OPERATIONAL RISK REPORTING STANDARDS …

1 OPERATIONAL RISK REPORTING STANDARDS (ORRS) EDITION 2011 VERSION: BOARD APPROVED: 10 JUNE 2011 REVISED: 12 JULY 2012 Sponsored by: G nther Helbok (UniCredit bank Austria) Thomas Mueller (Deutsche bank ) Supported by: Definitions Working Group Prepared by: Mark Laycock Copyright & Disclaimer Notice All rights in this document are owned and controlled by ORX. ORX permits it to be used internally by Members, but not transmitted publicly in whole or in part. ORX has prepared this document with care and attention. ORX does not accept responsibility for any errors or omissions. ORX does not warrant the accuracy of the comments, statement or recommendations in this document. ORX shall not be liable for any loss, expense, damage or claim arising from this document. The content of this document does not itself constitute a contractual agreement, ORX accepts no obligation associated with this document except as expressly agreed in Risk REPORTING STANDARDS Page 2 of 60 This document makes use of Hyperlinks for ease of navigation.

2 Hyperlinks can be activated using Ctrl+Click with the keyboard and mouse, the cursor may change shape, for example to . The Table of Contents also contains Hyperlinks. If ORX Members have queries on the text or would like to raise issues for concern then they should Email Mark Laycock of the ORX Secretariat, with a description of the issue. Contact Information OPERATIONAL Riskdata eXchange Association (ORX) Contact address: c/o Balmer Etienne AG Dreikonigstrasse 34 CH-8002 Zurich Switzerland Web Site: Version Control 30 June 2011 Definition of Legal Risk 20 July Requirement for Credit Risk- OPERATIONAL Risk Boundary 28 September Legal Events 9 December Board ratifies DWG Recommendations 10 May 2012 Tax Decision Tree Negative Revenues becomes Revenue Adjustments Uncollected Revenues added example, deleted example 15 June Transitional Arrangements - deleted Categorisation of Tax related sanctions 27 June Legal Costs Decision Tree TABLE OF CONTENTS OPERATIONAL Risk REPORTING STANDARDS 2011 12 July 2012 Page 3 of 60 1.

3 Introduction 5 Objectives of this document .. 5 Document Structure .. 6 Relationship between Global and Sector Databases .. 6 Governance of ORRS .. 7 2. Data Quality Governance 8 Introduction .. 8 ORX REquirements & Procedures .. 8 3. What to Report Definitions & Boundaries 10 OPERATIONAL Risk .. 10 OPERATIONAL Risk 10 Legal Risk 11 OPERATIONAL Risk Event .. 11 Grouped Losses (vs Single Events) 12 Linked Events 13 Legal Events 15 Tax Events 18 OPERATIONAL Risk Loss .. 18 Lifecycle of an OPERATIONAL Risk Loss 19 Timing Losses 19 Pending Losses 20 Boundary between OPERATIONAL and Other risks .. 21 Credit Risk 21 Market Risk 23 Strategic Risk 25 Project Risk 26 Business Risk 26 Reputational Risk 27 Liquidity Risk 27 4. Determine the OPERATIONAL Risk Loss Amount Quantification 28 General Principles .. 28 Gross Loss 28 Recoveries 29 Special Cases .. 30 Rapid Recoveries 30 Revenue ADjustment 31 Uncollected Revenue 31 Fixed Assets, Investment Assets, and Intangibles 33 Provisions & Reserves 34 Regulatory Action Fines and/or Penalties 34 FX Conversion Rates.

4 35 OPERATIONAL Risk REPORTING STANDARDS 2011 12 July 2012 Page 4 of 60 5. How to Categorise OPERATIONAL Risk Losses 36 Business Lines .. 36 Corporate Items 36 Events Affecting Multiple Business Lines 37 Materiality 38 Event Types .. 41 Product Types .. 44 Bundled Products 44 Process Types .. 47 Large Loss Event Attributes .. 51 Country Codes .. 52 6. How to Report Exposure Indicators 54 Gross Income .. 54 Sector Database Exposure Indicators .. 55 7. Technical issues: Threshold, History, Coverage, etc 56 REPORTING Gross Loss Threshold .. 56 Time Period .. 56 Consolidated REPORTING .. 57 Exceptions to Complete REPORTING .. 57 Submitting Historical Data .. 58 Effects of Acquiring or Disposing of Business Units .. 58 Submitting Losses for a New Business Line .. 59 Stopping REPORTING for an Existing Business Line .. 59 Mergers between Members .. 59 Leaving ORX .. 59 OPERATIONAL Risk REPORTING STANDARDS 2011 12 July 2012 Page 5 of 60 1.

