The Information Value of Past Losses in Operational Risk

Finance and Economics Discussion Series Federal Reserve Board, Washington, D.C. ISSN 1936-2854 (Print) ISSN 2767-3898 (Online) The Information Value of Past Losses in Operational Risk Filippo Curti, Marco Migueis 2023-003 Please cite this paper as: Curti, Filippo, and Marco Migueis (2023). “The Information Value of Past Losses in Operational Risk,” Finance and Economics Discussion Series 2023-003. Washington: Board of Governors of the Federal Reserve System, https://doi.org/10.17016/FEDS.2023.003. NOTE: Staff working papers in the Finance and Economics Discussion Series (FEDS) are preliminary materials circulated to stimulate discussion and critical comment. The analysis and conclusions set forth are those of the authors and do not indicate concurrence by other members of the research staff or the Board of Governors. References in publications to the Finance and Economics Discussion Series (other than acknowledgement) should be cleared with the author(s) to protect the tentative character of these papers.

The Information Value of Past Losses in Operational Risk ⋆ Filippo Curtia, Marco Migueisb,∗ aFederal Reserve Bank of Richmond, 701 E Byrd St, Richmond, VA 23219 bFederal Reserve Board, 20th St and Constitution Avenue N.W., Washington, DC 20551 August 11, 2022 Abstract Operational risk is a substantial source of risk for US banks. Improving the performance of operational risk models allows banks’ management to make more informed risk decisions by better matching economic capital and risk appetite, and allows regulators to enhance their understanding of banks’ operational risk. We show that past operational losses are informative of future losses, even after controlling for a wide range of financial characteristics. We propose that the information provided by past losses results from them capturing hard to quantify factors such as the quality of operational risk controls, the risk culture, and the risk appetite of the bank. Keywords: Banking; Operational Risk; Risk Management JEL Classification: G15, G18, G19, G21, G32 ⋆Filippo Curti and Marco Migueis can be reached at Filippo.Curti@rich.frb.org and Marco.A.Migueis@frb.gov, respectively. The opinions expressed in this manuscript belong to the authors and do not represent official positions of the Federal Reserve Bank of Richmond, the Federal Reserve Board, or the Federal Reserve System. The authors thank Andrew Hawley for excellent research assistance. Also, the authors thank Brian Clark, Simon Firestone, Jeff Gerlach, Atanas Mihov, BernardetteMinton, RobertStewart, andparticipantsattheFDIC/JFSR19th AnnualBank Research Conference, the American Bankers Association Conference, and the Operational Riskdata eXchange Association (ORX) Conference for helpful suggestions. ∗Corresponding author. Tel.+1(202)452-3000. Email addresses: filippo.curti@rich.frb.org (Filippo Curti), marco.a.migueis@frb.gov (Marco Migueis)

1. Introduction Operational risk is a major source of risk for financial institutions and has grown in recent years. Several institutions have been severely damaged or bankrupted due to operational loss events. Barings Bank, a 350-year old institution, failed because Nick Leeson’s rogue transactions caused a $1.3 billion loss (Jeremy (1995)). J´erˆome Kerviel’s rogue trades cost Soci´et´e G´en´erale over $7 billion after he evaded numerous layers of computer controls and audits (Clark and Jolly (2016)). In the US, large financial institutions experienced tens of billions of dollars of losses due to the improper origination, securitization, and foreclosure practices in the lead up to the 07/08 financial crisis.1 More recently, Wells Fargo experienced multiple costly operational failures whose full impact has yet to be determined (Wattles et al. (2018)). The relevance of operational risk is recognized by US regulators, as demonstrated by 29% of the advanced approaches capital requirements of the ten large, internationally active US bank holding companies (BHCs) with approved capital models resulting from operational risk as of the end of 2019 – more than market risk, which corresponds to 5% of advanced approaches capital requirements, and equivalent to 47% of credit risk advanced approaches capital requirements (Afonso et al. (2019)).2 Furthermore, projectedoperationallossesundertheseverelyadversescenarioreached$144billionfor BHCs participating in the 2020 Dodd-Frank Act Stress Test (DFAST), corresponding to 33% of the projected pre-provision net revenue (PPNR) losses of DFAST BHCs.3 1See for example https://www.justice.gov/opa/pr/justice-department-federal-and-state-partnerssecure-record-13-billion-global-settlement and https://www.justice.gov/opa/pr/bank-america-pay- 1665-billion-historic-justice-department-settlement-financial-fraud-leading. 2The advanced approaches are model-based capital requirements to which only large, internationally active banks are subject in the US. All US banks are also subject to standardized risk-based capital requirements, which do not currently include operational risk. 3Multiple academic studies have also demonstrated the large magnitude of operational risk. For example, de Fontnouvelle et al. (2006) showed that operational risk capital would likely exceed market risk capital and could reach several billion dollars in internationally active banks. Cummins et al. (2006) and Gillet et al. (2010) find strong market reactions to operational loss events. And 1

Given the magnitude of operational risk, achieving a better understanding of its drivers and enhancing its modeling is of utmost importance for practitioners and regulators. This paper contributes to this understanding by researching whether past losses are predictive of future exposure. We investigate whether the inclusion of past operational losses improves the performance of operational risk models, and generally find that it does even when accounting for a wide range of quantifiable controls. We do not claim that past losses cause future losses, but rather that they predict future losses because they capture hard-to-quantify drivers of exposure. In particular, we believe past losses proxy for banks’ operational risk control quality, risk culture, and risk appetite. Banks with worse risk controls and less risk averse cultures are likely to experience larger and more numerous operational losses. As internal controls and risk culture are unlukely to change overnight (Lazear (1995), Kreps (1996)), an association between controls and culture and operational losses explains why past operational losses are predictive of future operational losses. We analyze different operational loss event types separately and find that past losses are predictive of future losses for all events types. In addition, we investigate how far back past losses help predict future losses and find that past losses are informative up to three years prior. Also, we show that past losses suffered by peers are informative, even after controlling for an individual bank’s past losses. This finding suggests that past losses are not only useful proxies for bank-specific risk drivers, but also for systemic risk drivers. We perform quantile regressions to assess whether past losses are also predictive of tail exposure, and find that they are. Lastly, we find that historical loss frequency is generally more predictive of future exposure Allen and Bali (2007) investigate the cyclicality in operational risk and estimate that approximately 18% of banks returns compensate for operational risk, and the figure increases to 39% for depository institutions. 2

than historical loss severity, likely because loss frequency is a more stable metric of exposure than loss severity. We consider multiple robustness checks. First, we add firm and time fixed effects to our regressions and find that past losses remain predictive of future losses. This result implies that the exposure factors which past losses proxy for are not immutable within firms, nor fully driven by aggregate time series trends. Second, we compare the performance of models including past losses with models including other metrics of operational risk management, specifically the risk management index from Ellul and Yerramilli (2013) and the number of Federal Reserve operational risk exam findings, and find that past losses outperform these other metrics in predicting operational risk exposure. We also replicate our main regressions assigning losses to their date of accounting (the date in which losses resulted in an impact in financial statements), instead of the date of occurrence (the date when a bank judges the loss event to have occurred) used in other regressions, and find that the results do not materially change. Our study contributes to the literature exploring the drivers and predictors of operational risk (Chernobai et al. (2012), Cope et al. (2012), Cope and Carrivick (2013), Wang and Hsu (2013), Abdymomunov and Mihov (2019), Abdymomunov et al. (2020), and Curti et al. (2020)). Previous studies have argued that operational risk is linked to poor control practices, and have shown that operational risk correlates with corporate governance and executive compensation (Chernobai et al. (2012)), with boarddiversity(WangandHsu(2013)), andwithregulatoryassessmentsofbanks’risk management practices (Abdymomunov and Mihov (2019)). To this point, no study has examined whether past operational losses are informative of future operational losses. The persistence of operational loss experience that we find supports the view that operational risk is driven by hard-to-measure factors such as internal controls 3

risk culture, and risk appetite. Thus, despite our different focus, the findings of our paper are consistent with this previous literature. In addition, our study contributes to the broader literature assessing the performance of risk models in banking. This literature includes studies on credit risk, such as Rajan et al. (2015) and Shumway (2001), and on market risk, such as Berkowitz (2002); however, similar studies are lacking for operational risk. Our results show that past losses significantly improve models ability to predict future losses. How to best model operational risk is of particular policy interest at moment because the Basel Committee has introduced a new standardized framework for calculating operational risk capital (Basel Committee on Banking Supervision (2017)), which allows for two variants of the calculation, one including losses and the other not. The Basel agreement set an expectation that the operational risk standardized approach be implemented by January 2023, and thus, and regulators around the world will have to decide in the forthcoming months which version of the calculation to adopt. Certain jurisdictions have signaled their intention to not use historical losses in the calculation of operational risk capital (e.g., the European Union, Canada), while others have not yet made their intentions clear (e.g., the US). Operational risk is also a critical component of banks losses in stress testing exercises, such as DFAST. And the Federal Reserve uses historical operational losses in the calculation of stress operational losses in its supervisory model. Our results inform policy considerations around operational risk measurement by suggesting that incorporating historical losses in the operational risk capital requirements is likely to result in a more risk sensitive approach, and that incorporating historical losses in stress test models is likely to result in more accurate measurement of exposure. Operational failures can significantly affect banks’ balance sheets and hamper their ability to carry out day-to-day activities. At the same time, as the size and structural 4

