(155)

in Part Three, Title III is replaced by the following: ‘TITLE III OWN FUNDS REQUIREMENT FOR OPERATIONAL RISK CHAPTER 1 CALCULATION OF THE OWN FUNDS REQUIREMENT FOR OPERATIONAL RISK Article 311a Definitions For the purposes of this Title, the following definitions apply: Article 312 Own funds requirement for operational risk The own funds requirement for operational risk shall be the business indicator component calculated in accordance with Article 313. Article 313 Business indicator component Institutions shall calculate their business indicator component in accordance with the following formula: where: Article 314 Business indicator 1. Institutions shall calculate their business indicator in accordance with the following formula: BI = ILDC + SC + FC where: 2. For the purposes of paragraph 1, the interest, leases and dividend component shall be calculated in accordance with the following formula: where: 3. By way of derogation from paragraph 2, an EU parent institution may, until 31 December 2027, request permission from its consolidating supervisor to calculate a separate interest, leases and dividend component for any of its specific subsidiary institutions and to add the outcome of that calculation to the interest, leases and dividend component calculated, on a consolidated basis, for the other entities of the group where all of the following conditions are met: Once granted, the permission, and its conditions, shall be reassessed by the consolidating supervisor every two years. The consolidating supervisor shall notify EBA as soon as such permission is granted, confirmed or withdrawn. By 31 December 2031, EBA shall report to the Commission on the use and appropriateness of the derogation referred to in the first subparagraph having regard, in particular, to the specific business models concerned and to the adequacy of the related own funds requirement for operational risk. On the basis of that report, and taking due account of the related internationally agreed standards developed by the BCBS, the Commission shall, where appropriate, submit to the European Parliament and to the Council a legislative proposal by 31 December 2032. 4. Until 31 December 2027 or until the consolidating supervisor grants permission in accordance with paragraph 3, whichever is earlier, an EU parent institution that has been granted permission to apply the alternative standardised approach to its business lines of retail banking and commercial banking to calculate its own funds requirement for operational risk may, after having informed its consolidating supervisor, continue to use the alternative standardised approach as set out in the version of this Regulation applicable on 8 July 2024 for the purpose of calculating the own funds requirement for operational risk relating to those two business lines and according to the scope of the existing permission. 5. For the purposes of paragraph 1, the services component shall be calculated in accordance with the following formula: SC = max(OI,OE) + max(FI,FE) where: Subject to the prior permission of the competent authority, and to the extent that the institutional protection scheme has at its disposal suitable and uniformly stipulated systems for the monitoring and classification of operational risks, institutions that are members of an institutional protection scheme meeting the requirements of Article 113(7) may calculate the services component net of any income received from, or expenses paid to, institutions that are members of the same institutional protection scheme. Any losses resulting from the related operational risks are subject to mutualisation across institutional protection scheme members. 6. For the purposes of paragraph 1, the financial component shall be calculated in accordance with the following formula: FC = TC + BC where: 7. Institutions shall not use any of the following elements in the calculation of their business indicator: 8. Where an institution has been in operation for less than three years, it shall use forward-looking business estimates in calculating the relevant components of its business indicator, subject to the satisfaction of its competent authority. The institution shall start using historical data as soon as that data are available. 9. EBA shall develop draft regulatory technical standards to specify the following: EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. 10. EBA shall develop draft implementing technical standards to specify the items of the business indicator by mapping those items with the corresponding reporting cells set out in Commission Implementing Regulation (EU) 2021/451 (*14), where appropriate. EBA shall submit those draft implementing technical standards to the Commission by 10 January 2026. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1093/2010. Article 315 Adjustments to the business indicator 1. Institutions shall include business indicator items of merged or acquired entities or activities in their business indicator calculation from the time of the merger or acquisition, as applicable, and shall cover the last three financial years. 2. Institutions may request permission from the competent authority to exclude from the business indicator amounts related to disposed entities or activities. 3. EBA shall develop draft regulatory technical standards to specify the following: EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. CHAPTER 2 DATA COLLECTION AND GOVERNANCE Article 316 Calculation of the annual operational risk loss 1. Institutions with a business indicator equal to or exceeding EUR 750 million shall calculate their annual operational risk loss as the sum of all net losses over a given financial year, calculated in accordance with Article 318(1), that are equal to or exceed the loss data thresholds set out in Article 319(1) or (2). By way of derogation from the first subparagraph, competent authorities may grant a waiver from the requirement to calculate an annual operational risk loss to institutions with a business indicator that does not exceed EUR 1 billion, provided that the institution has demonstrated to the satisfaction of the competent authority that it would be unduly burdensome for the institution to apply the first subparagraph. 