(a) Process and systems requirements. (1) A national bank or Federal savings association must have a rigorous process for assessing its overall capital adequacy in relation to its risk profile and a comprehensive strategy for maintaining an appropriate level of capital.
(1) A national bank or Federal savings association must have a rigorous process for assessing its overall capital adequacy in relation to its risk profile and a comprehensive strategy for maintaining an appropriate level of capital.
(2) The systems and processes used by a national bank or Federal savings association for risk-based capital purposes under this subpart must be consistent with the national bank's or Federal savings association's internal risk management processes and management information reporting systems.
(3) Each national bank or Federal savings association must have an appropriate infrastructure with risk measurement and management processes that meet the qualification requirements of this section and are appropriate given the national bank's or Federal savings association's size and level of complexity. Regardless of whether the systems and models that generate the risk parameters necessary for calculating a national bank's or Federal savings association's risk-based capital requirements are located at any affiliate of the national bank or Federal savings association, the national bank or Federal savings association itself must ensure that the risk parameters and reference data used to determine its risk-based capital requirements are representative of its own credit risk and operational risk exposures.
(b) Risk rating and segmentation systems for wholesale and retail exposures. (1) A national bank or Federal savings association must have an internal risk rating and segmentation system that accurately and reliably differentiates among degrees of credit risk for the national bank's or Federal savings association's wholesale and retail exposures.
(1) A national bank or Federal savings association must have an internal risk rating and segmentation system that accurately and reliably differentiates among degrees of credit risk for the national bank's or Federal savings association's wholesale and retail exposures.
(2) For wholesale exposures:
(i) A national bank or Federal savings association must have an internal risk rating system that accurately and reliably assigns each obligor to a single rating grade (reflecting the obligor's likelihood of default). A national bank or Federal savings association may elect, however, not to assign to a rating grade an obligor to whom the national bank or Federal savings association extends credit based solely on the financial strength of a guarantor, provided that all of the national bank's or Federal savings association's exposures to the obligor are fully covered by eligible guarantees, the national bank or Federal savings association applies the PD substitution approach in Sec. 3.134(c)(1) to all exposures to that obligor, and the national bank or Federal savings association immediately assigns the obligor to a rating grade if a guarantee can no longer be recognized under this part. The national bank's or Federal savings association's wholesale obligor rating system must have at least seven discrete rating grades for non-defaulted obligors and at least one rating grade for defaulted obligors.
(ii) Unless the national bank or Federal savings association has chosen to directly assign LGD estimates to each wholesale exposure, the national bank or Federal savings association must have an internal risk rating system that accurately and reliably assigns each wholesale exposure to a loss severity rating grade (reflecting the national bank's or Federal savings association's estimate of the LGD of the exposure). A national bank or Federal savings association employing loss severity rating grades must have a sufficiently granular loss severity grading system to avoid grouping together exposures with widely ranging LGDs.
(3) For retail exposures, a national bank or Federal savings association must have an internal system that groups retail exposures into the appropriate retail exposure subcategory, groups the retail exposures in each retail exposure subcategory into separate segments with homogeneous risk characteristics, and assigns accurate and reliable PD and LGD estimates for each segment on a consistent basis. The national bank's or Federal savings association's system must identify and group in separate segments by subcategories exposures identified in Sec. 3.131(c)(2)(ii) and (iii).
(4) The national bank's or Federal savings association's internal risk rating policy for wholesale exposures must describe the national bank's or Federal savings association's rating philosophy (that is, must describe how wholesale obligor rating assignments are affected by the national bank's or Federal savings association's choice of the range of economic, business, and industry conditions that are considered in the obligor rating process).
(5) The national bank's or Federal savings association's internal risk rating system for wholesale exposures must provide for the review and update (as appropriate) of each obligor rating and (if applicable) each loss severity rating whenever the national bank or Federal savings association receives new material information, but no less frequently than annually. The national bank's or Federal savings association's retail exposure segmentation system must provide for the review and update (as appropriate) of assignments of retail exposures to segments whenever the national bank or Federal savings association receives new material information, but generally no less frequently than quarterly.
(c) Quantification of risk parameters for wholesale and retail exposures. (1) The national bank or Federal savings association must have a comprehensive risk parameter quantification process that produces accurate, timely, and reliable estimates of the risk parameters for the national bank's or Federal savings association's wholesale and retail exposures.
(1) The national bank or Federal savings association must have a comprehensive risk parameter quantification process that produces accurate, timely, and reliable estimates of the risk parameters for the national bank's or Federal savings association's wholesale and retail exposures.
(2) Data used to estimate the risk parameters must be relevant to the national bank's or Federal savings association's actual wholesale and retail exposures, and of sufficient quality to support the determination of risk-based capital requirements for the exposures.
(3) The national bank's or Federal savings association's risk parameter quantification process must produce appropriately conservative risk parameter estimates where the national bank or Federal savings association has limited relevant data, and any adjustments that are part of the quantification process must not result in a pattern of bias toward lower risk parameter estimates.