complexity of financial firms have increased, so has the challenge of understanding and mitigating operational risk. Our study can help banks’ risk managers build more accurate operational risk models. Better estimates of exposure would allow banks to better match their economic capital with their risk appetite and, thus, make better business decisions. The remainder of this paper is organized as follows. Section 2 describes the data. Section 3 presents our regression results. Lastly, Section 4 concludes. 2. Data Sample and Variable Definitions 2.1. Operational Loss Data This paper relies on operational loss event data, financial statements, and other supervisory information of 38 publicly traded BHCs that participate in the DFAST program. Operational loss event data follows the reporting requirements of the FR Y-14Q form and is provided by financial institutions with consolidated assets of $50 billion or more.4 Loss information (including loss amounts and counts) is used from 2000Q1, or as far back as available, and up to 2017Q4.5 The data is highly granular and provides information such as amounts, dates, classifications, and descriptions. Definitions of the variables used in the analysis are presented in Appendix A. Consistent with Basel II definitions, losses are categorized into seven event types. The event types are Internal Fraud (IF), External Fraud (EF), Employment Practices and Workplace Safety (EPWS), Clients, Products and Business Practices (CPBP), 4More information about FR Y-14Q reporting requirements, instructions and forms can be found at http://www.federalreserve.gov/apps/reportforms/. 5According to the FR Y-14Q reporting instructions, BHCs must report “a complete history of operational losses starting from the point-in-time at which the institution began capturing operational loss event data in a systematic manner.” The vast majority of BHCs in our sample report losses for periods prior to the Dodd-Frank Act. BHCs were already collecting such loss data in a systematic manner under the Basel II supervisory framework and for internal use. These data are subject to specific data quality checks, including regular exams conducted by Federal Reserve internal audit functions. 5

Damage to Physical Assets (DPA), Business Disruption and System Failures (BDSF), and Execution, Delivery and Process Management (EDPM). Appendix A provides definitions of each event type. Figure 1: Operational Losses by Event Type This figure presents the allocation of operational loss amounts (percentage of total losses and U.S. dollar loss amounts in billions) by event type. The sample includes 300,549 operational loss events incurred by 38 large U.S. bank holding companies over the period [2000:Q1-2017:Q4]. The nomenclature for event types is as follows: Internal Fraud (IF), External Fraud (EF), Employment PracticesandWorkplaceSafety(EPWS),Clients,ProductsandBusinessPractices(CPBP),Damage toPhysicalAssets(DPA),BusinessDisruptionandSystemFailures(BDSF),andExecution,Delivery and Process Management (EDPM). Figure 1 presents the U.S. dollar loss amounts by event type category, as well as the share of total losses corresponding to each event type. In aggregate, DFASTparticipating BHCs have suffered more than $230 billion in operational losses since 2000Q1. The most significant event type is CPBP, which accounts for $180 billion, or 78%, of losses. EDPM is the second category by contribution representing $31 billion 6

or 13% of losses. The remaining five event types comprise around $20 billion or less than 10% of losses. The reporting threshold for individual operational losses varies across BHCs; thus, to ensure consistency across BHCs, we discard losses below $20,000, the highest reporting threshold for institutions participating in the DFAST program. The final sample in our data consists of 300,549 individual loss events from 38 bank holding companies over the 2000Q1 - 2017Q4 period. Our data source is substantially richer than publicly available data used in other academic studies.6 Financial statement data are obtained from FR Y-9C reports when available and supplemented with data from Bloomberg otherwise.7 2.2. Operational Loss Metrics The dependent variable in the regressions of this paper is the natural logarithm of the total amount of operational losses suffered by a BHC in a quarter. We focus on total losses – instead of, for example, loss frequency as in Chernobai et al. (2012) — because total losses are the metric of exposure that is most relevant to risk managers and regulators. To mitigate the volatility of loss totals, reduce the influence of outlier observations and not given undue weight to the observations of the largest firms in regressions, we have chosen to take natural logs (and do the same for explanatory variables that incorporate quantities). The use of logs also facilitates the inclusion of certain control variables that are not proportional to firm scale (e.g., tier 1 capital ratio, ROE) in regressions. Total operational losses for quarter t are the sum of the 6For example, Chernobai et al. (2012) uses 2,426 operational loss events from Algo FIRST. 7Some firms in our sample, such as Goldman Sachs and Morgan Stanley, did not become BHCs until late in our sample period and so were not required to fill the FR Y-9C report for the earlier portionofoursample. Also,somenon-bankholdingcompanies(e.g.,CountrywideFinancial)merged with or were acquired by BHCs in our sample. For consistency between the loss datasets and the financial statement variables used for these companies, Y-9C data was augmented by Bloomberg data where appropriate. 7

loss amounts of all events with a loss amount of at least $20k and an occurrence date in quarter t. We consider three metrics of past loss experience to predict future losses: the natural logarithm of average quarterly total operational losses, the natural logarithm of average quarterly operational loss frequency, and the natural logarithm of average operational loss severity. These three averages are calculated over one calendar year (e.g., the average quarterly total operational losses for 2018Q2 corresponds to average of the total operational losses in 2017Q3, 2017Q4, 2018Q1, and 2018Q2). Frequency andseverityrepresenttwodimensionsofabank’soperationalriskexposure. Frequency reflects how often operational loss events occur in a bank, while severity reflects how damaging these events are on average. Total operational losses combine these two dimensions into a single measurement of exposure. Average frequency is typically more stable than average severity and average total operational losses because the lattertwocanexperiencelargeswingsduetoextremelossevents. Descriptivestatistics of the operational loss metrics are presented in Table 1 Panel A. 8

Table 1: Descriptive Statistics Thistablepresentsdescriptivestatistics. Thesampleincludes1,266quarterlyobservationsof38large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Panel A reports descriptive statistics on operational risk metrics. Panel B reports descriptive statistics on other variables used in our analyses. Panel A: Operational Risk Measures Mean Std P25 P50 P75 OpLosst+1 182.956 1,288.472 3.627 11.885 61.974 Ln(OpLosst+1) 2.947 1.804 1.501 2.524 4.104 OpLoss 187.596 745.063 5.209 15.782 82.765 Ln(OpLoss) 3.263 1.799 1.826 2.820 4.428 Frequency 240.547 398.536 31.000 67.875 228.000 Ln(Frequency) 4.533 1.327 3.466 4.232 5.434 Severity 0.490 1.107 0.124 0.203 0.453 Ln(Severity) 0.311 0.339 0.117 0.185 0.374 OpLossInd 304.940 300.462 83.911 205.400 428.166 Ln(OpLossInd) 5.276 0.971 4.430 5.325 6.060 FrequencyInd 459.855 83.472 385.320 474.340 519.059 Ln(FrequencyInd) 6.113 0.191 5.954 6.162 6.252 SeverityInd 597,326 520,255 217,709 423,060 839,678 Ln(SeverityInd) 12.978 0.802 12.291 12.955 13.641 Panel B: Control Variables Mean Std P25 P50 P75 Size 496,969 689,981 114,976 171,164 386,296 Ln(Size) 12.398 1.119 11.652 12.050 12.864 II-to-NII 1.806 3.356 1.007 1.770 2.657 RoE 10.267 38.456 5.785 11.046 15.719 T1Capital 11.902 3.699 10.631 12.014 13.620 EquityVol 37.288 26.966 21.068 27.933 38.728 CCARAge 7.656 8.959 0.000 4.000 14.000 MEIndex 109.460 11.693 101.270 105.064 112.970 RiskManagement 1.006 0.259 0.761 1.065 1.213 OpRiskMR(I)A 4.577 8.982 0.000 1.000 5.000 Ln(OpRiskMR(I)A) 1.058 1.059 0.000 0.693 1.792 2.3. Control Variables The regressions in this paper include a variety of firm-specific control factors that previous research has found relevant in explaining operational risk exposure. The first and most important control is firm size, as measured by the natural logarithm of 9

total assets. Previous research has shown that asset size is positively associated with operational losses (Abdymomunov and Curti (2020), and Curti et al. (2020)).8 The net interest income to noninterest income ratio has been used in the banking literature as a proxy for diversification, and previous studies have shown that this ratio affects profitability and risk (Baele et al. (2007) and Elsas et al. (2010)). The design of the Basel Committee new standardized approach also indicates that firms with a larger focus on non-traditional banking activities (and thus more noninterest income) likely experience more operational risk. For these reasons, we have included the net interest income to noninterest income ratio in our regressions. We borrow three additional controls from Chernobai et al. (2012): return on equity (ROE), tier 1 capital ratio, and equity return volatility.9 Chernobai et al. (2012) find that operational loss frequency is negatively associated with the tier 1 capital ratio, positively associated with equity return volatility, and positively associated with ROE (albeit in this last case, the effect is not statistically significant). We also control for how long the firm has been subject to CCAR, as the tighter supervision associated with CCAR may have contributed to improve firms’ risk management practices, and thus affected firms’ losses. Finally, we control for the macroeconomic environment by using an index proposed by Abdymomunov et al. (2020). Descriptive statistics of the control variables are provided in Table 1 Panel B. 8Following Chernobai et al. (2012), multiple studies have used market value of equity to control for size in operational risk studies. We have chosen not to do so because meaningful market value of equity figures are not available for multiple firms in our sample, as they are US holding companies of foreign firms (e.g., Deutsche Bank, Barclays), and thus using market value of equity as a control would meaningfully restrict our sample. Also, we believe the scale of operations of a bank is better representedbyitstotalassetsthanbyitsmarketvalueofequity. Nevertheless,wehaveestimatedthe regressions of this paper using market value of equity instead of total assets on the more restricted sample for which market value of equity is available, and estimates of the effect for our variables of interest remain similar. Results are available upon request. 9ROE is the net income divided by equity capital. Tier 1 capital ratio is tier 1 capital divided by risk-weighted assets. Equity return volatility is the annual daily volatility of returns over the previous calendar year. 10