2. For the purposes of paragraph 1, the relevant business indicator shall be the highest value of the business indicator that the institution has reported at the last eight reporting reference dates. An institution that has not yet reported its business indicator shall use its most recent business indicator. 3. EBA shall develop draft regulatory technical standards to specify the condition of “unduly burdensome” for the purposes of paragraph 1. EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. Article 317 Loss data set 1. Institutions that calculate an annual operational risk loss in accordance with Article 316(1) shall have in place arrangements, processes and mechanisms to establish and maintain updated on an ongoing basis a loss data set compiling for each recorded operational risk event the gross loss amounts, non-insurance recoveries, insurance recoveries, reference dates and grouped losses, including those from misconduct events. 2. The institution’s loss data set shall capture all operational risk events stemming from all entities that are part of the scope of consolidation pursuant to Part One, Title II, Chapter 2. 3. For the purpose of paragraph 1, institutions shall: 4. Institutions shall also collect: The level of detail of any descriptive information shall be commensurate with the size of the gross loss amount. 5. An institution shall not include in the loss data set operational risk events related to credit risk that are accounted for in the risk-weighted exposure amount for credit risk. Operational risk events that relate to credit risk but are not accounted for in the risk-weighted exposure amount for credit risk shall be included in the loss data set. 6. Operational risk events related to market risk shall be treated as operational risk and shall be included in the loss data set. 7. An institution shall, upon request from the competent authority, be able to map its historical internal loss data to the event type. 8. For the purposes of this Article, institutions shall ensure the soundness, robustness and performance of their IT systems and infrastructure necessary to maintain and update the loss data set, in particular by ensuring all of the following: 9. For the purposes of paragraph 7, EBA shall develop draft regulatory technical standards establishing a risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk. EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. 10. For the purposes of paragraph 8, EBA shall issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, explaining the technical elements necessary to ensure the soundness, robustness and performance of governance arrangements to maintain the loss data set, with a particular focus on IT systems and infrastructures. Article 318 Calculation of net loss and gross loss 1. For the purposes of Article 316(1), institutions shall calculate for each operational risk event a net loss as follows: net loss = gross loss – recovery where: Institutions shall maintain on an ongoing basis an updated calculation of the net loss for each specific operational risk event. To that end, institutions shall update the net loss calculation based on the observed or estimated variations of the gross loss and the recovery for each of the last 10 financial years. Where losses, linked to the same operational risk event, are observed during multiple financial years within that 10-year time window, the institution shall calculate and maintain updated: 2. For the purposes of paragraph 1, the following items shall be included in the gross loss computation: For the purposes of the first subparagraph, point (d), material pending losses shall be included in the loss data set within a time period commensurate with the size and age of the pending item. For the purposes of the first subparagraph, point (e), the institution shall include in the loss data set material timing losses where those losses are due to operational risk events that span more than one financial year. Institutions shall include in the recorded loss amount of the operational risk item of a financial year losses that are due to the correction of booking errors that occurred in any previous financial year, even where those losses do not directly affect third parties. Where there are material timing losses and the operational risk event affects directly third parties, including customers, providers and employees of the institution, the institution shall also include the official restatement of previously issued financial reports. 3. For the purposes of paragraph 1, the following items shall be excluded from the gross loss computation: 4. For the purposes of paragraph 1, recoveries shall be used to reduce gross losses only where the institution has received payment. Receivables shall not be considered as recoveries. Upon request from the competent authority, the institution shall provide all documentation needed to verify the payments received and factored in the calculation of the net loss of an operational risk event. Article 319 Loss data thresholds 1. To calculate the annual operational risk loss referred to in Article 316(1), institutions shall take into account from the loss data set operational risk events with a net loss, calculated in accordance with Article 318, that are equal to or exceed EUR 20 000. 2. Without prejudice to paragraph 1 of this Article, and for the purposes of Article 446, institutions shall also calculate the annual operational risk loss referred to in Article 316(1), taking into account from the loss data set operational risk events with a net loss, calculated in accordance with Article 318, that are equal to or exceed EUR 100 000. 