Skip Header

Federal Deposit
Insurance Corporation

Each depositor insured to at least $250,000 per insured bank

Home > Regulation & Examinations > Laws & Regulations > FDIC Federal Register Citations

FDIC Federal Register Citations

via email

OCC, Federal Reserve, FDIC and OTS
Advanced Notice of Proposed Rulemaking
Proposed Supervisory Guidance for
Operational Risk AMA for Regulatory
The Treatment of Insurance against

Operational Risk

August 4, 2003
U.S. Federal Register - Vol. 68 No. 149 pages 45900 to 45988

Prepared by Marsh Inc.

November 2003


OCC, Federal Reserve, FDIC and OTS Proposal
Advanced Notice of Proposed Rulemaking
Proposed Supervisory Guidance for Operational Risk
AMA for Regulatory Capital

The Treatment of Insurance against Operational Risk

Introduction to Comments

This paper contains Marsh Inc.'s comments concerning the ANPR and proposed supervisory guidance of the OCC, Federal Reserve, FDIC and OTS ("the Agencies") contained in the U.S. Federal Register, Vol. 68, No. 149, dated August 4, 2003. Marsh has also provided comments on the Basel Committee Third Consultative Paper and European Commission Third Consultation Paper that are very similar to our comments that follow. One significant difference is that, in this paper, we have omitted our comments on the treatment of insurance for the Basel Standardized Approach because that approach is not applicable in the U.S. Also, because the Agencies' proposal differs from the Basel and EC papers by providing definitions of "operational risk loss" and "operational risk event", we have adjusted our comments in order to address certain implications of these definitions. Finally we have modified our discussion of the haircuts for the duration of insurance policies and timeliness of insurance payouts in light of the Agencies' treatment of insurance policy duration.


Marsh Inc. is the world's largest insurance broker and risk management consultant. We are one of the companies of Marsh & McLennan Companies (MMC). Other MMC companies include both Mercer Oliver Wyman, whose major specialty is risk management consulting on issues specific to financial institutions, and National Economic Research Associates (NERA), who are experts in economic valuation and have performed a benchmarking study of banks' preparedness for the Basel II operational risk requirements.

The Federal Register Proposal of August 2003 as well as the Basel Committee on Banking Supervision's Third Consultative Paper dated April 2003 and the European Commission Consultation Paper dated July 2003 provide a major step forward in setting appropriate standards for the measurement of operational risk. We believe that our role as insurance broker and risk management consultant makes us especially well qualified to comment on the treatment of insurance in the Agencies' proposal and will with certain exceptions in our general comments confine our comments to provisions in the proposal that address this topic.

Insurance as an Imperfect Hedge

In light of the fact that insurance policies indemnify banks for hundreds of millions of dollars in operational risk losses annually, insurance is clearly a major tool for banks in mitigating operational risk. However, insurance provides imperfect protection against these risks. In fact, it is Marsh's primary role to advocate our policyholder clients' interests in dealing with insurers in both the placement of insurance and in helping them deal with claims. In this role, we are aware of the times when insurance does not live up to our clients' desires.

We have reviewed the proposals contained in the Federal Register to address the effect of insurance on banks' operational risk capital. As to the regulatory concerns underlying these proposals, we concur with the Agencies that it is appropriate to require that an AMA banking institution determine the portion within the full range of its operational risk exposure that its specific insurance contracts cover, to address the differences among insurers in terms of credit quality and other issues of timeliness and uncertainty of payment, and to consider the implications of the duration of coverage.

Despite limitations of insurance as a perfect hedge, we believe that insurance today can in fact effectively address a significant portion of many potentially severe operational risks. We also expect that future developments will lead to products that improve the ability of the insurance arrangements to address effectively a broader range of operational risk. It is important, in our view, that the provisions for the measurement of the insurance capital credit create incentives for such improvements in the functioning of insurance and reflect as closely as possible the actual risk mitigation effect of insurance.

Economic and Regulatory Capital

The Basel Committee and the Agencies have the goal of promulgating regulatory capital that is similar in concept to banks' own internal models of economic capital and reflective of the bank's actual operational risks. Implicit in this goal is to create regulatory incentives that are consistent with banks' economic incentives and thereby to encourage sound risk management and to avoid inconsistencies that could produce regulatory arbitrage.