2.4. Pairwise Correlation Table 2 presents the pairwise correlation between the variables included in this study. In the forthcoming regressions, we explain total operational losses in a given quarter by using lagged values of explanatory variables, and thus we include total operational losses one period ahead of the explanatory variables considered in Table 2. Log total operational losses are highly correlated with lagged log average total operational losses as well as with lagged log average operational loss frequency (78.9% and 77.3%, respectively — see Panel A). The correlation with lagged log average loss severity is weaker (27.3%), but still statistically significant. Log total operational losses are highly correlated with lagged log total assets (75%). Correlations with other control variables are weaker, and some of them are not statistically significant. Of the remaining control variables, the ones whose correlation with log total operational losses has highest magnitude are the net-interest income to noninterest income ratio (-18.5%) and the tier 1 capital ratio (-16.9%). 11

snoitalerroC esiwriaP :2 elbaT doirep eht revo seinapmoc gnidloh knab egral 83 fo snoitavresbo ylretrauq 662,1 sedulcni elpmas ehT .snoitalerroc esiwriap stneserp elbat sihT B lenaP .scirtem ssol lanoitarepo tnereffid neewteb snoitalerroc esiwriap stroper A lenaP .elbaliava era atad etisiuqer hcihw rof ]4Q:7102-1Q:0002[ .sesylana ruo ni desu selbairav lortnoc dna 1+t retrauq ni ssol lanoitarepo latot dezilaer neewteb snoitalerroc esiwriap stroper serusaeM ksiR lanoitarepO :A lenaP )dnIytireveS(nL )dnIycneuqerF(nL )dnIssoLpO(nL )ytireveS(nL )ycneuqerF(nL )ssoLpO(nL )1+tssoLpO(nL 000.1 )1+tssoLpO(nL 000.1 938.0 )ssoLpO(nL )000.0( 000.1 878.0 048.0 )ycneuqerF(nL )000.0( )000.0( 000.1 282.0 576.0 124.0 )ytireveS(nL )000.0( )000.0( )000.0( 000.1 843.0 071.0 133.0 623.0 )dnIssoLpO(nL )000.0( )000.0( )000.0( )000.0( 000.1 809.0 143.0 990.0 972.0 072.0 )dnIycneuqerF(nL )000.0( )000.0( )000.0( )000.0( )000.0( 000.1 168.0 599.0 043.0 381.0 433.0 133.0 )dnIytireveS(nL )000.0( )000.0( )000.0( )000.0( )000.0( )000.0( 12

selbairaVlortnoC:BlenaP ksiRpO(nL ksiR )A)I(RM tnemeganaM xednIEM egARACC tmgMksiR loVytiuqE latipaC1T EoR IIN-ot-II )eziS(nL )1+tssoLpO(nL 000.1 )1+tssoLpO(nL 000.1 077.0 )eziS(nL )000.0( 000.1 071.0- 671.0- IIN-ot-II )000.0( )000.0( 000.1 060.0 020.0- 310.0 EoR )230.0( )764.0( )356.0( 000.1 670.0- 510.0- 730.0- 771.0latipaC1T )700.0( )006.0( )581.0( )000.0( 000.1 870.0- 160.0- 230.0- 500.0- 931.0 loVytiuqE )600.0( )030.0( )162.0( )168.0( )000.0( 000.1 150.0 282.0 070.0- 450.0- 712.0 940.0 tmgMksiR )170.0( )000.0( )410.0( )850.0( )000.0( )680.0( 000.1 332.0 673.0- 282.0 150.0 140.0- 612.0 101.0egARACC )000.0( )000.0( )000.0( )170.0( )841.0( )000.0( )000.0( 000.1 114.0- 990.0- 108.0 191.0- 850.0- 180.0- 900.0 971.0 xednIEM )000.0( )000.0( )000.0( )000.0( )830.0( )400.0( )067.0( )000.0( 000.1 010.0- 191.0 381.0- 350.0- 870.0- 141.0 880.0 191.0 980.0 tnemeganaMksiR )918.0( )000.0( )000.0( )322.0( )470.0( )100.0( )440.0( )000.0( )140.0( 000.1 132.0 061.0- 480.0- 620.0- 041.0- 452.0 850.0 530.0- 243.0 623.0 )A)I(RMksiRpO(nL )000.0( )000.0( )600.0( )993.0( )000.0( )000.0( )160.0( )752.0( )000.0( )000.0( 13

3. Empirical Analysis 3.1. Hypothesis The main hypothesis we test with this study is whether past operational loss levels are predictive of future operational loss levels. We include in our analysis a wide range of controls, drawn from the literature on the determinants of operational risk. Nevertheless, we expect past losses to be predictive of future losses because operationallossesgenerallyresultfromfailuresoffirm’scontrolprocessesandcorrelate with the firm’s culture, and both internal controls and risk culture change slowly and are not directly measured by our other regression controls. In testing this hypothesis, we use the following regression equation: k (cid:88) Ln(OpLoss ) = β +β Ln(OpLossMetrics )+ β x +ϵ (1) i,t+1 1 2 i,t j j,i,t i,t j=1 Where OpLoss are total operational losses in quarter t+1, OpLossMetrics t+1 i,t are metrics of operational loss experience reflecting averages between quarter t-3 and quarter t, x is a control variable (control variables include log of total assets, j,i,t net-interest income to noninterest income ratio, ROE, tier 1 capital ratio, equity return volatility, number of years the firm has been in CCAR, and the macroeconomic environment index) as measured in quarter t, and ϵ is the error term. i,t 3.2. Main Regression Table 3 presents our main regression results. We include a regression just with the control variables plus two additional regressions: one that includes lagged average total operational losses as an explanatory variable; and another that separately includes lagged average loss frequency and lagged average loss severity as explanatory variables. 14

Table 3: Operational Loss Metrics and Current Losses This table reports coefficients from panel regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) is the t+1 natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. In Column (1), we only include control variables. In Column (2) we include Ln(OpLoss), the natural log transformation of BHC quarterly average total operational loss measured over the prior four quarters, in addition to control variables. In Column (3) we include Ln(Frequency) and Ln(Severity), the natural log transformation of BHC quarterly average loss frequency and quarterly average loss severity, respectively, over the prior four quarters. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. Ln(OpLosst+1) (1) (2) (3) Ln(OpLoss) 0.510∗∗∗ (0.000) Ln(Frequency) 0.852∗∗∗ (0.000) Ln(Severity) 0.389∗∗∗ (0.002) Ln(Size) 1.306∗∗∗ 0.601∗∗∗ 0.382∗∗∗ (0.000) (0.000) (0.000) II-to-NII −0.025∗∗ −0.014∗∗ −0.023∗∗∗ (0.050) (0.020) (0.000) RoE 0.002 0.001 0.000 (0.298) (0.279) (0.320) T1Capital −0.032∗∗ −0.022∗∗∗ −0.034∗∗ (0.012) (0.009) (0.025) EquityVol 0.000 −0.001 0.000 (0.908) (0.791) (0.833) CCARAge −0.047∗∗∗ −0.024∗∗∗ −0.035∗∗∗ (0.000) (0.002) (0.000) MEIndex 0.009 0.002 0.001 (0.156) (0.694) (0.867) N 1,266 1,266 1,266 AdjR2 0.677 0.738 0.778 BIC 3,704.456 3,447.104 3,244.402 ∆BIC 0 -257.352 -460.054 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 We find that average total operational losses are predictive of future total operational losses. A 1% increase in average total operational losses is associated with 15

a 0.51% increase in expected total operational losses in the ensuing quarter. This coefficient is statistically significant, and the Bayesian information criterion (BIC) shows that the regression model including lagged average total operational losses performs meaningfully better (lower BIC) than the baseline regression with the control variables alone.10 The regression in column (3) includes, separately, lagged average loss frequency and lagged average loss severity. Both dimensions of operational risk exposure prove predictive of operational loss totals. Nevertheless, the estimated coefficient of lagged average frequency is much larger than the estimated coefficient of lagged average severity. A 1% increase in average loss frequency is associated with a 0.85% increase in expected total operational losses in the ensuing quarter; while a 1% increase in average loss severity is associated with a 0.39% increase in expected total operational losses in the ensuing quarter. This regression performs much better than regression (2) according to the BIC, which indicates that taking into account separately frequency and severity of losses is likely to be add information relative to relying solely in past loss totals. The effects of the control variables that are statistically significant have the expected sign. Asset size is positively associated with losses, while the net-interest to noninterest income ratio (larger likely means less complex), the tier 1 capital ratio (larger means less risky), and the number of years of participation in CCAR (larger likely means less risk) are negatively associated with losses. ROE, equity return volatility, and the macroeconomic environment index are not statistically significant predictors of total operational losses in our regressions. Notably, the effect of asset size meaningfully decreases when past loss metrics are included in the regressions. 10Kass and Raftery (1995) showed that a model should be strongly preferred to another when its BIC is are more than six units larger. 16

