Changes from report parliamentary committee draft to plenary report

Added4. Institutions shall also collect:

Added(a) information about the reference dates of operational risk events, including:

Added(i) the date when the operational risk event happened or first began (‘date of occurrence’), where available;

Added(ii) the date on which the institution became aware of the operational risk event (‘date of discovery’);

Added(iii) the date or dates on which an operational risk event results in a loss, or the reserve or provision against a loss, recognised in the institution’s profit and loss accounts (‘date of accounting’);

Added(b) information on any recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss events.

AddedThe level of detail of any descriptive information shall be commensurate with the size of the gross loss amount.

Added5. An institution shall not include in the loss data set operational risk events related to credit risk that are accounted for in the risk weighted exposure amount for credit risk. Operational risk events that relate to credit risk but are not accounted for in the risk weighted exposure amount for credit risk shall be included in the loss data set.

Added6. Operational risk events related to market risk shall be treated as operational risk and be included in the loss data set.

Added7. An institution shall upon request from the competent authority be able to map its historical internal loss data to the event type▌.

Added8. For the purposes of this Article, institutions shall ensure the soundness, robustness and performance of the IT systems and infrastructure necessary to maintain and update the loss data set by confirming all of the following:

Added(a) that the IT systems and infrastructure of the institution for the purposes of this Article are sound and resilient and that that soundness and resilience can be maintained on a continuous basis;

Added(b) that the institution’s IT systems and infrastructure implemented for the purpose of this Article is subject to configuration management, change management and release management processes;

Added(c) where the institution outsources parts of the maintenance of the IT systems and infrastructure implemented for the purpose of this Article, that the soundness, robustness and performance of the IT infrastructure is ensured by confirming at least the following:

Added(i) that the IT systems and infrastructure of the institution for the purpose of this Article are sound and resilient and that those features can be maintained on a continuous basis;

Added(ii) that the process for planning, creating, testing, and deploying the IT systems and infrastructure for the purpose of this Article is sound and proper with reference to project management, risk management, and governance, engineering, quality assurance and test planning, systems’ modelling and development, quality assurance in all activities, including code reviews and where appropriate, code verification, and testing, including user acceptance;

Added(iii) that the institution’s IT systems and infrastructure for the purpose of this Article is subject to configuration management, change management and release management processes;

Added(iv) that the process for planning, creating, testing, and deploying the IT systems and infrastructure and contingency plans for the purpose of this Article is approved by the institution’s management body or senior management and that the management body and senior management are periodically informed about the IT infrastructure performance for the purposes of this Article.

Added9. For the purposes of paragraph 7 of this Article, EBA is mandated to develop draft regulatory technical standards establishing a risk taxonomy on operational risk and a methodology to classify, based on that risk taxonomy on operational risk, the loss events included in the loss data set, that should comply with international standards.

AddedEBA shall submit those draft regulatory technical standards to the Commission by [OP please insert the date = 18 months after entry into force of this Regulation].

AddedPower is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Added10. For the purposes of paragraph 8, EBA shall develop guidelines explaining the technical elements necessary to ensure the soundness, robustness and performance of governance arrangements to maintain the loss data set, with a particular focus on IT systems and infrastructures.

AddedThose guidelines shall be issued in accordance with Article 16 of Regulation (EU) No 1093/2010.

Added1. For the purposes of Article 316(1), institutions shall calculate for each operational risk event a net loss as follows:

AddedNet loss = gross loss – recovery

Addedwhere:

Addedgross loss = a loss linked to an operational risk event before recoveries of any type;

Addedrecovery = one or multiple independent occurrences, related to the original operational risk event, separated in time, in which funds or inflows of economic benefits are received from a third party.

AddedInstitutions shall maintain on an ongoing basis an updated calculation of the net loss for each specific operational risk event. To that end, institutions shall update the net loss calculation based on the observed or estimated variations of the gross loss and the recovery for each of the last ten financial years. Where losses, linked to the same operational risk event, are observed during multiple financial years within that ten-year time window, the institution shall calculate and maintain updated:

Added(a) the net loss, gross loss and recovery for each of the financial years of the ten-year time window where that net loss, gross loss and recovery were recorded;

Added(b) the aggregated net loss, aggregated gross loss and aggregated recovery of all the relevant financial years of the ten-year time window.

