REGULATION ON THE CALCULATION OF CAPITAL REQUIREMENTS FOR OPERATIONAL RISK FOR BANKS AND SAVINGS BANKS

Transcription

1 Official Gazette of the Republic of Slovenia, No. 135/06 (in force since 1 January 2007) _ Pursuant to point 6 of Articles 129 and 405 of the Banking Act (Official Gazette of the Republic of Slovenia, No. 131/06) and the first paragraph of Article 31 of the Bank of Slovenia Act (Official Gazette of the Republic of Slovenia No. 72/06 - official consolidated text), the Governing Board of the Bank of Slovenia issues the following REGULATION ON THE CALCULATION OF CAPITAL REQUIREMENTS FOR OPERATIONAL RISK FOR BANKS AND SAVINGS BANKS 1. GENERAL PROVISIONS 1.1. Content of the regulation and definitions Article 1 (content of the regulation) (1) This regulation sets out in detail the approaches for calculating capital requirements for operational risk and the general and specific conditions for their use in banks and savings banks (hereinafter: the banks). These conditions are closely linked to the increasing complexity of calculating capital requirements for operational risk and the associated level of achieved operational risk management development. (2) Whenever this regulation makes reference to the provisions of other regulations, these provisions shall apply in their valid wording at the time in question. Article 2 (definition of terms) (1) The terms used in this regulation are the same as those defined in the provisions of the Banking Act (Official Gazette of the Republic of Slovenia, No. 131/06; hereinafter: the ZBan-1), such as: (a) parent bank referred to in the first paragraph of Article 26, (b) operational risk referred to in Article 112. (2) For the purpose of this regulation the following definitions shall be valid: (a) "management body" is the management board in a two-tiered bank management system or the executive directors of the management board in a one-tiered bank management system; (b) "senior management" is the management level directly subordinated to the bank's management board and is responsible for ongoing business-operational decisions with regard to the bank's operations, risk management and the implementation of decisions adopted by the bank's management board. _ * The official language of the document translated herein is Slovene. In case of any doubt or misunderstanding the Slovene version should therefore be considered final.

2 2. METHODOLOGIES 2.1. Approaches for calculating capital requirements for operational risk and authorisation Article 3 (methodologies) (1) Capital requirements for operational risk shall be the amount calculated according using: (a) the Basic Indicator Approach, or (b) the Standardised Approach, or (c) the Advanced Measurement Approach. (2) Banks shall use the Basic Indicator Approach if they do not or may not use another approach for calculating capital requirements. (3) Before using the Advanced Measurement Approach, banks shall obtain permission from the Bank of Slovenia. The conditions for obtaining authorisation for the use of the Advanced Measurement Approach for calculating capital requirements for operational risk are set out in Subsection of this regulation. Detailed instructions for structuring the request for approval may be found in Annex I of this regulation. (4) With approval from the Bank of Slovenia, banks may also use a combination of different approaches: the Advanced Measurement Approach and Standardised Approach or the Advanced Measurement Approach and Basic Indicator Approach. In exceptional cases, the Standardised Approach and Basic Indicator Approach may be combined. Conditions for the granting of the relevant approval from the Bank of Slovenia are set out in Articles 27 and 29 of this regulation. Detailed instructions for structuring the request for approval may be found in Annexes III, IV and V of this regulation Limitations for changing approaches for calculating capital requirements for operational risk Article 4 (transition to a less developed approach) (1) Banks using the Standardised Approach for the calculation of capital requirements for operational risk may revert to the Basic Indicator Approach only with prior approval from the Bank of Slovenia. (2) Banks using the Advanced Measurement Approach for the calculation of capital requirements for operational risk may revert to the Basic Indicator Approach or Standardised Approach only with prior approval from the Bank of Slovenia. With the granting of such permission, permission for the use of the Advanced Measurement Approach ceases to be valid. (3) The Bank of Slovenia shall grant the permission referred to in the first or second paragraph of this article if a bank demonstrates good cause for the change of approach. In its ruling to grant such permission, the Bank of Slovenia shall determine the date of reversion to another approach. (4) The instructions for structuring the request for granting of permission referred to in the first or second paragraph of this article are defined in Annex II of this regulation. 2

