On 6 July 2018, the Official Journal of the EU published the Commission Delegated Regulation (EU) 2018/959 (the Regulation) supplementing the Capital Requirements Regulation (Regulation 575/2013) with regard to regulatory technical standards for the specification of the assessment methodology under which competent authorities permit institutions to use advanced measurement approaches (AMAs) for operational risk.

The delegated regulation is based on the draft regulatory technical standards submitted by the European Banking Authority to the Commission, under article 312(4) of the Capital Requirements Regulation (to specify the assessment methodology under which competent authorities permit institutions to use AMAs).

Key elements of the Regulation to note include:

• The addressing of operational risk in relation to legal, model, and market risk and financial transactions.
• Qualitative standards for: the governance of operational risk; testing for the use of AMAs; audit and internal validation for effective operational risk management; and the regulation of IT infrastructures.
• Quantitative standards for: the use of internal and external data, scenario analysis and BEICF; core modelling assumptions of the operational risk measurement system; expected loss and correlation; and mechanisms for capital allocation.
• The assessment of an institutions compliance with the requirements to use AMAs should be tailored to the type of application (e.g. for first use, as against extensions of permission), considering the nature of the elements to be assessed varying on the type of application submitted to the competent authority.

Transitional provisions are provided for in Article 45 of the Regulation for those institutions with existing AMA permission, or that have already applied AMA permission at the date the Regulation comes into force. The Regulation comes into force on 26 July 2018.