Operational risk capital in practice · RiskAtoms Academy

By the end you will be able to

1State the loss data standards behind the loss component: ten years, the threshold, the accounting date, net losses and boundary events.
2Decide whether a loss may be excluded, and how a disposal or an acquisition changes the BI and the losses.
3Measure what four choices about the data do to RiskAtoms Bank's capital under Basel and in the UK, and explain why only one matters in the UK.
4Describe in outline how supervisors set Pillar 2 capital for operational risk, using losses and scenarios.

Why it matters

In the UK the internal loss multiplier is 1 from 2027, so RiskAtoms Bank's losses no longer move its Pillar 1 capital. Yet it must keep ten years of them, event by event, above £20,000. Under Basel those records decide capital, and four choices about them, each one a rule in OPE25, move the bank's RWA by between £73m and £669m. In the UK they feed the supervisor's view in Pillar 2 instead.

Core explanation

The rules behind the loss component

Illustrative dataRiskAtoms Bank plc's capital book

The same made-up UK bank as Level 3: £67bn of assets and £4bn of equity at 31 December 2025, in £ millions. Module 4.1 adds its regulatory layer: own funds, deductions, risk-weighted assets by risk type, buffers, the leverage exposure and MREL, computed from the Level 3 credit, trading, derivatives and operational risk books. Every figure is illustrative, not any bank's data.

Pro forma. The book applies Basel 3.1, the 2017 finalisation of Basel III, to the 31 December 2025 balance sheet. On that date the bank still reported under the old UK CRR. The UK applies Basel 3.1 from 1 January 2027, and the internal model approach for market risk from 1 January 2028 (PRA PS1/26, paras 1.23 and 1.24). So the book shows the bank as it would look under the new rules.

Operational risk in Module 4.4. The data is the Level 3 operational risk book (M3.7: Operational and non-financial risk): three years of business indicator items (2023 to 2025, with 2025 tied to the bank's net interest income in Module 3.6) and ten years of internal loss events (2016 to 2025), every one invented. L4.1.04: Risk-weighted assets uses the UK rule, where the internal loss multiplier is 1, so operational risk RWA is £3,322.7m. Under the Basel standard the same book gives £3,631.1m. Nothing in the book has been changed; anything a lesson adds to it, such as a disposal, is labelled as an assumption.

Added in this lesson. An illustrative sale of the bank's wealth management business, which earned fees of £40m, £42m, £45m in 2023 to 2025 and paid £8m a year in fees. It is an assumption, not in the book.

The loss data standards

L3.7.03: Loss data showed how the bank collects its losses. For the loss component the loss data set must meet the standards of OPE25.14 to 25.29. A bank that does not meet them holds at least its BIC, and its supervisor may ask for more (OPE25.13).

Standard	Basel	RiskAtoms Bank
History	Ten years; five only during transition, or by exception (OPE25.10, 25.15)	Ten accounting years, 2016 to 2025
Threshold	€20,000; €100,000 at national discretion for buckets 2 and 3 (OPE25.18)	Collects from £10,000; the data set uses £20,000 gross
Dates	Occurrence, discovery and accounting; the data set uses the accounting date (OPE25.19, 25.28)	All three recorded
Amounts	Gross loss and recoveries; net counts, recoveries only once received (OPE25.24–25.26)	All recoveries treated as received by 31 December 2025
Boundaries	Credit losses in credit RWA out; market-related losses in (OPE25.20–25.21)	41 credit-boundary events out; 26 market-related in
Grouping	Losses with a common root cause are one event (OPE25.29 FAQ)	Two redress provisions, one group

Exclusions

A bank may ask its supervisor to take a loss out of the data set if it is no longer relevant to its risk profile (OPE25.30): a settled legal case with no similar exposure left, or a business that has been sold. Exclusions should be rare and well justified. Supervisors set a materiality threshold, for example a loss above 5% of the bank's average annual losses, and a minimum time in the data set first, for example three years, which does not apply to divested activities (OPE25.32). Each exclusion is disclosed (OPE25.31).

Sort itCan the bank ask to exclude it?

Sort each loss, then check.

The redress provisions for packaged accounts the bank stopped selling years ago, booked in 2018 and 2019
Losses of the wealth management business sold this year
A loss from moving its loans off a discontinued benchmark interest rate
A £5m fraud on a lending product withdrawn last year, booked last year
The card processor outage of 2022, with the same processor still in use
A £15,000 payment error
A mortgage fraud loss already in credit risk RWA

Disposals and acquisitions

The BI moves with the business. A bank may ask to take a divested activity out of its BI (OPE25.33). An acquired business comes in at once, with three years of its BI and ten years of its losses (OPE25.34). Both take effect from the first RWA calculation after the approval or the deal (the FAQs to OPE25.33 and 25.34).

