Forward-looking and Incentive-compatible Operational Risk Capital Framework

Finance and Economics Discussion Series Divisions of Research & Statistics and Monetary Affairs Federal Reserve Board, Washington, D.C. Forward-looking and Incentive-compatible Operational Risk Capital Framework Marco Migueis 2017-087 Please cite this paper as: Migueis, Marco (2017). “Forward-looking and Incentive-compatible Operational Risk Capital Framework,” Finance and Economics Discussion Series 2017-087. Washington: Board of Governors of the Federal Reserve System, https://doi.org/10.17016/FEDS.2017.087r1. NOTE: Staff working papers in the Finance and Economics Discussion Series (FEDS) are preliminary materials circulated to stimulate discussion and critical comment. The analysis and conclusions set forth are those of the authors and do not indicate concurrence by other members of the research staff or the Board of Governors. References in publications to the Finance and Economics Discussion Series (other than acknowledgement) should be cleared with the author(s) to protect the tentative character of these papers.

Forward-looking and Incentive-compatible Operational Risk Capital Framework1 Marco Migueis Federal Reserve Board April 23, 2018 Abstract This paper proposes an alternative framework to set banks’ operational risk capital, which allows for forward-looking assessments and limits gaming opportunities by relying on an incentive-compatible mechanism. This approach would improve upon the vulnerability to gaming of the AMA and the lack of risk-sensitivity of BCBS’s new standardized approach for operational risk. JEL Classification: G21, G28, G32 Keywords: Banking Regulation, Operational Risk, Regulatory Capital, Incentive Compatibility 1 – Introduction Operational risk is a substantial portion of the exposure of large and complex banks. Over the last decade, major US banks experienced large operational losses due to a variety of causes such as litigation and regulatory fines over improper mortgage origination and securitization, rigging of auction-rate securities markets, the London Whale, rigging of Libor, and the Wells Fargo account scandal. This paper proposes a novel approach to set operational risk capital requirements, which aims to be forward-looking while relying on an incentive-compatible mechanism to guarantee that banks have appropriate incentives to accurately forecast their exposure. Since 2006, the Basel capital framework for internationally active banks includes an operational risk capital requirement (BCBS 2006). US regulators chose to implement this Basel requirement through the Advanced Measurement Approach (AMA), an internal models approach to set operational risk capital requirements (Department of the Treasury et al. 2007). As of June 2017, 1 The views expressed in this manuscript belong to the author and do not represent official positions of the Federal Reserve Board or the Federal Reserve System. The author thanks Brian Clark, Filippo Curti, Lindsey Dietz, Greg Gupton, Marco Moscadelli, Ben Ranish, Robert Stewart, three anonymous referees, and seminar participants at the American Bankers Association, Durham University, Federal Reserve Board, Operational Risk North America, and Operational Riskdata eXchange Association for helpful suggestions. Email: marco.a.migueis@frb.gov. 1

AMA risk-weighted assets (RWA) comprise 29% of the advanced approaches RWA for large, internationally active US banks.2 However, regulators have found their experience with the AMA unsatisfactory. In proposing standardization of the operational risk capital requirements, the Basel Committee on Banking Supervision (BCBS) argued that AMA models are complex and that Basel II’s operational risk framework lacks comparability across banks (BCBS 2016). In December 2017, within the final package of Basel III reforms, the BCBS set a new framework for operational risk capital for internationally active banks (BCBS 2017). Under this revision, the operational risk capital framework is reduced to a single standardized approach (I will label it the “new standardized approach” or “NSA” throughout the paper). The NSA is a regulatory formula that uses financial statement information and historical operational losses (from the previous ten years) to set operational risk capital. During the consultation of BCBS’s 2016 proposal for operational risk capital (the Standardized Measurement Approach or “SMA”), industry commenters and academics criticized the lack of risk sensitivity of the framework and the elimination of forward-looking elements (American Bankers Association 2016, British Bankers Association 2016, European Banking Federation 2016, Mignola et al. 2016, Peters et al. 2016). The NSA formula is similar to the SMA formula and no new forward-looking elements were introduced. So this criticism still applies. Thus, both the AMA and the NSA have significant shortcomings.3 The ideal operational risk capital framework would be forward-looking and allow for a variety of inputs (besides past losses), while limiting gaming opportunities and ensuring comparability across banks. In this paper, I propose an alternative framework, the Forward-looking and Incentive-compatible Approach (FIA), which uses an incentive-compatible capital calculation mechanism to meet these goals. The FIA combines the NSA, necessary to guarantee compliance with Basel III as well as a minimum level of conservatism and comparability, with a forward-looking component based on banks’ estimates of exposure, aimed to enhance risk sensitivity. The incentive-compatibility of the mechanism guarantees that the framework is robust to gaming, which allows appropriate conservatism and risk sensitivity to be combined. 2 – Forward-looking and incentive-compatible operational risk capital framework A revised US operational risk capital framework can improve upon the lack of comparability and vulnerability to gaming of the AMA, and the lack of risk sensitivity and of a forward-looking view of the NSA, through the adoption of an incentive-compatible capital calculation mechanism. In the context of risk-based regulatory capital, incentive-compatibility means that banks have 2 Data from Federal Financial Institutions Examination Council 101 report. https://www.ffiec.gov/forms101.htm. 3 See Migueis (2018) for a thorough evaluation of the AMA and the NSA. 2