3 2.3. Basic Indicator Approach Capital requirements for operational risk calculated using the Basic Indicator Approach Article 5 (general) Under the Basic Indicator Approach, the capital requirement for operational risk is equal to 15 % of the relevant indicator defined in the sixth article of this regulation Basis for calculating capital requirements for operational risk Article 6 (calculation methodology) (1) The relevant indicator is the average over three years of the sum of net interest income and net non-interest income. (2) The three-year average is calculated on the basis of the last three twelve-monthly observations at the end of the financial year. When audited figures are not available, business estimates may be used. (3) If for any given observation, the sum of net interest income and net non-interest income is negative or equal to zero, this figure shall not be taken into account in the calculation of the three-year average. The relevant indicator shall be calculated as the sum of positive figures divided by the number of positive figures. Article 7 (consideration of elements) When calculating the sum of net interest income and net non-interest income in accordance with the sixth paragraph of Article 6 of this regulation, banks shall use the following elements (pursuant to International Accounting Standards and the Regulation on the Books of Account and Annual Reports of Banks and Savings Banks [Official Gazette of the Republic of Slovenia, No. 64/05 and 45/06, hereinafter: the books of accounts regulation]): (a) Interest income (b) Interest expenses (c) Dividend income (d) Fee and commission income (e) Fee and commission expenses (f) Net profit/loss on financial operations, including: Net income/loss from financial assets and liabilities intended for trading Net realised profit/loss from financial assets and liabilities which are not measured at fair value throughout the income statement, if they are the result of trading book items Net realised profit/loss from financial assets and liabilities recognised at fair value throughout the income statement, if they are the result of trading book items Changes to fair value during the calculation of risk mitigation Net profit/loss from exchange rate difference if they are the result of trading book items and if they are not included in the previous indents of point (f) of this article (g) Other operating income 3

4 Article 8 (exclusions) During the calculation of the sum of net interest income and net non-interest income referred to in Article 7 of this regulation, items which by content are considered income from extraordinary or irregular items or income derived from insurance claims, as defined by Directive 86/635/EEC of 8 December 1986 on the annual accounts and consolidated annual accounts of banks and other financial institutions, shall be excluded. Article 9 (treatment of external parties) Fee and commission expenses to external parties, shall include fees (commissions) paid to a parent or subsidiary of a credit institution or a subsidiary of a parent which is also the parent of a credit institution, while expenses for fees to other external parties are not included in fee and commission expenses expenses. Fee and commission expenses to external parties are included in the basis for calculating capital requirements for operational risk (included in Fee and commission expenses) if it involves payment to an entity which is the subject of supervision in accordance with the provisions of Directive 2006/48/EC of the European Parliament and of the Council of 14 June 2006 relating to the taking up and pursuit of the business of credit institutions or the supervision of the entity is, by content, equivalent to the supervision required by the aforementioned directive Operational risk management Article 10 (general operational risk management standards) Banks using the Basic Indicator Approach shall meet the general operational risk standards in accordance with the Regulation on Risk Management and Internal Capital Adequacy Assessment Process for Banks and Savings Banks (Official Gazette of the Republic of Slovenia, No. 135/06, hereinafter: regulation on risk management) Standardised approach for calculating capital requirements for operational risk Capital requirements, calculated by the Standardised Approach Article 11 (business lines) (1) Under the Standardised Approach, the capital requirement for operational risk is the average over three years of the risk-weighted relevant indicators calculated each year across the business lines. In each year, a negative capital requirement in one business line, resulting from a negative relevant indicator may be imputed to the whole. However, where the aggregate capital charge across all business lines within a given year is negative, then the input to the average for that year shall be zero. (2) Annual capital requirements are calculated as the sum of capital requirements for all business lines as set out in the fourth paragraph of this article. (3) The capital requirements for a specific business line shall be equal to the product of the percentage, defined for that business line and its basis for the calculation of capital requirements for operational risk. 4

5 (4) Business lines with their corresponding percentages for calculating specific capital requirements are defined in Table 1. Table 1: Capital requirements by business lines Item No. Business line Type of activity Capital requireme nt in % 18 % 1. Corporate finance Underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis Services related to underwriting Investment advice Advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to the mergers and the purchase of undertakings Investment research and financial analysis and other forms of general recommendation relating to transactions in financial instruments 2. Trading and sales Dealing on own account 18 % Money broking Reception and transmission of orders in relation to one or more financial instruments Execution of orders on behalf of clients Placing of financial instruments without a firm commitment basis 3. Retail brokerage (Activities with individual physical persons or legal entities which do not meet the criteria of a large company as set out in the fifth paragraph of Article 55 of the Companies Act (Official Gazette of the Republic of Slovenia, Nos. 42/06 and 60/06 [correction], hereinafter: the ZGD-1) and for which it is, in accordance with Article 4 of the Regulation on the Calculation of Capital Requirements for Credit Risk Using a Standardised Approach for Banks and Savings Banks (Official Operation of Multilateral Trading Facilities Reception and transmission of orders in relation to one or more financial instruments Execution of orders on behalf of clients Placing of financial instruments without a firm commitment basis 12 % 5