Pillar 2

Pillar 1 is a formula; supervisors also look at each bank's own risk. In the UK the PRA sets Pillar 2A for operational risk from the bank's own assessment, supervisory judgement and peer comparison. It treats conduct risk separately, and for the rest it uses three benchmarks: the bank's forecast losses taken out to a 1-in-1,000-year level, its largest losses by event type over five years, and its scenarios fitted to a fat-tailed distribution (the PRA's statement of policy on Pillar 2 methods, October 2025). In PS15/26 (May 2026) the PRA kept that methodology for 2027 and confirmed it will adjust Pillar 2A for operational risk mechanically for the Basel 3.1 change in Pillar 1, so that most firms' total operational risk requirement stays the same. That is where the loss data and the scenarios of L3.7.06: Scenario analysis still matter. The full Pillar 2 process is in M4.9: Supervision, stress testing and disclosure.

What each input tells the supervisor

The formal version

With the loss component and multiplier of L4.4.05: Operational risk: the standardised approach, the data rules decide what goes into the sum (OPE25.8–25.10, 25.15, 25.18, 25.30–25.34):

\begin{aligned} \text{LC} &= 15 \times \frac{1}{T} \sum_{y \in W} \ \sum_{i \in D_y} L_i \\ D_y &= \{\, i \text{ booked in } y : L_i \ge H,\ i \notin X \,\} \\ i \in X \ &\Rightarrow\ L_i > m \times \frac{1}{T}\sum_{y \in W}\sum_{j \in D_y} L_j \\ &\qquad \text{and (held} \ge r \text{ years, or divested)} \\ \text{BI}' &= \text{BI} - \text{BI}_{\text{divested}} + \text{BI}_{\text{acquired}} \end{aligned}

$W$ is the last $T$ years, $T = 10$ (at least five in transition); $L_i$ the net loss of event $i$ , by accounting date.
$H$ is the threshold: €20,000, or €100,000 where the supervisor chooses for buckets 2 and 3; £20,000 in the UK.
$X$ is the set of approved exclusions; $m$ and $r$ are set by the supervisor (OPE25.32 gives 5% and three years as examples).
Divested and acquired BI items are three-year averages, as in the BI itself; acquired losses come in for ten years.

Try it

Switch each change on alone and read the Basel change; then combine them. Exclude the redress and use five years together and see the second switch do nothing. Watch the UK line: it moves only when the business is sold.

Try itWhich losses, which years, which business

Basel (ILM from losses)

£3,631.1m

UK and EU (ILM = 1)

£3,322.7m

Basel RWA as the bank is: £3,631.1m

Basel RWA, change£0.0m

UK RWA, change£0.0m

Loss component£356.41m

BIC£265.81m

LC / BIC1.341

ILM (Basel)1.0928

The ILM is above 1: under Basel, losses still add to the BIC. None of these switches touches UK Pillar 1 capital, where the ILM is 1.

Illustrative data, £ millions. The €100,000 threshold is £86,957 at the capital book's exchange rate, applied to the gross loss as the book does. The sale removes the wealth management fees from the BI and its losses from all ten years, both with supervisory approval.

Worked example

Four choices about the same data

£ millions. Basel figures use the PRA's sterling buckets, as the book does, so the base is £3,631.12m under Basel and £3,322.66m in the UK.

From the base to four what-ifs

Step 1 of 7

1
The base
$\text{LC} = 356.41, \quad \text{ILM} = 1.0928, \quad \text{RWA}_{\text{Basel}} = \text{£}3{,}631.12\text{m}$

Regulatory lens

The loss data standards are OPE25.10 to 25.35. Statements on jurisdictions are as at 3 November 2026 as at 3 Nov 2026.

In the UK

From 1 January 2027 the PRA's Operational Risk Part keeps the loss data rules though the ILM is one: documented collection, ten years (at least five only by exception), a £20,000 threshold and the three dates (7.1), gross loss and recoveries counted once received (7.2). Acquisitions, mergers and disposals in the three-year BI period must be included; a firm may apply for the PRA's permission to exclude them where they would bias the BI (5.5). The PRA said in CP16/22 that past losses would be weighed in its Pillar 2A methods instead, avoiding double counting with Pillar 1 (paras 8.25–8.26).

In the EU

Under CRR3, applying since 1 January 2025, institutions with a BI of €750m or more must calculate their annual operational risk loss; supervisors may waive it up to €1bn where it would be unduly burdensome (Article 316). The data set uses the accounting date and the three dates (Article 317). The threshold is a net loss of €20,000, and €100,000 for the losses disclosed under Article 446 (Article 319). Acquired businesses come into the BI for three years; divested ones may come out with permission (Article 315).