incentive to disclose their best estimate of future exposure. The AMA requires banks to estimate exposure at the 99.9th percentile over the next year; however, banks do not have incentive to accurately estimate this exposure. Banks have incentives to minimize capital as much as regulators allow (Jones 2000, Repullo 2004, Admati and Hellwig 2014, Marriathasan and Merrouche 2014), and the same applies to operational risk. The regulatory capital framework includes an approach that gives banks some incentive to not underestimate exposure: the market risk requirements. Within this framework, banks who record an abnormally high number of loss exceedances over their internal model estimates of the 99th percentile see their regulatory multiplier increase (BCBS 2006). This mechanism, on its own, does not guarantee incentivecompatibility – banks would still have incentive to minimize estimates despite the increase in multiplier absent other regulatory consequences, such as withdrawal of model approval. Nevertheless, this mechanism provides some automatic incentive toward accurate estimation. The literature has discussed the incentive-compatibility (or lack thereof) of bank capital frameworks and the desirability of making these frameworks more incentive-compatible.4 Adoption of an incentive-compatible capital framework would allow meaningful improvement of the risk sensitivity of the capital framework and, at the same time, simplification of its modeling requirements. With aligned incentives, banks’ best interest would be to produce accurate exposure projections; thus, within such framework, banks should be provided with freedom to pursue the best modeling methodologies. Such alignment of incentives should reduce regulators’ skepticism regarding expert assessments, such as scenario analysis, or novel exposure estimation techniques. Relative to the AMA, the need for regulators challenging the specific statistical details of banks’ modeling frameworks would be reduced and, thus, supervisory burden and banks’ compliance burden would decrease. 2.1 – Incentive compatible framework Given a single observation of a random variable of interest, Gneiting and Raftery (2007) showed that truthful estimation of a quantile α could be made incentive-compatible for a risk-neutral agent by using a function such as S(r;x) below to reward the agent. 4 Kupiec and O’Brien (1997) propose a pre-commitment approach to set capital for market risk. Calomiris (1999) argues that requiring a minimal proportion of subordinated debt and restricting the ability of governments to bail out banks would discourage banks from taking excessive risks. Cuoco and Liu (2006) demonstrate that back-testing requirements associated with the market risk rule help curb portfolio risk and induce revelation of risk. Multiple papers show that banks use securitizations to increase risk while avoiding increases in capital requirements (Rajan et al. 2010, Acharya et al. 2013, Rajan et al. 2015). Mariathasan and Merrouche (2014) show that weakly capitalized banks in countries with weak supervision see large declines in credit risk RWA after model approval, consistent with RWA manipulation. Plosser and Santos (2014) show that low-capital banks underestimate probabilities of default relative to well capitalized firms. Finally, Behn et al. (2016) show that internal credit risk models systematically underestimate default rates. 3

