Reader question: Credit-risk capital can start from loans and counterparties, and market-risk capital can start from prices and sensitivities. Operational risk is different: it comes from failed processes, people, systems, legal events and external shocks. How can a bank turn something this heterogeneous into one regulatory capital number?
The Basel standardised approach does it in three layers. First, it computes a Business Indicator (BI) from financial-statement activity. Second, it converts that activity measure into a progressive Business Indicator Component (BIC). Third, where the jurisdiction uses the loss-sensitive mechanism, it scales BIC with an Internal Loss Multiplier (ILM) derived from historical operational losses.
The basic capital relation is:
Operational Risk Capital = BIC × ILM.
Then:
Operational Risk RWA = 12.5 × Operational Risk Capital.
This article explains that machinery as a computational pipeline rather than as a list of regulatory terms.
What this page owns — and what it does not
This page owns:
financial-statement activity + internal operational-loss history → BI → BIC → ILM → operational-risk capital → operational-risk RWA.
It does not replace the Basel output-floor calculation, the leverage-ratio backstop, FRTB market-risk capital, or CVA capital. Operational risk owns a different source of loss.
This is public regulatory mathematics, not advice for any bank’s capital planning and not personalized financial advice.
What counts as operational risk?
The Basel Framework defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.
It includes legal risk.
It excludes strategic and reputational risk from the formal definition.
Examples can include:
- internal fraud;
- external fraud;
- payment-processing errors;
- cyber incidents;
- system outages;
- failed trade booking;
- misdirected payments;
- legal settlements;
- operational failures around products, clients or business practices;
- physical damage or external disruptions.
Why Basel abandoned pure internal-model capital for operational risk
The post-crisis Basel reforms replaced the former collection of basic, standardised and advanced internal-model approaches with one standardised framework.
The reason is computationally interesting: operational-risk tails are sparse, heterogeneous and difficult to estimate robustly. A bank can have very few catastrophic observations but still face real tail risk. Highly flexible internal models can therefore produce unstable or difficult-to-compare capital numbers.
The new architecture uses a simpler observable scale proxy, then allows historical losses to influence capital through a constrained multiplier.
Step 1: calculate the Business Indicator
The BI is a financial-statement-based proxy for the scale of activities that can generate operational risk.
It has three components:
- Interest, Leases and Dividend Component (ILDC);
- Services Component (SC);
- Financial Component (FC).
Each component uses specified income-statement or balance-sheet items, generally averaged over three years under the Basel formulas.
Conceptually:
BI = ILDC + SC + FC.
Why absolute values appear in the BI
Operational activity can remain high even when net financial income is small because positive and negative items offset.
Suppose a trading business earns +€2 billion one year and loses -€2 billion the next. A naive signed average can approach zero, yet the business has clearly not become operationally inactive.
The Basel formulas therefore use absolute-value logic for specified net items before averaging.
This is an anti-cancellation design.
Step 2: convert BI into the Business Indicator Component
BIC is progressive.
Under the Basel Framework:
- BI up to €1 billion uses a 12% marginal coefficient;
- the slice above €1 billion up to €30 billion uses 15%;
- the slice above €30 billion uses 18%.
This is similar to a progressive tax schedule: a bank does not multiply its entire BI by 18% merely because BI exceeds €30 billion.
BIC formula by slices
For BI ≤ €1bn:
BIC = 0.12 × BI.
For €1bn < BI ≤ €30bn:
BIC = 0.12×1bn + 0.15×(BI−1bn).
For BI > €30bn:
BIC = 0.12×1bn + 0.15×29bn + 0.18×(BI−30bn).
A worked BIC example
Basel provides a useful €35 billion example.
The first €1bn contributes:
1 × 12% = €0.12bn.
The next €29bn contributes:
29 × 15% = €4.35bn.
The final €5bn contributes:
5 × 18% = €0.90bn.
Total:
BIC = €5.37bn.
A common implementation failure is to calculate €35bn × 18% = €6.30bn, which is wrong because the coefficients are marginal rather than flat.
Step 3: build the Loss Component
The Loss Component links historical operational experience to capital.
Under the Basel formula:
LC = 15 × Average Annual Operational Losses.
The standard calculation uses ten years of high-quality internal loss data.
If a bank averages €200 million of qualifying annual operational losses:
LC = 15 × €200m = €3.0bn.
Why ten years?
Operational losses are lumpy.
One year may contain almost no major events. Another may contain a cyber incident, legal settlement and payment-processing failure.
A long window reduces the chance that capital is determined by one unusually quiet or unusually bad year.
Basel requires ten years of good-quality loss data when available. During transition, a shorter window may be used exceptionally, with a minimum of five years subject to the rules.
Step 4: compute the Internal Loss Multiplier
The Basel ILM is:
ILM = ln[e − 1 + (LC/BIC)0.8].
The function has three intuitive states:
- if LC = BIC, then ILM = 1;
- if LC > BIC, then ILM > 1;
- if LC < BIC, then ILM < 1.
