Financial Sector (Collection of Data) (reporting standard) determination No. 10 of 2008 ARS 115.0 Advanced Measurement Approaches (AMA) to Operational Risk (Cth)
Financial Sector (Collection of Data) (reporting standard) determination No. 10 of 2008
Reporting standard ARS 115.0 Advanced Measurement Approaches (AMA) to Operational Risk
Financial Sector (Collection of Data) Act 2001
I, Wayne Stephen Byres, a delegate of APRA, under paragraph 13(1)(a) of the Financial Sector (Collection of Data) Act 2001 (the Act) and subsection 33(3) of the Acts Interpretation Act 1901 DETERMINE Reporting Standard ARS 115.0 Advanced Measurement Approaches (AMA) to Operational Risk in the form set out in the Schedule, which applies to financial sector entities to the extent provided in paragraph 2 of the reporting standard.
Under section 15 of the Act, I DECLARE that the reporting standard shall begin to apply to those financial sector entities on the later of 1 April 2008 and the date of registration of this instrument on the Federal Register of Legislative Instruments.
Dated 4th February 2008
[Signed]
Wayne Byres
Executive General Manager
Diversified Institutions Division
Interpretation
In this Determination
APRA means the Australian Prudential Regulation Authority.
Federal Register of Legislative Instruments means the register established under section 20 of the Legislative Instruments Act 2003.
Schedule
Reporting Standard ARS 115.0 Advanced Measurement Approaches (AMA) to Operational Risk comprises the 24 pages commencing on the following page.
Reporting Standard ARS 115.0
Advanced Measurement Approaches (AMA) to Operational Risk
Objective of this reporting standard
This reporting standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001.
This reporting standard outlines the overall requirements for the provision of information to APRA in relation to an authorised deposit-taking institution’s operational risk regulatory capital under the advanced measurement approaches to operational risk defined in Prudential Standard APS 115 Capital Adequacy: Advanced Measurement Approaches to Operational Risk. It should be read in conjunction with:
the versions of Form ARF 115.0A AMA – Regulatory Capital, Form ARF 115.0B AMA – Operational Risk Losses – Current Six Months and Form ARF 115.0C AMA – Operational Risk Losses – Previous Six Months designated for an authorised deposit-taking institution reporting at Level 1 and Level 2, and the associated instructions (all of which are attached and form part of this reporting standard); and
Prudential Standard APS 115 Capital Adequacy: Advanced Measurement Approaches to Operational Risk.
Purpose
Data collected in Form ARF 115.0A AMA – Regulatory Capital (ARF 115.0A), Form ARF 115.0B AMA – Operational Risk Losses – Current Six Months (ARF 115.0B) and Form ARF 115.0C – AMA – Operational Risk Losses – Previous Six Months (ARF 115.0C) is used by APRA for the purpose of prudential supervision, including assessing compliance with Prudential Standard APS 115 Capital Adequacy: Advanced Measurement Approaches to Operational Risk (APS 115). It may also be used by the Reserve Bank of Australia and the Australian Bureau of Statistics.
Application
This reporting standard applies to an authorised deposit-taking institution (ADI) that has APRA’s approval or is seeking APRA’s approval to use an advanced measurement approach to operational risk for capital adequacy purposes.
This reporting standard may also apply to the non-operating holding company (NOHC) of an ADI (refer to paragraph 4).
Information required
An ADI to which this reporting standard applies must provide APRA with the information required by the versions of ARF 115.0A, ARF 115.0B and ARF 115.0C designated for an ADI at Level 1 for each reporting period.
If an ADI to which this reporting standard applies is part of a Level 2 group, the ADI must also provide APRA with the information required by the versions of ARF 115.0A, ARF 115.0B and ARF 115.0C designated for an ADI at Level 2 for each reporting period, unless the ADI is a subsidiary of an authorised NOHC. If the ADI is a subsidiary of an authorised NOHC, the ADI’s immediate parent NOHC must provide APRA with the information required by that form for each reporting period. In doing so, the immediate parent NOHC must comply with this reporting standard (other than paragraphs 3 and 10) as if it were the relevant ADI.
Forms and method of submission
The information required by this reporting standard must be given to APRA in electronic form, using one of the electronic submission mechanisms provided by the ‘Direct to APRA’ (also known as ‘D2A’) application.
Note: the Direct to APRA application software may be obtained from APRA.