Where r is the qua𝑆𝑆nt(i𝑟𝑟le; 𝑥𝑥e)st=im𝛼𝛼at∙e𝑠𝑠, (x𝑟𝑟 i)s +on[e𝑠𝑠 (o𝑥𝑥b)s−erv𝑠𝑠e(𝑟𝑟d) v]a∙lu1e{𝑥𝑥 o≤f th𝑟𝑟e} +ranℎd(𝑥𝑥om) v(1ar)iable of interest (in the case of this paper, the total operational losses of a bank over a calendar year), s is a nondecreasing function, h is an arbitrary function, and 1{x ≤ r} is an indicator function that assumes the value of one if r is bigger or equal to x and zero otherwise. In the context of regulatory capital, the most straightforward way to reward the bank is by allowing the bank to minimize its capital requirement. By multiplying equation (1) by -1, S’(r;x} becomes a function that the agent will seek to minimize by truthfully reporting their quantile estimate. Setting s to be the i𝑆𝑆d′e(𝑟𝑟n;ti𝑥𝑥ty) f=un−ct𝛼𝛼io𝑠𝑠n(𝑟𝑟 ()i.e+., [s𝑠𝑠((r)𝑟𝑟 =) −r a𝑠𝑠n(d𝑥𝑥 s)(]x∙) 1={ x𝑥𝑥) –≤ w𝑟𝑟h}ic−h ℎis( a𝑥𝑥 )n o (n2-d)ecreasing function and thus meets the conditions of Gneiting and Raftery (2007) theorem – equation (2) simplifies to the expression below. S’ can then be re-writte𝑆𝑆n′ (a𝑟𝑟s ;f𝑥𝑥o)llo=w−s: 𝛼𝛼 𝑟𝑟+[𝑟𝑟−𝑥𝑥]∙1{𝑥𝑥 ≤ 𝑟𝑟}−ℎ(𝑥𝑥) (3) ′ 𝑆𝑆 (𝑟𝑟;𝑥𝑥) = −𝛼𝛼𝑟𝑟+[𝑟𝑟−𝑥𝑥]∙1{𝑥𝑥 ≤ 𝑟𝑟}−ℎ(𝑥𝑥) = −𝛼𝛼𝑟𝑟+𝑀𝑀𝑀𝑀𝑥𝑥{𝑟𝑟−𝑥𝑥,0}−ℎ(𝑥𝑥) One approach to implem=en(1t a−n 𝛼𝛼in)c𝑟𝑟e+nt𝑀𝑀ive𝑀𝑀 𝑥𝑥co{−m𝑥𝑥p,a−ti𝑟𝑟b}le− caℎp(i𝑥𝑥ta)l r(e4q)uirement is to require that the bank hold r (its estimate of the α-quantile of the annual loss distribution) during the year to which this estimate refers and, if necessary, require that additional capital be held after the annual loss of this year (x) is realized. For the remainder of this section I will assume that capital required on a period after t is equivalent to capital required in t (i.e., no time discounting). To implement such capital requirement, two modifications are necessary to equation (4). First, the whole expression should be multiplied by 1/(1-α): ′′ 𝑀𝑀𝑀𝑀𝑥𝑥{−𝑥𝑥,−𝑟𝑟}−ℎ(𝑥𝑥) 𝑆𝑆 (𝑟𝑟;𝑥𝑥) = 𝑟𝑟+ (5) Even if h(x) was set to zero, equation (5) is suffic(ie1n−t t𝛼𝛼o) provide proper incentives for banks to accurately estimate the required quantile of the operational loss distribution. However, if h(x) was set to zero, the adjustment after x is revealed would be negative, meaning that banks would see a decrease in their capital requirement in future years. To ensure that proper incentives are provided to banks to estimate the α-quantile, while not including capital reductions in future years, h(x) can be set equal to –x. Under such h function, S’’ becomes as follows: 4

′′ 𝑀𝑀𝑀𝑀𝑥𝑥{𝑥𝑥 −𝑟𝑟,0} 𝑆𝑆 (𝑟𝑟;𝑥𝑥) = 𝑟𝑟+ (6) If regulators desire to add additional conservatis(m1 −to 𝛼𝛼c)apital requirements, one alternative to increasing the quantile α is to multiply the capital requirement by a scaling factor (β). To guarantee that incentive compatibility is met, the whole S’’ would need to be equally scaled. ′′′ 𝑀𝑀𝑀𝑀𝑥𝑥{𝑥𝑥 −𝑟𝑟,0} 𝑆𝑆 (𝑟𝑟;𝑥𝑥) = 𝛽𝛽𝑟𝑟+𝛽𝛽 (7) 2.2 – Numerical example (1−𝛼𝛼) The regulatory capital framework aims to guarantee that banks have sufficient capital to cover unexpected losses. Such goal led the Basel framework to require banks to model annual exposure at the 99.9% confidence level for credit risk and operational risk and 10-day exposure at the 99% confidence level for market risk (BCBS 2006). The approach developed in this paper to guarantee the incentive-compatibility of banks’ quantile estimates can in theory can be applied to any quantile (including such extreme quantile as the 99.9th). However, given the large uncertainty associated with the estimation of extreme quantiles in general (Danielsson 2002) and of operational risk in particular (Mignola and Ugoccioni 2006, Nešlehová et al. 2006, Cope et al. 2009, Opdyke and Cavallo 2012, Ames et al. 2015), I do not believe requiring banks to estimate such extreme quantile directly would be appropriate.5 Rather, the operational risk capital framework should require banks to estimate a tail (but not extreme) quantile (e.g., 95th), and then requirements should be scaled by a safety factor (e.g., two) to ensure appropriate conservatism, as is done in the market risk VAR approach and been proposed in the operational risk literature (Mignola and Ugoccioni 2006, Nešlehová et al. 2006, Cope et al. 2009, Ames et al. 2015). Previous studies have proposed the 95th quantile, a loss amount that is expected to be equaled or exceed every 20 years (on average), as an adequate estimation target (Cope et al. 2009, Ames et al. 2015). Such quantile already reflects unexpected losses, but generally does not embed orders of magnitude of uncertainty. The safety factor applied to banks’ estimates should be informed by an impact study and reflect regulators desired degree of conservatism. This safety factor serves largely to capture uncertainty, but, in my view, should not be a very large number (e.g., larger than five) because to the degree that a bank’s tail quantile estimate reflects expected losses (e.g., a bank is forecasting to have a large legal settlement in the upcoming year) such estimate should not be multiplied up significantly. Rather, if a safety factor up to five or so is not deemed sufficient to ensure appropriate conservatism of the framework, the required estimated 5 Colliard (2015) highlighted the challenges in achieving incentive-compatibility when tail risk is significant. 5