The exponent 0.8 and logarithm dampen the response so that capital does not move linearly one-for-one with the loss ratio.
A simple ILM example
Suppose:
- BIC = €2.0bn;
- LC = €2.0bn.
Then:
LC/BIC = 1
and:
ILM = ln(e − 1 + 1) = ln(e) = 1.
Operational-risk capital is therefore €2.0bn.
High-loss example
Suppose BIC remains €2.0bn but LC rises to €4.0bn.
Then:
LC/BIC = 2.
The ILM rises above one and capital exceeds the BIC baseline.
The exact nonlinear value should be calculated with full precision in production systems.
Low-loss example
If LC is much lower than BIC, ILM can fall below one where the jurisdiction permits internal-loss sensitivity.
But this is not universally available in exactly the same way.
Basel allows national discretion. Supervisors may set ILM equal to one for all banks in their jurisdiction, and bucket-1 treatment also has discretion around use of internal loss data.
This means a global implementation needs a jurisdictional rule switch.
Step 5: calculate operational-risk capital and RWA
Once BIC and ILM are known:
ORC = BIC × ILM.
Then:
Operational Risk RWA = 12.5 × ORC.
The factor 12.5 is the reciprocal of 8%:
1 / 0.08 = 12.5.
This converts a capital requirement into an RWA-equivalent amount used in Basel capital-ratio calculations.
Why this is not an expected-loss forecast
If operational-risk capital is €3 billion, Basel is not claiming the bank will lose exactly €3 billion next year.
The number is a regulatory capital measure generated by the standardised methodology.
It is not:
- a one-year expected-loss forecast;
- a 99.9% VaR estimate;
- a cyber-loss budget;
- a legal-loss provision;
- an insurance premium.
Loss-data quality is part of the algorithm
Historical loss data do not enter automatically just because a number exists in a ledger.
Basel requires documented processes for identification, collection and treatment of internal loss data.
The system must distinguish:
- gross loss;
- recoveries;
- insurance recoveries;
- date of occurrence;
- date of discovery;
- date of accounting;
- losses related to credit risk;
- losses related to market risk;
- grouped or related losses over time.
The €20,000 data threshold
Basel sets a minimum threshold of €20,000 for including a loss event in the internal data collection used for average annual losses.
At national discretion, supervisors may raise the threshold to €100,000 for banks in BI buckets 2 and 3.
A bank cannot safely hard-code one threshold globally without jurisdiction metadata.
Gross loss versus recovery
Gross loss is recorded before recoveries.
A later insurance payment or recovery from a fraud perpetrator is a separate event associated with the original loss.
This prevents the loss database from hiding the operational severity of an event simply because money was later recovered.
Tax effects are not recoveries
Basel explicitly notes that reductions in tax liability arising from operational losses are not treated as recoveries for this purpose.
This is a useful data-quality test: tax-accounting effects should not be allowed to reduce the operational-loss dataset as if they were cash recoveries.
Credit-risk boundary
Operational events related to credit risk that are already accounted for in credit RWA should not be double counted in the operational-loss dataset.
But operational events related to credit risk that are not accounted for in credit RWA can remain within operational risk.
This is a boundary-control problem.
Market-risk boundary
Basel treats operational-risk losses related to market risk as operational risk for the operational-risk capital framework.
Again, classification matters more than label intuition.
Mergers and acquisitions
A bank that acquires another business also acquires its operational-risk activity and, subject to the rules, relevant historical loss information.
A BI and loss-data engine must therefore handle:
- entity acquisition dates;
- historical data availability;
- restated BI components;
- loss-data integration;
- data-quality gaps.
Divestitures
If a business is sold, Basel permits specified treatment for removing BI items and, with supervisory approval and conditions, some historical losses associated with divested activities.
This cannot be a casual deletion process. It needs controlled eligibility, approval and disclosure.
Inputs and outputs
An operational-risk capital engine can require:
- three years of relevant financial-statement BI items;
- banking-group consolidation scope;
- 10 years of qualifying internal operational losses where available;
- gross loss and recovery fields;
- occurrence, discovery and accounting dates;
- loss-event taxonomy;
- credit-risk and market-risk boundary flags;
- merger/divestiture adjustments;
- jurisdictional ILM discretion;
- loss-data inclusion threshold;
- current Basel rule version.
Outputs can include:
- ILDC, SC and FC;
- Business Indicator;
- BIC by marginal bucket;
- average annual loss;
- Loss Component;
- ILM;
- operational-risk capital;
- operational-risk RWA;
- data-quality exceptions;
- reconciliation and disclosure fields.
Evidence polarity: what supports confidence?
Evidence for a reliable result includes BI components reconciling to audited financial statements, correct three-year averaging, correct marginal BIC slicing, a complete 10-year loss population where required, independently reproduced ILM, and capital/RWA that reconcile to regulatory reporting.
