|
via email
OCC, Federal Reserve, FDIC and OTS
Proposal
Advanced Notice of Proposed Rulemaking
and
Proposed Supervisory Guidance for
Operational Risk AMA for Regulatory
Capital
The Treatment of Insurance against
Operational Risk
August 4, 2003
U.S. Federal Register - Vol. 68 No. 149 pages 45900 to 45988
Prepared by Marsh Inc.
November 2003
OCC, Federal Reserve,
FDIC and OTS Proposal
Advanced Notice of Proposed Rulemaking
and
Proposed Supervisory Guidance for Operational Risk
AMA for Regulatory Capital
The Treatment of Insurance against Operational Risk
Introduction to Comments
This paper contains Marsh Inc.'s comments
concerning the ANPR and proposed supervisory guidance of the OCC,
Federal Reserve, FDIC and OTS ("the Agencies") contained in the U.S.
Federal Register, Vol. 68, No. 149, dated August 4, 2003. Marsh has also
provided comments on the Basel Committee Third Consultative Paper and
European Commission Third Consultation Paper that are very similar to
our comments that follow. One significant difference is that, in this
paper, we have omitted our comments on the treatment of insurance for
the Basel Standardized Approach because that approach is not applicable
in the U.S. Also, because the Agencies' proposal differs from the Basel
and EC papers by providing definitions of "operational risk loss" and
"operational risk event", we have adjusted our comments in order to
address certain implications of these definitions. Finally we have
modified our discussion of the haircuts for the duration of insurance
policies and timeliness of insurance payouts in light of the Agencies'
treatment of insurance policy duration.
Marsh
Marsh Inc. is the world's largest
insurance broker and risk management consultant. We are one of the
companies of Marsh & McLennan Companies (MMC). Other MMC companies
include both Mercer Oliver Wyman, whose major specialty is risk
management consulting on issues specific to financial institutions, and
National Economic Research Associates (NERA), who are experts in
economic valuation and have performed a benchmarking study of banks'
preparedness for the Basel II operational risk requirements.
The Federal Register Proposal of August
2003 as well as the Basel Committee on Banking Supervision's Third
Consultative Paper dated April 2003 and the European Commission
Consultation Paper dated July 2003 provide a major step forward in
setting appropriate standards for the measurement of operational risk.
We believe that our role as insurance broker and risk management
consultant makes us especially well qualified to comment on the
treatment of insurance in the Agencies' proposal and will with certain
exceptions in our general comments confine our comments to provisions in
the proposal that address this topic.
Insurance as an Imperfect Hedge
In light of the fact that insurance
policies indemnify banks for hundreds of millions of dollars in
operational risk losses annually, insurance is clearly a major tool for
banks in mitigating operational risk. However, insurance provides
imperfect protection against these risks. In fact, it is Marsh's primary
role to advocate our policyholder clients' interests in dealing with
insurers in both the placement of insurance and in helping them deal
with claims. In this role, we are aware of the times when insurance does
not live up to our clients' desires.
We have reviewed the proposals contained
in the Federal Register to address the effect of insurance on banks'
operational risk capital. As to the regulatory concerns underlying these
proposals, we concur with the Agencies that it is appropriate to require
that an AMA banking institution determine the portion within the full
range of its operational risk exposure that its specific insurance
contracts cover, to address the differences among insurers in terms of
credit quality and other issues of timeliness and uncertainty of
payment, and to consider the implications of the duration of coverage.
Despite limitations of insurance as a
perfect hedge, we believe that insurance today can in fact effectively
address a significant portion of many potentially severe operational
risks. We also expect that future developments will lead to products
that improve the ability of the insurance arrangements to address
effectively a broader range of operational risk. It is important, in our
view, that the provisions for the measurement of the insurance capital
credit create incentives for such improvements in the functioning of
insurance and reflect as closely as possible the actual risk mitigation
effect of insurance.
Economic and Regulatory Capital
The Basel Committee and the Agencies have
the goal of promulgating regulatory capital that is similar in concept
to banks' own internal models of economic capital and reflective of the
bank's actual operational risks. Implicit in this goal is to create
regulatory incentives that are consistent with banks' economic
incentives and thereby to encourage sound risk management and to avoid
inconsistencies that could produce regulatory arbitrage.
