By Warren Hrung and Clifford Rossi
The overwhelmingly negative public response to the so-called Basel III “endgame” proposal has already caused top regulatory officials to forecast “broad and material” changes before a final rule is issued. ABA and others have called for the endgame framework to be withdrawn and re-proposed, given the significant consequences its faults would have throughout the economy.
One aspect of the endgame proposal that needs to be thoroughly and carefully reconsidered is its treatment of operational risk. Official estimates suggest that these new capital standards on operational risk will increase risk-weighted assets, or RWA, by nearly $2 trillion across all covered banks, representing a substantial portion of the increase in RWA under the endgame. Changes in operational risk capital, or ORC, requirements account for almost 80 percent of the capital increase for Category I and II banks (namely, global systemically important banks and those with over $700 billion in assets or $75 billion in cross-border activity), and nearly 90 percent when the regional banks of $100-700 billion in assets are included.
The predictable result of the required leap in capital costs would be likely to constrain credit to bank customers, with an accompanying negative impact on economic growth.
A fundamentally flawed approach
Our research shows that these changes in ORC requirements are riddled with shortcomings as they relate ORC to bank income, expense and revenue from various banking activities. The standardized approach to operational risk—referred to as SA-OR—is inherently flawed methodologically, unsupported by a well-developed theoretical foundation for the drivers of operational loss and not empirically supported. Moreover, the ORC charge grossly overestimates the amount of tail operational losses given actual historical loss experience.
In short, the SA-OR uses two components—the business indicator component and an internal loss multiplier—to calculate ORC. However, the proposed business indicator component is a fairly crude proxy of drivers of operational loss, and completely ignores factors that explain operational risk. Meanwhile, the multiplier is a complex formula that is detached from direct operational losses—an example of over-engineering without rigorous empirical support.
The flaws in the methodology are further compounded by the fact that the existing stress capital buffer (SCB), which is a major component of minimum required capital calculations, already includes a component for operational risk under a severely adverse scenario in the annual bank stress test exercise. This “blending” of regulatory capital and stress tests likely leads to an excessive amount of required capital for operational risk.
Based on the Fed’s estimate above of the endgame’s RWA increases, ORC would represent an increase in bank capital of $156 billion. Using the earlier estimate of $138 billion in stress operational losses for SCB, the proposed requirement would essentially double the amount of capital banks would need for operational risk. Imposing such a significant amount of capital on banks without a clear rationale and empirical support is fundamentally without merit.
Costs to end users
As mentioned above, significantly higher ORC levels will have the effect of eroding profitability, raising costs, constraining credit to bank customers or some combination of all three—generally creating a drag on economic growth and increasing risks to financial stability.
Specifically, individual and commercial borrowers would face higher borrowing costs from higher capital costs passed through by banks affected by the new capital standards. Individual borrowers today are already under severe pressure from higher market interest rates that have led to significantly higher lending rates and from inflation which has sapped borrower financial capacity; additional charges to borrowers to reflect ORC costs for banks would directionally double down on macroeconomic policies that tighten financial conditions and hurt rather than help.
Take the example of a hypothetical borrower with a conforming mortgage of $320,000 at a 7.5 percent 30-year fixed rate and monthly principal and interest of $2,238. The bank would face a 50 percent risk weight for this loan under current capital standards. Assuming a total risk-based capital (RBC) ratio of 10 percent, the mortgage would require 5 percent capital. Isolating the increase in ORC under the Basel endgame to 19 percent would result in a below-minimum total RBC ratio of 4.28 percent. To cover the cost to the bank (in terms of yield to investors providing the required capital) of the additional 72 basis points of capital required to leave the bank at its original 5 percent total RBC ratio, the incremental cost to the borrower would be 8 basis points above the existing rate if fully passed through, resulting in a payment of $204 more per year for the borrower. Over the eight-year period that the average homeowner maintains a loan, the additional cost for operational risk would be $1,632 per borrower.
While this example illustrates the impact that higher operational risk capital would have in conjunction with higher mortgage risk weights on mortgage costs, borrowing costs for other bank products such as credit cards, auto and personal loans would also see increases commensurate with their loan features. Likewise, commercial borrowers, including small-business owners, would experience higher costs for loans due to the increase in capital associated with changes in ORC under the endgame.