Evidence against confidence includes signed P&L cancellation where absolute values are required, applying 18% to an entire €35bn BI, missing loss events below an internally arbitrary threshold, treating insurance recoveries as if losses never occurred, using occurrence date when accounting date is required for the dataset, or applying ILM below one in a jurisdiction that has fixed ILM at one.
Failure mode: progressive-bucket error
Bad logic: BI = €35bn, therefore BIC = 18% × €35bn.
Correct logic: apply 12%, 15% and 18% marginally to the relevant slices.
Diagnostic: reproduce Basel’s €35bn = €5.37bn example.
Failure mode: stale three-year BI window
A financial-statement restatement can change one or more years in the BI average.
Diagnostic: version every source period and rerun after restatement.
Failure mode: incomplete loss capture
One subsidiary or outsourcing arrangement can be missing from the loss dataset.
Diagnostic: reconcile legal-entity and business-line coverage against the consolidation perimeter.
Failure mode: duplicate loss events
One legal event can generate several accounting entries across years.
Diagnostic: preserve event identifiers while allocating accounting impacts to the appropriate years.
Failure mode: recovery netting too early
If a €100m loss and €40m insurance recovery are stored only as a €60m loss, gross severity disappears.
Diagnostic: preserve gross loss and recoveries separately.
Failure mode: jurisdictional discretion ignored
The same Basel baseline can produce different implemented capital if a supervisor fixes ILM at one.
Diagnostic: store jurisdiction, effective date and ILM policy explicitly.
Counterexample: a larger bank can have lower historical losses yet higher capital
Because BIC increases with activity scale, a large bank with relatively low losses can still have more operational-risk capital than a small bank with a higher loss ratio.
Scale and loss experience both matter.
Counterexample: one catastrophic loss does not permanently define the bank
A large event influences the rolling loss window, but eventually exits it. Capital sensitivity therefore changes through time even if current operations are unchanged.
Counterexample: zero recent losses do not prove zero operational risk
Operational-risk tails are sparse. A quiet historical period does not falsify the possibility of severe future operational events.
This is one reason the framework retains the BI scale component.
Counterexample: operational-risk capital is not a substitute for controls
Holding more capital does not prevent cyber failures, fraud, payment errors or system outages.
Capital absorbs loss; controls reduce probability and severity.
Diagnostics: how to test the engine
- Basel €35bn test: BIC must equal €5.37bn.
- ILM identity test: LC = BIC must produce ILM = 1.
- high-loss test: LC > BIC must produce ILM > 1.
- low-loss test: LC < BIC should produce ILM < 1 before jurisdictional overrides.
- 12.5 test: operational-risk RWA must equal 12.5 × ORC.
- absolute-value test: sign-flipping financial P&L must not cancel incorrectly.
- loss-threshold test: apply the correct €20k or approved €100k threshold.
- recovery test: preserve gross loss and recovery separately.
- boundary test: credit-related operational losses already captured in credit RWA must not be double counted.
- ten-year-roll test: verify the oldest year exits and the newest year enters correctly.
- M&A test: acquisition data changes BI and loss history according to the effective rules.
What would falsify confidence?
Confidence should be withdrawn if BIC cannot reproduce the marginal-bucket formula; if the loss dataset cannot be reconciled to accounting records; if the same operational event is counted twice; if gross losses and recoveries cannot be separated; if jurisdictional ILM policy is unknown; or if regulatory capital cannot be traced to the exact BI years and loss years used.
Alternatives and limits
The Basel standardised approach is a prudential capital framework. Banks still need richer internal operational-risk tools:
- scenario analysis;
- key risk indicators;
- control testing;
- cyber metrics;
- business-continuity testing;
- insurance analysis;
- fraud analytics;
- tail scenario stress tests.
Those methods answer questions that BIC × ILM cannot.
Verification and update triggers
Revalidate after:
- financial-statement restatements;
- new operational-loss events;
- large recoveries or legal settlements;
- mergers, acquisitions or divestitures;
- changes in data-quality status;
- supervisory changes to ILM discretion;
- Basel OPE amendments;
- changes in disclosure or loss-data thresholds.
The Basel Framework currently shows OPE as in force from 1 January 2023, with future OPE25 changes scheduled for 1 January 2027. Implementations should therefore be effective-date aware.
Primary and high-quality references
- Basel Committee on Banking Supervision, Basel Framework — Operational risk.
- Basel Committee on Banking Supervision, OPE25 — Standardised approach, including BI, BIC, ILM and loss-data rules.
- Basel Committee on Banking Supervision, OPE10 — Definitions and application.
- Bank for International Settlements / Financial Stability Institute, Operational risk standardised approach — Executive Summary.
- Basel Committee on Banking Supervision, Basel III: Finalising post-crisis reforms.
Educational boundary: This article explains public Basel operational-risk mathematics. It does not determine any real bank’s regulatory capital requirement and does not provide personalized financial advice.