The AMA option that will allow sophisticated banks to set regulatory capital on the basis of internal models essentially demands that a common model underlies estimates of both regulatory and economic capital. Achieving this would require that minimum capital should neither overstate, nor understate, the actual protection afforded to the bank through the use of insurance. Our recommendations and the supporting comments are designed to help the Agencies in achieving this goal, i.e. to reflect appropriately the actual risk mitigation effect of insurance.

Marsh's Specific Comments about the Proposals

In the discussion that follows, Marsh will argue that the 20% limitation on the insurance credit for operational risk is inconsistent with the principle of matching regulatory and economic capital calculations and should be modified. We will suggest clarification of how the operational risk treats how both operational risk capital and the insurance credit address historical losses and their development over time and of how insurance addresses expected loss (EL). We also make other recommendations that address some of the specific wording of the proposed Supervisory Guidelines concerning measurement of the credit for insurance in mitigating operational risk for AMA banks.

Recommendation US-1

The 20% cap on insurance credits for AMA banks should be eliminated.


The proposed regulations require that credible models and sound quantitative arguments back up any calculation of regulatory capital and mitigation through insurance. The proposal has identified the areas where insurance is an incomplete hedge against operational risk, and the Agencies will require that banks address these areas explicitly in order to validate the credit for insurance. Thus, even with no cap at all on the credit for insurance, a bank that complies with these requirements and that is guided by appropriate regulatory supervision could not claim an excessive capital credit for insurance.

On the other hand, the cap may stifle innovation by potentially separating the economic effect of insurance from the regulatory credit it receives. The insurance contract is undergoing constant innovation, and what might be true regarding its current impact is not likely to remain true through time. Indeed, a foreseeable consequence of the capital Accord itself will be to spur innovation and to produce future design enhancements to the insurance product. This is even now occurring. Although we are certain that the Agencies do not intend to inhibit positive evolution of the insurance product, we raise this as a possible counter-productive and unintentional consequence of the 20% limitation. That will happen, if, because of the cap, too many policyholders forego potential mitigation by insurance when they find themselves unable to receive an otherwise appropriate credit for the true mitigation effect of their insurance programs. Already we sense that the anticipated 20% cap may be influencing what some banks think will be an appropriate purchase of insurance.

We believe that it is at least theoretically possible that existing insurance programs could mitigate more than 20% of the economic capital for operational risk, at least for unexpected loss. We will have more to say in our next set of comments concerning Unexpected Loss(UL) and Expected Loss(EL). For now, suffice it to say that insurance may address both EL and UL but differently.

The separation of future UL and EL provides the context for our belief that, even though insurance may typically address a relatively very small percentage of the total number of operational risk losses and even the total loss amounts at the average bank, the effect of insurance upon the UL for certain kinds of operational risk is greatly leveraged. This is the case because the most common losses at most banks will fall within the EL and will have no insurance benefit either because of the deductible or because they are from perils that are typically not insured. As opposed to the small, frequent losses, the most severe losses at banks have a much greater chance of having insurance apply. In particular, insurance normally deals quite effectively, albeit with some delay, with perils which result in damage to physical assets and the resulting business interruptions as well as with theft of bank assets. Furthermore, while the benefit may be somewhat uneven, the insurers still pay hundreds of millions of dollars each year to address banks' legal risks through the various lines of liability insurance so that there is substantial mitigation of legal risk as well.

Notes on the 2002 Loss Data Collection Exercise of the Basel Committee

As part of our efforts to understand the potential mitigating value of insurance on capital for AMA banks, we arranged for the construction of a model around the Basel Committee's 2002 Loss Data Collection Exercise (LDCE) data. Based upon this analysis, we conclude that the data collected is not inconsistent with a world in which insurance mitigates a substantial portion of Unexpected Loss and in which economic capital is reduced by even as much as 20 to 40%. We do not claim that this is an accurate estimate of a true value for any specific bank or even an average for the 89 banks in the LDCE as the limitations of the published data preclude us from making such an assessment. But, as it pertains to the proposed 20% limit, we cannot exclude the possibility that many banks will find themselves at the 20% limit, thus potentially implying the unintended consequences noted above.

