ANNEX II
EXTENSIONS AND CHANGES TO THE AMA
PART I
SECTION 1
Extensions requiring competent authorities' approval (‘material’)
1. First-time introduction of measures to capture expected losses in the institutions' business practices offset according to Article 322(2)(a) of Regulation (EU) No 575/2013.
2. First-time introduction of operational risk mitigation techniques such as insurance or other risk transfer mechanisms according to Article 323(1) of Regulation (EU) No 575/2013.
3. First-time recognition of correlations in operational risk losses according to Article 322(2)(d) of Regulation (EU) No 575/2013.
4. First-time introduction of methodology for allocating operational risk capital among the different entities of the group according to Article 20(1)(b) and 322(2)(a) of Regulation (EU) No 575/2013.
5. The introduction of the AMA within parts of the institution or group of institutions not yet covered by the approval or the approved roll out plan according to Article 314(1) of Regulation (EU) No 575/2013, where those additional areas account for more than 5 % of the EU parent institution on a consolidated level or of the institution which is neither a parent institution, nor a subsidiary.
The above calculation shall be made at the end of the preceding financial year using the amount of the relevant indicator assigned to the areas to which the AMA will be rolled out as defined in Article 316 of Regulation (EU) No 575/2013.
SECTION 2
Extensions requiring ex ante notification to competent authorities
The introduction of the AMA within parts of the institution or group of institutions not yet covered by the approval or the approved roll out plan according to Article 314(1) of Regulation (EU) No 575/2013, where those additional areas account with respect to the EU parent institution on a consolidated level or of the institution which is neither a parent institution, nor a subsidiary for both of the following:
more than 1 %;
less than or equal to 5 %.
The above calculation shall be made at the end of the preceding financial year using the amount of the relevant indicator assigned to the areas to which the AMA will be rolled out, as defined in Article 316 of Regulation (EU) No 575/2013.
PART II
CHANGES TO THE AMA
SECTION 1
Changes requiring competent authorities' approval (‘material’)
1. Changes in the organisational and operational structure of the independent risk management function for operational risk according to Article 321 of Regulation (EU) No 575/2013 which reduce the ability of the operational risk management function to oversee and inform the decision making processes of the business and support units they control.
2. Changes to the measurement system for operational risk if they fulfil any of the following criteria:
they change the architecture of the measurement system regarding the combination of the four data elements of internal and external loss data, scenario analysis, business environment and internal control factors, according to Article 322(2)(b) of Regulation (EU) No 575/2013;
they change the logics and drivers of the methodology for allocating the operational risk capital between the different entities of a group according to Article 20(1)(b) and 322(2)(a) of Regulation (EU) No 575/2013.
3. Changes to the procedures relating to internal and external data, scenario analysis and business environment and internal control factors where they:
reduce the level of controls regarding the completeness and quality of operational risk data collected according to Article 322(3) and (4) of Regulation (EU) No 575/2013;
change the external data sources to be used within the measurement system according to Article 322(4) and 322(5) of Regulation (EU) No 575/2013 unless the data are comparable and representative for the operational risk profile.
4. Changes to the overall method on how insurance contracts and/or other risk transfer mechanisms are recognized within the calculation of the AMA capital charge according to Article 323(1) of Regulation (EU) No 575/2013.
5. Reducing the part of the operational risk captured by the AMA within the institution or group of institutions using the AMA according to Article 314(2) and (3) of Regulation (EU) No 575/2013, where one of the following conditions is met:
the areas to which the AMA will no longer be applied account for more than 5 % of the overall own funds requirements for operational risk of the EU parent institution on a consolidated level or of the institution which is neither a parent institution, nor a subsidiary;
the reduction of the areas covered under the AMA leads to a use of the AMA in a part of the institution which account for a lower percentage as required by the competent authority under Article 314(3) of Regulation (EU) No 575/2013.
This calculation shall be made when the institution applies for the change and shall be based on the capital requirement as calculated at the end of the preceding financial year.
SECTION 2
Changes requiring ex ante notification to competent authorities
1. Changes to the way the operational risk measurement system is integrated into the day-to-day management process through operational risk processes and policies according to Article 321(a) and (c) of Regulation (EU) No 575/2013, where the changes have one of the following characteristics:
they change the extent to which the operational risk measurement system contributes to relevant information in the institutions' risk management and related decision making processes, including the approval of new products, systems and processes and definition of the operational risk tolerance;
they reduce the scope, groups of recipients and frequency of the reporting system for informing all relevant parts of the institution about the results of the operational risk measurement system and decisions taken in response to material operational risk events.