quantile should increase instead. For the remainder of this paper, I will assume that banks are required to estimate the 95th quantile and that estimates are scaled up by a safety factor of two. If regulators required banks to estimate the 95th percentile, applied a scaling factor of two, and, to ensure incentive-compatibility, required an adjustment reflecting a positive difference between the realized loss (x) and the estimated quantile (r) to happen in the ensuing year, equation (7) would give us that capital requirements for a given year t would be as follows (I will label this “Option 1”): 95 95 To ill𝑂𝑂us𝑂𝑂t𝑂𝑂ra𝑂𝑂𝑠𝑠te𝑂𝑂 𝑂𝑂ca𝑀𝑀p𝑂𝑂it𝑂𝑂a𝑂𝑂𝑀𝑀l r𝑂𝑂e_𝑂𝑂qu𝑂𝑂i𝑂𝑂r𝑂𝑂e𝑂𝑂m𝑂𝑂e1n𝑡𝑡t=s u2n𝑄𝑄der (O𝑂𝑂p|𝑂𝑂ti−on1 1) (+an4d0 t𝑀𝑀he𝑀𝑀 o𝑥𝑥t{h𝐿𝐿e𝑂𝑂r𝑠𝑠 o𝑠𝑠𝑡𝑡p−t1io−ns𝑄𝑄 des(c𝑂𝑂ri−be1d| l𝑂𝑂a−ter2 o)n,0),} I will consider the impact on a hypothetical bank whose total annual operational losses are distributed according to a lognormal distribution, with μ = 20 and σ = 1. The average, median, 95th percentile, and 99.9th percentile of the loss distribution of this bank are presented below. Statistics of Total Annual Loss Distribution given by Lognormal(20,1) Average Median 95th Percentile 99.9th Percentile $800Mln $485Mln $2,513Mln $10,665Mln If the bank has perfect knowledge of this loss distribution, seeks to minimize capital requirements, is risk-neutral, and trades off-capital in year t one-to-one with capital in t+1 (no time discounting), then the bank will chose to estimate the 95th percentile as $2,513Mln. Assuming this loss distribution does not change through time, in 95% of years losses will not exceed the bank’s estimate. In the years directly after such years, the bank’s capital requirement would be $5,027Mln, which approximately corresponds to the 99th percentile of the operational loss distribution of this bank (note that the percentile equivalent to two times the 95th percentile will vary depending on banks’ specific loss distribution). However, given accurate estimation of the 95th percentile, losses will exceed this estimate 5% of years, and the bank will need to hold additional capital in the subsequent year within this incentive-compatible capital requirement. The table below presents some statistics regarding capital requirements under Option 1 (based on 10 million simulations). 6

Statistics of Capital Requirements (Option 1) Median & 95th Average Standard Deviation 99th Percentile Percentile $5,027Mln $8,315Mln $24,672Mln $103,480Mln On average, operational risk capital requirements would reach $8,315Mln for this bank, which corresponds approximately to the 99.8th percentile of its loss distribution. But due to the large multiplier necessary to achieve incentive-compatibility (40 in this case), in some years the penalty would be substantial, as the 99th percentile of capital requirements illustrates. One alternative to decrease the volatility of requirements, while maintaining incentive-compatibility, would be to have the penalty be distributed over a period of time, such as ten years. Under such approach, capital requirements for year t would be as follows (I will label this Option 2): 10 95 95 𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑠𝑠𝑂𝑂𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑂𝑂𝑀𝑀𝑂𝑂_𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂2𝑡𝑡 = 2𝑄𝑄 (𝑂𝑂|𝑂𝑂−1)+4�𝑀𝑀𝑀𝑀𝑥𝑥{𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡−𝑖𝑖 −𝑄𝑄 (𝑂𝑂−𝑂𝑂|𝑂𝑂−𝑂𝑂 −1),0} The table below presents some statistics for capital𝑖𝑖 =re1quirements under this approach (based on 10 million simulations). Statistics of Capital Requirements (Option 2) Median Average Standard Deviation 99th Percentile $5,027Mln $8,315Mln $7,798Mln $41,273Mln By stretching out the period over which a penalty applies, Option 2 meaningfully reduces the volatility of requirements and the severity of requirements after large losses. Nevertheless, as this example demonstrates, the possibility of very large requirements after a large loss year remains. A possible option to reduce volatility and limit excessive requirements further (while retaining incentive-compatibility) is to directly limit the increases in capital requirements due to the penalty term and cap the total amount of penalty, but track of the penalty amounts that the bank still has to hold in the future. Option 3 gives an example of a possible framework of this kind. Building from Option 1, the year-to-year increase in the penalty term is capped at two times average losses over a ten year window and the total amount of the penalty term is capped at twelve times average losses over a ten window. 7