6 Gazette of the Republic of Slovenia, No. 135/06, hereinafter: the standardised approach regulation) possible to classify in the retail exposure class). 4. Commercial banking Acceptance of deposits and other repayable funds 15 % Lending Financial leasing 5. Retail banking (Activities with individual physical persons or with legal entities which do not meet the criteria of a large company as set out in the fifth paragraph of Article 55 of the ZGD-1 and for which it is, in accordance with Article 4 of the standardised approach regulation, possible to classify in the retail exposure class). Guarantees and commitments Acceptance of deposits and other repayable funds Lending Financial leasing Guarantees and commitments 6. Payment and settlement Money transmission services, Issuing and administering means of payment 7. Agency services Safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management 8. Asset Management Portfolio management 12 % 18 % 15 % 12 % Managing of UCITS Other forms of asset management Basis for calculating capital requirements for operational risk Article 12 (calculation methodology) (1) The basis for calculating capital requirements for operational risk, calculated by the standardised approach, is calculated separately for each business line and for each year taken into consideration for the calculation of the average set out in the first paragraph of Article 11 of this regulation. (2) The basis for calculating the capital requirement for operational risk for a specific business line, calculated by the standardised approach, shall be the sum of net interest income and net non-interest income. 6

7 (3) When audited figures are not available, business estimates may be used. (4) The methodologies set out in Articles 7 to 9 of this regulation shall be applied for calculating the sum of net interest income and net non-interest income pursuant to the second paragraph of this article Principles for business lines mapping Article 13 (policies and criteria for formulating business line) Credit institutions must develop and document specific policies and criteria for mapping the relevant indicator for current business lines and activities into the standardised framework. The criteria must be reviewed and adjusted as appropriate for new or changing business activities and risks. The principles for business line mapping are: (a) all activities must be mapped into the business lines in a mutually exclusive and jointly exhaustive manner; (b) any activity which cannot be readily mapped into the business line framework, but which represents an ancillary function to an activity included in the framework, must be allocated to the business line it supports. If more than one business line is supported through the ancillary activity, an objective-mapping criterion must be used; (c) if an activity cannot be mapped into a particular business line then the business line yielding the highest percentage must be used. The same business line equally applies to any associated ancillary activity; (d) banks may use internal pricing methods to allocate the relevant indicator between business lines. Costs generated in one business line which are imputable to a different business line may be reallocated to the business line to which they pertain, for instance by using a treatment based on internal transfer costs between the two business lines; (e) the mapping of activities into business lines for operational risk capital purposes must be consistent with the categories used for credit and market risks; (f) senior management is responsible for the mapping policy under the control of the governing bodies of the bank; and (g) the mapping process to business lines must be subject to independent review Conditions for the use of the standardised approach Article 14 (qualifying criteria) (1) Banks shall meet the qualifying criteria set out below in addition to the general risk management standards in accordance with the regulation on risk management: (a) banks shall have a well-documented assessment and management system for operational risk with clear responsibilities assigned for this system. They shall identify their exposures to operational risk and track relevant operational risk data, including material loss data. (b) the operational risk management system shall be subject to regular independent review; (c) The operational risk assessment system must be closely integrated into the risk management processes of the credit institution. Its output must be an integral Part of the process of monitoring and controlling the credit institution's operational risk profile. (d) banks shall implement a system of management reporting that provides operational risk reports to relevant functions within the credit institution. Banks shall have procedures for taking appropriate action according to the information within the management reports. 7

8 (2) Fulfilment of the qualifying criteria referred to in the first paragraph of this article shall be proportionate to the characteristics, extent and the complexities of the bank s operations. (3) Banks shall document the fulfilment of qualifying criteria referred to in the first paragraph of this article and submit this documentation to the Bank of Slovenia upon request Advanced Measurement Approaches Capital requirements, calculated by the Advanced Measurement Approaches Article 15 (operational risk measurement system) Capital requirements for operational risk calculated by the Advanced Measurement approach shall be based on a bank's own operational risk measurement system Conditions for the use of the Aadvanced Measurement Approaches Qualitative qualifying criteria Article 16 (general) Banks shall meet the qualitative qualifying criteria set out below, in addition to the general risk management standards in accordance with the regulation on risk management: (a) the operational risk assessment system must be closely integrated into the day-to-day risk management processes; (b) banks shall have an independent risk management function for operational risk; (c) there must be regular reporting of operational risk exposures and loss experience. The bank shall have procedures for taking appropriate corrective action. (d) The bank's risk management system must be well documented. The bank shall have routines in place for ensuring compliance and policies for the treatment of non-compliance. (e) operational risk management processes and the operational risk measurement system shall be the subject of regular reviews carried out by the internal audit department and/or external auditors; (f) The validation of the operational risk measurement system include the following elements: - verifying that the internal validation processes are operating in a satisfactory manner; - making sure that data flows and processes associated with the risk measurement system are transparent and accessible Quantitative qualifying criteria Article 17 (process) (1) Banks shall calculate their capital requirement as comprising both expected loss and unexpected loss, unless they can demonstrate that expected loss is adequately captured in their internal business practices. The operational risk measure must capture potentially severe tail events, achieving a soundness standard comparable to a 99,9 % confidence interval over a one year period. 8