Reporting periods and due dates
Subject to paragraph 7, an ADI to which this reporting standard applies must provide the information required by this reporting standard for each quarter based on the financial year (within the meaning of the Corporations Act 2001) of the ADI.
APRA may, by notice in writing, change the reporting periods, or specified reporting periods, for a particular ADI, to require it to provide the information required by this reporting standard more frequently, or less frequently, having regard to:
(a)the particular circumstances of the ADI;
(b)the extent to which the information is required for the purposes of the prudential supervision of the ADI; and
(c)the requirements of the Reserve Bank of Australia or the Australian Bureau of Statistics.
The information required by this reporting standard must be provided to APRA within 30 business days after the end of the reporting period to which the information relates.
APRA may grant an ADI an extension of a due date in writing, in which case the new due date for the provision of the information will be the date on the notice of extension.
Quality control
The information provided by an ADI under this reporting standard (except for the information required under paragraph 4) must be the product of processes and controls that have been reviewed and tested by the external auditor of the ADI. AGS 1008 ‘Audit Implications of Prudential Reporting Requirements for Authorised Deposit-taking Institutions’, issued by the Auditing and Assurance Standards Board provides guidance on the scope and nature of the review and testing required from external auditors. This review and testing must be done on an annual basis or more frequently if necessary to enable the external auditor to form an opinion on the accuracy and reliability of the data.
All information provided by an ADI under this reporting standard must be subject to processes and controls developed by the ADI for the internal review and authorisation of that information. It is the responsibility of the board and senior management of the ADI to ensure that an appropriate set of policies and procedures for the authorisation of data submitted to APRA is in place.
Authorisation
When an ADI submits information under this reporting standard using the ‘Direct to APRA’ software, it will be necessary for an officer of the ADI to digitally sign, authorise and encrypt the relevant data. For this purpose, APRA’s certificate authority will issue ‘digital certificates’, for use with the software, to officers of the ADI who have authority from the ADI to transmit the data to APRA.
Minor alterations to forms and instructions
APRA may make minor variations to:
(a)a form that is part of this reporting standard, and the instructions to such a form, to correct technical, programming or logical errors, inconsistencies or anomalies; or
(b)the instructions to a form, to clarify their application to the form
without changing any substantive requirement in the form or instructions.
If APRA makes such a variation it must notify in writing each ADI that is required to report under this reporting standard.
Interpretation
In this reporting standard:
ADI means an authorised deposit-taking institution within the meaning of the Banking Act 1959.
APRA means the Australian Prudential Regulation Authority established under the Australian Prudential Regulation Authority Act 1998.
authorised NOHC has the meaning given in the Banking Act 1959.
business days means ordinary business days, exclusive of Saturdays, Sundays and public holidays.
immediate parent NOHC means an authorised NOHC, or a subsidiary of an authorised NOHC, that is an immediate parent NOHC within the meaning of paragraph 10(b) of Prudential Standard APS 110 Capital Adequacy (APS 110).
Level 1 has the meaning in APS 110.
Level 2 has the meaning in APS 110.
reporting period means a period mentioned in paragraph 6 or, if applicable, paragraph 7.
subsidiary has the meaning in the Corporations Act 2001.
Reporting Forms ARF 115.0A, ARF 115.0B and ARF 115.0C
Advanced Measurement Approaches (AMA) to Operational Risk
Instruction Guide
This instruction guide is designed to assist in the completion of the Advanced Measurement Approaches (AMA) to Operational Risk suite of forms. This suite of forms consists of the following:
(a)Form ARF 115.0A AMA – Regulatory Capital (ARF 115.0A);
(b)Form ARF 115.0B AMA – Operational Risk Losses – Current Six Months (ARF 115.0B); and
(c)Form ARF 115.0C AMA – Operational Risk Losses – Previous Six Months (ARF 115.0C).
These forms capture details of the regulatory capital required to be held by authorised deposit-taking institutions (ADIs) using the advanced measurement approaches (AMA) to operational risk. In addition, they collect information in relation to losses attributable to business lines and event types. In completing these forms, ADIs should refer to Prudential Standard APS 115 Capital Adequacy: Advanced Measurement Approaches to Operational Risk (APS 115).
General directions and notes
Reporting entity
These forms are to be completed at both Level 1 and Level 2[1] by each ADI that has APRA’s approval or is seeking APRA’s approval to use an AMA to operational risk for capital adequacy purposes, in accordance with APS 115.