Although the LDCE data shows that overall relatively few losses have associated insurance recoverable (1.7%), this result is consistent with insurance policies with significant deductibles. The data does show that larger losses are more likely to have an associated insurance recovery, again consistent with this view. It is impossible to determine from the published LDCE data how many losses without an associated insurance recoverable might have been properly covered by insurance but simply were not large enough to exceed the deductible.

In summary, we believe that the Agencies should remove the 20% cap because

• with the modeling requirements in the rules, the cap is unnecessary,
• the cap may stifle innovation,
• the practical effect may be to discourage beneficial opportunities for risk mitigation, and
• contrary to the purpose of Basel II, the cap engenders basing decisions upon purely regulatory requirements rather than upon the underlying economic reality.

Recommendation US-2

In the ANPR, the Agencies have asked if the broad operational risk structure incorporates all the key elements that should be dealt with by the rules. We believe there are at least two areas for improvement-added clarity in how the regulations deal with potential historical loss development and in the way the regulations deal with insurance against expected loss (EL).

Note that we are aware that the Basel Committee, in its October press release, has indicated that the Accord will address only unexpected loss (UL) and not EL for Credit Risk. For similar reasons that led to that modification, the operational risk rules may be amended in a similar manner, but we do not know whether the Agencies will in fact drop the requirement for banks to provide for EL for operational risk. Therefore, these comments assume that capital or other means to account for EL for operational risk will still be required.

A. The rules should provide greater clarity whether the operational risk capital must take into account a bank's particular risk of adverse development of its historical losses.

If the bank must provide capital for the potential adverse development of its portfolio of historical losses, there is also the question of how to value mitigation through insurance of these losses. While the issues of timeliness, credit rating and uncertainty of payment would presumably still apply to this element operational risk, any cap on the value of insurance should not apply.

B. In addition to reserves and budgets as cited by the Agencies1 as potential alternatives to capital in providing for EL, insurance can mitigate a portion of EL. The Agencies should, therefore, if EL remains part of what the banks must address, acknowledge that the bank's insurance coverage can provide a portion of EL.


A. Historical loss development

Each bank will have a different profile of exposure to events (herein called "historical losses") known prior to a given date when a bank determines its regulatory capital, and these profiles may differ substantially among banks and within a given bank over time. In dealing with a bank's particular portfolio of these historical losses, there should be greater clarity and consistency as to the intended make-up of an AMA bank's "Operational Risk Exposure," defined in the proposed regulations as "the potential operational losses that the banking institution faces at a soundness standard consistent with a 99.9% confidence level over a one-year period.1

There appears to be a possible conflict between (1) the proposed definition of an operational risk loss2 as GAAP loss, which implies addressing both historical loss development and future losses and (2) the implication of much of the industry's discussion to date of operational risk capital and specifically the Agencies' discussion of reserves in the context of EL versus UL, where the implication appears to be for capital to address future losses only and not adverse development of historical losses.3

Operational risk losses, particularly those involving litigation, often extend over many years from the date of the event that gives rise to the loss until the date of final disposition. Until resolved, estimates of the ultimate cost of these loss contingencies can be subject to substantial variability and risk over time. Under the U.S. GAAP accounting treatment of such a loss under FASB 54, the bank will not have a loss on its books until the bank either incurs expenses such as legal or investigatory costs or establishes a reserve based upon the determination that it is probable that a liability has been created and the amount of loss can be reasonably estimated5.

How do the Agencies intend that the capital requirement will address the risk of greater than anticipated loss development arising from the inventory of liability case reserves for historical losses (or for that matter other operational risk contingencies) as of the date that the required capital is determined? If the capital itself does not address loss development, adverse loss development might nevertheless drain capital. On the other hand, if the capital is intended to address historical loss development, to what specifically does the 99.9% one-year probability apply-presumably the GAAP treatment, i.e. the reserves for the inventory of historical losses one year hence less the reserves for the inventory now plus any payments during the year?6

If there is insurance against loss development and capital calculations are to address historical events, how should the insurance rules apply? Since historical losses represent a specific inventory of known events, the effect of insurance would typically be much more easily measurable than against future losses. In the event that the capital calculations do address historical losses and the 20% cap or some other cap on the insurance credit is retained, then, in dealing with such losses, the bank should address the factors affecting uncertainty and timeliness of payment, but the cap should clearly not apply to historical losses.'