95 Where 𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑠𝑠𝑂𝑂𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑂𝑂𝑀𝑀𝑂𝑂_𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂𝑂3𝑡𝑡 = 2𝑄𝑄 (𝑂𝑂|𝑂𝑂−1)+𝑃𝑃𝑃𝑃𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑃𝑃𝑡𝑡−1 𝑃𝑃𝑃𝑃𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑃𝑃𝑡𝑡 = 𝑚𝑚𝑂𝑂𝑂𝑂{𝐸𝐸𝑥𝑥𝐸𝐸𝑃𝑃𝑃𝑃𝐸𝐸𝑃𝑃𝑂𝑂𝐸𝐸𝑃𝑃𝑆𝑆𝑂𝑂𝑂𝑂𝐸𝐸𝑂𝑂𝑡𝑡,2𝐴𝐴𝐴𝐴𝐴𝐴𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡 +𝑃𝑃𝑃𝑃𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑃𝑃𝑡𝑡−1,12𝐴𝐴𝐴𝐴𝐴𝐴𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡} 𝐸𝐸𝑥𝑥𝐸𝐸𝑃𝑃𝑃𝑃𝐸𝐸𝑃𝑃𝑂𝑂𝐸𝐸𝑃𝑃𝑆𝑆𝑂𝑂𝑂𝑂𝐸𝐸𝑂𝑂𝑡𝑡 95 = 𝐸𝐸𝑥𝑥𝐸𝐸𝑃𝑃𝑃𝑃𝐸𝐸𝑃𝑃𝑂𝑂𝐸𝐸𝑃𝑃𝑆𝑆𝑂𝑂𝑂𝑂𝐸𝐸𝑂𝑂𝑡𝑡−1 −𝑃𝑃𝑃𝑃𝑂𝑂𝑀𝑀𝑂𝑂𝑂𝑂𝑃𝑃𝑡𝑡−1 +40𝑀𝑀𝑀𝑀𝑥𝑥{𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡 −𝑄𝑄 (𝑂𝑂|𝑂𝑂−1),0} 9 ∑𝑖𝑖=0𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡−𝑖𝑖 𝐴𝐴𝐴𝐴𝐴𝐴𝐿𝐿𝑂𝑂𝑠𝑠𝑠𝑠𝑡𝑡 = Under this approach, ExceedenceStock corresponds to the amount of penalty that the bank needs 10 to accrue to ensure incentive-compatibility. The table below presents some statics for capital requirements under this approach (based on 10 million simulations). Statistics of Capital Requirements (Option 3) Median Average Standard Deviation 99th Percentile $5,027Mln $8,315Mln $5,477Mln $26,231Mln The volatility of capital requirements is meaningfully reduced under Option 3 relative to Options 1 and 2, and so is the severity of requirements after large exceedances. The volatility of requirements and the potential for large requirements could be further reduced by decreasing the caps on the penalty proposed (two times average losses for increases in the penalty and twelve times average losses for maximum penalty). However, if these caps are reduced too much, incentive compatibility could be compromised. Under the formula proposed (and for loss distribution function of this example), average capital requirements are minimized when the bank reports the true 95th percentile – average capital under alternative percentile estimates are presented below (based on 10 million simulations). 8

Bank reports as the 95th percentile Average Capital estimate $0 $9,430Mln 50th percentile $10,400Mln 80th percentile $11,267Mln 90th percentile $8,967Mln 95th percentile $8,315Mln 96th percentile $8,373Mln 97th percentile $8,610Mln 98th percentile $9,220Mln However, if the caps were reduced meaningfully, the ExceedenceStock could accumulate indefinitely without resulting in a penalty, and average capital would no longer be minimized by reporting the 95th percentile. While average capital requirements increase if the bank reports a percentile higher than the true 95th percentile, volatility of capital requirements decreases. The table below presents how the standard deviation of capital requirements varies depending on the bank’s percentile estimates (based on 10 million simulations). Bank reports as the Standard Deviation 95th percentile of Capital estimate 90th percentile $5,827Mln 95th percentile $5,477Mln 96th percentile $5,253Mln 97th percentile $4,935Mln 98th percentile $4,469Mln 9