[1] Level 1 and Level 2 are defined in accordance with Prudential Standard APS 110 Capital Adequacy.
If an ADI is a subsidiary of an authorised non-operating holding company (NOHC), the report at Level 2 is to be provided by the ADI’s immediate parent NOHC.[2]
[2] Refer to paragraph 4 of Reporting Standard ARS 115.0 Advanced Measurement Approaches (AMA) to Operational Risk.
Securitisation deconsolidation principle
Except as otherwise specified in these instructions, the following applies:
Where an ADI (or a member of its Level 2 consolidated group) participates in a securitisation that meets APRA’s operational requirements for regulatory capital relief under Prudential Standard APS 120 Securitisation (APS 120):
(a)special purpose vehicles (SPVs) holding securitised assets may be treated as non-consolidated independent third parties for regulatory reporting purposes, irrespective of whether the SPVs (or their assets) are consolidated for accounting purposes;
(b)the assets, liabilities, revenues and expenses of the relevant SPVs may be excluded from the ADI’s reported amounts in APRA’s regulatory reporting returns; and
(c)the underlying exposures (i.e. the pool) under such a securitisation may be excluded from the calculation of the regulatory capital (refer to APS 120). However, the ADI must still hold regulatory capital for the securitisation exposures[3] that it retains or acquires and such exposures are to be reported in Form ARF 120.0 Standardised – Securitisation or Forms ARF 120.1A to ARF 120.1C IRB – Securitisation (as appropriate). The risk-weighted assets relating to such securitisation exposures must also be reported in Form ARF 110.0 Capital Adequacy.
[3] Securitisation exposures are defined in accordance with APS 120.
Where an ADI (or a member of its Level 2 consolidated group) participates in a securitisation that does not meet APRA’s operational requirements for regulatory capital relief under APS 120, or the ADI elects to treat the securitised assets as on-balance sheet assets under Prudential Standard APS 112 Capital Adequacy: Standardised Approach to Credit Risk or Prudential Standard APS 113 Capital Adequacy: Internal Ratings-based Approach to Credit Risk (as appropriate), such exposures are to be reported as on-balance sheet assets in APRA’s regulatory reporting returns. In addition, these exposures must also be reported as a part of the ADI’s total securitised assets within Form ARF 120.2 Securitisation – Supplementary Items.
Reporting period and timeframe for lodgement
These forms are to be completed as at the last day of the stated reporting period (the relevant quarter) and submitted to APRA within 30 business days after the end of the relevant reporting period.
Requirements applying to certain ADIs reporting under the forms
The following particular requirements apply to certain ADIs:
| Description of ADI | Reporting requirement | Timeframe for lodgement |
| ADI is operating under Basel II[4] APS 114 standardised approach, but has applied to adopt (or APRA has indicated that it proposes to approve it for) the AMA for most or all of its operations | Report under ARF 115.0A, ARF 115.0B and ARF 115.0C (the forms) in respect of operations to be covered by the AMA (for purposes of assessing prospective operational risk component of regulatory capital calculation after AMA approval (i.e. “parallel run” of data)) | Within 30 business days of end of reporting period. |
| ADI has AMA approval, but some operations remain under Basel II standardised approach | Report under the forms in respect of operations that are under the AMA (for purposes of calculating operational risk component of regulatory capital) | Within 30 business days of end of reporting period. |
[4] If an ADI is required to apply the Basel I capital adequacy standards pending APRA’s determination of an application made before 1 January 2008 for approval to use an internal ratings-based approach to credit risk and/or an advanced measurement approach to operational risk, the ADI must report under the Basel I capital reporting standards: refer to Reporting Standard ARS 150 Capital Adequacy: Basel II Transition (Advanced ADIs) and paragraph 14 of Prudential Standard APS 150 Capital Adequacy: Basel II Transition (Advanced ADIs).
These ADIs will also have certain reporting obligations under Form ARF 114.0 Standardised – Operational Risk.
Unit of measurement
These forms are to be completed in millions of Australian dollars (AUD) rounded to one decimal place, unless otherwise specified in this instruction guide.
Amounts denominated in foreign currency are to be converted to AUD in accordance with AASB 121 The Effects of Changes in Foreign Exchange Rates.
ARF 115.0A AMA – Regulatory capital
Specific instructions
The following instructions are applicable at Level 1 and (where relevant) Level 2.
