Art. 317

texts differ too much for an inline diff; shown separately

before (02013R0575-20240709)

Article 317
Own funds requirement
1. Under the Standardised Approach, institutions shall divide their activities into the business lines set out in Table 2 of paragraph 4 and in accordance with the principles set out in Article 318.
2. Institutions shall calculate the own funds requirement for operational risk as the average over three years of the sum of the annual own funds requirements across all business lines referred to in Table 2 of paragraph 4. The annual own funds requirement of each business line is equal to the product of the corresponding beta factor referred to in that Table and the part of the relevant indicator mapped to the respective business line.
3. In any given year, institutions may offset negative own funds requirements resulting from a negative part of the relevant indicator in any business line with positive own funds requirements in other business lines without limit. However, where the aggregate own funds requirement across all business lines within a given year is negative, institutions shall use the value zero as the input to the numerator for that year.
4. Institutions shall calculate the average over three years of the sum referred to in paragraph 2 on the basis of the last three twelve-monthly observations at the end of the financial year. When audited figures are not available, institutions may use business estimates.
Where an institution can prove to its competent authority that, due to a merger, an acquisition or a disposal of entities or activities, using a three year average to calculate the relevant indicator would lead to a biased estimation for the own funds requirement for operational risk, the competent authority may permit institutions to amend the calculation in a way that would take into account such events and shall duly inform EBA thereof. In such circumstances, the competent authority may, on its own initiative, also require an institution to amend the calculation.
Where an institution has been in operation for less than three years it may use forward-looking business estimates in calculating the relevant indicator, provided that it starts using historical data as soon as it is available.
Table 2
Business line List of activities Percentage (beta factor)
Corporate finance Underwriting of financial instruments or placing of financial instruments on a firm commitment basis
Services related to underwriting
Investment advice
Advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to the mergers and the purchase of undertakings
Investment research and financial analysis and other forms of general recommendation relating to transactions in financial instruments 18 %
Trading and sales Dealing on own account
Money broking
Reception and transmission of orders in relation to one or more financial instruments
Execution of orders on behalf of clients
Placing of financial instruments without a firm commitment basis
Operation of Multilateral Trading Facilities 18 %
Retail brokerage
(Activities with natural persons or with SMEs meeting the criteria set out in Article 123 for the retail exposure class) Reception and transmission of orders in relation to one or more financial instruments
Execution of orders on behalf of clients
Placing of financial instruments without a firm commitment basis 12 %
Commercial banking Acceptance of deposits and other repayable funds
Lending
Financial leasing
Guarantees and commitments 15 %
Retail banking
(Activities with natural persons or with SMEs meeting the criteria set out in Article 123 for the retail exposure class) Acceptance of deposits and other repayable funds
Lending
Financial leasing
Guarantees and commitments 12 %
Payment and settlement Money transmission services,
Issuing and administering means of payment 18 %
Agency services Safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management 15 %
Asset management Portfolio management
Managing of UCITS
Other forms of asset management 12 %
9. For the purposes of paragraph 7, EBA shall develop draft regulatory technical standards establishing a risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk.
EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.
10. For the purposes of paragraph 8, EBA shall issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, explaining the technical elements necessary to ensure the soundness, robustness and performance of governance arrangements to maintain the loss data set, with a particular focus on IT systems and infrastructures.

after (02013R0575-20250101)

Article 317
Loss data set
1. Institutions that calculate an annual operational risk loss in accordance with Article 316(1) shall have in place arrangements, processes and mechanisms to establish and maintain updated on an ongoing basis a loss data set compiling for each recorded operational risk event the gross loss amounts, non-insurance recoveries, insurance recoveries, reference dates and grouped losses, including those from misconduct events.
2. The institution’s loss data set shall capture all operational risk events stemming from all entities that are part of the scope of consolidation pursuant to Part One, Title II, Chapter 2.
3. For the purpose of paragraph 1, institutions shall:
(a) include in the loss data set each operational risk event recorded during one or multiple financial years;
(b) use the date of accounting for including losses related to operational risk events in the loss data set;
(c) allocate losses and recoveries related to a common operational risk event or related operational risk events over time and posted to the accounts over several years, to the corresponding financial years of the loss data set, in line with their accounting treatment.
4. Institutions shall also collect:
(a) information about the reference dates of operational risk events, including:
(i) the date when the operational risk event happened or first began (date of occurrence), where available;
(ii) the date on which the institution became aware of the operational risk event (date of discovery);
(iii) the date or dates on which an operational risk event results in a loss, or the reserve or provision against a loss, recognised in the institution’s profit and loss accounts (date of accounting);
(b) information on any recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss events.
The level of detail of any descriptive information shall be commensurate with the size of the gross loss amount.
5. An institution shall not include in the loss data set operational risk events related to credit risk that are accounted for in the risk-weighted exposure amount for credit risk. Operational risk events that relate to credit risk but are not accounted for in the risk-weighted exposure amount for credit risk shall be included in the loss data set.
6. Operational risk events related to market risk shall be treated as operational risk and shall be included in the loss data set.
7. An institution shall, upon request from the competent authority, be able to map its historical internal loss data to the event type.
8. For the purposes of this Article, institutions shall ensure the soundness, robustness and performance of their IT systems and infrastructure necessary to maintain and update the loss data set, in particular by ensuring all of the following:
(a) their IT systems and infrastructure are sound and resilient and that that soundness and resilience can be maintained on a continuous basis;
(b) their IT systems and infrastructure are subject to configuration management, change management and release management processes;
(c) where an institution outsources parts of the maintenance of its IT systems and infrastructure, the soundness, robustness and performance of the IT systems and infrastructure is ensured by confirming at least the following:
(i) its IT systems and infrastructure are sound and resilient and that soundness and resilience can be maintained on a continuous basis;
(ii) the process for planning, creating, testing and deploying the IT systems and infrastructure is sound and proper with reference to project management, risk management, governance, engineering, quality assurance and test planning, systems’ modelling and development, quality assurance in all activities, including code reviews and, where appropriate, code verification, and testing, including user acceptance;
(iii) its IT systems and infrastructure are subject to configuration management, change management and release management processes;
(iv) the process for planning, creating, testing and deploying the IT systems and infrastructure and contingency plans is approved by the management body or senior management and the management body and senior management are periodically informed about the IT systems and infrastructure performance.
9. For the purposes of paragraph 7, EBA shall develop draft regulatory technical standards establishing a risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk.
EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2026.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.
10. For the purposes of paragraph 8, EBA shall issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, explaining the technical elements necessary to ensure the soundness, robustness and performance of governance arrangements to maintain the loss data set, with a particular focus on IT systems and infrastructures.