3. In the case of an operational risk event that leads to losses during more than one financial year, as referred to in Article 318(1), second subparagraph, the net loss to be taken into account for the thresholds referred to in paragraphs 1 and 2 of this Article shall be the aggregated net loss. Article 320 Exclusion of losses 1. An institution may request permission from the competent authority to exclude from the calculation of its annual operational risk loss exceptional operational risk events that are no longer relevant to the institution’s risk profile, where all of the following conditions are met: For the purposes of the first subparagraph, point (c), of this paragraph the minimum period of one year shall start from the date on which the operational risk event, included in the loss data set, first became greater than the materiality threshold provided for in Article 319(1). 2. An institution requesting the permission referred to in paragraph 1 shall provide the competent authority with documented justifications for the exclusion of an exceptional operational risk event, including: 3. EBA shall develop draft regulatory technical standards to specify the conditions that the competent authority has to assess pursuant to paragraph 1, including how the average annual operational risk loss is to be computed and the specifications on the information to be collected pursuant to paragraph 2 or any further information deemed necessary to carry out the assessment. EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2027. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. Article 321 Inclusion of losses from merged or acquired entities or activities 1. Losses stemming from merged or acquired entities or activities shall be included in the loss data set as soon as the business indicator items related to those entities or activities are included in the institution’s business indicator calculation in accordance with Article 315(1). To that end, institutions shall include losses observed during a 10-year period prior to the acquisition or merger. 2. EBA shall develop draft regulatory technical standards to specify how institutions are to determine the adjustments to their loss data set following the inclusion of losses from merged or acquired entities or activities as referred to in paragraph 1. EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2027. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. Article 322 Comprehensiveness, accuracy and quality of the loss data 1. Institutions shall have in place the organisation and processes to ensure the comprehensiveness, accuracy and quality of the loss data and to subject that data to independent review. 2. Competent authorities shall periodically, and at least every five years, review the quality of the loss data of an institution that calculates an annual operational risk loss in accordance with Article 316(1). Competent authorities shall carry out such review at least every three years for an institution with a business indicator that exceeds EUR 1 billion. Article 323 Operational risk management framework 1. Institutions shall have in place: 2. EBA shall develop draft regulatory technical standards to specify the obligations under paragraph 1, points (a) to (h), taking into consideration the size and complexity of the institution. EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2027. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. (*14) Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 laying down implementing technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to supervisory reporting of institutions and repealing Implementing Regulation (EU) No 680/2014 (OJ L 97, 19.3.2021, p. 1).’;" “operational risk event” means any event linked to an operational risk which generates a loss or multiple losses, within one or multiple financial years; “aggregated gross loss” means the sum of all gross losses linked to the same operational risk event over one or multiple financial years; “aggregated net loss” means the sum of all net losses linked to the same operational risk event over one or multiple financial years; “grouped losses” means all operational losses caused by a common underlying trigger or root cause that could be grouped into one operational risk event. = the business indicator component; = the business indicator, expressed in billions of euro, calculated in accordance with Article 314. = the business indicator, expressed in billions of euro; = the interest, leases and dividend component, expressed in billions of euro and calculated in accordance with paragraph 2; = the services component, expressed in billions of euro and calculated in accordance with paragraph 5; = the financial component, expressed in billions of euro and calculated in accordance with paragraph 6. = the interest, leases and dividend component; = the interest component, which is the institution’s interest income from all financial assets and other interest income, including finance income from financial leases and income from operating leases and profits from leased assets, minus the institution’s interest expenses from all financial liabilities and other interest expenses, including interest expense from financial and operating leases, depreciation and impairment of, and losses from, operating leased assets, calculated as the annual average of the absolute values of the differences over the last three financial years; = the asset component, which is the sum of the institution’s total gross outstanding loans, advances, interest bearing securities, including government bonds, and lease assets, calculated as the annual average over the last three financial years on the basis of the amounts at the end of each of the respective financial years; = the dividend component, which is the institution’s dividend income from investments in stocks and funds not consolidated in the financial statements of the institution, including dividend income from non-consolidated subsidiaries, associates and joint ventures, calculated as the annual average over the last three financial years. the subsidiaries’ retail or commercial banking activities account for the majority of their activity; a significant proportion of the subsidiaries’ retail or commercial banking activities comprise