Therefore, overestimating the quantile required in the regulation could be beneficial to a bank if the bank prefers to limit the volatility of capital requirements. The reduction in the penalty increments and the overall penalty levels under Option 3 also make the penalty more credible. If the penalty after an exceedance needs to be very large to ensure incentive compatibility, banks may anticipate that regulators will not follow through with requiring the additional capital after large losses. By limiting how much extra capital would be required after an exceedance, this modification would thus enhance the credibility of the exceedance penalty. The analysis produced in this section ignores time discounting. If holding capital today is costlier than holding the same capital tomorrow, as is reasonable to assume, banks would likely chose to underestimate the required quantile absent some penalization that took into account time discounting. The FIA would likely require such penalty to be fully incentive-compatible. Note that large losses that the bank is fairly certain will occur in the next year (e.g., large legal losses that have not yet been reserved for, but which the bank believes are likely to happen in the next year) should not lead to breaches of the 95th quantile estimate. The bank’s 95th quantile estimate within this framework should be conditional on all available information for the ensuing year, and thus likely losses (even if very large and higher than the 95th quantile on a median year) should be incorporated into the 95th quantile estimate. When assessing whether realized losses they are larger than the quantile estimate, losses should be introduced when they produce an accounting impact. The same applies to recoveries, including insurance recoveries. This is needed to perform apples-to-apples comparisons of projected losses to realized losses. This accounting date treatment of operational losses includes legal events. When legal reserves increase, these increases should be counted as operational losses in the year they are first registered in the income statement. Similarly, reserve releases (except the reserve releases directly resulting from settlement payments) would count as loss recoveries, which would offset other operational losses in a year. The options on this section follow from equation (6), which achieves incentive-compatibility by introducing a penalty after the quantile estimate is exceeded. However, incentive-compatibility can also be achieved while allowing for capital reductions after years where losses fell short of the quantile estimate. In my view, such reductions would be hard to justify from a prudential perspective, but allowing for such reductions would decrease capital requirements after exceedances and could diminish capital volatility under an incentive-compatible framework. Such option could be further explored. 10

In my view, an approach similar to Option 3 could form the basis for a forward-looking component of the US banks operational risk capital requirement. Regulators would need to study the appropriate quantile, safety factor, and the caps to impose on the underestimation penalty, but the overall mechanics could follow this template. 2.3 – Compliance with Basel III If US regulators choose to pursue the forward-looking approach proposed in this paper, they would still need to articulate it with the NSA to comply with Basel III. The NSA provides an option to not include past internal losses in the calculation upon national discretion. Such option is likely to result in meaningfully smaller capital requirements for US banks than the main NSA methodology, given US banks’ large loss experience. US regulators could chose to adopt NSA with no losses as a floor to a forward-looking framework. This would guarantee that capital requirements do not fall below a minimal level given firms’ size, but would likely not be a binding constraint for most US banks given their high operational loss exposure relative to their international peers. Given its limited risk sensitivity, using the NSA as a backstop in this fashion rather than as the main regulatory constraint would be sensible. 3 – Conclusion The FIA would improve upon the AMA by introducing incentive-compatibility and refocusing estimation efforts on a lower confidence standard, which suffers from less uncertainty. The incentive-compatibility of the framework should allow regulators to provide banks more modeling flexibility than under the AMA, which together with the less extreme quantile used should lead to more risk-sensitive models. In addition, the forward-looking nature and flexibility of FIA models would make them more useful as risk management tools for banks than AMA models. The FIA would improve upon the NSA by introducing a forward-looking view to the capital requirement, which would likely make the FIA models more risk-sensitive than the NSA. Given that banks would have proper incentives to estimate operational loss exposure, even BCBS’s objective of improving comparability of capital requirements relative to risk (BCBS 2013) would likely be better achieved under the FIA than under the NSA. Unlike the NSA, which only provides a top-of-the-house estimate of operational loss exposure, the FIA could facilitate risk management, as banks would have incentives to build ground-up forward-looking models of exposure. In my view, the BCBS should consider reviewing the NSA in the future and adopt an approach within the spirit of the proposal introduced in this paper (although I agree a standardized backstop should likely remain). 11