B. Insurance and EL

Insurance premiums, as promulgated by insurers, typically include a provision for expected losses, a provision for risk (which becomes profit to the insurer if the losses come in at or below the expected level) and provisions for expenses of the insurer and perhaps an offset for anticipated investment income. From the insured bank's perspective, therefore, some portion of the premium would typically address EL. This means in theory that a bank could show that it had provided for a portion of its EL, by demonstrating the amount of EL imbedded in its insurance premiums.

In summary, clarifying the treatment of EL and UL and historical loss development will assist the Agencies and the banks in understanding the effect of insurance.

Specific Comments-Detailed Calculations of the Insurance Credit

Like the Agencies, we believe that the following issues should be addressed in calculating the credit for insurance for AMA banks:

-Uncertainty and delays in payment, which includes both the credit risk of the insurer and the possibility of disputed claims.

-Degree to which the insurance addresses the actual operational risks of the bank. -Policy provisions that limit coverage including but not limited to policy limits and deductibles.

We believe that the proposed rules do address the above. However, we also believe the rules could be improved in a way that will better achieve the underlying purpose of the proposal but better reflect the actual functioning of insurance as well as the actual degree by which insurance mitigates operational risk.

Recommendation US-3

Supervisory Standard S30, the Agencies' proposal currently reads in part:

"The policy is provided through a third party that has a minimum claims paying ability rating of A."

Marsh suggests that Agencies modify this wording so that the calculation of any offset for insurance should apply explicit haircuts for the credit and timing risk associated with the particular insurance program of the bank that addresses both the credit quality of the specific insurers and anticipated duration of the outstanding losses as well as a discount for the anticipated delays in payment.


While we believe that the requirement to reflect the credit risk of collection of insurance proceeds from insurers is appropriate and consistent with other provisions of the proposal, we do not believe that an arbitrary cut-off at an A rating is appropriate. A or higher rated insurers have some probability of default and, even if they may have a higher likelihood of default, A- and B+ rated insurers are still likely to pay their claims. Furthermore, the credit risk increases with the length of time that the insured loss remains unpaid. So it is appropriate to take into account both the credit quality and duration just as in any credit analysis.

Recommendation US-4

Supervisory Standard S30, the Agencies' proposal currently reads in part:

"The insurance policy must have an initial term of one year."


"An institution should discount (i.e., apply its own estimates of haircuts) the impact of insurance coverage to take into account factors, which may limit the likelihood or size of claim payouts. Among these factors are the remaining term of the policy, especially when it is less than one year ... and the possibility that the policy can be cancelled before the contractual expiration."


Marsh suggests that the Agencies should modify the first quotation wording to read: "The insurance policy must have an initial term of at least one year."

Marsh also suggests that the mere presence of a cancellation provision or a remaining policy term of less than one year do not necessarily require a haircut.


It is true that the insurance market typically provides one-year policies. However, the Agencies should find longer-term policies acceptable hence our first point that the initial term needs to be at least one year rather than must be one year.

On the other hand, in insurance, continuous contracts and a policy term of more than one year is atypical. The Basel Committee proposal on policy term appears to require a pro-rata haircut for

the degree to which the remaining term is less than one year and no credit in the last ninety days. We do not know what the Agencies may have in mind in terms of haircuts for policy term and so we will provide the same comments as we did the Basel Committee, especially since we believe that haircuts are appropriate but only to the extent the insured institution believes that its policy will be cancelled, non-renewed or renewed on less favorable terms.

To require durations in excess of one year or non-standard cancellation or renewal provisions, in effect, would require the banks to obtain insurance on terms and conditions that are highly unusual in the marketplace. Such a requirement could result in far less than optimal insurance from the few insurers willing to adjust their contracts to provide provisions that address this requirement.