loans associated with a high PD; the use of the derogation provides an appropriate basis for calculating the EU parent institution’s own funds requirement for operational risk. = the services component; = the other operating income, which is the annual average over the last three financial years of the institution’s income from ordinary banking operations not included in other items of the business indicator but of similar nature; = the other operating expenses, which is the annual average over the last three financial years of the institution’s expenses and losses from ordinary banking operations not included in other items of the business indicator but of similar nature, and from operational risk events; = the fee and commission income component, which is the annual average over the last three financial years of the institution’s income received from providing advice and services, including income received by the institution as an outsourcer of financial services; = the fee and commission expenses component, which is the annual average over the last three financial years of the institution’s expenses paid for receiving advice and services, including outsourcing fees paid by the institution for the supply of financial services, but excluding outsourcing fees paid for the supply of non-financial services. = the financial component; = the trading book component, which is the annual average of the absolute values over the last three financial years of the net profit or loss, as applicable, on the institution’s trading book, determined as appropriate either in accordance with accounting standards or in accordance with Part Three, Title I, Chapter 3, including from trading assets and trading liabilities, from hedge accounting and from exchange differences; = the banking book component, which is the annual average of the absolute values over the last three financial years of the net profit or loss, as applicable, on the institution’s non-trading book, including from financial assets and liabilities measured at fair value through profit and loss, from hedge accounting, from exchange differences and from realised gains and losses on financial assets and liabilities not measured at fair value through profit and loss. income and expenses from insurance or reinsurance business; premiums paid and payments received from insurance or reinsurance policies purchased; administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services, and other administrative expenses; recovery of administrative expenses including recovery of payments on behalf of customers; expenses of premises and fixed assets, except where those expenses result from operational risk events; depreciation of tangible assets and amortisation of intangible assets, except the depreciation related to operating lease assets, which shall be included in financial and operating lease expenses; provisions and reversal of provisions, except where those provisions relate to operational risk events; expenses due to share capital repayable on demand; impairment and reversal of impairment; changes in goodwill recognised in profit or loss; corporate income tax. the components of the business indicator, and their use, by developing lists of typical sub-items, taking into account international regulatory standards and, where appropriate, the prudential boundary defined in Part Three, Title I, Chapter 3; the elements listed in paragraph 7 of this Article. how institutions are to determine the adjustments to the business indicator referred to in paragraphs 1 and 2; the conditions under which competent authorities are able to grant the permission referred to in paragraph 2; the timing for the adjustments referred to in paragraph 2. include in the loss data set each operational risk event recorded during one or multiple financial years; use the date of accounting for including losses related to operational risk events in the loss data set; allocate losses and recoveries related to a common operational risk event or related operational risk events over time and posted to the accounts over several years, to the corresponding financial years of the loss data set, in line with their accounting treatment. information about the reference dates of operational risk events, including: the date when the operational risk event happened or first began (“date of occurrence”), where available; the date on which the institution became aware of the operational risk event (“date of discovery”); the date or dates on which an operational risk event results in a loss, or the reserve or provision against a loss, recognised in the institution’s profit and loss accounts (“date of accounting”); information on any recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss events. their IT systems and infrastructure are sound and resilient and that that soundness and resilience can be maintained on a continuous basis; their IT systems and infrastructure are subject to configuration management, change management and release management processes; where an institution outsources parts of the maintenance of its IT systems and infrastructure, the soundness, robustness and performance of the IT systems and infrastructure is ensured by confirming at least the following: its IT systems and infrastructure are sound and resilient and that soundness and resilience can be maintained on a continuous basis; the process for planning, creating, testing and deploying the IT systems and infrastructure is sound and proper with reference to project management, risk management, governance, engineering, quality assurance and test planning, systems’ modelling and development, quality assurance in all activities, including code reviews and, where appropriate, code verification, and testing, including user acceptance; its IT systems and infrastructure are subject to configuration management, change management and release management processes; the process for planning, creating, testing and deploying the IT systems and infrastructure and contingency plans is approved by the management body or