did not. Recorded for learning; not a loss.

Rapidly recovered loss

Rapidly recovered loss: in this book, a loss recovered in full within five working days. Recorded, net loss zero.

Grouping

Grouping: losses from one root cause, such as several provisions for one mis-selling programme, are linked as one event even when booked in different years.