9 (2) The operational risk measurement system of a credit institution must have certain key elements to meet the soundness standard set out in point 8. These elements must include the use of internal data, external data, scenario analysis and factors reflecting the business environment and internal control systems as set out in points 13 to 24. A bank needs to have a well documented approach for weighting the use of these four elements in its overall operational risk measurement system. (3) The risk measurement system shall capture the major drivers of risk affecting the shape of the tail of the loss estimates. (4) Correlations in operational risk losses across individual operational risk estimates may be recognised only if banks can demonstrate to the satisfaction of the Bank of Slovenia that their systems for measuring correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates, particularly in periods of stress. The bank must validate its correlation assumptions using appropriate quantitative and qualitative techniques. (5) The risk measurement system shall be internally consistent and shall avoid the multiple counting of qualitative assessments or risk mitigation techniques recognised in other areas of the capital adequacy framework. Article 18 (internal data) (1) Internally generated operational risk measures shall be based on a minimum historical observation period of five years. When a bank first moves to an Advanced Measurement Approach, a three-year historical observation period is acceptable. (2) Banks shall map their historical internal loss data across the business lines defined in the fourth paragraph of Article 11 of this regulation and by types of loss events. The types and definitions of loss events are as follows: (a) "internal fraud" are losses due to acts of embezzlement, misappropriation of property or circumvention of regulations or internal acts of a bank and which involves at least one internal party. For the purpose of this regulation, an internal party shall mean any party that performs specific tasks for a bank based on a contractual relationship. (b) "external fraud" are losses due to acts of defraud, misappropriate property or circumvent the law and which involve a third party. For the purpose of this regulation a third party shall mean any party who is not considered an internal party as defined in point (a) of this article. (c) "employment practices and workplace safety" are losses arsing from acts inconsistent with employment, health or safety laws or agreements, governing employment and health and safety at work, resulting in payment of personal injury claims. The definition includes acts of discrimination. (d) "clients, products and business practices" are losses due to the unintentional or negligent failure to meet contractual obligations to specific clients (including non-fulfilment of requirements regarding confidentiality and suitability) and losses from the nature or design of a product; (e) "damages to physical assets" include losses arising from loss or damage to physical assets from natural disasters or other events; (f) "business disruption and system failures" include losses arising from the disruption of business or system failures; (g) "execution, delivery and process management" includes losses arising from failed transaction processing or process management in relations with counterparties and vendors. (3) Banks shall document objective criteria for allocating operational risk losses to specific business lines and event types and to provide these data to competent authorities upon request. The operational risk losses that are related to credit risk and have historically been included in the internal credit risk databases must be recorded in the operational risk databases and be separately identified. Such losses will not be subject to the operational risk charge, as long as they continue to be treated as credit risk 9

10 for the purposes of calculating minimum capital requirements. Operational risk losses that are related to market risks shall be included in the scope of the capital requirement for operational risk. (4) The bank's internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations. Banks must be able to justify that any excluded activities or exposures, both individually and in combination, would not have a material impact on the overall risk estimates. Appropriate minimum loss thresholds for internal loss data collection must be defined. (5) Aside from information on gross loss amounts, banks shall collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event. The gross loss is the first loss amount without taking into account any recoveries from the associated event. (6) Banks shall define specific criteria for assigning loss data arising from an event in a centralized function or an activity that spans more than one business line, as well as from related events over time. (7) Banks must have documented procedures for assessing the on-going relevance of historical loss data, including those situations in which judgment overrides, scaling, or other adjustments may be used, to what extent they may be used and who is authorized to make such decisions. Article 19 (external data) A bank's operational risk measurement system shall use relevant external data, especially when there is reason to believe that the credit institution is exposed to infrequent, yet potentially severe, losses. Bank must have a systematic process for determining the situations for which external data must be used and the methodologies used to incorporate the data in its measurement system. The conditions and practices for external data use must be regularly reviewed, documented and subject to periodic independent review. Article 20 (scenario analysis) Banks shall use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high severity events. Over time, such assessments need to be validated and reassessed through comparison to actual loss experience to ensure their reasonableness. Article 21 (business environment and internal control factors) (1) The bank's firm-wide operational risk measurement system must capture key business environment and internal control factors that can change its operational risk profile. (2) Banks must be able of justifying each factor referred to in the first paragraph of this article as a meaningful driver of risk, based on experience and the expert judgement of the affected business lines. (3) The sensitivity of risk estimates to changes and the relative weighing of the various factors shall be well reasoned. In addition to capturing changes in risk due to improvements in the internal controls system, the framework must also capture potential increases in risk due to greater complexity of activities or increased business volume. (4) Banks shall appropriately document the methodology for capturing business environment and internal control factors. The methodology shall also be subject to independent reviews of the internal 10