This indicates that while size is a good proxy for operational risk exposure, the inclusion of metrics of loss experience adds relevant information relative to models that consider size alone. 11 These regression results are consistent with operational loss exposure being persistent and partly driven by factors that cannot be easily accounted for through through financial statement metrics. These factors are likely to include operational risk control quality, risk culture, and risk appetite. Such factors influence operational loss history and are slow moving. Therefore, they likely explain why operational loss history predicts future operational losses, even after controlling for various balance sheet and business model factors. These results support the inclusion of historical operational losses in the modeling of future operational risk exposure. In addition, the results support the separate consideration of frequency and severity in operational risk models. 3.3. Regressions by Event Type Table 4 shows regressions by operational loss event type (i.e., both the dependent variable and the lagged loss metric are calculated using only losses from a certain event type). There are seven event types under the Basel categorization: internal fraud (IF); external fraud (EF); employment practices and workplace safety (EPWS); clients, products, and business practice (CPBP); damage to physical assets (DPA); business disruption and systems failures (BDSF); and execution, delivery, and process management (EDPM) (Basel Committee on Banking Supervision (2006)). All these regressions include the same set of controls as the regressions in the previous 11We also considered alternative specifications where both the dependent loss total variable and the explanatory lagged losses variables were scaled by total assets, and the results regarding the significance of historical losses remain. See Appendix B. 17

subsection.12 Lagged average total operational losses (Panel A) are predictive of future total operational losses across all event types, except for damage to physical assets. Meanwhile, the regressions where lagged average loss frequency and lagged average loss severity are accounted for separately (Panel B) show that lagged average loss frequency is always positively associated with future total losses and statistically significant. The effect of average loss severity is positive and statistically significant for CPBP and EDPM — the event types with the highest dollar losses — but is negative and statistically significant for BDSF. The negative association between past BDSF loss severity and future BDSF losses may reflect firms investing in their operational resilience after large disrupations and, therefore, minimizing future losses. In the other event types, lagged average loss severity is not a statistically significant predictor of future total operational losses. For all event types, except EPWS, the regression that separately accounts for frequency and severity performs better according to the BIC than the regression that includes lagged average total operational losses alone. 12Note that banks sometimes have zero operational loss events in a quarter. In those cases, the log of operational loss frequency plus one and the log of operational loss severity plus one equal zero. 18

sepyT tnevE :4 elbaT lortnoc dna scirtem ssol lanoitarepo no 1+t retrauq ta sessol lanoitarepo latot dezilaer fo snoisserger lenap morf stneicffieoc stroper elbat sihT egral 83 fo snoitavresbo ylretrauq 662,1 fo lenap decnalabnu na sesirpmoc elpmas noitamitse ehT .epyt tneve yb t retrauq ni derusaem selbairav noitamrofsnart gol larutan eht si ) ssoLpO(nL .elbaliava era atad etisiuqer hcihw rof ]4Q:7102-1Q:0002[ doirep eht revo seinapmoc gnidloh knab 1+t larutan eht si )ssoLpO(nL .retrauq radnelac nevig a revo CHB a yb derrucni epyt tneve cfiiceps a fo )snoillim ni( sessol lanoitarepo latot eht fo )ycneuqerF(nL .sretrauq ruof roirp eht revo derusaem epyt tneve cfiiceps a fo ssol lanoitarepo latot egareva ylretrauq CHB fo noitamrofsnart gol cfiiceps a fo ytireves ssol egareva ylretrauq dna ycneuqerf ssol egareva ylretrauq CHB fo noitamrofsnart gol larutan eht era )ytireveS(nL dna secitcarP tnemyolpmE ,)FE( duarF lanretxE ,)FI( duarF lanretnI :swollof sa era sepyt tnevE .sretrauq ruof roirp eht revo ,ylevitcepser ,epyt tneve noitpursiD ssenisuB ,)APD( stessA lacisyhP ot egamaD ,)PBPC( secitcarP ssenisuB dna stcudorP ,stneilC ,)SWPE( ytefaS ecalpkroW dna na sa )ssoLpO(nL gnisu stluser stroper A lenaP .)MPDE( tnemeganaM ssecorP dna yrevileD ,noitucexE dna ,)FSDB( seruliaF metsyS dna ,)eziS(nL( selbairav lortnoC .selbairav yrotanalpxe sa )ytireveS(nL dna )ycneuqerF(nL gnisu gnitluser stroper B lenaP .elbairav yrotanalpxe era setamitse tneicffieoc rieht tub ,elbat siht fo snoisserger lla ni dedulcni era )xednI EM ,egA RACC ,loV ytiuqE ,latipaC 1T ,EoR ,IIN-ot-II .sesehtnerap ni detneserp era seulav-P .retrauq dna CHB yb deretsulc era srorre dradnatS .ytiverb rof dettimo elbairaV yrotanalpxE sa sessoL lanoitarepO latoT egarevA :A lenaP )1+tssoLpO(nL )7( )6( )5( )4( )3( )2( )1( MDPE FSDB APD PBPC SWPE FE FI ∗∗∗756.0 ∗∗∗442.0 101.0 ∗∗∗523.0 ∗∗∗186.0 ∗∗∗497.0 ∗∗∗143.0 )ssoLpO(nL )000.0( )600.0( )771.0( )000.0( )000.0( )000.0( )000.0( seY seY seY seY seY seY seY slortnoCCHB 662,1 662,1 662,1 662,1 662,1 662,1 662,1 N 457.0 444.0 841.0 536.0 477.0 167.0 824.0 2RjdA 504.068,2 755.077,1 800.626,1 929.021,4 787.328,1 496.322,2 808.778,1 CIB 9616.955- 3784.75- 6071.4- 2350.201- 3632.494- 7064.6611- 6849.931- CIB∆ 10.0<p∗∗∗,50.0<p∗∗,01.0<p∗ 19

selbairaV yrotanalpxE sa seitireveS ssoL egarevA dna seicneuqerF ssoL egarevA :B lenaP )1+tssoLpO(nL )7( )6( )5( )4( )3( )2( )1( MDPE FSDB APD PBPC SWPE FE FI ∗∗∗047.0 ∗∗∗673.0 ∗∗∗971.0 ∗∗∗435.0 ∗∗∗614.0 ∗∗∗335.0 ∗∗∗563.0 )ycneuqerF(nL )000.0( )000.0( )000.0( )000.0( )000.0( )000.0( )000.0( ∗∗176.0 ∗∗∗831.0− 510.0− ∗∗∗542.0 880.0 831.0 800.0 )ytireveS(nL )710.0( )000.0( )766.0( )100.0( )464.0( )482.0( )098.0( seY seY seY seY seY seY seY slortnoCCHB 662,1 662,1 662,1 662,1 662,1 662,1 662,1 N 277.0 505.0 202.0 646.0 367.0 208.0 854.0 2RjdA 713.277,2 459.926,1 805.845,1 256.680,4 973.098,1 262.599,1 335.418,1 CIB 3507.746- 2090.891- 4076.18- 2033.631- 8446.724- 1398.4931- 422.302- CIB∆ 10.0<p∗∗∗,50.0<p∗∗,01.0<p∗ 20

Increases in lagged average total losses predict the largest increases in EF, EPWS, and EDPM losses (a 1% increase in lagged average event type total losses is associated with a 0.79%, a 0.68%, and a 0.66% increase in the ensuing quarter event type total losses, respectively). While increases in lagged average event type loss frequency predict the largest increases in EDPM, CPBP, and EF (a 1% increase in lagged average event type loss frequency is associated with a 0.74%, 0.53%, and 0.53% increase in the ensuing quarter event type total losses, respectively). EDPM losses also have the strongest association with lagged average loss severity (a 1% increase in lagged average event type loss severity is associated with a 0.67% increase in the ensuing quarter event type total losses). The weak relationship between DPA losses and metrics of its lagged loss experience (lagged average total losses are not significant, and in the frequency & severity regression the BIC improvement obtained from introducing the historical loss metrics is the smallest among the event types) is unsurprising because they are driven more by external events (e.g., weather events) than by internal controls, risk culture, and risk appetite. So, this weaker relationship is consistent with the mechanism we hypothesize explains why past operational losses are predictive of future operational losses. These event type regressions strongly support the robustness of our top-of-thehouse results, as they show that the relevance of past operational losses in predicting future operational losses is not a feature of one kind of operational loss event, but rather a general property of operational risk exposure across its various dimensions. 3.4. Lag Structure To further understand the dependency of operational losses across time, we performed additional regressions where we discretely added up to four years of average loss metrics. Table 5 presents the regression results. Panel A focuses on 21

using lagged average total losses, while the regressions in Panel B use lagged average loss frequency and lagged average loss severity separately. In the regression in the first column, only the average for the year previous to the quarter to be explained is used; while in the second column, the average for the year previous to that is added; and so on. To allow for fair comparisons across these regressions, we only included the observations that could be included in all regressions (i.e., the first observation in these regressions refers to the start of the fifth year for which there is data for a bank because four lag years are needed, rather than just one lag year as is the case in the other regressions in this paper). This approach implies that the number of observations is lower (1036) than in the other regressions in this paper (1266), and that the regression results from column 1 in Panel A and B are slightly different from those in Table 3. 22