senior management and the management body and senior management are periodically informed about the IT systems and infrastructure performance. gross loss | = a loss linked to an operational risk event before recoveries of any type; recovery | = one or multiple independent occurrences, related to the original operational risk event, separated in time, in which funds or inflows of economic benefits are received from a third party. the net loss, gross loss and recovery for each of the financial years of the 10-year time window where that net loss, gross loss and recovery were recorded; the aggregated net loss, aggregated gross loss and aggregated recovery of all relevant financial years of the 10-year time window. direct charges, such as impairments, settlements, amounts paid to make good the damage, penalties and interest in arrears and legal fees, to the institution’s profit and loss accounts and write-downs due to the operational risk event, including: where the operational risk event relates to market risk, the costs to unwind market positions in the recorded loss amount of the operational risk items; where payments relate to failures or inadequate processes of the institution, penalties, interest charges, late-payment charges, legal fees and, with the exclusion of the tax amount originally due, tax, unless that amount is already included under point (e); costs incurred as a consequence of the operational risk event, including external expenses with a direct link to the operational risk event and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event occurred; provisions or reserves accounted for in the profit and loss accounts against the potential operational loss impact, including those from misconduct events; losses stemming from operational risk events with a definitive financial impact which are temporarily booked in transitory or suspense accounts and are not yet reflected in the profit and loss accounts (“pending losses”); negative economic impacts booked in a financial year and which are due to operational risk events impacting the cash flows or financial statements of previous financial years (“timing losses”). costs of general maintenance of contracts on property, plant or equipment; internal or external expenditure to enhance the business after the operational risk losses, including upgrades, improvements, risk assessment initiatives and enhancements; insurance premiums. the institution can demonstrate to the satisfaction of the competent authority that the cause of the operational risk event at the origin of those operational risk losses will not occur again; the aggregated net loss of the corresponding operational risk event is either of the following: equal to or exceed 10 % of the institution’s average annual operational risk loss, calculated over the last 10 financial years and based on the threshold referred to in Article 319(1), where the operational risk loss event refers to activities that are still part of the business indicator; related to an operational risk event that refers to activities divested from the business indicator in accordance with Article 315(2); the operational risk loss was in the loss database for a minimum period of one year, unless the operational risk loss is related to activities divested from the business indicator in accordance with Article 315(2). a description of the operational risk event; proof that the loss from the operational risk event is above the materiality threshold for loss exclusion referred to in paragraph 1, point (b)(i), including the date on which that operational risk event became greater than the materiality threshold; the date on which the operational risk event concerned would be excluded, considering the minimum retention period set out in paragraph 1, point (c); the reason why the operational risk event is no longer deemed relevant to the institution’s risk profile; a demonstration that there are no similar or residual legal exposures and that the operational risk event to be excluded has no relevance to other activities or products; reports of the institution’s independent review or validation, confirming that the operational risk event is no longer relevant and that there are no similar or residual legal exposures; proof that competent bodies of the institution, through the institution’s approval processes, have approved the request for exclusion of the operational risk event and the date of such approval; the impact of the exclusion of the operational risk event on the annual operational risk loss. a well-documented assessment and management system for operational risk which is closely integrated into day-to-day risk management processes, forms an integral part of the process of monitoring and controlling the institution’s operational risk profile, and for which clear responsibilities have been assigned; the assessment and management system for operational risk shall identify the institution’s exposures to operational risk and track relevant operational risk data, including material loss data; an operational risk management function that is independent from the institution’s business and operational units; a system of reporting to senior management that provides operational risk reports to relevant functions within the institution; a system of regular monitoring and reporting of operational risk exposures and loss experience, and procedures for taking appropriate corrective actions; routines for ensuring compliance, and policies for the treatment of non-compliance; regular reviews of the institution’s operational risk assessment and management processes and systems, carried out by internal or external auditors that possess the necessary knowledge; internal validation processes that operate in a sound and effective manner; transparent and accessible data flows and processes associated with the institution’s operational risk assessment system.

← ‘(f) · All articles · (1) →

Source: EUR-Lex CELLAR · retrieved 2026-09-04 · Text as adopted (Official Journal); later amendments are not incorporated in this text.