11 audit department. In appropriate time intervals, the methodology and outcomes need to be reassessed through comparison to actual internal loss experience and relevant external data Impact of insurance and other operational risk transfer mechanisms on the calculation of capital requirements for operational risk Article 22 (recognising the impact of insurance) (1) Banks may recognise the impact of insurance subject to the conditions set out in the second and third paragraphs of this article and in Article 23 of this regulation during the calculation of capital requirements for operational risk based on the Advanced Measurement Approach. (2) The insurance provider shall be authorised by a competent supervisory authority to provide insurance or reinsurance and shall have a credit assessment by an eligible ECAI which has been determined to be associated with credit quality step 3 or above under the rules for risk weighting exposures to credit institutions, pursuant to the standardised approach for the calculation of capital requirements for operational risk. (3) The insurance and the bank's policies for use of insurance shall meet the following conditions: (a) the insurance policy must have an initial term of no less than one year. For policies with a residual term of less than one year, the credit institution must make appropriate haircuts reflecting the declining residual term of the policy, up to a full 100 % haircut for policies with a residual term of 90 days or less; (b) the insurance policy shall have a minimum notice period for cancellation of the contract of 90 days; (c) the insurance policy has no exclusions or limitations triggered by supervisory actions or, in the case of a failed credit institution, that preclude the credit institution receiver or liquidator, from recovering for damages suffered or expenses incurred by the credit institution, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the credit institution; provided that the insurance policy may exclude any fine, penalty, or punitive damages resulting from actions by the competent authorities; (d) the risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of operational risk capital; (e) the insurance is provided by a third party entity. In the case of insurance through captives and affiliates, the exposure has to be laid off to an independent third party entity, for example through re-insurance, that meets the eligibility criteria; (f) banks shall have well reasoned and documented policies for the use of insurance as an operational risk transfer instrument; (g) The methodology for recognizing insurance shall capture the following elements through discounts or haircuts in the amount of insurance recognition: - the residual term of an insurance policy, if less than one year, as noted in point (a) of this paragraph, - a policy's cancellation terms when the residual term is less than one year, - mismatches in coverage of insurance policies, - the uncertainty of payment. (4) Banks may take into consideration other operational risk transfer mechanisms during the calculation of capital requirements for operational risk using the advanced measurement approach if it can demonstrate that operational risk is substantially reduced by their use. 11

12 Article 23 (limitation) The reduction of capital requirements for operational risk from the recognition of insurance or other operational risk mitigation mechanisms shall not exceed 20% of the operational risk capital requirements before the recognition of insurance or other operational risk mitigation mechanisms Approval for the use of the Advanced Measurement Approach Article 24 (conditions and documentation for granting permission) (1) The Bank of Slovenia shall grant permission for the use of the Advanced Measurement Approach for the calculation of capital requirements for operational risk if a bank meets the qualifying criteria set out in Section of this regulation. (2) A bank shall demonstrate that it meets the conditions set out in the first paragraph of this article by submitting the following documentation set out in Annex I as part of its Application for granting of permission: (a) general information, (b) fulfilment of the qualitative qualifying criteria for the Advanced Measurement Approach, (b) fulfilment of the quantitative qualifying criteria for the Advanced Measurement Approach, (d) the use of insurance or other operational risk mitigation mechanisms, (e) self-assessment confirming the bank's compliance with qualifying criteria for the Advanced Measurement Approach. (3) A bank shall ensure the continuous fulfilment of the conditions set out in the first paragraph of this article, from the day the Bank of Slovenia grants permission for use of the Advanced Measurement Approach. (4) More detailed instructions for structuring the Application for granting of permission by the Bank of Slovenia for use of the Advanced Measurement approach to calculate capital requirements for operational risk are set out in Annex I of this regulation. (5) The provisions set out in first to fourth paragraphs of this article are also applied by analogy whenever the use of the Advanced Measurement Approach is intended by the EU parent bank and its subsidiary or by the subsidiaries of an EU parent financial holding company and jointly submit an Application for granting the permission for use of the advanced measurement approach, pursuant to Article 291 of the ZBan-1. (6) In addition to the documentation set out in the fifth paragraph of this article, the request for granting of permission shall also include the following: (a) a description and justification of the methodology for allocating operational risk capital between the different entities of the group, and (b) clarification whether and how diversification effects are factored in the risk measurement system. (7) The Bank of Slovenia shall grant authorisation for the use of the Advanced Measurement System to an EU parent bank or bank which is controlled by an EU parent financial holding company pursuant to the decision set out in the third and fourth paragraphs of Article 291 of the ZBan-1. In this respect, it shall be defined in the authorisation whether and to what extent said EU parent bank with its subsidiary institutions or said bank with other institutions, which are subsidiaries of an EU parent 12