A combination of higher borrowing costs and tighter underwriting standards would create additional headwinds on U.S. economic growth at a time when the full effect of Federal Reserve monetary policy tightening on near- and intermediate-term economic growth is still unclear. The accelerated and relatively large rate hike campaign that started in early 2022 has yet to fully be absorbed throughout the economy, and the estimated additional $156 billion in capital required due to proposed changes in ORC would create a further drag on growth.
Alternative approaches
If the proposed endgame approach for ORC is untenable, then what alternatives could the regulatory agencies adopt instead? In a paper in this series, we outline principles for any alternatives: a sound theoretical foundation, operational tractability for covered institutions and analytical consistency across the industry. The principles reflect our personal views and are not an ABA policy recommendation.
The incidence and severity of operational loss events are a function of firm scale and complexity, asset growth rate, risk profile and investment in operational capabilities. Tying such losses directly to macroeconomic factors or bank income and expense as in the case with the Federal Reserve’s supervisory stress test and proposed SA-OR misrepresents the manner in which operational losses manifest but also how they interact with other risk types.
Fundamentally, operational risk events generate direct and indirect losses to a banking organization. An example of a direct operational loss would be from an internal or external fraud event or ransomware attack. An operational risk event that poses a loss of business due to reputation risk or a large class action settlement posing legal risk, or a major civil money penalty causing regulatory risk are just a few examples of indirect operational losses. Notably, operational losses can increase as financial risks such as credit build in the portfolio, and can even lead to increases in other financial risks. The is particularly the case if operational controls have not kept pace with the scale and level of risk-taking of the bank.
One option is to abandon assessing an operational risk component of the SCB for affected banking organizations since the analytical and theoretical framework on which it is built is also completely flawed and unsupported empirically.
Another possible option that could be considered, as it relates to the endgame, would be to replace SA-OR with an approach that relates operational risk to market, credit and counterparty RWA. This approach would have several advantages compared to the proposed SA-OR approach. First, it would align better with how operational risk relates to other major risk types. Second, the drivers of operational risk mentioned earlier would be reflected in the RWA for credit, market and counterparty risk, and third, it would present a tractable and standardized solution to estimating operational risk capital that relies on determining a single factor: the operational risk factor, or ORF.
According to regulatory agency RWA estimates under current capital standards, approximately 25 percent of RWA under the advanced approach is from operational risk for Category I and II banking organizations. This provides a benchmark for establishing the ORF. Refinement of the ORF could be accomplished by leveraging results from the existing internal models-based loss distribution approach. After all, these models have been in place for years with significant attention given to statistical measurement of both operational event frequency and loss severity. Such approaches, while subject to their own limitations, are superior to the proposed endgame approach that relies on crude factors relating bank income and revenue to operational loss.
However, the agencies are correct to point out that significant variation in the application of models used to estimate operational risk capital exists and that some standardization in approach is warranted. A combined assessment (for example, the average from the results of all ORC models) in an ensemble approach could guide the process. Rather than rely on a single model, an ensemble provides a model diversification effect that would guide ORF setting with greater confidence than relying on a single model.
The computation of operational risk RWAs could differ for certain types of banking organizations based on business complexity. For example, four different ORFs could be developed for each banking organization category. ORFs for Category I and II organizations could employ results from the ensemble LDA model results; ORFs for Category III and IV banks, since they are not required to use internal models for operational risk, would require further analysis—but arguably, since these firms are typically less complex than Category I and II firms, they would have lower ORFs. Offsets to the ORF would be possible under this framework to encourage firms to apply best practice risk management techniques and invest in strong operational risk capabilities.
Conclusion
Our alternative approach, while not an ABA policy recommendation, is more reflective of how operational risk actually affects banks. These changes not only would avoid overestimating operational risk capital, but they would also rest on a firm theoretical and empirical foundation, reduce model risk effects of individual operational risk models currently in use and provide a standardized methodology which reduces regulatory burden and improves consistency and transparency in operational risk capital measurement.
Warren Hrung is SVP and head of banking and financial services research at ABA and a former economist at the Federal Reserve Bank of New York. Clifford Rossi is a professor of the practice and executive in residence at the Robert H. Smith School of Business at the University of Maryland. He has nearly 25 years of risk management experience in both banking and government. The views expressed in this essay are their own.