Table 5: Lagged Operational Loss Metrics and Current Losses This table reports coefficients from panel regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprisesanunbalancedpanelof1,036quarterlyobservationsof38largebankholdingcompaniesover theperiod[2000:Q1-2017:Q4]forwhichrequisitedataareavailable. Ln(OpLoss ) isthenaturallog t+1 transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. Ln(OpLoss),Ln(Frequency),andLn(Severity) arethenaturallogtransformationofBHC quarterly average total operational loss, average loss frequency, and average loss severity measured over the prior four quarters. Ln(OpLoss ), Ln(Frequency ), and Ln(Severity ) are the t−4 t−4 t−4 natural log transformation of BHC quarterly average total operational loss, average loss frequency, and average loss severity measured over the quarters t-7 to t-4. Ln(OpLoss ), Ln(Frequency ), t−8 t−8 and Ln(Severity ) are the natural log transformation of BHC quarterly average total operational t−8 loss, average loss frequency, and average loss severity measured over the quarters t-11 to t-8. Ln(OpLoss ), Ln(Frequency ), and Ln(Severity ) are the natural log transformation t−12 t−12 t−12 of BHC quarterly average total operational loss, average loss frequency, and average loss severity measured over the quarters t-15 to t-12. Panel A reports regression results when lagged quarterly average total operational losses are used as explanatory variables. Panel B reports regression results when lagged quarterly average loss frequency and lagged quarterly average loss severity are used as explanatory variables. Control variables (Ln(Size), II-to-NII, RoE, T1 Capital, Equity Vol, CCAR Age, ME Index) are included, but their coefficient estimates are omitted for brevity. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. Panel A: Average Total Operational Losses as Explanatory Variables Ln(OpLosst+1) (1) (2) (3) (4) Ln(OpLoss) 0.503∗∗∗ 0.327∗∗∗ 0.279∗∗∗ 0.275∗∗∗ (0.000) (0.000) (0.000) (0.000) Ln(OpLoss ) 0.329∗∗∗ 0.264∗∗∗ 0.262∗∗∗ t−4 (0.000) (0.000) (0.000) Ln(OpLoss ) 0.178∗∗∗ 0.173∗∗∗ t−8 (0.000) (0.000) Ln(OpLoss ) 0.016 t−12 (0.617) BHCControls Yes Yes Yes Yes N 1,036 1,036 1,036 1,036 AdjR2 0.741 0.760 0.766 0.766 BIC 2,799.761 2,725.988 2,708.425 2,715.157 ∆BIC -203.7258 -277.4985 -295.0614 -288.3294 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 23

Panel B: Average Loss Frequencies and Average Loss Severities as Explanatory Variables Ln(OpLosst+1) (1) (2) (3) (4) Ln(Frequency) 0.842∗∗∗ 0.785∗∗∗ 0.795∗∗∗ 0.783∗∗∗ (0.000) (0.000) (0.000) (0.000) Ln(Frequency ) 0.088 0.145 0.140 t−4 (0.321) (0.344) (0.361) Ln(Frequency ) −0.052 0.185 t−8 (0.699) (0.267) Ln(Frequency ) −0.231∗∗ t−12 (0.021) Ln(Severity) 0.288∗∗ 0.165∗ 0.106 0.064 (0.015) (0.052) (0.160) (0.526) Ln(Severity ) 0.467∗∗∗ 0.420∗∗∗ 0.413∗∗∗ t−4 (0.000) (0.000) (0.000) Ln(Severity ) 0.382∗∗∗ 0.375∗∗∗ t−8 (0.000) (0.000) Ln(Severity ) 0.110 t−12 (0.353) BHCControls Yes Yes Yes Yes N 1,036 1,036 1,036 1,036 AdjR2 0.787 0.792 0.794 0.795 BIC 2,601.683 2,593.127 2,592.031 2,600.051 ∆BIC -399.8257 -410.3599 -411.4557 -403.4357 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 Panel B regressions generally show that the information provided by loss frequency is almost fully captured by frequency in the previous year (regression (4) shows the fourth lag of frequency negative and statistically significant, but regression (4) performs worse than regression (2) or (3) according to the BIC). Meanwhile, average loss severity in a two year and three year lag appears more predictive of losses than average loss severity in the previous year. This difference between frequency and severity likely results from frequency being a stable metric, not prone to upswings and downswings year-to-year, and thus once frequency increases, exposure can be expected to increase in the near future; while severity is volatile, and thus extrapolating into the future that exposure has increased after observing an increase in severity is only 24

more certain after multiple years of high severity are observed. Panel A regressions show that lagged average total losses are informative up to three years prior to the modeled quarter. The relevance of total losses up to three year lags is likely explained by the compound effect of frequency and severity, which, as discussed above, provide information about future exposure in the first lag (frequency) and in the second and third lag (severity). 3.5. Industry Experience The hard-to-measure factors driving operational risk exposure (which we argue in this paper can be proxied by past losses) likely have commonalities across firms in the banking industry. For example, an increase in the rate of credit card fraud across the industry is likely to also provide information about the exposure of an individual firm that has not yet observed a large increase in fraud in its own credit cards. In this subsection, we formally test whether industry-wide historical operational loss experience helps explain the operational risk exposure of individual firms. To do so, we define three metrics of the industry-wide operational loss experience based on average total losses, average loss frequency, and average loss severity. Consistent with our firm-level historical metrics, we calculate industry averages over a four-quarter window. To separate the effect of a firm’s own loss experience from the effect of the industry experience, we exclude a firm’s losses from the calculations of the industry metric (thus, the industry loss metrics on a given quarter will vary slightly across the firms). Also, because the number and size of firms change through our sample, simple averages of industry loss metrics would move even if the average riskiness of firms, controlling for their size, is unchanged. To eliminate such confounding effects from our metrics of industry historical loss experience, we followed the following approach in calculating them: 1) To build the average industry-wide operational loss total and the average 25

industry-wide operational loss frequency for each observation, we took the following steps: i) we calculate the average total operational loss (average operational loss frequency) for all banks; ii) we sum these averages across all banks (except for the firm for which an observation refers to); 3) we sum total assets at time t for all banks (except for the firm for which the observation refers to); and 4) we divide the sum of average total losses (sum of average loss frequency) by the sum of total assets. (cid:80) Nt OpLossMetrics m,t m=1,m̸=i OpLossMetricsInd = (2) i,t (cid:80) Nt Size m,t m=1,m̸=i Where OpLossMetricsInd is the average industry-wide operational loss (loss i,t frequency) assigned to bank i in quarter t, N represents the number of banks in our t sample in quarter t, OpLossMetrics is the average operational loss (loss frequency) m,t of bank m measured in quarter t (calculated as described in Section 2.2), and Size m,t are the total assets of bank m in quarter t. This calculation provides the average total operational losses (average frequency of operational losses) per dollar of total assets in our industry sample. 2) To build the average industry-wide operational loss severity for each observation, we sum the severities of all losses for all banks in a given four quarter window and divide this sum by the total number of loss events (the losses experienced by the firm are excluded from the numerator and the denominator). (cid:80) St Severity x x=1,x̸⊂i SeverityInd = (3) i,t S −s t i,t 26

Where SeverityInd is the average industry-wide operational loss severity asi,t signed to bank i in quarter t, S represents the total number of operational loss t events in quarters t−3 to t, Severity is the dollar amount of loss event x, and s x i,t represents the number of loss events of bank i in quarters t−3 to t. This simple average provides the average severity of a loss event in the industry, where all losses are equally weighted (and thus banks with more losses influence the average more). Table 6 presents the regressions results where lagged average industry losses are included as explanatory variables together with firm lagged loss metrics (all control variables included in previous regressions are also included). The regression in column (1) pairs lagged average industry total losses with lagged average firm-level total losses, while the regression in column (2) separately accounts for lagged average industry loss frequency, lagged average industry loss severity, lagged average firm-level loss frequency, and lagged average firm-level loss severity. Lagged average industry total losses are predictive of individual firms’ exposure. A 1% increase in average industry total losses (excluding the firm) is associated with a 0.23% increase in expected total losses of a firm in the ensuing quarter. The inclusion of lagged average industry total losses in the regression only slightly attenuates the coefficient of lagged average firm-level total losses, from 0.510 (see Table 3 column 2) to 0.480. 27

Table 6: Industry Operational Loss Metrics and Current Losses This table reports coefficients from quantile regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) t+1 is the natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. Ln(OpLoss), Ln(Frequency), and Ln(Severity) are the natural log transformation of BHC quarterly average total operational loss, average loss frequency, and average loss severity measured over the prior four quarters. Ln(OpLossInd) is the natural log transformationofindustryquarterlyaverageoperationallossesmeasuredoverthepriorfourquarters as per Equation 2. Ln(FrequencyInd) is the natural log transformation of industry average loss frequency measured over the prior four quarters as per Equation 2. Ln(SeverityInd) is the natural log transformation of industry average loss severity measured over the prior four quarters as per Equation 3. Control variables (Ln(Size), II-to-NII, RoE, T1 Capital, Equity Vol, CCAR Age, ME Index) are included, but their coefficient estimates are omitted for brevity. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. Ln(OpLosst+1) (1) (2) (3) (4) Ln(OpLossInd) 0.400∗∗∗ 0.230∗∗∗ (0.000) (0.000) Ln(OpLoss) 0.480∗∗∗ (0.000) Ln(FrequencyInd) 0.050 0.589∗∗ (0.926) (0.049) Ln(Frequency) 0.837∗∗∗ (0.000) Ln(SeverityInd) 0.476∗∗∗ 0.025 (0.001) (0.781) Ln(Severity) 0.374∗∗∗ (0.005) BHCControls Yes Yes Yes Yes N 1,266 1,266 1,266 1,266 AdjR2 0.690 0.742 0.690 0.779 BIC 3,657.678 3,433.605 3,663.431 3,247.969 ∆BIC -46.7787 -270.8512 -41.0248 -456.4876 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 The regression where the effects of severity and frequency are taken separately (column 2) shows that average industry loss frequency is a statistically significant predictor of exposure, while average industry loss severity is not. A 1% increase in industry average loss frequency (excluding the firm) is associated with a 0.59% 28