13 financial holding company, jointly meet the qualifying criteria set out in Subsection of this regulation. (8) The Bank of Slovenia grants authorisation for the use of the Advanced Measurement Approach to a subsidiary bank with its head office in the Republic of Slovenia which has submitted a request for granting of authorisation jointly with an EU parent bank or bank which is a subsidiary of an EU financial holding company pursuant to the decision set out in third, fourth and sixth paragraphs of Article 291 of the ZBan-1. Article 25 (revocation of permission) (1) The Bank of Slovenia shall revoke permission for use of the advanced measurement approach from a bank if: (a) the bank conducts itself contrary to the decision or decision with additional measures for correction of violations during the fulfilment of the conditions set out in the first paragraph of Article 24 of this regulation; (b) the bank is in serious breach of the conditions set out in the first paragraph of Article 24 of this regulation. (2) The Bank of Slovenia shall revoke permission for the use of the Advanced Measurement Approach from a bank based on the decision for revocation of permission for use of the Advanced Measurement Approach in a bank group, for which the third, fourth and sixth paragraphs of Article 291 of the ZBan- 1are applied by analogy Combined use of different approaches for calculating capital requirements for operational risk Article 26 (general) (1) The combined use of different approaches for calculating capital requirements for operational risk means that during the calculation of capital requirements for operational risk, a bank sums portions of operational risk capital requirements calculated by different approaches (for specific business lines and/or branches). (2) The combined used of different approaches for calculating capital requirements for operational risk is permitted only if a bank acquires the appropriate permission from the Bank of Slovenia. (3) As a rule, it is possible to combine the Advanced Measurement Approach and Standardised Approache or the Advanced Measurement Approache and Basic Indicator Approache. In exceptional cases, the Standardised Approach and Basic Indicator Approaches may be combined. 13

14 Authorisation for the combined use of the Advanced Measurement Approach and Standardised Approache or the Advanced Measurement Approach and Basic Indicator Approache Article 27 (conditions and documentation for granting permission) (1) The Bank of Slovenia shall grant permission for the combined use of the Advanced Measurement Approach and Standardised Approach or permission for the use of the Advanced Measurement Approach and Basic Indicator Approache if the following two conditions are met: (a) all operational risks of the bank are captured. The operational risk measurement methodology used shall appropriately capture different activities, geographical locations, all entities or portions of entities or other relevant internally defined divisions; (b) for the bank activities for which the Advanced Measurement Approach is used, the qualifying criteria set in Subsection of this regulation shall be fulfilled; for activities for which the Standardised Approach is used, the qualifying criteria set out in Subsection of this regulation shall be fulfilled. (2) In order to achieve effective operational risk management, banks shall also meet the following two conditions: (a) a significant portion of a bank's operational risks are captured by the Advanced Measurement Approach, and/or (b) the bank commits itself to roll out the Advanced Measurement Approach across a material portion of its operations within a time schedule agreed with the Bank of Slovenia. (3) A bank shall demonstrate that it meets the conditions specified in the first paragraph of this article by submitting the following documentation as part of its request for granting of authorisation: (a) a review of how all the bank's operational risks are captured and a review of how the operational risk measurement methodology used captures the different activities, geographical locations and other relevant internally defined divisions; (b) a review of activities for which the Advanced Measurement Approach is used and how the qualifying criteria set out in Subsection of this regulation are met for these activities; (b) a review of activities for which the Standardised Approach is used and how the qualifying criteria set out in Subsection of this regulation are met for these activities; (4) More detailed instructions for structuring the Application for granting permission for the combined use of the Advanced Measurement Approach and Standardised Approache or Application for the combined use of the Advanced Measurement Approach and Basic Indicator Approaches are set out in Annexes III and IV of this regulation. Article 28 (revocation of permission) The Bank of Slovenia shall withdraw permission for the combined use of the Advanced Measurement Approach and the Standardised Approach or the Advanced Measurement Approach and the Basic Indicator Approach if: (a) the bank conducts itself contrary to the decision or decision with additional measures for correction of violations during the fulfilment of the conditions set out in the first and second paragraphs of Article 27 of this regulation; (b) the bank is in serious breach of the conditions set out in the first and second paragraphs of Article 27 of this regulation. 14