If the bank does not or cannot achieve these special provisions from its insurers, there could in practice be very large fluctuations each time the bank calculates its operational risk capital credit, reflecting solely where the bank is in its policy term, for example when the insurance is six months rather than one year from renewal. This fluctuation would not reflect any real added risk.

Since renewal of an insurance policy is typical, there is no more reason to assume renewal will not occur than to assume any other adverse change in the bank's situation. If non-renewal or cancellation is expected by the bank or does occur, then the bank will have to address that in its next quarterly or semi-annual capital calculation just as it must reflect any other change in circumstances.

On the other hand, if the bank has decided not to renew a particular insurance program or believes that it will not be able to renew or will have very different terms and conditions, then it should reflect this in its AMA calculations.

Recommendation US-5

Supervisory Standard S30, the Agencies' proposal currently reads in part:

"The insurance policy has no exclusions or limitations based upon regulatory action or in the for the receiver or liquidator of a failed bank."

Marsh sueaests that the Agencies modify this wordina to the effect that there is no credit if the insurance policv is specifically voided in the event of regulatory action or excludes claims by the reeulator or receiver of a failed bank. However, we sueeest that the Agencies allow for a liability policy to exclude coverage for fines, penalties or punitive damages but provide that such a policy exclusion must be taken into account in the AMA insurance mitigation calculations.


While the proposal reflects valid concerns of the regulators about policies that will not cover claims by them or by liquidators, the current wording in it could be interpreted to require coverage that is abnormal or even against public policy. In some jurisdictions where fines and penalties by regulators could be assessed, insurance against them is unenforceable due to the belief that insurance of fines and penalties removes the incentive against inappropriate behavior created by potential fines and penalties. Therefore, we believe that the bank must be in a position to accept typical exclusions of coverage for fines, penalties and punitive damages, especially as it may be against public policy for insurers to indemnify the banks for these.

We have suggested a change that, without preventing collection of claims by regulators or bankruptcy trustees, addresses the public policy issues as long as the bank reflects these limitations in its calculations.

Recommendation US-6

Supervisory Standard S30, the Agencies' proposal currently reads in part:

"...for example, the institution must also demonstrate that insurance policies used as the basis for the adjustment have a history of timely payouts. If claims have not been paid on a timely basis, the institution must exclude that policy from the operational risk capital calculation."


"An institution should discount (i.e., apply its own estimates of haircuts) the impact of insurance coverage to take into account factors, which may limit the likelihood or size of claim payouts. Among these factors are ... the willingness and ability of an insurer to pay a claim in a timely manner, the legal risk that a claim can be disputed...."

Marsh suggests that of the two approaches-no credit and haircuts- that appear in S30 that the Agencies require haircuts for timeliness and uncertainty of payment rather than exclusion for claims that have a history of not being paid on a timely basis.


There are several reasons to avoid a clear line between credit and no credit where the claims do not have a history of being paid on a timely basis. The first of these is that many of the coverages that banks carry may have, at that bank, no history of claims. This is especially true of coverages where relatively remote tail risk only is transferred. Certainly, just because the bank may have had no claims under a particular coverage and therefore no history of timely payment, the institution should not forego credit. On the other hand a history of prompt payment does not guarantee future prompt payments.

Even where there is a history of delays in payment, the reason for the delay may not be applicable to current circumstances. For example, if the bank had a large property insurance claim and took many months to document its loss, this hardly means that property insurance is worthless as a mitigant. And if the bank has taken steps so that it is prepared to document the next claim, it is likely that the next claim payment will be timely.

Finally, there is clearly a question as to what is an objective standard for timely payment and an acceptable history of same.

For all these reasons a haircut approach to uncertainty of payment is much better than a clear line.

Recommendation US-7

Supervisory Standard S30, the Agencies' proposal currently reads in part:

"The policy coverage has been explicitly mapped to the actual operational risk exposure of the institution."

Marsh suggests that the Agencies modify this wording to clarify that the insurance mitigation calculations must reflect the bank's insurance coverage in a manner that is transparent in its relationship to and consistent with the actual likelihood and impact of loss used in the bank's overall determination of its operational risk capital.


