As a minimum—
| (A) | a bank shall duly capture internal loss data— |
| (i) | in order for the bank, amongst other things, to validate or compare its risk estimates with the bank's actual experience of loss; |
| (ii) | which loss data shall clearly be linked to the bank's business activities, technological processes and risk management procedures; |
| (B) | a bank's internal processes relating to the collection of loss data— |
| (i) | shall be adequate to map the bank's historical internal loss data into the relevant level 1 categories specified in subparagraph (iv) above, which level 1 categories relate to loss event types; |
| (ii) | shall be duly documented, which documentation, amongst other things— |
| (aa) | shall include objective criteria for the allocation of losses to the relevant business lines specified in table 1, in subregulation (8)(c)(i), and the specified loss event types; |
| (bb) | shall duly specify the relevant criteria to be applied when assigning loss data arising from an event in a centralised function, such as an information technology department, or an activity that spans more than one business line, as well as from related events over time; |
| (iii) | shall be sufficiently robust— |
| (aa) | to ensure that the bank's internal loss data is comprehensive in the sense that the bank's internal process captures all material activities and exposures from all appropriate subsystems and geographic locations; |
| (bb) | to capture adequate information in respect of— |
| (i) | the gross loss amounts; |
| (ii) | the date of the loss event; |
| (iii) | any recovery of gross loss amounts; |
| (iv) | descriptive information relating to the drivers or causes of the loss event; |
| (iv) | shall include an appropriate de minimis gross loss threshold amount for the collection of internal loss data provided that in order to ensure broadly consistent data collection between banks that adopted the advanced measurement approach for the calculation of their respective capital requirements relating to operational risk the Registrar may from time to time specify a minimum gross loss threshold amount; |
| (v) | shall treat operational risk losses that are related to credit risk and that have historically been included in the bank's credit risk databases, such as collateral management failures, as credit risk for the purposes of calculating the bank's relevant minimum required amount of capital and reserve funds, that is, such losses shall not be subject to the operational risk capital requirement specified in these Regulations; |
[Regulation 33(9)(d)(v)(B)(v) inserted by regulation 5(d) of Notice No. R. 261 dated 27 March 2015]
| (vi) | shall flag material operational risk-related credit risk losses separately within the bank's internal operational risk database; |
[Regulation 33(9)(d)(v)(B)(vi) inserted by regulation 5(d) of Notice No. R. 261 dated 27 March 2015]
| (vii) | shall treat operational risk losses that are related to market risk as operational risk for the purposes of calculating the bank's relevant minimum required amount of capital and reserve funds, that is, such losses shall be subject to the relevant operational risk capital requirement specified in these Regulations. |
[Regulation 33(9)(d)(v)(B)(vii) inserted by regulation 5(d) of Notice No. R. 261 dated 27 March 2015]
| (C) | a bank shall have in place duly documented procedures in order to assess the ongoing relevance of historical data, which documented procedures shall duly specify the situations in which judgement, scaling or other adjustments to internal loss data may be used, including the extent to which such judgement may be used and the officials who are authorized to make such decisions; |
| (D) | when a bank's capital requirement in respect of operational risk is based on internal loss data, the said capital requirement shall be based on a minimum observation period of— |
| (i) | five years of data; or |
| (ii) | when the bank originally adopts the advanced measurement approach, subject to such conditions as may be specified in writing by the Registrar, a minimum observation period of less than five years of data, but in no case less than three years of data, |
irrespective whether the internal loss data is used to calculate or validate the bank's measure of loss.
