Banks record clerical errors and fraud in trade capture and settlement as losses. They map each record to a type and use the records in the capital calculation. The business lines and the risk management function look at losses from this same set of records.

Regulatory definition and scope

The FSA's capital adequacy notice for banks (the Notice) defines operational risk as the risk of loss. The loss has two possible sources: inadequate or failed business processes, officers and employees, or systems; or external events. The definition includes legal risk and excludes strategic risk and reputational risk1. The risk also covers clerical errors, system failures (including those caused by cyberattacks), natural disasters, and penalties or fines for misconduct such as money laundering2. Its subcategories include clerical risk (the risk of loss when officers and employees fail to process work accurately or cause accidents or fraud) and system risk2.

The scope used to calculate regulatory capital is not the same as the scope an institution manages. Each institution decides what it manages, and it can define and manage as operational risk some risks that fall outside the regulatory calculation3. Strategic risk and reputational risk are outside the regulatory definition, but they are still points to consider in managing operational risk4.

The boundary with other risks is set by the criteria for the internal loss data used in the capital calculation. Internal loss data includes operational risk losses related to market risk. It excludes losses related to credit risk that are already included in the capital calculation for credit risk5.

Seven types of loss events

The Notice classifies operational risk loss events into the following seven types6. A bank that uses its own loss data in the capital calculation maps its loss data to these types and keeps it ready to submit when the FSA asks for it5.

Loss event type What it covers
Internal fraud Losses from fraud, misappropriation of property, or acts intended to circumvent regulations, laws or internal rules, involving at least one officer or employee
External fraud Losses from fraud, misappropriation of property, or acts intended to circumvent the law, committed by a third party
Employment practices and workplace safety Losses from acts inconsistent with employment, health or safety laws or agreements, from workplace injuries, from discrimination and similar acts
Clients, products and business practices Losses from a negligent failure to meet obligations to specific clients (such as fiduciary duties and suitability), or from the nature or design of a product
Damage to physical assets Losses from damage to physical assets caused by natural disasters and other events
Business disruption and system failures Losses from disruption of business or from system failures
Execution, delivery and process management Losses from relationships with counterparties and vendors, and from failed transaction processing or process management

In derivatives business, failures in transaction processing, such as trade capture, reconciliation of trade confirmations and settlement, fall under "execution, delivery and process management." Breaches of obligations such as suitability when selling derivatives to clients fall under "clients, products and business practices"6.

Where losses can arise in derivatives business

The situations in derivatives business that can lead to operational risk losses fall into the following seven.

Situation Examples of what happens Page that continues the topic
Trade capture and confirmation Errors in entering trade terms, mismatches between the confirmation and internal records Booking Errors and Confirmation Mismatches
Settlement Failures in settlement processing Settlement Failures and Reporting Errors
Exchange of collateral Disputes with counterparties over margin Collateral Operations
Models and data Errors in valuation or risk measurement models, errors in how they are used Model Risk Management
Contracts Flaws in executing contracts or in their terms The ISDA Master Agreement and Schedule
Rogue trading A trader circumvents internal rules to trade and hides the losses Rogue Trading Cases: Barings, Societe Generale and Others
System failures Business disruption from system outages or processing errors None

For margin on OTC derivatives that are not centrally cleared, the FSA's supervisory guidelines for financial instruments business operators list the following points for supervisors to check. The firm decides in advance how it will respond when a dispute arises, and it records and keeps the details of each dispute7. The firm also signs an appropriate contract on margin with each counterparty8.

If a valuation or risk measurement model contains errors, or is used inappropriately, decisions can be based on incorrect information, which can damage earnings or the financial position9.

Rogue trading falls under "internal fraud," as an act by an officer or employee intended to circumvent internal rules6. Controls that help prevent it include segregation of duties and regular reconciliation of transactions and accounts10.

The three lines model and management tools

Operational risk management builds on the three lines model. The FSA's supervisory guidelines for major banks treat the three lines model (which the guidelines call a three lines of defense system) as one of the points for supervisors to check. Supervisors look at whether the board of directors and others have set policies and reporting arrangements so that the business units, the risk management function and the internal audit function check one another11. In the principles the Basel Committee on Banking Supervision revised in March 2021, statements on the importance of the three lines model were added in many places12.