The AMA option that will allow
sophisticated banks to set regulatory capital on the basis of internal
models essentially demands that a common model underlies estimates of
both regulatory and economic capital. Achieving this would require that
minimum capital should neither overstate, nor understate, the actual
protection afforded to the bank through the use of insurance. Our
recommendations and the supporting comments are designed to help the
Agencies in achieving this goal, i.e. to reflect appropriately the
actual risk mitigation effect of insurance.
Marsh's Specific Comments about the
Proposals
In the discussion that follows, Marsh
will argue that the 20% limitation on the insurance credit for
operational risk is inconsistent with the principle of matching
regulatory and economic capital calculations and should be modified. We
will suggest clarification of how the operational risk treats how both
operational risk capital and the insurance credit address historical
losses and their development over time and of how insurance addresses
expected loss (EL). We also make other recommendations that address some
of the specific wording of the proposed Supervisory Guidelines
concerning measurement of the credit for insurance in mitigating
operational risk for AMA banks.
Recommendation US-1
The 20% cap on insurance credits for
AMA banks should be eliminated.
Comments
The proposed regulations require that
credible models and sound quantitative arguments back up any calculation
of regulatory capital and mitigation through insurance. The proposal has
identified the areas where insurance is an incomplete hedge against
operational risk, and the Agencies will require that banks address these
areas explicitly in order to validate the credit for insurance. Thus,
even with no cap at all on the credit for insurance, a bank that
complies with these requirements and that is guided by appropriate
regulatory supervision could not claim an excessive capital credit for
insurance.
On the other hand, the cap may stifle
innovation by potentially separating the economic effect of insurance
from the regulatory credit it receives. The insurance contract is
undergoing constant innovation, and what might be true regarding its
current impact is not likely to remain true through time. Indeed, a
foreseeable consequence of the capital Accord itself will be to spur
innovation and to produce future design enhancements to the insurance
product. This is even now occurring. Although we are certain that the
Agencies do not intend to inhibit positive evolution of the insurance
product, we raise this as a possible counter-productive and
unintentional consequence of the 20% limitation. That will happen, if,
because of the cap, too many policyholders forego potential mitigation
by insurance when they find themselves unable to receive an otherwise
appropriate credit for the true mitigation effect of their insurance
programs. Already we sense that the anticipated 20% cap may be
influencing what some banks think will be an appropriate purchase of
insurance.
We believe that it is at least
theoretically possible that existing insurance programs could mitigate
more than 20% of the economic capital for operational risk, at least for
unexpected loss. We will have more to say in our next set of comments
concerning Unexpected Loss(UL) and Expected Loss(EL). For now, suffice
it to say that insurance may address both EL and UL but differently.
The separation of future UL and EL
provides the context for our belief that, even though insurance may
typically address a relatively very small percentage of the total number
of operational risk losses and even the total loss amounts at the
average bank, the effect of insurance upon the UL for certain kinds of
operational risk is greatly leveraged. This is the case because the most
common losses at most banks will fall within the EL and will have no
insurance benefit either because of the deductible or because they are
from perils that are typically not insured. As opposed to the small,
frequent losses, the most severe losses at banks have a much greater
chance of having insurance apply. In particular, insurance normally
deals quite effectively, albeit with some delay, with perils which
result in damage to physical assets and the resulting business
interruptions as well as with theft of bank assets. Furthermore, while
the benefit may be somewhat uneven, the insurers still pay hundreds of
millions of dollars each year to address banks' legal risks through the
various lines of liability insurance so that there is substantial
mitigation of legal risk as well.
Notes on the 2002 Loss Data Collection
Exercise of the Basel Committee
As part of our efforts to understand the
potential mitigating value of insurance on capital for AMA banks, we
arranged for the construction of a model around the Basel Committee's
2002 Loss Data Collection Exercise (LDCE) data. Based upon this
analysis, we conclude that the data collected is not inconsistent with a
world in which insurance mitigates a substantial portion of Unexpected
Loss and in which economic capital is reduced by even as much as 20 to
40%. We do not claim that this is an accurate estimate of a true
value for any specific bank or even an average for the 89 banks in the
LDCE as the limitations of the published data preclude us from making
such an assessment. But, as it pertains to the proposed 20% limit, we
cannot exclude the possibility that many banks will find
themselves at the 20% limit, thus potentially implying the unintended
consequences noted above.