(4) The national bank's or Federal savings association's risk parameter estimation process should not rely on the possibility of U.S. government financial assistance, except for the financial assistance that the U.S. government has a legally binding commitment to provide.
(5) Where the national bank's or Federal savings association's quantifications of LGD directly or indirectly incorporate estimates of the effectiveness of its credit risk management practices in reducing its exposure to troubled obligors prior to default, the national bank or Federal savings association must support such estimates with empirical analysis showing that the estimates are consistent with its historical experience in dealing with such exposures during economic downturn conditions.
(6) PD estimates for wholesale obligors and retail segments must be based on at least five years of default data. LGD estimates for wholesale exposures must be based on at least seven years of loss severity data, and LGD estimates for retail segments must be based on at least five years of loss severity data. EAD estimates for wholesale exposures must be based on at least seven years of exposure amount data, and EAD estimates for retail segments must be based on at least five years of exposure amount data.
(7) Default, loss severity, and exposure amount data must include periods of economic downturn conditions, or the national bank or Federal savings association must adjust its estimates of risk parameters to compensate for the lack of data from periods of economic downturn conditions.
(8) The national bank's or Federal savings association's PD, LGD, and EAD estimates must be based on the definition of default in Sec. 3.101.
(9) The national bank or Federal savings association must review and update (as appropriate) its risk parameters and its risk parameter quantification process at least annually.
(10) The national bank or Federal savings association must, at least annually, conduct a comprehensive review and analysis of reference data to determine relevance of reference data to the national bank's or Federal savings association's exposures, quality of reference data to support PD, LGD, and EAD estimates, and consistency of reference data to the definition of default in Sec. 3.101.
(d) Counterparty credit risk model. A national bank or Federal savings association must obtain the prior written approval of the OCC under Sec. 3.132 to use the internal models methodology for counterparty credit risk and the advanced CVA approach for the CVA capital requirement.
(e) Double default treatment. A national bank or Federal savings association must obtain the prior written approval of the OCC under Sec. 3.135 to use the double default treatment.
(f) Equity exposures model. A national bank or Federal savings association must obtain the prior written approval of the OCC under Sec. 3.153 to use the internal models approach for equity exposures.
(g) Operational risk. (1) Operational risk management processes. A national bank or Federal savings association must:
(1) Operational risk management processes. A national bank or Federal savings association must:
(i) Have an operational risk management function that:
(A) Is independent of business line management; and
(B) Is responsible for designing, implementing, and overseeing the national bank's or Federal savings association's operational risk data and assessment systems, operational risk quantification systems, and related processes;
(ii) Have and document a process (which must capture business environment and internal control factors affecting the national bank's or Federal savings association's operational risk profile) to identify, measure, monitor, and control operational risk in the national bank's or Federal savings association's products, activities, processes, and systems; and
(iii) Report operational risk exposures, operational loss events, and other relevant operational risk information to business unit management, senior management, and the board of directors (or a designated committee of the board).
(2) Operational risk data and assessment systems. A national bank or Federal savings association must have operational risk data and assessment systems that capture operational risks to which the national bank or Federal savings association is exposed. The national bank's or Federal savings association's operational risk data and assessment systems must:
(i) Be structured in a manner consistent with the national bank's or Federal savings association's current business activities, risk profile, technological processes, and risk management processes; and
(ii) Include credible, transparent, systematic, and verifiable processes that incorporate the following elements on an ongoing basis:
(A) Internal operational loss event data. The national bank or Federal savings association must have a systematic process for capturing and using internal operational loss event data in its operational risk data and assessment systems.
(1) The national bank's or Federal savings association's operational risk data and assessment systems must include a historical observation period of at least five years for internal operational loss event data (or such shorter period approved by the OCC to address transitional situations, such as integrating a new business line).
(2) The national bank or Federal savings association must be able to map its internal operational loss event data into the seven operational loss event type categories.
(3) The national bank or Federal savings association may refrain from collecting internal operational loss event data for individual operational losses below established dollar threshold amounts if the national bank or Federal savings association can demonstrate to the satisfaction of the OCC that the thresholds are reasonable, do not exclude important internal operational loss event data, and permit the national bank or Federal savings association to capture substantially all the dollar value of the national bank's or Federal savings association's operational losses.
(B) External operational loss event data. The national bank or Federal savings association must have a systematic process for determining its methodologies for incorporating external operational loss event data into its operational risk data and assessment systems.
(C) Scenario analysis. The national bank or Federal savings association must have a systematic process for determining its methodologies for incorporating scenario analysis into its operational risk data and assessment systems.
(D) Business environment and internal control factors. The national bank or Federal savings association must incorporate business environment and internal control factors into its operational risk data and assessment systems. The national bank or Federal savings association must also periodically compare the results of its prior business environment and internal control factor assessments against its actual operational losses incurred in the intervening period.