This paper focused on banks’ incentives to accurately report exposure estimates. But the FIA would also produce strong incentives for banks to reduce their exposure. After improvements on risk controls, divestment from risky businesses, or increased use of insurance, banks would be able to immediately reduce their exposure estimates and thus reduce capital requirements. Under the AMA (as is currently implemented) and the NSA, improved risk controls and other risk mitigation only decrease capital slowly, as losses fail to materialize. Capital savings under the FIA could be achieved much faster. As an added bonus, the FIA would provide supervisors with banks’ incentive-compatible estimates of their exposure, which neither the AMA nor the NSA do. A possible criticism of the FIA is that that requiring additional capital after large losses have materialized, rather than before, is “too-little-too-late.” I agree that capital increases after losses exceed requirements cannot protect banks from these initial losses. Nevertheless, these capital increases serve two prudential purposes: 1) give banks incentive to hold an appropriate level of capital in the first place, so as to avoid capital increases in the future (this incentive is bigger than zero as long as a bank’s management believes there is some probability the bank will survive the next year); and 2) ensure that banks that systematically underestimate exposure are appropriately capitalized. Given their use of historical losses, the AMA (as implemented in the US) and the NSA also aim to guarantee that systematic underestimation does not persist. But given their backward-looking nature, the AMA and the NSA react to large losses rather than anticipate them. The FIA would accomplish 2) in a more direct and transparent way than the AMA or the NSA (i.e., banks which saw exceedances would get add-ons, banks that did not would not). Most importantly, the AMA and the NSA do not give banks incentive to appropriate estimate exposure. Under the FIA, banks can avoid capital increases after large losses by appropriately estimating exposure in the first place. The FIA gives banks incentive to hold capital before large losses hit, rather than after. The discussion of this paper focused on operational risk Pilar I capital requirements, and on comparing the FIA with the AMA and the NSA. But a framework such as the FIA could be used as a unified operational risk framework, replacing not only the Pilar I regime but also Pillar II and/or stress testing. Given the likely high risk sensitivity of the FIA, and need for using the NSA as a backstop to comply with Basel III, the need for additional, risk sensitive operational risk capital requirements through Pillar II or stress testing is less clear. If so desired, banks could be asked to forecast a high quantile loss under the stress scenario for stress testing purposes, although incentive-compatibility of such estimates may be harder to achieve. The FIA uses future capital requirements to provide incentives for appropriate estimation of exposure in the present. This approach results in the need for a capital penalization after losses exceeding exposure estimates are realized. There are perhaps other ways to provide banks 12

incentives to accurately estimate losses, such as changes to banks’ supervisory rating, constraints on growth, or even restrictions on compensation. I did not explore such options in this paper because defining appropriate trade-offs between capital requirements and other considerations would be challenging. But in developing an incentive-compatible capital framework, regulators should consider other options to introduce incentive-compatibility besides the capital requirement itself. Legislation currently under consideration in the US Congress would require US regulators to ensure that operational risk capital requirements focus on current businesses and are forwardlooking.6 Regardless of whether this legislation ultimately succeeds, US regulators should use the opportunity to reform the operational risk capital framework to ensure that it is forward-looking. Adopting a forward-looking approach, giving banks flexibility, without introducing gaming opportunities is best achieved by ensuring that the framework is incentive-compatible. The FIA would accomplish these goals. 6 See H.R. 4296 – “To place requirements on operational risk capital requirements for banking organizations established by an appropriate Federal banking agency.” https://www.congress.gov/bill/115th-congress/housebill/4296. Retrieved on March 26, 2018. 13

References Acharya, Viral, Philipp Schnabl, and Gustavo Suarez (2013). “Securitization without risk transfer.” Journal of Financial Economics Vol. 107, 515-536. DOI: 10.1016/j.jfineco.2012.09.004 Admati, Anat, and Martin Hellwig (2014). The Bankers’ New Clothes: What’s Wrong with Banking and What to Do about It. Princeton University Press. American Bankers Association (2016). Comment letter on the Standardized Measurement Approach. http://www.aba.com/Advocacy/commentletters/Documents/basel-operational-riskcapital-proposal-6216.pdf. Retrieved on April 9, 2018. Ames, Mark, Til Schuermann, and Hal Scott (2015). “Bank capital for operational risk: A tale of fragility and instability.” Journal of Risk Management in Financial Institutions Vol. 8, 227-243. Basel Committee on Banking Supervision (2006). “International Convergence of Capital Measurement and Capital Standards – A Revised Framework.” Basel Committee on Banking Supervision (2013). “The regulatory framework: balancing risk sensitivity, simplicity and comparability.” Basel Committee on Banking Supervision (2016). “Standardized Measurement Approach for operational risk.” Basel Committee on Banking Supervision (2017). “Basel III: Finalising post-crisis reforms.” Behn, Markus, Rainer Haselmann, and Vikrant Vig (2016). “The limits of model-based regulation.” Working Paper Series No 1928. European Central Bank. British Bankers’ Association (2016). Comment letter on the Standardized Measurement Approach. https://www.bba.org.uk/policy/financial-and-risk-policy/prudential-capital-andrisk/operational-risk/bba-response-to-the-basel-committees-consultation-on-the-standardisedmeasurement-approach-for-operational-risk/. Retrieved on April 9, 2018. Calomiris, Charlos (1999). “Building an incentive-compatible safety net.” Journal of Banking & Finance Vol. 23, 1499-1519. DOI: 10.1016/S0378-4266(99)00028-X Colliard, Jean-Edouard (2015). “Strategic Selection of Risk Models and Bank Capital Regulation.” 15th Society for the Advancement of Economic Theory Conference on Current Trends in Economics. University of Cambridge, UK. Cope, Eric, Giulio Mignola, Gianluca Antonini, and Roberto Ugoccioni (2009). “Challenges and pitfalls in measuring operational risk from loss data.” Journal of Operational Risk Vol. 4 (4), 3-27. DOI: 10.21314/JOP.2009.069 14