Although the LDCE data shows that overall
relatively few losses have associated insurance recoverable (1.7%), this
result is consistent with insurance policies with significant
deductibles. The data does show that larger losses are more likely to
have an associated insurance recovery, again consistent with this view.
It is impossible to determine from the published LDCE data how many
losses without an associated insurance recoverable might have been
properly covered by insurance but simply were not large enough to exceed
the deductible.
In summary, we believe that the Agencies
should remove the 20% cap because
• with the modeling requirements in the
rules, the cap is unnecessary,
• the cap may stifle innovation,
• the practical effect may be to discourage beneficial opportunities for
risk mitigation, and
• contrary to the purpose of Basel II, the cap engenders basing
decisions upon purely regulatory requirements rather than upon the
underlying economic reality.
Recommendation US-2
In the ANPR, the Agencies have asked
if the broad operational risk structure incorporates all the key
elements that should be dealt with by the rules. We believe there are at
least two areas for improvement-added clarity in how the regulations
deal with potential historical loss development and in the way the
regulations deal with insurance against expected loss (EL).
Note that we are aware that the Basel
Committee, in its October press release, has indicated that the Accord
will address only unexpected loss (UL) and not EL for Credit Risk. For
similar reasons that led to that modification, the operational risk
rules may be amended in a similar manner, but we do not know whether the
Agencies will in fact drop the requirement for banks to provide for EL
for operational risk. Therefore, these comments assume that capital or
other means to account for EL for operational risk will still be
required.
A. The rules should provide greater
clarity whether the operational risk capital must take into account a
bank's particular risk of adverse development of its historical losses.
If the bank must provide capital for
the potential adverse development of its portfolio of historical losses,
there is also the question of how to value mitigation through insurance
of these losses. While the issues of timeliness, credit rating and
uncertainty of payment would presumably still apply to this element
operational risk, any cap on the value of insurance should not apply.
B. In addition to reserves and budgets
as cited by the Agencies1 as potential alternatives to
capital in providing for EL, insurance can mitigate a portion of EL. The
Agencies should, therefore, if EL remains part of what the banks must
address, acknowledge that the bank's insurance coverage can provide a
portion of EL.
Comments
A. Historical loss development
Each bank will have a different profile
of exposure to events (herein called "historical losses") known prior to
a given date when a bank determines its regulatory capital, and these
profiles may differ substantially among banks and within a given bank
over time. In dealing with a bank's particular portfolio of these
historical losses, there should be greater clarity and consistency as to
the intended make-up of an AMA bank's "Operational Risk Exposure,"
defined in the proposed regulations as "the potential operational losses
that the banking institution faces at a soundness standard consistent
with a 99.9% confidence level over a one-year period.1
There appears to be a possible conflict
between (1) the proposed definition of an operational risk loss2
as GAAP loss, which implies addressing both historical loss development
and future losses and (2) the implication of much of the industry's
discussion to date of operational risk capital and specifically the
Agencies' discussion of reserves in the context of EL versus UL, where
the implication appears to be for capital to address future losses only
and not adverse development of historical losses.3
Operational risk losses, particularly
those involving litigation, often extend over many years from the date
of the event that gives rise to the loss until the date of final
disposition. Until resolved, estimates of the ultimate cost of these
loss contingencies can be subject to substantial variability and risk
over time. Under the U.S. GAAP accounting treatment of such a loss under
FASB 54, the bank will not have a loss on its books until the
bank either incurs expenses such as legal or investigatory costs or
establishes a reserve based upon the determination that it is probable
that a liability has been created and the amount of loss can be
reasonably estimated5.
How do the Agencies intend that the
capital requirement will address the risk of greater than anticipated
loss development arising from the inventory of liability case reserves
for historical losses (or for that matter other operational risk
contingencies) as of the date that the required capital is determined?
If the capital itself does not address loss development, adverse loss
development might nevertheless drain capital. On the other hand, if the
capital is intended to address historical loss development, to what
specifically does the 99.9% one-year probability apply-presumably the
GAAP treatment, i.e. the reserves for the inventory of historical losses
one year hence less the reserves for the inventory now plus any payments
during the year?6
If there is insurance against loss
development and capital calculations are to address historical events,
how should the insurance rules apply? Since historical losses represent
a specific inventory of known events, the effect of insurance would
typically be much more easily measurable than against future losses. In
the event that the capital calculations do address historical losses and
the 20% cap or some other cap on the insurance credit is retained, then,
in dealing with such losses, the bank should address the factors
affecting uncertainty and timeliness of payment, but the cap should
clearly not apply to historical losses.'