2. Changes in the organisational and operational structure of the independent risk management function for operational risk according to Article 321(b) of Regulation (EU) No 575/2013 if they fulfil any of the following criteria:
they reduce the hierarchical level of the operational risk management function or of its head;
they lead to a relevant reduction the duties and responsibilities of the operational risk management function;
they extend the duties and responsibilities of the operational risk management function, unless no conflicts of interests exist and appropriate additional resources are provided to the operational risk management function;
they lead to a reduction of the available resources in terms of budget and headcount of more than 10 %, of the institution or group, since the last approval according to Article 312(2) of Regulation (EU) No 575/2013 was granted, unless the available resources in terms of budget and headcount at the institution or group level has been reduced with the same proportion.
3. Changes to validation processes and the internal review according to Article 321(e) and (f) of Regulation (EU) No 575/2013 if they change the logic and methodologies used for internally validating or reviewing the AMA framework.
4. Changes to the calculation of the operational risk capital charge which change one of the following:
structure and characteristics of the data set used for the calculation of the operational risk capital requirement (the ‘calculation data set’), including any of the following:
the definition of gross loss amount to be used within the calculation data set according to Article 322(3)(d) of Regulation (EU) No 575/2013;
the reference date of loss events to be used within the calculation data set according to Article 322(2)(a) of Regulation (EU) No 575/2013;
the method used to determine the length of the time series of loss data to be used within the calculation data set according to Article 322(2)(a) of Regulation (EU) No 575/2013;
the criteria to group losses caused by a common operational risk event or by related events over time according to Article 322(3)(b) and (3)(e) of Regulation (EU) No 575/2013;
the number or the type of risk classes, or equivalent, over which the operational risk capital requirement is calculated;
the method for setting the threshold for the level of losses above which the model is fitted to the data according to Article 322(2)(a) of Regulation (EU) No 575/2013;
where applicable, the method for setting the threshold for differentiating the body and tail regions of the data, when fitted by different methods according to Article 322(2)(a) of Regulation (EU) No 575/2013;
the processes and criteria for assessing the relevance, for scaling or for doing other adjustments to the operational risk data according to Article 322(3)(f) of Regulation (EU) No 575/2013;
change the external data sources to be used within the measurement system according to Article 322(4) and 322(5) of Regulation (EU) No 575/2013, unless already classified as material according to Part II, Section 1 of this Annex.
the criteria for the selection, update and review of used distributions and methods for the estimation of their parameters according to Article 322(2)(a) of Regulation (EU) No 575/2013;
criteria and procedures for the determination of the aggregated loss distributions and for the calculation of the pertinent operational risk measure at the regulatory confidence level according to Article 322(2)(a) of Regulation (EU) No 575/2013;
methodology for the determination of expected losses and their capturing within internal business practices according to Article 322(2)(a) of Regulation (EU) No 575/2013;
methodology about how correlations in operational risk losses across individual operational risk estimates are recognised according to Article 322(2)(d) of Regulation (EU) No 575/2013.
5. Changes to the standards relating to internal data, scenario analysis and business environment and internal control factors if they:
change the internal processes and criteria for collecting internal loss data according to Article 322(3) of Regulation (EU) No 575/2013, including any of the following:
increase of the threshold for the collection of internal loss data according to Article 322(3)(c) of Regulation (EU) No 575/2013;
methods or criteria for the exclusion of activities or exposures from the scope of the internal data collection according to article 322(3)(c) of Regulation (EU) No 575/2013.
change the internal processes and criteria for one of the following:
performing scenario analysis according to Article 322(5) of Regulation (EU) No 575/2013;
determining business environment and internal control factors according to Article 322(6) of Regulation (EU) No 575/2013.
6. Changes to the standards relating to insurance and other risk transfer mechanisms according to Article 323 of Regulation (EU) No 575/2013, if they fulfil one of the following conditions:
they cause a relevant alteration of the level of coverage provided;
they alter the processes and criteria for calculating the haircuts in the amount of insurance recognition, introduced to capture the uncertainty of payment, the mismatches in coverage and the policy's residual and cancellation terms, where less than one year according to article 323(4) of Regulation (EU) No 575/2013.
7. Relevant changes to the IT systems used to process the AMA, including the collection of data and their administration, reporting procedures and the measurement system for operational risk according to article 312(2) of Regulation (EU) No 575/2013 and the general risk management standards set out in article 74 of Directive 2013/36/EU, which reduce the integrity and availability of the data or IT systems.