A credit institution recently changed the scope of the gross losses for operational risk reported in COREP. The credit institution explained that they do not automatically report some types of incidents in the ‘gross losses’ for operational risk in COREP (C17.01a) when the amount is recovered after 5 days. We refer here to transfer of cash involving e.g. a human input error whereby a cash amount is transferred for a far greater size than intended, at the wrong price, or with any number of other input errors, or to the wrong counterparty.
The credit institution explained that gross losses for operational risk should be reported in COREP only if there is a P&L movement in the financial statements. Therefore, if the credit institution considers that there is a high probability to recover the amount linked to the operational risk event, even if they recover the money after more than 5 days, they will not increment any amount in the financial statements, they do not consider it as loss, and therefore they will not report the amount in the COREP ‘gross losses’ for operational risk.
According to us, the competent authorities, this interpretation seems to be incorrect. Our interpretation is that the gross losses for operational risk in COREP should not be dependent on the decision of the credit institution to book losses in its financial statements for this operational risk event. Therefore, if there is an operational risk event, the amount should be reported in COREP in the ‘gross losses’ for operational risk. The only exception is if the losses are recovered within 5 days, in which case it is considered as a “rapidly recovered loss events” and can be deducted from the reported gross losses in COREp (C17.01a)
Could you please clarify which interpretation is correct?
Example: the credit institution A has an operational risk event (execution error): they have wrongly transferred an amount of EUR 1,000 million instead of EUR 1 million to credit institution B. Credit institution A is convinced there is a high probability to recover the funds from credit institution B. Finally, credit institution A recovers the amount of EUR 1,000 million 7 days later after the incident. As credit institution A considered as from start they could recover the money, they did not recorded any loss (EUR 999 million) in their financial statements. Therefore, credit institution A considers it is not an operational risk gross loss and it should not be reported in the COREP "gross losses" (C17.01a) although it took more than 5 days to recover the funds.
It must be preliminary observed that, according to the Regulation (EU) No 451/2021 (ITS on Reporting), gross loss “means a loss – as referred to in point (b) of Article 322(3) CRR – stemming from an operational risk event or loss event type before recoveries of any kind, without prejudice to ‘Rapidly recovered loss events” and “Rapidly recovered loss events’ means operational risk events that lead to losses that are partly or fully recovered within five working days.”
The same regulation sets out that “In case of a rapidly recovered loss event, only the part of the loss that is not fully recovered (i.e. the loss net of the partial rapid recovery) shall be included into the gross loss definition. As a consequence, loss events that lead to losses that are fully recovered within five working days shall not be included into the gross loss definition, and neither into the OPR DETAILS reporting. In the case described in the question, the recovery takes place after five working days, therefore, the event is not a “rapidly recovered loss event”.
Regarding the specific question, the ITS state that:
This means that the number and the gross loss amounts of discovered operational risk events should be reported in COREP in the reporting reference period when they were accounted, i.e., were recognised in the P&L statement of the institution within this reporting reference period.
In the above-described example, as the cash out has not been recovered within 5 days, it is not a considered as a ‘rapidly recovered loss event’. However, as the bank has not recognised yet the loss in the P&L statements, it should not be reported as a gross operational risk loss in COREP C17.01 in the current reporting reference period.
Irrespective of this conclusion based on the current wording of the ITS, it should be observed that the event in the above-described example fully meets the definition of operational risk according to Article 4 (1) (52) of CRR 575/2013 and as such it should be considered for the institution's effective operational risk management.
Moreover, where the reporting Institution is using an AMA for the purpose of calculating its own funds requirements for operational risk, it should be carefully assessed whether such events, i.e., operational risk events discovered but not recognised yet in the P&L statement, are to be instead included within the scope of operational risk for AMA calculation, since triggering the definition of “pending losses”, according to Article 22 (1) (d) of CDR 959/2018.
According to the template instructions of Annex II to Regulation (EU) No 680/2014 (ITS on Reporting), gross loss amounts do not take into account obtained recoveries. The amount of the loss can only be decreased by the “rapidly recovered loss events” (losses that are partly or fully recovered within five working days). In the case described in the question, the recovery takes place after five working days, therefore, the event is not a “rapidly recovered loss event”, but a loss event that should be reported in the gross loss amount line. In addition, the amount recovered should be considered a “recovery” that is, “an independent occurrence related to the original operational risk loss that is separate in time, in which funds or inflows of economic benefits are received from first or third parties, such as insurers or other parties”. In particular, it should be considered a “direct loss recovery”, since the amount is not subject to article 323 CRR (insurance or other risk transfer).
Update 15.10.2021: This Q&A has been amended to reflect Annex II to Regulation (EU) 2021/451 (ITS on Reporting), instructions for template C 17.01.