B. Insurance and EL
Insurance premiums, as promulgated by
insurers, typically include a provision for expected losses, a provision
for risk (which becomes profit to the insurer if the losses come in at
or below the expected level) and provisions for expenses of the insurer
and perhaps an offset for anticipated investment income. From the
insured bank's perspective, therefore, some portion of the premium would
typically address EL. This means in theory that a bank could show that
it had provided for a portion of its EL, by demonstrating the amount of
EL imbedded in its insurance premiums.
In summary, clarifying the treatment of
EL and UL and historical loss development will assist the Agencies and
the banks in understanding the effect of insurance.
Specific Comments-Detailed
Calculations of the Insurance Credit
Like the Agencies, we believe that the
following issues should be addressed in calculating the credit for
insurance for AMA banks:
-Uncertainty and delays in payment,
which includes both the credit risk of the insurer and the possibility
of disputed claims.
-Degree to which the insurance
addresses the actual operational risks of the bank. -Policy provisions
that limit coverage including but not limited to policy limits and
deductibles.
We believe that the proposed rules do
address the above. However, we also believe the rules could be improved
in a way that will better achieve the underlying purpose of the proposal
but better reflect the actual functioning of insurance as well as the
actual degree by which insurance mitigates operational risk.
Recommendation US-3
Supervisory Standard S30, the
Agencies' proposal currently reads in part:
"The policy is provided through a
third party that has a minimum claims paying ability rating of A."
Marsh suggests that Agencies modify
this wording so that the calculation of any offset for insurance should
apply explicit haircuts for the credit and timing risk associated with
the particular insurance program of the bank that addresses both the
credit quality of the specific insurers and anticipated duration of the
outstanding losses as well as a discount for the anticipated delays in
payment.
Comments
While we believe that the requirement to
reflect the credit risk of collection of insurance proceeds from
insurers is appropriate and consistent with other provisions of the
proposal, we do not believe that an arbitrary cut-off at an A rating is
appropriate. A or higher rated insurers have some probability of default
and, even if they may have a higher likelihood of default, A- and B+
rated insurers are still likely to pay their claims. Furthermore, the
credit risk increases with the length of time that the insured loss
remains unpaid. So it is appropriate to take into account both the
credit quality and duration just as in any credit analysis.
Recommendation US-4
Supervisory Standard S30, the
Agencies' proposal currently reads in part:
"The insurance policy must have an initial term of one year."
And
"An institution should discount (i.e.,
apply its own estimates of haircuts) the impact of insurance coverage to
take into account factors, which may limit the likelihood or size of
claim payouts. Among these factors are the remaining term of the policy,
especially when it is less than one year ... and the possibility that
the policy can be cancelled before the contractual expiration."
Recommendation:
Marsh suggests that the Agencies
should modify the first quotation wording to read: "The insurance policy
must have an initial term of at least one year."
Marsh also suggests that the mere
presence of a cancellation provision or a remaining policy term of less
than one year do not necessarily require a haircut.
Comments
It is true that the insurance market
typically provides one-year policies. However, the Agencies should find
longer-term policies acceptable hence our first point that the initial
term needs to be at least one year rather than must be one year.
On the other hand, in insurance,
continuous contracts and a policy term of more than one year is
atypical. The Basel Committee proposal on policy term appears to require
a pro-rata haircut for
the degree to which the remaining term is
less than one year and no credit in the last ninety days. We do not know
what the Agencies may have in mind in terms of haircuts for policy term
and so we will provide the same comments as we did the Basel Committee,
especially since we believe that haircuts are appropriate but only to
the extent the insured institution believes that its policy will be
cancelled, non-renewed or renewed on less favorable terms.
To require durations in excess of one
year or non-standard cancellation or renewal provisions, in effect,
would require the banks to obtain insurance on terms and conditions that
are highly unusual in the marketplace. Such a requirement could result
in far less than optimal insurance from the few insurers willing to
adjust their contracts to provide provisions that address this
requirement.
If the bank does not or cannot achieve
these special provisions from its insurers, there could in practice be
very large fluctuations each time the bank calculates its operational
risk capital credit, reflecting solely where the bank is in its policy
term, for example when the insurance is six months rather than one year
from renewal. This fluctuation would not reflect any real added risk.