Spark Atoms

Spark AtomNet, not gross

A Basel FAQ to OPE25.18 says the threshold applies to the net loss over the ten years. The book applies it to the gross loss. On a net basis the bank's LC would be £354.55m instead of £356.41m.

Spark AtomBenchmark reform losses stay in

When banks moved off LIBOR, the Basel Committee answered whether the losses could later be excluded: they “do not fulfil the criteria for exclusion” (FAQ to OPE25.30). A loss being one-off is not the same as it being irrelevant.

Spark AtomA shorter memory can flatter

Five years of data drop the redress provisions entirely: the Basel ILM falls from 1.093 to 1.017 without asking anyone's approval. That is why ten years is the rule and five only a transitional exception.

Key takeaways

The loss component needs ten years of losses by accounting date, net of recoveries received, above €20,000 (£20,000 in the UK); banks failing the standards hold at least the BIC.
A loss can be excluded only with approval, if no longer relevant, material (for example over 5% of average losses) and held for a minimum period (for example three years), unless the business was divested.
Divested businesses may leave the BI with approval; acquired ones enter with three years of BI and ten years of losses.
On RiskAtoms Bank, excluding the redress provisions cuts Basel RWA by £669m, the €100,000 threshold by £85m, five years by £253m; in the UK only the sale moves capital (−£79.4m).
Losses and scenarios still drive Pillar 2: the PRA sets operational risk Pillar 2A from benchmarks, judgement and the bank's own assessment.

Reaction

Check what stuck

Question 1 · objective 2

A bank's average annual operational losses are £40m. Using OPE25.32's example materiality threshold, how large must a loss be before the bank may ask to exclude it, in £m?

£m

Question 2 · objective 2

Which of these losses can never be excluded from the loss data set, according to the Basel FAQ?

ALosses from benchmark rate reformBLosses from a business the bank has soldCA settled legal case with no similar exposure leftDA loss held in the data set for more than three years

Question 3 · objective 1

RiskAtoms Bank's losses of £20,000 or more booked in 2021 to 2025 add up to £93.71m. If it used only those five years, what would its loss component be, in £m?

£m

Question 4 · objective 3

In the UK from 1 January 2027, which of the four changes in this lesson lowers RiskAtoms Bank's Pillar 1 operational risk capital?

ASelling the wealth management businessBExcluding the redress provisionsCRaising the threshold to €100,000DUsing five years of data

Question 5 · objective 3

The wealth management business earned fees of £40m, £42m and £45m and paid fees of £8m a year. Before the sale, the bank's average fee income was £395m and fee expense £100m, and the larger of other operating income and expense averaged £45m. What is the services component after the sale, in £m?

£m

Glossary

Loss data set: Loss data set: the bank's record of operational loss events used for the loss component: ten years, by accounting date, events at or above the threshold, net of recoveries received.
Loss threshold: Loss threshold: the smallest loss that enters the data set: €20,000 under Basel, which supervisors may raise to €100,000 for banks in buckets 2 and 3 (OPE25.18); £20,000 in the UK.
Loss exclusion: Loss exclusion: removing a loss event from the data set, with the supervisor's approval, because it is no longer relevant to the bank's risk profile (OPE25.30).
Divested activity: Divested activity: a business the bank has sold or closed. With approval its income comes out of the BI and its losses may come out of the data set without a minimum retention period (OPE25.32–25.33).
Pillar 2A: Pillar 2A: capital a supervisor sets on top of Pillar 1 for risks Pillar 1 does not capture, or captures badly, after reviewing the bank's own assessment (the ICAAP).
Conduct risk: Conduct risk: the risk of poor outcomes for customers from how the bank behaves; the PRA uses losses under 'clients, products and business practices' as its proxy.

Deep Dives & Origins

Deep Dives

L4.9.01: Pillar 2 and the SREP: Pillar 2 and the supervisory review. Intermediate.
L3.7.06: Scenario analysis: how the bank's scenarios were built. Intermediate.

Origins

Basel Committee on Banking Supervision, OPE25: Standardised approach, paras 25.10–25.35 and FAQs, version in force from 1 January 2023, bis.org.
Prudential Regulation Authority, PRA Rulebook: Operational Risk Part, version in force from 1 January 2027, rules 5.5, 7.1 and 7.2.
Prudential Regulation Authority, CP16/22 Implementation of the Basel 3.1 standards, chapter 8, November 2022.
Prudential Regulation Authority, Statement of Policy: The PRA's methodologies for setting Pillar 2 capital, October 2025, chapter on operational risk.
Prudential Regulation Authority, PS15/26 Pillar 2A review – Phase 1, 28 May 2026, paras 3.25–3.26.
Regulation (EU) No 575/2013 as amended by Regulation (EU) 2024/1623, Articles 315, 316, 317 and 319 (consolidated text on gesetze.legal).

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.