Bank Capital for Operational Risk: A Tale of Fragility and Instability

Abstract

Operational risk is fundamentally different from all other risks taken on by a bank. It is embedded in every activity and product of an institution, and in contrast to the conventional financial risks (e.g. market, credit) is harder to measure and model, and not straight forwardly eliminated through simple adjustments like selling off a position. While it varies considerably, operational risk tends to represent about 10-30% of the total risk pie, and has grown rapidly since the 2008-09 crisis. It tends to be more fat-tailed than other risks, and the data are poorer. As a result, models are fragile – small changes in the data have dramatic impacts on modeled output – and thus required operational risk capital is unstable. Yet the U.S. regulatory capital regime, the central focus of this paper, is surprisingly more rigidly model-focused for this risk than for any other. We are especially concerned with the absence of incentives to invest in and improve business control processes through the granting of regulatory capital relief. We make three, not mutually exclusive policy suggestions. First, address model fragility directly through regulatory anchoring of key model parameters, yet allow each bank to scale capital to their data using robust methodologies. Second, relax the current tight linkage between statistical model output and required regulatory capital, incentivizing prudent risk management through joint use of scenarios and control factors in addition to data-based statistical models in setting regulatory capital. Third, provide allowance for real risk transfer through an insurance credit to capital, encouraging more effective risk sharing through future product innovation. Until our understanding of operational risks increases, required regulatory capital should be based on methodologies that are simpler, more standardized, more stable and more robust.