Since renewal of an insurance policy is
typical, there is no more reason to assume renewal will not occur than
to assume any other adverse change in the bank's situation. If
non-renewal or cancellation is expected by the bank or does occur, then
the bank will have to address that in its next quarterly or semi-annual
capital calculation just as it must reflect any other change in
circumstances.
On the other hand, if the bank has
decided not to renew a particular insurance program or believes that it
will not be able to renew or will have very different terms and
conditions, then it should reflect this in its AMA calculations.
Recommendation US-5
Supervisory Standard S30, the
Agencies' proposal currently reads in part:
"The insurance policy has no
exclusions or limitations based upon regulatory action or in the for the
receiver or liquidator of a failed bank."
Marsh sueaests that the Agencies
modify this wordina to the effect that there is no credit if the
insurance policv is specifically voided in the event of regulatory
action or excludes claims by the reeulator or receiver of a failed bank.
However, we sueeest that the Agencies allow for a liability policy to
exclude coverage for fines, penalties or punitive damages but provide
that such a policy exclusion must be taken into account in the AMA
insurance mitigation calculations.
Comments
While the proposal reflects valid
concerns of the regulators about policies that will not cover claims by
them or by liquidators, the current wording in it could be interpreted
to require coverage that is abnormal or even against public policy. In
some jurisdictions where fines and penalties by regulators could be
assessed, insurance against them is unenforceable due to the belief that
insurance of fines and penalties removes the incentive against
inappropriate behavior created by potential fines and penalties.
Therefore, we believe that the bank must be in a position to accept
typical exclusions of coverage for fines, penalties and punitive
damages, especially as it may be against public policy for insurers to
indemnify the banks for these.
We have suggested a change that, without
preventing collection of claims by regulators or bankruptcy trustees,
addresses the public policy issues as long as the bank reflects these
limitations in its calculations.
Recommendation US-6
Supervisory Standard S30, the
Agencies' proposal currently reads in part:
"...for example, the institution must
also demonstrate that insurance policies used as the basis for the
adjustment have a history of timely payouts. If claims have not been
paid on a timely basis, the institution must exclude that policy from
the operational risk capital calculation."
and
"An institution should discount (i.e.,
apply its own estimates of haircuts) the impact of insurance coverage to
take into account factors, which may limit the likelihood or size of
claim payouts. Among these factors are ... the willingness and ability
of an insurer to pay a claim in a timely manner, the legal risk that a
claim can be disputed...."
Marsh suggests that of the two
approaches-no credit and haircuts- that appear in S30 that the Agencies
require haircuts for timeliness and uncertainty of payment rather than
exclusion for claims that have a history of not being paid on a timely
basis.
Comments
There are several reasons to avoid a
clear line between credit and no credit where the claims do not have a
history of being paid on a timely basis. The first of these is that many
of the coverages that banks carry may have, at that bank, no history of
claims. This is especially true of coverages where relatively remote
tail risk only is transferred. Certainly, just because the bank may have
had no claims under a particular coverage and therefore no history of
timely payment, the institution should not forego credit. On the other
hand a history of prompt payment does not guarantee future prompt
payments.
Even where there is a history of delays
in payment, the reason for the delay may not be applicable to current
circumstances. For example, if the bank had a large property insurance
claim and took many months to document its loss, this hardly means that
property insurance is worthless as a mitigant. And if the bank has taken
steps so that it is prepared to document the next claim, it is likely
that the next claim payment will be timely.
Finally, there is clearly a question as
to what is an objective standard for timely payment and an acceptable
history of same.
For all these reasons a haircut approach
to uncertainty of payment is much better than a clear line.
Recommendation US-7
Supervisory Standard S30, the
Agencies' proposal currently reads in part:
"The policy coverage has been
explicitly mapped to the actual operational risk exposure of the
institution."
Marsh suggests that the Agencies
modify this wording to clarify that the insurance mitigation
calculations must reflect the bank's insurance coverage in a manner that
is transparent in its relationship to and consistent with the actual
likelihood and impact of loss used in the bank's overall determination
of its operational risk capital.