5 INTRODUCTION OBJECTIVES OF THIS DOCUMENT This document describes the STANDARDS for REPORTING OPERATIONAL Risk losses for consolidation and analysis in the ORX global database by Members of ORX. These STANDARDS may serve as a useful reference for Non-ORX firms for categorising OPERATIONAL Risk losses; as such the STANDARDS are provided and published as an industry resource. This document contains a number of definitions and principles to promote the consistency of REPORTING and data categorisation. The Definitions Working Group (DWG) has found it useful to refer to these definitions and principles when discussing issues around categorisation and various boundaries, in particular between OPERATIONAL and Other risks . This 2011 edition of the OPERATIONAL Risk REPORTING STANDARDS (ORRS) supersedes and replaces the current version from 2007. The main changes since the 2007 edition have been the addition of categories for Products, Processes and additional attributes for Large Losses.

6 ORX Members are free to adopt varying definitions and methodologies for internal loss recording and REPORTING . However, each Member is required to make submissions to the ORX global database following the uniform STANDARDS and definitions set out below. These STANDARDS relate to the ORX global database of OPERATIONAL Risk losses. A number of Sector Databases have been, or are in the process of being established by ORX. These Sector Databases may have particular emphasis on geography or business activity, for example Canada and Investment Banking. The STANDARDS for these Sector Databases may deviate in some way from the STANDARDS for the global database. The relationship between the Global and Sector databases is more completely described in Section page 6. Data submission to the ORX global database is made on a quarterly basis. Each time there is a data REPORTING cycle, Members will produce and send their data since inception (January 2002 for founding Members).

7 Members are expected to report their full loss data history. See Section Exceptions to Complete REPORTING for further reference ORX is aware that all Members are constantly refining their internal processes for capturing OPERATIONAL Risk losses/events. As a consequence of this constant refinement, Members are allowed to modify and/or update their previously reported records. OPERATIONAL Risk REPORTING STANDARDS 2011 12 July 2012 Page 6 of 60 A number of aspects around the ORX global database promote anonymity of the individual members. In some instances these aspects relate to the delivery of historic data by new Members, in other instances it affects the granularity of the reports back to Members. For example, Members provide country level data, but receive back regional level information. Anonymity and confidentiality around the ORX databases and data are important and are reflected in the Articles of Association of ORX.

8 DOCUMENT STRUCT URE The document has been restructured, in comparison to earlier editions, to promote clarity and ease of finding details. Each topic begins with a Principle / Definition section. This is then followed by the REPORTING Requirement and Examples. The final parts of the individual topic relate to Cross-References and ORRS Updates. The examples may be sub-divided into examples of Inclusions and examples of Exclusions. Details of all categories can be found in an Appendix, which has been moved into a separate document. These detailed descriptions may include additional examples as well as notes. RELATIONSHIP BETW EEN GLOBAL AND SECTOR DATABASES This document is primarily concerned with the OPERATIONAL Risk REPORTING STANDARDS that apply to the Global Database. As one of the strategic initiative for ORX is the development of Sector Databases it is important that the relationship between these OPERATIONAL Risk REPORTING STANDARDS and the Sector Databases is clearly understood and appreciated.

9 Sector Databases may address a variety of interests, for example geographic or activity. An example of a Geographic Sector Database is the Canadian database. An example of an Activity Sector Database is Investment Banking. Where the Sector Databases primarily have banks as Members and the focus is upon loss data then it is efficient for these Sector Databases to follow the STANDARDS for the Global Database. The efficiency is in terms of STANDARDS and supporting system infrastructure. This implies that where the STANDARDS for the Global Database change then these changes will be reflected in the Sector Database. Where the Members of the Sector Database agree to deviate from the STANDARDS for the Global Database they can do so. For example a Geographic Sector Database may decide to have a lower REPORTING threshold. An Activity Sector Database may decide to have additional exposure indicators and additional levels of granularity in Business Lines or Event Types.

10 OPERATIONAL Risk REPORTING STANDARDS 2011 12 July 2012 Page 7 of 60 Where the Sector Database does not have banks as Members, for example in the case of insurance companies (even if they are subsidiaries of banks) then changes will be required. Such changes may be in the detailed business lines and other data categories, such as Products. For the Sector Databases, the responsibility for agreeing and documenting the REPORTING STANDARDS belongs to the participants of that database. In any case, substantial incremental costs from deviating from the STANDARDS of the Global Database may be reflected in the costs of membership to the respective database. GOVERNANCE OF ORRS Changes to the OPERATIONAL Risk REPORTING STANDARDS must be approved by the Board of ORX. The Definitions Working Group has the responsibility for reviewing the OPERATIONAL Risk REPORTING STANDARDS and making recommendations to the Board of ORX. The Definitions Working Group will review requests from individual Members as well as from the Quality Assurance Working Group.