Line Who Role
First line Business lines Identify and manage the risks in their own products, activities, processes and systems
Second line An operational risk management function independent of the business lines Reviews the reports from the business lines and, in large banks, designs and maintains the firm-wide framework
Third line Internal audit Verifies that the framework works, from a position not involved in building or running it

The table follows the Basel Committee's 2011 principles, which call the same arrangement the "three lines of defence"13.

BankBoard of directors and othersIdentify the loss event andrecord its date, amount andcauseMap it to one ofthe 7 typesAnalyze the losses andlook for control problemsReport to the boardof directors and others
Figure 1From a loss event to a management report
Figure description

The loss analysis checks whether control problems are isolated or common across the institution13. Whether the second line makes the report depends on factors such as the size of the bank13.

Management tools include loss data collection, risk and control self-assessment (RCSA) and key risk indicators (KRIs)14. RCSA is a method in which the people who do the work identify and assess risks that have not yet materialized15. It assesses the inherent risk before controls, the effectiveness of the controls, and the residual risk that remains after controls14. KRIs are quantitative metrics that track the main drivers of key risks, and they are used with an escalation process that reports to a higher level when a threshold is exceeded14.

Consider a hypothetical example in which Bank A's derivatives department makes an error in trade capture. A mismatch is found when the confirmation is reconciled with the counterparty. Correcting the trade to its agreed terms causes a loss of 300 million yen, and 100 million yen is later recovered from the counterparty.

Because this is a failure in transaction processing, the type is "execution, delivery and process management." The loss data records the date of occurrence, the date of discovery, the amount recovered and other details, along with the cause (an entry error). The gross loss before the recovery is 300 million yen, and the net loss after subtracting the recovery is 200 million yen. When the same kind of record builds up, the causes of large losses become clear14.

Capital calculation

Capital adequacy regulation requires banks to hold capital against operational risk, as it does for credit risk and market risk17. The denominator of the capital adequacy ratio adds the operational risk amount divided by 8% to amounts such as credit risk-weighted assets18. How credit risk-weighted assets and the denominator of the ratio are built up is covered in Overview of the Regulatory Treatment of Counterparty Risk.

Banks calculate the operational risk amount with the standardized approach. The amount is the business indicator component (BIC), derived from an indicator of business size (the business indicator, BI), multiplied by the internal loss multiplier (ILM), which reflects past loss experience. For a bank that calculates the ILM from its loss experience, the amount rises as losses grow relative to the size of the business. A bank with a BI of 100 billion yen or less may use an ILM of 1. A bank with a BI of 100 billion yen or less also uses 1 if it does not meet the loss data criteria19.

The standardized approach was introduced with the Basel III finalization, which also abolished the internal model approach for operational risk20. Under Japan's capital adequacy regulation, the international standard applies to banks with business offices (subsidiaries or branches) outside Japan, and the domestic standard applies to other banks21. The standardized approach has applied since March 31, 2024 to institutions under the international standard and certain others, and since March 31, 2025 to the remaining domestic-standard institutions and certain others22.

Notes

  1. Financial Services Agency, "銀行法第十四条の二の規定に基づき、銀行がその保有する資産等に照らし自己資本の充実の状況が適当であるかどうかを判断するための基準" (Standards for determining whether a bank's capital adequacy is appropriate in light of the assets it holds, under Article 14-2 of the Banking Act, our translation; FSA Notice No. 19 of 2006, consolidated version updated on August 24, 2026), Article 1, item 111 (page 26) (in Japanese). ↩

  2. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), III-2-3-7-1 (pages 144–145) (in Japanese). ↩ ↩2

  3. Bank of Japan, Financial System and Bank Examination Department, Center for Advanced Financial Technology, "オペレーショナルリスク管理態勢の整備" (Developing an operational risk management framework) (September 2019), page 3 (in Japanese). ↩