For the purposes of this comment, we assume that the intent of this provision is to ensure that the bank's treatment of insurance reflects the bank's own particular array of likelihood and impact from operational risk in such a way that the resulting adjustments to capital are justifiable. However, we are concerned that the word "explicitly" could be interpreted to require direct mapping.

Such a requirement for direct mapping would be problematic because insurance policies and coverage do not map directly to the Basel Committee's Loss Event type classifications. In some cases, insurance policies extend to multiple event types and in other cases multiple insurance coverages apply to a single loss event type. Although direct mapping' of loss eventtypes to insurance is in theory a reasonable and logical process, when used in the context of operational risk and insurance, it provides an insufficient result because it ignores various complexities that accompany the operational risk/insurance relationship.

The determination of insurance coverage is often a detailed process that involves the consideration of numerous circumstantial factors that might give rise to policy limitations or exclusions or even void coverage. Accordingly, the composite elements from which a determination of insurance coverage is made cannot be captured in a one-dimensional category.

Given the complexity of the insurance/operational risk relationship, which makes direct mapping problematic, and the benefits to be achieved through a more comprehensive modeling, we have suggested the change from wording that might imply a requirement for direct mapping to wording that requires transparency and consistency.


1 See Federal Register Vol. 68, No. 149 p. 45943. "The Agencies have considered both reserving and budgeting as potential methods for EL offsets." This statement implies that the Agencies have not considered insurance.

1 See Definitions in the Federal Register Vol. 68, No. 149 p. 45979

2 Ibid. "The financial impact associated with an operational event that is recorded in the institution's financial statements consistent with Generally Accepted Accounting Principles (GAAP)."

3 Ibid. p. 45985. "Given that EL is looking beyond current losses to losses that will be incurred in the future.... "

4 See Financial Accounting Standards Board, Statement of Financial Accounting Standards No. 5, March 1975. The reserve amount will reflect what is determined to be probable and not what is possible or remote.

5 Once established, it is normal for such a reserve, called "a case reserve" by insurers, to fluctuate over time up to the final disposition of the claim. The inventory of all losses, i.e. aggregate amount of case reserves, along with the cumulative partial payments of defense costs and indemnity payments on these cases usually but not always increases over time. In addition, losses may emerge that have occurred in the past but are provided for later. These losses are called IBNR or "incurred but not reported." The process of the change in the valuation of losses over time is called "loss development."

6 For example, assume that a bank has US$1 billion in loss reserves for litigation on 12/31/2008 and pays $250 million in indemnity for judgments and settlements and for litigation expense during 2009 for the historical cases and any new cases that emerge during 2009. If then there are then $1.5 billion in reserves on 12/31/2009, the GAAP losses would be $750 million. Was the capital (plus allowable EL from reserves, budgeting and insurance) on 12/31/2008 intended to provide 99.9% confidence for the $750 million of adverse loss development (plus non-litigation related operational risk losses)? GAAP and the one-year period specification would imply this.

Or is the bank to ignore the risk of adverse development and to address only occurrences (or events discovered or claims) during 2009? If this is what the capital is intended to address, is it the recognition of these cases during 2009 or their ultimate cost?

For example (and ignoring for now any portfolio effect), if there is a large unsettled loss with a reserve for the EL of $100 million and where the insurance limit is $200 million with a $25 million deductible and the one year UL is $50 million, then the value of the insurance will, depending upon the credit rating of the insurer and any reservation of rights by the insurer, offset $75 million of the EL and all of the UL or $125 million of the $150 million. It would clearly be inappropriate to limit the effect of insurance to 20% or $30 million unless there is quite a low likelihood of an actual recovery from the insurers.

1 Direct mapping" refers to the process of matching an operational risk event category (such appear in the Definitions section of the Proposed Supervisory Guidance, p. 45979 of the Federal Register) to insurance products (as commonly known.). For example, one might map the operational risk event category "Internal Fraud" to the insurance product known as Banker's Blanket Bond (BBB). Unfortunately for the mapping exercise, neither are all internal fraud events covered by this policy (e.g. internal fraud without the intent of personal gain is usually not covered by the BBB) nor does the BBB cover only internal fraud (e.g. external theft of the bank's securities would often be covered by the BBB).


Last Updated 11/04/2003

Skip Footer back to content