increase in expected total losses of a firm in the ensuing quarter. The coefficients of lagged average firm-level loss frequency and lagged average firm-level loss severity are only slightly reduced relative to the regression that does not include industry losses (see Table 3 column 3). These results indicate that when losses become frequent in the industry, individual banks generally see their own loss totals increase. While industry average severity, which is meaningfully influenced by large losses, is not a statistically significant indicator of future exposure. The results of this subsection suggest that operational risk presents commonalities across the industry, which are reflected in banks’ loss experience. And thus, external loss data can contribute to the understanding of operational risk in individual firms. Still, these regressions also show that industry-wide factors do not explain away the association between a firms historical loss history and its operational risk exposure; therefore, this association is unlikely to be fully due to systemic factors such as higher regulatory scrutiny is some periods, and is likely in part due to factors idiosyncratic to a firm, such as its internal controls, risk culture, and risk appetite 3.6. Tail Exposure Operational risk exposure is dominated by large, often idiosyncratic, events (Neˇslehov´a et al. (2006) and Cope et al. (2009)). Thus, beyond understanding the drivers of expected operational losses, understanding and modeling the tail regions of the operational loss distribution is critical for effective risk management. In this subsection, we examine whether historical metrics of loss experience are predictive of tail losses using quantile regression. We present results for 95th quantile regressions, which correspond to infrequent occurrences (i.e., one-in-twenty-years losses) while not quite to the extreme tail (e.g., the 99.9th quantile used in the operational risk 29

capital standards.13 Our findings are generally robust to changes in the quantile used.14 Table 7 presents the quantile regression results. All regressions include the same controls as the least squares regressions discussed in previous subsections. The quantile regressions show broadly similar results to the least squares regressions. A 1% increase in lagged average total operational losses is associated with a 0.74% increase in the 95th quantile of total operational losses in the ensuing quarter; while the regression that separately accounts for loss frequency and severity (column 3) shows that a 1% increase in lagged average loss frequency is associated with a 0.89% increase in the 95th quantile of total operational losses in the ensuing quarter, and that a 1% increase in lagged average loss severity is associated with a 0.98% increase in the 95th quantile of total operational losses in the ensuing quarter. Loss metrics are often used by practitioners and regulators in capital and stress testing models that aim to project tail losses (Board of Governors of the Federal Reserve System (2020)). These quantile regressions corroborate the usefulness of using metrics based on past losses to model tail exposure. 13Detailed information on the US risk-based capital standards can be found at: https://www.govinfo.gov/content/pkg/FR-2007-12-07/pdf/07-5729.pdf 14Albeit coefficient standard errors do increase meaningfully as we move towards higher quantiles due to higher quantile estimates depending more heavily on a few tail observations. 30

Table 7: Operational Loss Metrics and Tail Risk This table reports coefficients from 95th quantile regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) t+1 is the natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. In Column (1), we only include control variables. In Column (2) we include Ln(OpLoss), the natural log transformation of BHC quarterly average total operational losses measured over the prior four quarters, in addition to control variables. In Column (3) we include Ln(Frequency) and Ln(Severity), the natural log transformation of BHC quarterly average loss frequency and quarterly average loss severity, respectively, over the prior four quarters, in addition to control variables. Pseudo R2 is presented to compare the performance of the regressions and is calculated following Koenker and Machado (1999). P-values are computed with bootstrap (100,000 samples) and presented in parentheses. Ln(OpLoss) (1) (2) (3) Ln(OpLoss) 0.740∗∗∗ (0.000) Ln(Frequency) 0.886∗∗∗ (0.000) Ln(Severity) 0.978∗ (0.054) Ln(Size) 1.381∗∗∗ 0.525∗∗∗ 0.516∗∗∗ (0.000) (0.000) (0.002) II-to-NII −0.096∗∗∗ −0.048 −0.057 (0.002) (0.388) (0.146) RoE 0.013∗∗ −0.002 −0.002 (0.020) (0.766) (0.330) T1Capital −0.114∗ −0.029 −0.064∗∗ (0.064) (0.156) (0.036) EquityVol −0.001 −0.007 −0.002 (0.704) (0.428) (0.814) CCARAge −0.068∗∗∗ −0.044∗∗∗ −0.059∗∗∗ (0.000) (0.000) (0.000) MEIndex 0.013∗ 0.019 0.002 (0.092) (0.150) (0.836) N 1,266 1,266 1,266 PseudoR2 0.411 0.469 0.487 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 31

3.7. Time and Bank Fixed Effects Table 8 Panel A shows the regressions results when quarter fixed effects are added to the regression. The statistical significance of lagged total operational losses, lagged operational loss frequency, and lagged operational loss severity in explaining total operational losses remains, while the magnitude of the coefficients is only slightly reduced. These regressions show that the results in this paper are robust to time effects as the predictive power of historical loss metrics is not an artifact of systemic effects relating to specific time periods. Inadditiontoquarterfixedeffects, regressionsinTable8PanelBincludefirmfixed effects as control variables. The inclusion of firm fixed effects reduces the explanatory power of historical loss metrics. Lagged average loss severity is no longer statistically significant and the coefficient of lagged average total losses decreases in magnitude meaningfully. The improvement of the BIC resulting from the inclusion of historical loss metrics is also much smaller than when firm effects are not included. The diminished explanatory power of historical loss metrics once fixed effects are included is not surprising because the internal control processes and cultural characteristics of firms originating operational risk exposure proxied by past losses are unlikely to change overnight, and thus are bound to be somewhat absorbed by firm fixed effects. Nevertheless, we note that, according to the BIC, the regression models that include historical operational losses are meaningfully superior to the one that does not. And the coefficient of lagged loss frequency does not lose much of its magnitude or its statistical significance, which suggests that the underlying risk factors that frequency proxies have meaningful variation through time and, thus, that loss frequency is a particularly relevant metric of future exposure. 32

Table 8: Operational Loss Metrics and Current Losses with Time Fixed Effects This table reports coefficients from panel regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) is the t+1 natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. In Column (1), we only include control variables. In Column (2) we include Ln(OpLoss), the natural log transformation of BHC quarterly average total operational losses measured over the prior four quarters. In Column (3) we include Ln(Frequency) and Ln(Severity), the natural log transformation of BHC quarterly average loss frequency and quarterly average loss severity measured over the prior four quarters. Control variables (Ln(Size), II-to-NII, RoE, T1 Capital, Equity Vol, CCAR Age, ME Index) are included in all specifications, but their coefficient estimates are omitted for brevity. All specifications include time (quarter) fixed effects. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. Panel A: Time FE Ln(OpLosst+1) (1) (2) (3) Ln(OpLoss) 0.463∗∗∗ (0.000) Ln(Frequency) 0.803∗∗∗ (0.000) Ln(Severity) 0.385∗∗∗ (0.003) BHCControls Yes Yes Yes QuarterFE Yes Yes Yes N 1,266 1,266 1,266 AdjR2 0.708 0.754 0.788 BIC 3,932.454 3,721.854 3,538.713 ∆BIC 0 -210.6007 -393.7411 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 33

Panel B: Bank & Time FE Ln(OpLosst+1) (1) (2) (3) Ln(OpLoss) 0.180∗∗∗ (0.001) Ln(Frequency) 0.782∗∗∗ (0.000) Ln(Severity) 0.062 (0.607) BHCControls Yes Yes Yes BHCFE Yes Yes Yes QuarterFE Yes Yes Yes N 1,266 1,266 1,266 AdjR2 0.780 0.785 0.797 BIC 3,796.313 3,776.976 3,708.847 ∆BIC 0 -19.3376 -87.4666 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 3.8. Comparison to Other Risk Management metrics So far we have shown that past operational losses provide information regarding operational risk exposure, even when various financial metrics and fixed effects are controlled for. To further understand whether past operational losses are useful predictors of operational risk exposure, we compare models including historical loss metrics with models including alternative indicators of risk management quality. Table 9 Panel A compares a regression model using historical operational loss metrics with a regression model using the risk management index (RMI) from Ellul and Yerramilli (2013). Data on RMI is only available up to 2013 and only for a subset of the firms that are included in the rest of the analysis.15 Therefore, to better compare the performance of the RMI and the historical loss metrics, we restrict the sample to the period and the firms for which both are available. The bilateral correlation between the RMI and the log of future operational losses is only 5% (see 15We thank Andrew Ellul for sharing the RMI data with us. 34

Table 2 Panel B). In the regression analysis, once the controls used so far in this paper are accounted for, RMI is not a statistically significant predictor of operational losses and its inclusion in the regression does not meaningfully improve the performance of the model according to the BIC. Lagged operational loss severity performs worse as a predictor of operational risk in this subsample than in our full sample and loses statistical significance; meanwhile, the coefficient of operational loss frequency does not meaningfully change with the introduction of RMI as an additional control and retains statistical significance. These results indicate that historical loss frequency is likely a more reliable proxy for the idiosyncratic factors driving the operational risk of a firm than its RMI. Table 9 Panel B introduces as an alternative explanatory variable the log of the number of the Federal Reserve operational risk supervisory findings that firms are subject to. Operational risk supervisory findings reflect issues where the Federal Reserve assesses the firms operational risk processes to not be adequate to meet regulatoryrequirements. TothedegreethattheissuesidentifiedbytheFederalReserve are material, a relation between supervisory findings and operational losses should be expected. The bilateral correlation between the log of the number of operational risk supervisory findings and the log of future operational losses is approximately 32%. Also, the regression results confirm this hypothesis. When included in a regression together with lagged operational loss severity and lagged operational loss frequency, the log of the number of operational risk findings is a statistically significant predictor of operational losses, and the model that includes the number of findings (column 4) outperforms the model that does not include the number of findings (column 3) according to the BIC. Meanwhile, the coefficients associated with lagged operational loss frequency and lagged operational loss severity do not change meaningfully, albeit lagged operational loss severity loses significance. These results indicate that while 35

the supervisory findings are a relevant indicator of firm’s operational risk, they do not substitute for the information provided by historical operational losses. Table 9: Operational Loss Metrics and Current Losses with Risk Management This table reports coefficients from panel regressions of realized total operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) is the t+1 natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. In Column (1), we only include control variables. In Column (2), in addition to control variables, we include a metric capturing the quality of the bank holding companies risk management function. In Panel A, the risk management metric is Risk Management the risk management index developed by Ellul and Yerramilli (2013). In Panel B, the risk management metric is Ln(OpRisk MR(I)A) the natural log transformation of the number of MRIA and MRA outstanding at the beginning of the quarter of interest. In column (3) we include Ln(Frequency) and Ln(Severity), the natural log transformation of BHC quarterly average loss frequency and quarterly average loss severity measured over the prior four quarters in addition to control variables. In column (4) we include the risk management metric, Ln(Frequency) and Ln(Severity). Control variables (Ln(Size), II-to-NII, RoE, T1 Capital, Equity Vol, CCAR Age, ME Index) are included in all specifications, but their coefficient estimates are omitted for brevity. All specifications in Panel A include time (quarter) fixed effects. All specifications in Panel B include BHC and time (quarter) fixed effects.Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. Panel A: Risk Management Index Ln(OpLosst+1) (1) (2) (3) (4) Ln(Frequency) 0.953∗∗∗ 0.943∗∗∗ (0.000) (0.000) Ln(Severity) 0.105 0.095 (0.411) (0.429) RiskManagement −0.534 −0.117 (0.178) (0.563) BHCControls Yes Yes Yes Yes N 530 530 530 530 AdjR2 0.712 0.716 0.785 0.785 BIC 1,627.363 1,625.897 1,483.200 1,489.002 ∆BIC 0 -1.466 -144.1628 -138.3608 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 36