Added2. For the purposes of paragraph 1, the following items shall be included in the gross loss computation:

Added(a) direct charges, including impairments, settlements, amounts paid to make good the damage, penalties, interest in arrears and legal fees to the institution’s profit and loss accounts and write-downs due to the operational risk event, including:

Added(i) where the operational risk event relates to market risk, the costs to unwind market positions in the recorded loss amount of the operational risk items;

Added(ii) where payments relate to failures or inadequate processes of the institution, penalties, interest charges, late-payment charges, and legal fees, and, with the exclusion of the tax amount originally due, tax;

Added(b) costs incurred as a consequence of the operational risk event, including external expenses with a direct link to the operational risk event and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event occurred;

Added(c) provisions or reserves accounted for in the profit and loss accounts against the potential operational loss impact, including those from misconduct events;

Added(d) losses stemming from operational risk events with a definitive financial impact which are temporarily booked in transitory or suspense accounts and are not yet reflected in the profit and loss accounts (‘pending losses’);

Added(e) negative economic impacts booked in a financial year and which are due to operational risk events impacting the cash flows or financial statements of previous financial years (‘timing losses’).

AddedFor the purposes of point (d), material pending losses shall be included in the loss data set within a time period commensurate with the size and age of the pending item.

AddedFor the purposes of point (e), the institution shall include in the loss data set material timing losses where those losses are due to operational risk events that span more than one financial year and give rise to legal risk. Institutions shall include in the recorded loss amount of the operational risk item of a financial year losses that are due to the correction of booking errors that occurred in a previous financial year, even where those losses do not directly affect third parties. Where there are material timing losses and the operational risk event affects directly third parties, including customers, providers and employees of the institution, the institution shall also include the official restatement of previously issued financial reports.

Added3. For the purposes of paragraph 1, the following items shall be excluded from the gross loss computation:

Added(a) costs of general maintenance of contracts on property, plant or equipment;

Added(b) internal or external expenditures to enhance the business after the operational risk losses, including upgrades, improvements, risk assessment initiatives and enhancements;

Added(c) insurance premiums.

Added4. For the purposes of paragraph 1, recoveries shall be used to reduce gross losses only where the institution has received payment. Receivables shall not be considered as recoveries.

AddedUpon request from the competent authority, the institution shall provide all the documentation needed to perform verification of payments received and factored in the calculation of the net loss of an operational risk event.

Added1. To calculate an annual operational risk loss as required by Article 316(1), institutions shall take into account from the loss data set operational risk events with a net loss, calculated in accordance with Article 318, that are equal to or above EUR 20 000.

Added2. Without prejudice to paragraph 1, and for the purposes of Article 446, institutions shall also calculate the annual operational risk loss referred to in Article 316(1), taking into account from the loss data set operational risk events with a net loss, calculated in accordance with Article 318, that are equal to or above EUR 100 000.

Added3. In case of an operational risk event that leads to losses during more than one financial year, as referred to in Article 318(1), second subparagraph, the net loss to be taken into account for the thresholds referred to in paragraph 1 and 2 shall be the aggregated net loss.

Added1. Competent authorities may permit an institution to exclude from the calculation of the institution’s annual operational risk losses exceptional operational risk events that are no longer relevant to the institution’s risk profile, where all of the following conditions are fulfilled:

Added(a) the institution can demonstrate to the satisfaction of the competent authority that the cause of the operational risk event at the origin of those operational risk losses will not occur again;

Added(b) the operational risk loss is either of the following:

Added(i) equal to or above 10 % of the institution’s average annual operational risk loss, calculated based on the threshold referred to in Article 319(1), where the operational risk loss event refers to activities that are still part of the business indicator;

Added(ii) above 0 % of the institution’s average annual operational risk loss, calculated based on the threshold referred to in Article 319(1), where the operational risk loss event refers to activities divested from the business indicator in accordance with Article 315(2);

Added(c) the operational risk loss was in the loss database for a minimum period of 1 year, unless the operational risk loss is related to activities divested from the business indicator in accordance with Article 315(2).

AddedFor the purposes of point (c), the minimum period of 1 year shall start from the date on which the operational risk event, included in the loss data set, first became greater than the materiality threshold referred to in Article 319(1).

Added2. An institution requesting the permission referred to in paragraph 1 shall provide the competent authority with documented justifications for the exclusion of an exceptional loss, including:

Added(a) a description of the operational risk event that is submitted for exclusion;

Added(b) proof that the loss from the operational risk event is above the materiality threshold for loss exclusion referred to in paragraph 1, point (b), including the date on which that operational risk event became greater than the materiality threshold;