Section A: Summary of AMA regulatory capital
1.1AMA regulatory capital
Report the amount of AMA regulatory capital net of any insurance offsets, diversification benefits and expected loss offset amounts, in accordance with APS 115.
1.2AMA regulatory capital before insurance offsets
An ADI may recognise the risk-mitigating effect of insurance in determining its AMA regulatory capital (refer to paragraphs 45-49 of Attachment B to APS 115).
Report the amount of AMA regulatory capital, as specified in item 1.1, after taking into account any diversification benefits and expected loss offset amounts but prior to the recognition of the insurance offset amount.
1.3Insurance offset amount
Derived field that subtracts item 1.1 AMA regulatory capital from item 1.2 AMA regulatory capital before insurance offsets.
1.4Insurance offsets as a percentage of AMA regulatory capital before insurance offsets
Derived field that calculates item 1.3 Insurance offset amount as a percentage of item 1.2 AMA regulatory capital before insurance offsets.
1.5AMA regulatory capital before expected loss offsets
An ADI may recognise expected loss offsets in determining the amount of AMA regulatory capital (refer to paragraph 26 of APS 115).
Report the amount of AMA regulatory capital, as specified in item 1.1, after taking into account any insurance offset and diversification benefits but prior to the recognition of any expected loss offsets.
1.6Expected loss offset amount
Derived field that subtracts item 1.1 AMA regulatory capital from item 1.5 AMA regulatory capital before expected loss offsets.
1.7AMA risk-weighted asset equivalent amount
Derived field that multiplies item 1.1 AMA regulatory capital by 12.5.
Section B: AMA regulatory capital mapped to business line
An ADI is required to map its AMA regulatory capital (as specified in section A: item 1.1) to the following business lines:
(a)2.1 Corporate finance;
(b)2.2 Trading and sales;
(c)2.3 Retail banking;
(d)2.4 Commercial banking;
(e)2.5 Payment and settlement;
(f)2.6 Agency services;
(g)2.7 Asset management;
(h)2.8 Retail brokerage; and
(i)2.9 Not otherwise allocated.
Refer to Attachment D of APS 115 for further details on mapping of the AMA regulatory capital to these business lines.
Report these items net of insurance and expected loss offsets and diversification benefits, as permitted under APS 115.
The not otherwise allocated category is only to be used for those losses that are not able to be mapped to the business lines detailed in Attachment D to APS 115. In accordance with paragraph 25 of Attachment B to APS 115, the ADI must develop specific criteria for allocating any such losses.
Section C: AMA regulatory capital mapped to event type
An ADI is required to map its AMA regulatory capital (as specified in section A: item 1.1) to the following loss event types:
(a)3.1 Internal fraud;
(b)3.2 External fraud;
(c)3.3 Employment practices and workplace safety;
(d)3.4 Clients, products and business practices;
(e)3.5 Damage to physical assets;
(f)3.6 Business disruption; and
(g)3.7 Execution, delivery and process management.
Refer to Attachment E of APS 115 for further details on mapping of the AMA regulatory capital to these loss event types.
Where an ADI is unable to complete this section based on its operational risk measurement system, regulatory capital should be allocated proportionally based on the total net loss amounts by event type over the last 12 months.
ARF 115.0B AMA – Operational risk losses - Current six months and ARF 115.0C AMA – Operational risk losses – Previous six months
General guidance
The following instructions are applicable at Level 1 and (where relevant) Level 2.
ADIs are asked to complete the operational risk loss amounts in ARF 115.0B and ARF 115.0C in thousands of Australian dollars rounded to one decimal place.
Global reporting threshold
Unless otherwise stated in this instruction guide, the data to be reported in these forms are to be based on only those loss events which exceed an ADI’s global reporting threshold. For an ADI with foreign operations, only loss events exceeding the equivalent of the global reporting threshold after currency conversion are to be reported.
Open and closed loss events
For reporting purposes, the date of the loss event is the date that the loss was discovered (discovery date). Both open and closed loss events are to be reported in the forms. Open events are those loss events that have been identified but may not yet have been finalised. For open loss events, the amount to be reported is the best estimate of the loss, as at the time of reporting.
Net loss amount
Net loss amount represents the gross loss amount after subtracting any non-insurance recoveries or expected recoveries. Recoveries associated with insurance should not be subtracted from the gross loss amount.
