ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The Basel III operational risk standardised approach replaces earlier methods with one framework for every bank, built on a business indicator and, for larger banks, on the bank’s own loss history. It sits in the Basel Framework standard OPE25, and national regulators decide when and how it applies in their jurisdictions. This guide explains the building blocks, works through the calculation logic and lists the data and governance work banks need to complete before supervisors ask for it.
The description below draws on the Basel Committee’s published text. Local rules may differ, for example through national discretion, so confirm the position with your regulator. For context, read our guides to Basel III and the Basel III endgame.
Capital under the approach equals the business indicator component multiplied by an internal loss multiplier. The business indicator component depends on the size of the bank’s business. The internal loss multiplier adjusts the result for the bank’s own history of operational losses.
| Element | What it does |
|---|---|
| Business indicator (BI) | Measures the size of the bank’s business from financial statement items |
| Business indicator component (BIC) | Applies tiered coefficients to the BI |
| Loss component (LC) | Reflects average annual operational losses over ten years |
| Internal loss multiplier (ILM) | Scales capital up or down depending on loss experience against BIC |
| Operational risk capital | BIC multiplied by ILM |
The BI has three components, each averaged over three years, with absolute values calculated before averaging, according to the framework text.
Absolute values are used so that negative items do not offset positive ones, which means banks with volatile income cannot net away exposure. The BI should be built from audited financial statement lines, with a clear mapping documented for each item.
The BIC applies marginal coefficients across three buckets. A marginal coefficient applies only to the slice of the BI within the bucket, so a bank with a BI of 5 billion euros applies 12 percent to the first billion and 15 percent to the remainder.
| Bucket | Business indicator | Marginal coefficient |
|---|---|---|
| 1 | Up to 1 billion euros | 12% |
| 2 | Above 1 billion up to 30 billion euros | 15% |
| 3 | Above 30 billion euros | 18% |
Smaller banks in bucket 1 have a simpler position. The framework says bucket 1 banks are not required to use the loss multiplier by default, so their capital equals 12 percent of the BI, though supervisors may allow them to include loss data voluntarily.
For banks above the first bucket, the loss component is 15 times the average annual operational losses over ten years. The internal loss multiplier is calculated from the ratio of the loss component to the BIC using a formula in the framework. Where losses are low relative to business size, the multiplier lowers capital, and where losses are high, it raises capital. Read the formula in the framework text and validate your calculation tool against it.
Supervisors also have national discretion. The framework says supervisors may set the multiplier at one for all banks in their jurisdiction, which would remove the loss experience from the calculation. Check whether your regulator has done so.
Loss data quality is where most of the work lies. The framework describes these requirements.
Build a loss event process with clear categories, ownership by business lines, reconciliation to the general ledger and independent review. Grouped losses, meaning multiple losses arising from a single event, need consistent treatment. Document the rules for merging related losses.
Supervisors will look at the quality of controls around BI calculation and loss data. Assign owners for the BI inputs, keep a reconciliation between BI items and audited accounts, and test the loss database regularly for completeness. Our guide to the ICAAP shows how operational risk capital fits into wider capital planning, and Pillar 3 disclosure covers the public reporting of capital requirements.
Operational risk capital is one part of a larger set of requirements. Include the new figure in your capital plan next to credit and market risk, and test the effect on capital buffers and on the leverage ratio. Where capital rises, decide whether to change business mix, improve controls to reduce losses or raise more capital. Because the loss component reflects your own experience, better control of operational incidents can reduce the multiplier over time, giving a direct link between risk management and capital. Liquidity measures such as the LCR and NSFR are separate, but management will want to see them in one dashboard.
The approach is a regulatory calculation, but the data behind it is useful for management. Loss event analysis shows which processes cause repeat losses, and BI trends show which business lines drive the capital charge. Share the results with business heads each quarter, and connect large loss events to root cause reviews and control improvements. Consider setting internal risk appetite limits for operational losses, and report against them to the board.
Also think about scenario analysis. Although the standardised approach does not use scenarios for the regulatory calculation, your internal capital assessment may still use them to consider events not yet in your loss history, such as major cyber incidents, third-party failures or conduct issues. Document the assumptions and challenge them.
Treat implementation as a project with a defined owner. In the first phase, confirm rules and map data. In the second, build and test the calculation engine and loss database, and in the third, run parallel calculations and review governance. Reserve time for internal audit review and for discussions with the supervisor. Keep evidence of each step, because supervisors often ask banks to demonstrate readiness well before the first reporting date.
A hypothetical regional bank has a three-year average business indicator of 4 billion euros. Its BIC applies 12 percent to the first billion and 15 percent to the remaining three billion. The bank has ten years of loss data with a modest average annual loss, and its loss component is well below the BIC, so the multiplier reduces the capital requirement. During preparation, the bank finds that small legal settlements were recorded in expenses, not in the loss database, and adds a monthly reconciliation to the general ledger to catch them. The numbers are invented for illustration and do not use a real bank’s data.
The primary source is the Basel Framework’s OPE25 standardised approach, which shows a version in force from 2027 in the version linked. Confirm your regulator’s timetable and any local rules.
If you would rather not build BI mapping sheets, loss data policies and review templates from scratch, the Basel III Toolkit provides documents you can adapt. Have your risk and regulatory reporting teams review them against local rules.
A single standardised approach based on the business indicator and, for larger banks, the internal loss multiplier.
Marginal coefficients of 12, 15 and 18 percent across three buckets, at up to 1 billion, up to 30 billion and above 30 billion euros.
Bucket 1 banks are not required to use the loss multiplier by default, though supervisors may allow voluntary use of loss data.
The framework describes a minimum of 20,000 euros per event, which supervisors may raise to 100,000 euros.
The framework lets supervisors set the multiplier to one for all banks in their jurisdiction, so check local rules.
September 30, 2026