15 Permission for the combined use of the standardised and basic indicator approaches Article 29 (conditions and documentation for granting permission) (1) The Bank of Slovenia shall grant permission for the combined use of the standardised and basic indicator approaches in exceptional circumstances such as the acquisition of new business which requires a transition period for the roll out of the standardised approach. In its ruling granting authorisation for the combined use of the Standardised and Basic Indicator Approaches, the Bank of Slovenia shall also define the deadline by which a bank shall roll out the Standardised Approach for all business lines and/or branches. (2) A bank shall demonstrate that it meets the conditions specified in the first paragraph of this Article by submitting the following documentation as part of its request for granting of permission: (a) evidence of the occurrence exceptional circumstances and a description thereof, (b) a time plan for roll out of the Standardised Approach for all business lines and/or branches. (3) More detailed instructions for structuring the Application for the granting of permission by the Bank of Slovenia for the combined use of the Standardised and Basic Indicator Approaches are set out in Annex V of this regulation. Article 30 (revocation of permission) The Bank of Slovenia shall revoke the permission for the combined use of the Standardised and Basic Indicator Approaches if a bank does not roll out the Standardised Approach for all business lines and/or branches in the time frame defined in the Bank of Slovenia's permission for the combined use of the Standardised and Basic Indicator Approaches. 3. TRANSITIONAL AND FINAL PROVISIONS Article 31 (business line "Trading and Sales") Banks using the Standardised Approach for the calculation of capital requirements for operational risk and for which the basis for calculating capital requirements for the business line "Trading and Sales" achieves 50% of the total value of the basis for calculation of capital requirements for operational risk for all business lines, may apply a percentage of 15% to the "Trading and Sales" business line until 31 December Article 32 (deferring the use of the Standardised Approach for the calculation of capital requirements for credit risk) (1) A bank that in accordance with Article 405 of the ZBan-1 defers the use of the Standardised Approach for calculating capital requirements for credit risk until 1 January 2008 shall not be obliged to calculate capital requirements for operational risk until the aforementioned date: (2) A bank that begins using the Standardised Approach or an approach based on internal credit assessment systems for calculating capital requirements for credit risk during 2007 shall also begin applying the provisions of this regulation on the day it begins using the aforementioned approach. 15

16 Article 33 (application of other regulations) (1) Banks that will only partially calculate capital requirements for credit risk in accordance with the Regulation on the Capital Adequacy of Banks and Savings Banks (Official Gazette of the Republic of Slovenia, Nos. 24/02, 85/02, 22/03, 36/04, 68/04, 103/04, 124/04, 62/05, 67/05 and 74/06), shall reduce capital requirements for operational risk, based on the Basic Indicator or Standardised Approach, by the percentage representing the ratio of the exposures for which capital requirements are calculated in accordance with the aforementioned regulation to the total value of exposures. (2) During the calculation of the sum of net interest income and net non-interest income for financial years 2004 and 2005, the elements set out in Article 7 of this regulation shall be substituted with the relevant elements pursuant to Slovene Accounting Standards and the Book of Accounts regulation. Article 34 (entry into force) This regulation shall enter into force on 1 January 2007, with the exception of the provisions set out in Section 2.5 of this regulation which shall enter into force on 1 January Chairman of the Governing Board of the Bank of Slovenia Mitja Gaspari (signed) 16

17 ANNEXES Annex I: Application for the granting permission by the Bank of Slovenia for the use of the Advanced Measurement Approach for calculating capital requirements for operational risk Annex II: Application for the granting permission by the Bank of Slovenia for reversion from a more developed approach to a less developed approach for calculating capital requirements for operational risk Annex III: Application for the granting permission by the Bank of Slovenia for the combined use of the Advanced Measurement and Standardised Approaches Annex IV: Application for the granting permission by the Bank of Slovenia for the combined use of the Advanced Measurement and Basic Indicator Approaches Annex V: Application for the granting permission by the Bank of Slovenia for the combined use of the Standardised and Basic Indicator Approaches 17

