In accordance with Article 4 (52) of the Capital Requirements Regulation (CRR), operational risk is the risk of losses resulting from inadequate or failed internal processes, people and systems or from external events, including legal risk, model risk or information and communication technology (ICT) risk.

With the revision of the CRR to implement the Basel III requirements, the multitude of approaches to calculating own funds requirements for operational risk (the basic indicator approach, the standardised/alternative standardised approach, and the advanced measurement approaches) was abolished.

The own funds requirements for operational risk are now calculated on the basis of a standardised approach based on the business indicator (BI). This replaces the previous “relevant indicator”.

In accordance with Article 314 of the CRR, the business indicator consists of an interest, leasing and dividend component, a services component and a financial component and is derived from defined items in the profit and loss account.

    Interest rate, leasing and dividend component (ILDC)
+ Services component (SC) 
+ Financial component (FC)
--------------------------------------------------------------------
= Business indicator (BI)

The business indicator component (BIC) is calculated on the basis of the business indicator in accordance with Article 313 of the CRR. The business indicator is broken down into different buckets, each subject to a defined coefficient. The own funds requirement for operational risk is the calculated business indicator component (Article 312 of the CRR).

The CRR regime does not provide for an additional adjustment to the own funds requirement based on internal loss data (as included in the Basel framework). However, institutions with a business indicator of at least €750 million must calculate their annual operational risk loss in accordance with Article 316 of the CRR. This is calculated as the 10-year average of the sum of all net losses per financial year that have reached or exceeded the set threshold of €20,000.

Qualitative requirements for operational risk management remain unchanged (Article 323 of the CRR). These include, in particular, the identification, assessment and management of operational risk as well as the collection and evaluation of internal loss data.