Comments
For the purposes of this comment, we
assume that the intent of this provision is to ensure that the bank's
treatment of insurance reflects the bank's own particular array of
likelihood and impact from operational risk in such a way that the
resulting adjustments to capital are justifiable. However, we are
concerned that the word "explicitly" could be interpreted to require
direct mapping.
Such a requirement for direct mapping
would be problematic because insurance policies and coverage do not
map directly to the Basel Committee's Loss Event type classifications.
In some cases, insurance policies extend to multiple event types and in
other cases multiple insurance coverages apply to a single loss event
type. Although direct mapping' of loss eventtypes to insurance is in
theory a reasonable and logical process, when used in the context of
operational risk and insurance, it provides an insufficient result
because it ignores various complexities that accompany the operational
risk/insurance relationship.
The determination of insurance coverage
is often a detailed process that involves the consideration of numerous
circumstantial factors that might give rise to policy limitations or
exclusions or even void coverage. Accordingly, the composite elements
from which a determination of insurance coverage is made cannot be
captured in a one-dimensional category.
Given the complexity of the
insurance/operational risk relationship, which makes direct mapping
problematic, and the benefits to be achieved through a more
comprehensive modeling, we have suggested the change from wording that
might imply a requirement for direct mapping to wording that requires
transparency and consistency.
________________________________
1 See Federal Register Vol.
68, No. 149 p. 45943. "The Agencies have considered both reserving and
budgeting as potential methods for EL offsets." This statement implies
that the Agencies have not considered insurance.
1 See Definitions in the
Federal Register Vol. 68, No. 149 p. 45979
2 Ibid. "The financial impact
associated with an operational event that is recorded in the
institution's financial statements consistent with Generally Accepted
Accounting Principles (GAAP)."
3 Ibid. p. 45985. "Given that
EL is looking beyond current losses to losses that will be incurred in
the future.... "
4 See Financial Accounting
Standards Board, Statement of Financial Accounting Standards No. 5,
March 1975. The reserve amount will reflect what is determined to be
probable and not what is possible or remote.
5 Once established, it is
normal for such a reserve, called "a case reserve" by insurers, to
fluctuate over time up to the final disposition of the claim. The
inventory of all losses, i.e. aggregate amount of case reserves, along
with the cumulative partial payments of defense costs and indemnity
payments on these cases usually but not always increases over time. In
addition, losses may emerge that have occurred in the past but are
provided for later. These losses are called IBNR or "incurred but not
reported." The process of the change in the valuation of losses over
time is called "loss development."
6 For example, assume that a
bank has US$1 billion in loss reserves for litigation on 12/31/2008 and
pays $250 million in indemnity for judgments and settlements and for
litigation expense during 2009 for the historical cases and any new
cases that emerge during 2009. If then there are then $1.5 billion in
reserves on 12/31/2009, the GAAP losses would be $750 million. Was the
capital (plus allowable EL from reserves, budgeting and insurance) on
12/31/2008 intended to provide 99.9% confidence for the $750 million of
adverse loss development (plus non-litigation related operational risk
losses)? GAAP and the one-year period specification would imply this.
Or is the bank to ignore the risk of
adverse development and to address only occurrences (or events
discovered or claims) during 2009? If this is what the capital is
intended to address, is it the recognition of these cases during 2009 or
their ultimate cost?
For example (and ignoring for now any
portfolio effect), if there is a large unsettled loss with a reserve for
the EL of $100 million and where the insurance limit is $200 million
with a $25 million deductible and the one year UL is $50 million, then
the value of the insurance will, depending upon the credit rating of the
insurer and any reservation of rights by the insurer, offset $75 million
of the EL and all of the UL or $125 million of the $150 million. It
would clearly be inappropriate to limit the effect of insurance to 20%
or $30 million unless there is quite a low likelihood of an actual
recovery from the insurers.
1 Direct mapping" refers to
the process of matching an operational risk event category (such appear
in the Definitions section of the Proposed Supervisory Guidance, p.
45979 of the Federal Register) to insurance products (as commonly
known.). For example, one might map the operational risk event category
"Internal Fraud" to the insurance product known as Banker's Blanket Bond
(BBB). Unfortunately for the mapping exercise, neither are all internal
fraud events covered by this policy (e.g. internal fraud without the
intent of personal gain is usually not covered by the BBB) nor does the
BBB cover only internal fraud (e.g. external theft of the bank's
securities would often be covered by the BBB).
| 