Business lines and event types
Refer to Attachments D and E to APS 115 for guidance on the business lines and event types, respectively, to which an ADI is required to map its internal loss data.
The not otherwise allocated category is only to be used for those losses that are not able to be mapped to the business lines detailed in Attachment D to APS 115. In accordance with paragraph 25 of Attachment B to APS 115, the ADI must develop specific criteria for allocating any such losses.
Operational risk-related credit losses
Refer to paragraphs 27-29 of Attachment B to APS 115 for guidance on operational risk-related credit losses and clarification of the treatment for capital purposes of operational risk losses related to market risk and operational risk-related credit losses.
Absence of losses
Where there has not been a loss corresponding to a specific event type within the applicable business lines, enter zero.
Specific instructions
ARF 115.0B AMA – Operational risk losses – Current six months
The current six month loss events to be reported in this form are those which have discovery dates during the current reporting quarter and the quarter prior to the current quarter.
For column 1 of sections A to F of ARF 115.0B, an ADI is required to select the applicable business lines based on its loss experience, from the dropdown lists in each section.
Section A: Number of loss events by business line and event type
Report the number of loss events according to the relevant business line and event type. Include in this section only those operational risk losses that are treated as operational risk for the purpose of calculating an ADI’s regulatory capital.
Section B: Maximum single net loss amount by business line and event type
Report the largest single net loss amount for each business line and event type by dollar value. Include in this section only those operational risk losses that are treated as operational risk for the purpose of calculating an ADI’s regulatory capital.
Section C: Total net loss amounts by business line and event type
Report the total net loss amount by business line and event type. Include in this section only those operational risk losses that are treated as operational risk for the purpose of calculating an ADI’s regulatory capital.
Section D: Total gross loss amounts by business line and event type
Report the total gross loss amount by business line and event type prior to any recoveries. Include in this section only those operational risk losses that are treated as operational risk for the purpose of calculating an ADI’s regulatory capital.
Section E: Number of operational risk-related credit loss events by business line and event type
Report the number of operational risk-related credit loss events by business line and event type. Include only those losses which exceed the threshold that the ADI has established for operational risk-related credit losses (refer to item 7 Memorandum item: Loss thresholds below) and that are treated as credit risk for the purpose of calculating an ADI’s regulatory capital (refer to paragraph 28 of Attachment B to APS 115).
Section F: Total net operational risk-related credit loss amounts by business line and event type
Report the total net loss amount for operational risk-related credit losses by business line and event type. Include only those losses which exceed the threshold that the ADI has established for operational risk-related credit losses (refer to item 7 Memorandum item: Loss thresholds below) and that are treated as credit risk for the purpose of calculating an ADI’s regulatory capital (refer to paragraph 28 of Attachment B to APS 115).
7. Memorandum items: Loss thresholds
7.1 Threshold for collection of internal loss data
Report the global threshold for collection of data on internal operational risk loss events (including operational risk losses related to market risk) and the currency in which it is denominated. To report the currency, use the relevant three-letter alphabetic International Organization for Standardization (ISO) code[5] (e.g. AUD, New Zealand dollar (NZD) and United States dollar (USD)).
[5] Refer to ISO 4217 Currency names and code elements.
7.2 Threshold for collection of operational risk-related credit loss data
Report the threshold for collection of data on operational risk-related credit losses and the currency in which it is denominated. To report the currency, use the relevant three-letter alphabetic ISO code.
In the event that there are multiple regional thresholds, the ADI is to report the threshold applied at the head office level of the ADI.
ARF 115.0C AMA – Operational risk losses - Previous six months
The loss events to be reported in this form are those which have discovery dates in the six months prior to those events captured in ARF 115.0B.
For column 1 of sections A to F of ARF 115.0C, an ADI is required to select the applicable business lines based on its loss experience, from the dropdown lists in each section.
For the following sections of this form, refer to the instructions for ARF 115.0B included in this instruction guide:
(a)Section A: Number of loss events by business line and event type;
(b)Section B: Maximum single net loss amount by business line and event type;
(c)Section C: Total net loss amounts by business line and event type;
(d)Section D: Total gross loss amounts by business line and event type;
(e)Section E: Number of operational risk-related credit loss events by business line and event type;
(f)Section F: Total net operational risk-related credit loss amounts by business line and event type; and
(g)7. Memorandum items: Loss thresholds.
0
0
0