Panel B: Operational Risk MR(I)A Ln(OpLosst+1) (1) (2) (3) (4) Ln(Frequency) 0.867∗∗∗ 0.860∗∗∗ (0.000) (0.000) Ln(Severity) 0.368∗∗ 0.304∗ (0.016) (0.063) Ln(OpRiskMR(I)A) 0.126 0.107∗∗ (0.184) (0.013) BHCControls Yes Yes Yes Yes N 1,046 1,046 1,046 1,046 AdjR2 0.701 0.705 0.796 0.798 BIC 2,974.962 2,968.342 2,589.092 2,582.218 ∆BIC 0 -6.6202 -385.8703 -392.7441 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 Overall, these results show that lagged operational losses are a strong predictor of operational risk exposure and outperform other risk management metrics identified in the literature. 3.9. Using Disaggregated Accounting Dates The regressions in this paper (outside of this subsection) account for operational losses at their date of occurrence – the date in which a bank experiencing a loss event judges the loss event to have been triggered. This choice is justified by our focus in understanding whether past losses predict future losses, given the common factors that originate the past and future losses. However, banks also record the accounting dates of their losses (i.e., the date or dates on which a loss event results in financial impacts for the bank). The accounting date is relevant because the accounting impacts of losses are a mechanism through which operational risk can directly lead to bankruptcy. Also, accounting dates are objective, while occurrence dates, albeit useful to understand risk, can suffer from measurement error because they often have to be estimated by banks. For these 37

reasons, recent operational risk regulations, such as new standardized approach for operational risk (Basel Committee on Banking Supervision (2017)) require loss calculations to reflect accounting dates rather than occurrence dates. To understand whether our results apply when accounting dates are used (both in constructing the dependent variable and in constructing the lagged loss metrics explanatory variables), we perform the regressions presented in Table 10. The results hold. All lagged loss metrics remain statistically significant in the regressions that include them. The magnitude of the coefficient on lagged average loss frequency decreases only slightly. Meanwhile, the magnitude of the coefficient on historical loss severity more than doubles. This increase in the association between future exposure and lagged loss severity is likely due to the accounting measurement of severity being close to the realization of the future losses to be predicted, while in regressions that use occurrence dates some loss severity amounts have to be moved back in time several years despite the factors that influence them (such as the legal environment) potentially changing between when the loss event occurred and when the losses are accounted. 38

Table 10: Operational Loss Metrics and Current Losses at the Time of Financial Impact This table reports coefficients from panel regressions of realized operational losses at quarter t+1 on operational loss metrics and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. Ln(OpLoss ) is the t+1 natural log transformation of the total operational losses (in millions) incurred by a BHC over a given calendar quarter. In Column (1), we only include control variables. In Column (2) we include Ln(OpLoss), the natural log transformation of BHC quarterly average total operational loss measured over the prior four quarters, in addition to control variables. In Column (3) we include Ln(Frequency) and Ln(Severity), the natural log transformation of BHC quarterly average loss frequency and quarterly average loss severity, respectively, over the prior four quarters. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. In this table, Ln(OpLoss ), Ln(OpLoss), Ln(Frequency), and Ln(Severity) are measured based on the date t+1 that losses result in a financial statement impact, rather than on their occurrence date (as is done in all other tables). Ln(OpLosst+1) (1) (2) (3) Ln(OpLoss) 0.529∗∗∗ (0.000) Ln(Frequency) 0.797∗∗∗ (0.000) Ln(Severity) 0.832∗∗∗ (0.000) Ln(Size) 1.398∗∗∗ 0.672∗∗∗ 0.456∗∗∗ (0.000) (0.000) (0.000) II-to-NII −0.011 −0.007 −0.010 (0.428) (0.299) (0.101) RoE 0.002 0.001 0.000 (0.248) (0.276) (0.858) T1Capital 0.029 0.002 0.007 (0.126) (0.762) (0.629) EquityVol 0.005∗ 0.003 0.003 (0.085) (0.205) (0.120) CCARAge −0.013 −0.011∗∗ −0.011∗∗ (0.136) (0.030) (0.040) MEIndex −0.004 −0.004 −0.007 (0.596) (0.518) (0.239) N 1,266 1,266 1,266 AdjR2 0.689 0.754 0.767 BIC 3,746.077 3,452.883 3,393.077 ∆BIC 0 -293.1934 -352.9993 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 39

4. Conclusion The analysis presented in this paper provides substantial evidence that historical operational losses are predictive of operational risk exposure, even after multiple drivers of operational risk that have been identified in the literature (such as size) and alternative metrics of risk management quality are accounted for. The most likely explanation for this relationship of losses across time is that operational risk exposure is partly explained by factors such as internal controls, risk culture, and risk appetite, which are persistent through time (but not immutable). Historical losses proxy for these factors and, thus, provide information on exposure beyond other factors previously identified in the literature. Among the metrics of historical loss experience, loss frequency proves the most reliable predictor of operational risk exposure. This is likely because the number of operational failures is more stable than the severity of failures and, thus, reflects more consistently the underlying drivers of exposure. A 1% increase in past average loss frequency is associated with a 0.85% increase in total operational losses. We also provide evidence that operational loss experience of other firms is useful in forecasting the loss experience of a firm, particularly the loss frequency rate in the industry. Such finding suggests that firms should expand and retain industry data sharing, as such data can help firms better understand their exposure. It also suggests that regulators should consider publishing aggregate information on operational loss trends. The results of this paper support the use of historical losses in operational risk exposure models. Across the range of types of operational risk, from fraud to legal risk, operational loss history is predictive of future exposure. Past losses are not only useful to predict expected exposure, but also to predict tail exposure. Thus, industry practitioners and regulators should use historical loss experience to better understand banks’ operational risk exposure. Such experience provides a guide for areas in which 40

firms can improve their operational risk management and controls. 41

References Abdymomunov, A. and Curti, F. (2020). Quantifying and stress testing operational risk with peer banks’ data. Journal of Financial Services Research, 57:287–313. Abdymomunov, A., Curti, F., and Mihov, A. (2020). U.S. banking sector operational losses and the macroeconomic environment. Journal of Money, Credit, and Banking, 52(1):115–144. Abdymomunov, A. and Mihov, A. (2019). Operational risk and risk management quality: Evidence from US bank holding companies. Journal of Financial Services Research, 56:73–93. Afonso, G., Curti, F., and Mihov, A. (2019). Coming to terms with operational risk. Liberty Street Economics, Federal Reserve Bank of New York. Allen, L. and Bali, T. G. (2007). Cyclicality in catastrophic and operational risk measurements. Journal of Banking & Finance, 31(4):1191–1235. Baele, L., De Jonghe, O., and Vennet, R. V. (2007). Does the stock market value bank diversification? Journal of Banking & Finance, 31(7):1999–2023. Basel Committee on Banking Supervision (2006). International convergence of capital measurement and capital standards. Bank of International Settlements. Basel Committee on Banking Supervision (2017). Basel III: Finalising post-crisis reforms. Bank of International Settlements. Berkowitz, J. (2002). How accurate are value-at-risk models at commercial banks? The Journal of Finance, 57(3):1093–1111. Board of Governors of the Federal Reserve System (2020). Dodd-Frank Act Stress Test 2020: Supervisory Stress Test Results. Federal Reserve System. Chernobai, A., Jorion, P., and Yu, F. (2012). The determinants of operational risk in U.S. financial institutions. Journal of Financial and Quantitative Analysis, 46:1683–1725. Clark, N. and Jolly, D. (2016). French bank says rogue trader lost $7 billion. Nytimes.com. Cope, E. W. and Carrivick, L. (2013). Effects of the financial crisis on banking operational losses. Journal of Operational Risk, 8:3–29. Cope, E. W., Mignola, G., Antonini, G., , and Ugoccioni, R. (2009). Challenges and pitfalls in measuring operational risk from loss data. Journal of Operational Risk, 4(4):3–27. 42