  4. Financial Services Agency and Bank of Japan, "バーゼル銀行監督委員会による「健全なオペレーショナル・リスク管理のための諸原則の改訂」の公表について" (On the Basel Committee on Banking Supervision's publication of "Revisions to the Principles for the Sound Management of Operational Risk") (May 2021), page 4 (in Japanese). ↩

  5. Financial Services Agency, "銀行法第十四条の二の規定に基づき、銀行がその保有する資産等に照らし自己資本の充実の状況が適当であるかどうかを判断するための基準" (FSA Notice No. 19 of 2006), Article 310, item 1, sub-items ハ, ホ to チ, リ and ヌ (pages 563–564) (in Japanese). ↩ ↩2 ↩3

  6. The same Notice, Appended Table 2 (別表第二) (pages 614–615) (in Japanese). ↩ ↩2 ↩3

  7. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), IV-2-4(4)③ロ (page 125) (in Japanese). ↩

  8. The same guidelines, IV-2-4(4)①イ and ②イ (pages 124–125) (in Japanese). ↩

  9. Financial Services Agency, "モデル・リスク管理に関する原則" (Principles for Model Risk Management) (November 2021), "Ⅰ. 意義" (I. Purpose), pages 2–3 (in Japanese). The FSA published an English translation, "Principles for Model Risk Management" (November 12, 2021): FSA. ↩

  10. Basel Committee on Banking Supervision, "健全なオペレーショナル・リスク管理のための諸原則" (Principles for the Sound Management of Operational Risk, provisional Japanese translation by the FSA; June 2011), paragraphs 49 and 50 (f) (page 21) (in Japanese). The English original is Basel Committee on Banking Supervision, "Principles for the Sound Management of Operational Risk" (June 2011); the page numbers above are those of the translation. ↩

  11. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), III-2-3-7-2(1)② (page 145) (in Japanese). ↩

  12. Financial Services Agency and Bank of Japan, "バーゼル銀行監督委員会による「健全なオペレーショナル・リスク管理のための諸原則の改訂」の公表について" (On the Basel Committee on Banking Supervision's publication of "Revisions to the Principles for the Sound Management of Operational Risk") (May 2021), page 3 (in Japanese). ↩

  13. Basel Committee on Banking Supervision, "健全なオペレーショナル・リスク管理のための諸原則" (Principles for the Sound Management of Operational Risk, provisional Japanese translation by the FSA; June 2011), paragraphs 13–16 and 18 (pages 4–6) (in Japanese). ↩ ↩2 ↩3

  14. Basel Committee on Banking Supervision, "健全なオペレーショナル・リスク管理のための諸原則" (Principles for the Sound Management of Operational Risk, provisional Japanese translation by the FSA; June 2011), paragraph 39 (b) to (d) and (f) (pages 15–17) (in Japanese). ↩ ↩2 ↩3 ↩4

  15. Bank of Japan, Financial System and Bank Examination Department, Center for Advanced Financial Technology, "オペレーショナルリスク管理態勢の整備" (Developing an operational risk management framework) (September 2019), page 18 (in Japanese). ↩

  16. Bank of Japan, Financial System and Bank Examination Department, Center for Advanced Financial Technology, "オペレーショナルリスク管理態勢の整備" (Developing an operational risk management framework) (September 2019), page 17 (in Japanese). ↩

  17. Financial Services Agency, "バーゼル規制の概要" (Overview of the Basel framework) (August 2026), page 12 (in Japanese). ↩

  18. Financial Services Agency, "銀行法第十四条の二の規定に基づき、銀行がその保有する資産等に照らし自己資本の充実の状況が適当であるかどうかを判断するための基準" (FSA Notice No. 19 of 2006), Article 2 (page 27) (in Japanese). ↩

  19. The same Notice, Articles 303 and 304 (page 559), Article 305, paragraph 1 (page 559), and Article 306, paragraph 1, items 1 to 3 (pages 560–561) (in Japanese). ↩

  20. Financial Services Agency, "バーゼル規制の概要" (Overview of the Basel framework) (August 2026), page 9 (in Japanese). ↩

  21. The same document, page 16 (in Japanese). ↩

  22. The same document, page 10, which groups institutions by the date the rules start to apply (in Japanese). ↩