(3) Operational risk quantification systems. (i) The national bank's or Federal savings association's operational risk quantification systems:
(i) The national bank's or Federal savings association's operational risk quantification systems:
(A) Must generate estimates of the national bank's or Federal savings association's operational risk exposure using its operational risk data and assessment systems;
(B) Must employ a unit of measure that is appropriate for the national bank's or Federal savings association's range of business activities and the variety of operational loss events to which it is exposed, and that does not combine business activities or operational loss events with demonstrably different risk profiles within the same loss distribution;
(C) Must include a credible, transparent, systematic, and verifiable approach for weighting each of the four elements, described in paragraph (g)(2)(ii) of this section, that a national bank or Federal savings association is required to incorporate into its operational risk data and assessment systems;
(D) May use internal estimates of dependence among operational losses across and within units of measure if the national bank or Federal savings association can demonstrate to the satisfaction of the OCC that its process for estimating dependence is sound, robust to a variety of scenarios, and implemented with integrity, and allows for uncertainty surrounding the estimates. If the national bank or Federal savings association has not made such a demonstration, it must sum operational risk exposure estimates across units of measure to calculate its total operational risk exposure; and
(E) Must be reviewed and updated (as appropriate) whenever the national bank or Federal savings association becomes aware of information that may have a material effect on the national bank's or Federal savings association's estimate of operational risk exposure, but the review and update must occur no less frequently than annually.
(ii) With the prior written approval of the OCC, a national bank or Federal savings association may generate an estimate of its operational risk exposure using an alternative approach to that specified in paragraph (g)(3)(i) of this section. A national bank or Federal savings association proposing to use such an alternative operational risk quantification system must submit a proposal to the OCC. In determining whether to approve a national bank's or Federal savings association's proposal to use an alternative operational risk quantification system, the OCC will consider the following principles:
(A) Use of the alternative operational risk quantification system will be allowed only on an exception basis, considering the size, complexity, and risk profile of the national bank or Federal savings association;
(B) The national bank or Federal savings association must demonstrate that its estimate of its operational risk exposure generated under the alternative operational risk quantification system is appropriate and can be supported empirically; and
(C) A national bank or Federal savings association must not use an allocation of operational risk capital requirements that includes entities other than depository institutions or the benefits of diversification across entities.
(h) Data management and maintenance. (1) A national bank or Federal savings association must have data management and maintenance systems that adequately support all aspects of its advanced systems and the timely and accurate reporting of risk-based capital requirements.
(1) A national bank or Federal savings association must have data management and maintenance systems that adequately support all aspects of its advanced systems and the timely and accurate reporting of risk-based capital requirements.
(2) A national bank or Federal savings association must retain data using an electronic format that allows timely retrieval of data for analysis, validation, reporting, and disclosure purposes.
(3) A national bank or Federal savings association must retain sufficient data elements related to key risk drivers to permit adequate monitoring, validation, and refinement of its advanced systems.
(i) Control, oversight, and validation mechanisms. (1) The national bank's or Federal savings association's senior management must ensure that all components of the national bank's or Federal savings association's advanced systems function effectively and comply with the qualification requirements in this section.
(1) The national bank's or Federal savings association's senior management must ensure that all components of the national bank's or Federal savings association's advanced systems function effectively and comply with the qualification requirements in this section.
(2) The national bank's or Federal savings association's board of directors (or a designated committee of the board) must at least annually review the effectiveness of, and approve, the national bank's or Federal savings association's advanced systems.
(3) A national bank or Federal savings association must have an effective system of controls and oversight that:
(i) Ensures ongoing compliance with the qualification requirements in this section;
(ii) Maintains the integrity, reliability, and accuracy of the national bank's or Federal savings association's advanced systems; and
(iii) Includes adequate governance and project management processes.
(4) The national bank or Federal savings association must validate, on an ongoing basis, its advanced systems. The national bank's or Federal savings association's validation process must be independent of the advanced systems' development, implementation, and operation, or the validation process must be subjected to an independent review of its adequacy and effectiveness. Validation must include:
(i) An evaluation of the conceptual soundness of (including developmental evidence supporting) the advanced systems;
(ii) An ongoing monitoring process that includes verification of processes and benchmarking; and
(iii) An outcomes analysis process that includes backtesting.
(5) The national bank or Federal savings association must have an internal audit function independent of business-line management that at least annually assesses the effectiveness of the controls supporting the national bank's or Federal savings association's advanced systems and reports its findings to the national bank's or Federal savings association's board of directors (or a committee thereof).
(6) The national bank or Federal savings association must periodically stress test its advanced systems. The stress testing must include a consideration of how economic cycles, especially downturns, affect risk-based capital requirements (including migration across rating grades and segments and the credit risk mitigation benefits of double default treatment).
(j) Documentation. The national bank or Federal savings association must adequately document all material aspects of its advanced systems.