Cope,E.W.,Piche,M.T.,andWalter,J.S.(2012). Macroenvironmentaldeterminants of operational loss severity. Journal of Banking & Finance, 36(5):1362–1380. Cummins, J. D., Lewis, C. M., and Wei, R. (2006). The market value impact of operational loss events for US banks and insurers. Journal of Banking & Finance, 30(10):2605–2634. Curti, F., Frame, W. S., and Mihov, A. (2020). Are the largest banking organizations operationally more risky? Working Paper. de Fontnouvelle, P., Dejesus-Rueff, V., Jordan, J. S., and Rosengren, E. S. (2006). Capital and risk: New evidence on implications of large operational losses. Journal of Money, Credit and Banking, 38(7):1819–1846. Ellul, A. and Yerramilli, V. (2013). Stronger risk controls, lower risk: Evidence from U.S. bank holding companies. The Journal of Finance, 68(5):1757–1803. Elsas, R., Hackethal, A., and Holzha¨user, M. (2010). The anatomy of bank diversification. Journal of Banking & Finance, 34(6):1274–1287. Gillet, R., Hubner, G., and Plunus, S. (2010). Operational risk and reputation in the financial industry. Journal of Banking & Finance, 34(1):224–235. Jeremy, M. (1995). Leeson pleads guilty to two charges in Barings collapse, and may cooperate. Wall Street Journal. Kass, R. E. and Raftery, A. E. (1995). Bayes factors. Journal of the American Statistical Association, 90(430):773–795. Koenker, R. and Machado, J. A. (1999). Goodness of fit and related inference processes for quantile regression. Journal of the american statistical association, 94(448):1296–1310. Kreps, D. M. (1996). Corporate culture and economic theory. Firms, Organizations and Contracts. Oxford University Press, -:221–275. Lazear, E. P. (1995). Corporate culture and the diffusion of values. Trends in business organization: do participation and cooperation increase competitiveness, -:89–133. Neˇslehova´, J., Embrechts, P., and Chavez-Demoulin, V. (2006). Infinite mean models and the lda for operational risk. Journal of Operational Risk, 1(1):3–25. Rajan, U., Seru, A., and Vig, V. (2015). The failure of models that predict failure: Distance, incentives, and defaults. Journal of Financial Economics, 115(2):237–260. Shumway, T. (2001). Forecasting bankruptcy more accurately: A simple hazard model. The Journal of Business, 74(1):101–124. 43

Wang, T. and Hsu, C. (2013). Board composition and operational risk events of financial institutions. Journal of Banking & Finance, 37(6):2042–2051. Wattles, J., Geier, B., Egan, M., and Wiener-Bronner, D. (2018). Wells Fargo’s 20-month nightmare. CNN.com. 44

Appendix A Table A1: Definitions This table presents variable definitions in Panel A and operational loss event type definitions according to Basel Committee on Banking Supervision (2006) in Panel B. Panel A: Variables Operational Loss Metrics OpLoss ThesumofthelossesresultingfromoperationallosseventsexperiencedbyaBHCovera quarter(inmillionsofU.S.dollars). Ln(OpLoss) AnaturallogtransformationofOpLoss,definedasLn(1+OpLoss). OpLoss ThequarterlyaverageofOpLoss measuredoverthepriorfourquarters. Ln(OpLoss) AnaturallogtransformationofOpLoss,definedasLn(1+OpLoss). Frequency Thequarterlyaveragenumberoflosseventsmeasuredoverthepriorfourquarters. Ln(Frequency) AnaturallogtransformationofFrequency,definedasLn(1+Frequency). Severity Theaverageseverityoflosseventsmeasuredoverthepriorfourquarters. Ln(Severity) AnaturallogtransformationofSeverity,definedasLn(1+Severity). OpLossInd Thesize-weightedindustryaverageofOpLosscalculatedasperEquation2. Ln(OpLossInd) AnaturallogtransformationofOpLossInd,definedasLn(OpLossInd). FrequencyInd Thesize-weightedindustryaverageofFrequency calculatedasperEquation2. Ln(FrequencyInd) AnaturallogtransformationofFrequencyInd,definedasLn(FrequencyInd). SeverityInd IndustryaveragelosseventseveritycalculatedasperEquation3. Ln(SeverityInd) AnaturallogtransformationofSeverityInd,definedasLn(Severity). Controls Size BHCtotalassets(inmillionsofU.S.dollars). Ln(Size) AnaturallogtransformationofSize,definedasLn(Size). II-to-NII TheratioofBHCnetinterestincometonon-interestincome. RoE BHCreturnonequityoverafourquarterwindow. T1Capital BHCTier1Capital. EquityVol AnnualizedBHCdailyequityreturnvolatilitymeasuredoverthepriorfourquarters. CCARAge The number of quarters since the BHC was first subject to the Comprehensive Capital AnalysisandReview(CCAR).Ittakesthevalueof0forthequartersbeforetheBHCbecome subjecttoCCAR. ME U.S.financialandeconomicenvironmentmeasure,definedasthefirstprincipalcomponentof GDP Growth,HPI Growth,CREPI Growth,VIX,andBBB-T10Yr Sprd. GDP Growth is theyear-over-yearU.S.realGDPgrowthrate. HPI Growth istheyear-over-yeargrowthrate intheU.S.CoreLogicHousePriceIndex. CREPI Growth istheyear-over-yeargrowthrate intheU.S.CommercialRealEstatePriceIndex. VIX istheCBOEU.S.MarketVolatility Index,convertedtoaquarterlyfrequencybyusingthemaximumclose-of-dayvalueinany quarter. BBB-T10Yr Sprd isthespreadbetweentheU.S.10-yearBBB-ratedcorporatebond yieldandthe10-yearU.S.Treasurybondyield. Highervaluesdenoteworseconditions. RiskManagement BHCriskmanagementindex(RMI)valuedevelopedbyEllulandYerramilli(2013). Ahigher valuecorrespondstoahigherqualityofBHCs’riskmanagementfunction. OpRiskMR(I)A The number of outstanding operational risk Matters Requiring Immediate Attention and MattersRequiringAttentionfindingsataBHCasofagivenquarter. Ln(OpRiskMR(I)A) AnaturallogtransformationofOpRisk MR(I)A,definedasLn(1+OpRisk MR(I)A). 45

sepyT tnevE :B lenaP noitpircseD trohS yrogetaCepyTtnevE tnevmucricroytreporpetairporppasim,duarfedotdednetniepytafostcA FI duarFlanretnI lanretnienotsaeltasevlovnihcihw,snoitaluger tnevmucricroytreporpetairporppasim,duarfedotdednetniepytafostcA FE duarFlanretxE ytrapdrihtayb,waleht morf,stnemeergaroswalytefasrohtlaeh,tnemyolpmehtiwtnetsisnocnistcA SWPE ytefaSecalpkroWdnasecitcarPtnemyolpmE .stnevenoitanimircsid/ytisrevidmorfro,smialcyrujnilanosrepfotnemyap ot noitagilbo lanoisseforp a teem ot eruliaf tnegilgen ro lanoitnetninu nA PBPC secitcarPssenisuBdnastcudorP,stneilC .tcudorpafongisedroerutanehtmorfro,stneilccfiiceps .stneverehtorosretsasidlarutanmorfstessalacisyhpotegamaD APD stessAlacisyhPotegamaD .seruliafmetsysrossenisubfonoitpursiD FSDB seruliaFmetsySdnanoitpursiDssenisuB htiw snoitaler morf ,tnemeganam ssecorp ro gnissecorp noitcasnart deliaF MPDE tnemeganaMssecorPdnayrevileD,noitucexE .srodnevdnaseitrapretnuocedart 46

Appendix B Table A2: Operational Loss Metrics and Current Losses scaled by Size This table reports coefficients from panel regressions of realized operational losses at quarter t+1 scaled by Total Asset in quarter t on operational loss metrics scaled by Total Asset and control variables measured in quarter t. The estimation sample comprises an unbalanced panel of 1,266 quarterly observations of 38 large bank holding companies over the period [2000:Q1-2017:Q4] for which requisite data are available. OpLosst+1 is the total operational losses incurred by a BHC over Size a given calendar quarter scaled by the BHC Total Assets at the end of the previous quarter t. In Column (1), we only include control variables. In Column (2) we include OpLoss, the BHC quarterly Size average total operational losses measured over the prior four quarters divided by BHC Total Assets, inadditiontocontrolvariables. InColumn(3)weinclude Severity and Frequency,theBHCquarterly Size Size average loss frequency over the prior four quarters divided by BHC Total Assets and the quarterly averagelossseverityoverthepriorfourquartersdividedbyBHCTotalAssets,respectively. Standard errors are clustered by BHC and quarter. P-values are presented in parentheses. OpLosst+1 Size (1) (2) (3) OpLoss 0.242∗∗ Size (0.042) Severity 29.110∗∗ Size (0.030) Frequency 0.251∗∗∗ Size (0.000) Ln(Size) 0.108∗∗∗ 0.080∗∗∗ 0.127∗∗∗ (0.000) (0.009) (0.000) II-to-NII −0.014∗∗ −0.013∗∗∗ −0.012∗∗ (0.015) (0.010) (0.024) RoE −0.000 −0.000 −0.001∗∗∗ (0.431) (0.303) (0.000) T1Capital −0.024∗∗∗ −0.022∗∗∗ −0.019∗∗∗ (0.000) (0.000) (0.000) EquityVol −0.002 −0.002 −0.002 (0.154) (0.195) (0.140) CCARAge −0.013∗∗∗ −0.010∗∗∗ −0.011∗∗∗ (0.000) (0.005) (0.000) MEIndex 0.003∗ 0.001 0.001 (0.077) (0.452) (0.441) N 1,266 1,266 1,266 AdjR2 0.082 0.094 0.118 BIC 2,552.292 2,542.600 2,514.398 ∆BIC 0 -9.6917 -37.8937 ∗p<0.10,∗∗p<0.05,∗∗∗p<0.01 47