A. Operational Risk Management Framework & Governance

1. This section of the BPG sets out the standards, guidance and norms required to fulfil the regulatory requirements in respect of the Operational Risk management framework and governance, specified in Section 7.1 of Chapter 7 of BBR. These elements convey the supervisory expectations of the AFSA regarding Operational Risk management framework & governance in a Bank. The AFSA will use these standards, norms and key elements specified here to assess compliance with BBR Rules on Operational Risk management.

2. A Bank’s Operational Risk management policy is expected to address the following key elements:

(a) the governance structures used to manage Operational Risk, including reporting lines and accountabilities;

(b) risk assessment tools and how they are used;

(c) the Authorised Firm’s accepted Operational Risk appetite, permissible thresholds or tolerances for inherent and residual risk, and approved risk mitigation strategies and instruments;

(d) the Authorised Firm’s approach to establishing and monitoring thresholds or tolerances for inherent and residual risk Exposure;

(e) risk reporting and MIS; and

(f) appropriate independent review and assessment of the Authorised Firm’s Operational Risk framework.

3. An Authorised Firm’s Operational Risk policy should, amongst other things, include consideration of Principles for the Sound Management of Operational Risk, issued by the Basel Committee on Banking Supervision (BCBS) and the Guidelines on the management of Operational Risk in market- related activities issued by the European Banking Authority which are useful in relation to activities other than banking.

4. The GEN Module contains Rules and Guidance regarding corporate governance requirements for Authorised Firms, including the responsibilities of an Authorised Firm regarding risk management. In developing, implementing and maintaining an effective Operational Risk framework, an Authorised Firm’s Governing Body should:

(a) approve and review a risk appetite and tolerance for Operational Risk that articulates the nature, types and levels of Operational Risk that the Authorised Firm is willing to assume;

(b) consider all relevant risks, the Authorised Firm’s level of risk appetite, its current financial condition and its strategic direction. The Governing Body should monitor management adherence to the risk appetite and tolerance and provide for timely detection and remediation of breaches;

(c) encourage a management culture, and develop supporting processes, which help to engender within the Authorised Firm an understanding by relevant Employees of the nature and scope of the Operational Risk inherent in the Authorised Firm’s strategies and activities;

(d) provide senior management with clear guidance and direction regarding the principles underlying the Authorised Firm’s Operational Risk management framework and approve the corresponding policies developed by senior management;

(e) regularly review the Authorised Firm’s Operational Risk policy to ensure that the Authorised Firm has identified and is managing the Operational Risk arising from external market changes and other environmental factors, as well as those Operational Risks associated with new strategies, products, activities, or systems, including changes in risk profiles and priorities (e.g. changing business volumes). Such review should also take into account the Operational Risk loss experience, the frequency, volume or nature of limit breaches, the quality of the control environment and the effectiveness of risk management or mitigation strategies;

(f) ensure that the Authorised Firm’s Operational Risk policy and framework is subject to effective independent review by audit or other appropriately-trained Persons;

(g) ensure that management is incorporating industry best practice in managing Operational Risk; and

(h) establish clear lines of management responsibility and accountability for implementing a strong control environment. The control environment should provide appropriate independence/separation of duties between Operational Risk control functions, business lines and support functions.

B. Operational Risk Management Processes and standards

6. This section of the BPG sets out the standards, guidance, and best practices required to fulfil the regulatory requirements in respect of the Operational Risk management processes, specified in Section 7.5 of Chapter 7 of BBR. The AFSA will use these standards, norms and key elements to assess compliance with BBR Rules on Operational Risk management processes and procedures and the effectiveness of such processes.

7. A Bank should record all Operational Risk events, including near misses and events which result in a positive financial outcome. Tools that an Authorised Firm may employ for identifying and assessing Operational Risk include:

(a) internal loss data collection and analysis;

(b) external data collection and analysis;

(c) risk assessments;

(d) business process mapping;

(e) risk and performance indicators; and

(f) scenario analysis.

8. GEN Rules require an Authorised Person in the AIFC to establish and maintain arrangements to provide its Governing Body and senior management with the information necessary to organise and control its activities, to comply with legislation applicable in the AIFC and to manage risks.

9. BBR Rule 7.5 (1) (f) requires Banks to establish and maintain reporting mechanisms specifically addressing the Operational Risk matters. The frequency of internal reporting of Operational Risks required by BBR Rule 7.5 (1) (f) should reflect the risks involved and the pace and nature of changes in the Bank’s operating environment.

10. The following lists some of the items that an Authorised Firm should consider including in its internal reporting of Operational Risks:

(a) the results of monitoring activities;

(b) assessments of the Operational Risk framework performed by control functions such as internal audit, compliance, risk management and/or external audit;

(c) reports generated by (and/or for) supervisory authorities;

(d) material breaches of the Authorised Firm’s risk appetite and tolerance with respect to Operational Risk;

(e) details of recent significant internal Operational Risk events and losses, including near misses or events that resulted in a positive return; and

(f) relevant external events and any potential impact on the Authorised Firm and its Operational Risk framework, including Operational Risk capital.

11. Banks are required to establish and maintain systems and controls, including but not limited to financial and risk systems and controls that ensure that its affairs are managed effectively and responsibly by its senior management. In order to comply with the rules in BBR Chapter 7, Banks are expected to establish and maintain a strong control environment that uses policies, processes and systems, appropriate internal controls and appropriate risk mitigation and/or transfer strategies.

12. In order to establish such a strong control environment to address Operational Risk, a Bank should consider the following:

(a) clear segregation of duties and dual control;

(b) clearly established authorities and/or processes for approval;

(c) close monitoring of adherence to assigned risk limits or thresholds;

(d) safeguards for access to, and use of, the Authorised Firm’s assets and records;

(e) appropriate staffing level and training to maintain expertise;

(f) ongoing processes to identify business lines or products where returns appear to be out of line with reasonable expectations; and

(g) regular verification and reconciliation of transactions and accounts.

C. Specific elements of Operational Risk