18 ANNEX I Receiver: Bank of Slovenia Slovenska cesta Ljubljana Submitter: (Company and address, specification of legal representatives authorised to submit the request or grant authorisation for submission of the request) Authorised representative 1 : (Person or company, address of residence or head office) APPLICATION FOR THE GRANTING PERMISSION BY THE BANK OF SLOVENIA FOR THE USE OF THE ADVANCED MEASUREMENT APPROACH FOR CALCULATING CAPITAL REQUIREMENTS FOR OPERATIONAL RISK Contact person for handling the request Position Title Telephone Signature of legal representatives and/or authorised persons 1 To be filled in as necessary. In such cases, the appropriate authorisation shall also be attached. 18

19 JUSTIFICATION OF THE REQUEST SECTION A Documentation regarding general information as set out in point (a) of the second paragraph of Article 24 of this regulation (accompanying letter) A1. Attach a list of all internal documents in connection with the Advanced Measurement Approach, which in your opinion are important for understanding the approach. The list should include a description of the contents of each document and the date it was last updated. Note: The documents referred to in this point need not be attached unless otherwise explicitly required in the process of granting this authorisation. A2. Explain the reasons for use of the Advanced Measurement Approach. A3. Clarify whether this request is submitted on a group or individual level. A4. Attach a list of persons included in the calculation of capital requirements for operational risk using the Advanced Measurement Approach in the group, and indicate those persons responsible. If, based on Article 291 of the ZBan-1, an EU parent bank and its subsidiary institutions, or a bank and other subsidiary institutions of an EU parent financial holding company, jointly submit a request to the Bank of Slovenia for granting of permission for use of the Advanced Measurement Approach, attach a list of these entities and indicate the persons responsible. A5. Describe which activities and/or operational risks are captured by the operational risk measurement system. A6. Is the methodology of the model for calculating capital requirements for operational risk the same for all activities and/or types of operational risk or does it differ by specific business lines? If the methodology differs, explain the differences. SECTION B Documentation regarding the fulfilment of qualitative qualifying criteria for the Advanced Measurement Approach as defined in point (b) of the second paragraph of Article 24 of this regulation (the control environment of the operational risk measurement system, implementing procedures and the IT infrastructure) B1. Describe the approach for ensuring a close link between the operational risk measurement system and day-to-day risk management processes. B2. Describe the operational risk management approach. B3. Describe the role of the management body in the area of operational risk management. From the description it shall be clear which areas of operational risk management are delegated to other levels of management. B4. Briefly describe: (a) the role of the independent operational risk management function and explain how its independence is ensured; (b) the role of senior management in operational risk management. B5. Describe the existing reporting flow with regard to exposures to operational risk and loss experience. Explain the process and frequency of reports to management bodies, to risk management functions and to the internal audit department. Attach a general operational risk reporting flow scheme. 19

20 B6. Describe the nature and extent of information with regard to operational risk for specific levels of management. Attach an example of the information generated from the model for calculating capital requirements for operational risk and intended for the highest level of management. Explain how the content of information with regard to operational risk is defined and how such information is recognised as relevant for the purpose of reporting to specific levels of management. B7. Describe the process of monitoring decisions in the area of operational risk. Explain how the process works in practice on different organisational levels. B8. Describe the approach for documenting the risk management system. Explain how the quality of documentation is ensured and how it is kept up-to-date, complete and relevant. B9. Describe the approach for ensuring compliance with the risk management system. Attach the policies for the treatment of non-compliance. B10. Describe the role of the internal audit department in the area of operational risk. B11. Describe the role of external auditors in the area of operational risk. B12. Explain on what basis senior management can determine whether or not a specific operational risk measurement system validation process is satisfactory. B13. Explain how the transparency and accessibility of data flows and processes associated with the operational risk measurement system are ensured. SECTION C Documentation regarding the fulfilment of quantitative qualifying criteria for the advanced measurement approach as defined in point (c) of the second paragraph of Article 24 of this regulation (operational risk measurement systems used or planned and internal models) C1. Describe the statistical parameters and assumptions on which the model for calculating capital requirements for operational risk is based. C2. Does the model for calculating capital requirements for operational risk also take into consideration expected loss? If not, describe the method of controlling expected loss. C3. Describe and justify the principle for defining the soundness standard. C4. Describe the method for achieving the prescribed soundness standard. C5. Describe the characteristics of the four elements of the operational risk measurement system and explain the method for determining an appropriate relation between them. If a specific element was excluded from the operational risk measurement system, explain the approach for its subsequent treatment. C6. Describe the approach for capturing the major risk drivers affecting the shape of the tail of the loss estimates. C7. Describe the approach for the use of correlations during the calculation of capital requirements for operational risk and justify their use. C8. Describe the methodologies for estimating correlations and provide empirical evidence on which the methodology is based. 20