Cuoco, Domenico, and Hong Liu (2006). “An analysis of VaR-based capital requirements.” Journal of Financial Intermediation Vol. 15, 362-394. DOI: 10.1016/j.jfi.2005.07.001 Danielsson, Jon (2002). “The emperor has no clothes: Limits to risk modelling.” Journal of Banking and Finance Vol. 26, 1273-1296. DOI: 10.1016/S0378-4266(02)00263-7 Department of the Treasury, Federal Reserve System, and Federal Deposit Insurance Corporation (2007). “Risk-Based Capital Standards: Advanced Capital Adequacy Framework – Basel II.” European Banking Federation (2016). Comment letter on the Standardized Measurement Approach. http://www.ebf-fbe.eu/wp-content/uploads/2016/06/EBF_020386-EBF-Final- Response-to-BIS-on-CD-SMA-for-operational-risk_3June2016.pdf. Retrieved on April 9, 2018. Gneiting, Tilmann, and Adrian Raftery (2007). “Strictly Proper Scoring Rules, Prediction, and Estimation.” Journal of the American Statistical Association Vol. 102, No. 477, 359-377. DOI: 10.1198/016214506000001437 Jones, David (2000). “Emerging problems with the Basel Capital Accord: Regulatory capital arbitrage and related issues.” Journal of Banking & Finance Vol. 24, 35-58. DOI: 10.1016/S0378- 4266(99)00052-7 Kupiec, Paul, and James O’Brien (1997). “The Pre-Commitment Approach: Using Incentives to Set Market Risk Capital Requirements.” Finance and Economics Discussion Series 1997-14. Board of Governors of the Federal Reserve System. Mariathasan, Mike, and Ourda Merrouche (2014). “The manipulation of basel risk-weights.” Journal of Financial Intermediation vol. 23, 300-321. DOI: 10.1016/j.jfi.2014.04.004 Mignola, Giulio, and Roberto Ugoccioni (2006). “Sources of uncertainty in modeling operational risk losses.” Journal of Operational Risk Vol. 1 (2), 33-50. DOI: 10.21314/JOP.2006.008 Mignola, Giulio, Roberto Ugoccioni, and Eric Cope (2016). “Comments on the Basel Committee on Banking Supervision proposal for a new standardized approach for operational risk.” Journal of Operational Risk Vol. 11 (3), 51-69. DOI: 10.21314/JOP.2016.184 Migueis, Marco (2018). “Evaluating the AMA and the New Standardized Approach for Operational Risk Capital.” Social Science Research Network. Nešlehová, Johanna, Paul Embrechts, and Valérie Chavez-Demoulin (2006). “Infinite mean models and the LDA for operational risk.” Journal of Operational Risk Vol. 1 (1), 3-25. DOI: 10.21314/JOP.2006.001 15

Opdyke, John, and Alexander Cavallo (2012). “Estimating Operational Risk Capital: The Challenges of Truncation, the Hazards of Maximum Likelihood Estimation, and the Promise of Robust Statistics.” Journal of Operational Risk Vol. 7 (3), 3-90. DOI: 10.21314/JOP.2012.111 Peters, Gareth, Pavel Shevchenko, Bertrand Hassani, and Ariane Chapelle (2016). “Should the advanced measurement approach be replaced with the standardized measurement approach for operational risk?” Journal of Operational Risk Vol. 11 (3), 1-49. DOI: 10.21314/JOP.2016.177 Plosser, Matthew, and João Santos (2014). “Banks’ Incentives and the Quality of Internal Risk Models.” Staff Report No. 704. Federal Reserve Bank of New York. Rajan, Uday, Amit Seru, Vikrant Vig (2010). “Statistical Default Models and Incentives.” American Economic Review: Papers & Proceedings Vol. 100, 506-510. Rajan, Uday, Amit Seru, and Vikrant Vig (2015). “The failure of models that predict failure: Distance, incentives, and defaults.” Journal of Financial Economics Vol. 115, 237-260. DOI: 10.1016/j.jfineco.2014.09.012 Repullo, Rafael (2004). “Capital requirements, market power, and risk-taking in banking.” Journal of Financial Intermediation Vol. 13, 156-182. DOI: 10.1016/j.jfi.2003.08.005 16