Get a plain-English read of Standardised Approach — Operational Risk
Turn the raw legal text into a practical explanation grounded in Financial Sector (Collection of Data) (reporting standard) determination No. 9 of 2008 - ARS 114.0 Standardised Approach - Operational Risk.
This reporting standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001.
This reporting standard outlines the overall requirements for the provision of information to APRA relating to an authorised deposit-taking institution’s operational risk regulatory capital. It should be read in conjunction with:
the versions of Form ARF 114.0 Standardised – Operational Risk designated for an authorised deposit-taking institution reporting at Level 1 and Level 2, and the associated instructions (all of which are attached and form part of this reporting standard); and
Prudential Standard APS 114 Capital Adequacy: Standardised Approach to Operational Risk.
Purpose
Data collected in Form ARF 114.0 Standardised – Operational Risk (ARF 114.0) is used by APRA for the purpose of prudential supervision including assessing compliance with Prudential Standard APS 114 Capital Adequacy: Standardised Approach to Operational Risk (APS 114). It may also be used by the Reserve Bank of Australia and the Australian Bureau of Statistics.
Application
This reporting standard applies to an authorised deposit-taking institution (ADI) that satisfies both of the following requirements:
(a) it is applying the standardised approach to operational risk to all or part of its business activities for capital adequacy purposes (refer to APS 114 or Prudential Standard APS 115 Advanced Measurement Approaches to Operational Risk, as appropriate); and
(b) it is included in one of the classes of ADI to which this reporting standard applies, as set out in the table below.
Class of ADI
Applicable
Bank – Advanced or Applicant Advanced
Yes
Bank – Standardised
Yes
Branch of a Foreign Bank
No
Building Society
Yes
Credit Union
Yes
Specialist Credit Card Institution (SCCI)[1]
Yes
Provider of Purchased Payment Facilities
No
Other ADI
Yes
This reporting standard may also apply to the non-operating holding company (NOHC) of an ADI (refer to paragraph 4).
Information required
An ADI to which this reporting standard applies must provide APRA with the information required by the version of ARF 114.0 designated for an ADI at Level 1 for each reporting period.
If an ADI to which this reporting standard applies is part of a Level 2 group, the ADI must also provide APRA with the information required by the version of ARF 114.0 designated for an ADI at Level 2 for each reporting period, unless the ADI is a subsidiary of an authorised NOHC. If the ADI is a subsidiary of an authorised NOHC, the ADI’s immediate parent NOHC must provide APRA with the information required by that form for each reporting period. In doing so, the immediate parent NOHC must comply with this reporting standard (other than paragraphs 3 and 10) as if it were the relevant ADI.
Forms and method of submission
The information required by this reporting standard must be given to APRA in electronic form, using one of the electronic submission mechanisms provided by the ‘Direct to APRA’ (also known as ‘D2A’) application.
Note: the Direct to APRA application software may be obtained from APRA.
Reporting periods and due dates
Subject to paragraph 7, an ADI to which this reporting standard applies must provide the information required by this reporting standard in respect of each quarter based on the financial year (within the meaning of the Corporations Act 2001) of the ADI.
APRA may, by notice in writing, change the reporting periods, or specified reporting periods, for a particular ADI, to require it to provide the information required by this reporting standard more frequently, or less frequently, having regard to:
(a) the particular circumstances of the ADI;
(b) the extent to which the information is required for the purposes of the prudential supervision of the ADI; and
(c) the requirements of the Reserve Bank of Australia or the Australian Bureau of Statistics.
The information required by this reporting standard must be provided to APRA in accordance with the table below. The right hand column of the table sets out the number of business days after the end of the reporting period to which the information relates, within which information must be submitted to APRA by an ADI in each of the classes set out in the same row in the left hand column.
Class of ADI
Number of business days
Bank – Advanced or Applicant Advanced
30
Bank – Standardised
20
Branch of a Foreign Bank
Not applicable
Building Society
15
Credit Union
15
Specialist Credit Card Institution (SCCI)
15
Provider of Purchased Payment Facilities
Not applicable
Other ADI[2]
20
In certain cases an ADI will be both a "bank – advanced or applicant advanced" and a "bank – standardised". The instructions associated with ARF 114.0 set out the relevant reporting requirements and timeframes in those circumstances.
APRA may grant an ADI an extension of a due date in writing, in which case the new due date for the provision of the information will be the date on the notice of extension.
Quality control
The information provided by an ADI under this reporting standard (except for the information required under paragraph 4) must be the product of processes and controls that have been reviewed and tested by the external auditor of the ADI. AGS 1008 ‘Audit Implications of Prudential Reporting Requirements for Authorised Deposit-taking Institutions’, issued by the Auditing and Assurance Standards Board provides guidance on the scope and nature of the review and testing required from external auditors. This review and testing must be done on an annual basis or more frequently if necessary to enable the external auditor to form an opinion on the accuracy and reliability of the data.
All information provided by an ADI under this reporting standard must also be subject to processes and controls developed by the ADI for the internal review and authorisation of that information. It is the responsibility of the board and senior management of the ADI to ensure that an appropriate set of policies and procedures for the authorisation of data submitted to APRA is in place.
Authorisation
When an ADI submits information under this reporting standard using the ‘Direct to APRA’ software, it will be necessary for an officer of the ADI to digitally sign, authorise and encrypt the relevant data. For this purpose, APRA’s certificate authority will issue ‘digital certificates’, for use with the software, to officers of the ADI who have authority from the ADI to transmit the data to APRA.
Minor alterations to forms and instructions
APRA may make minor variations to:
(a) a form that is part of this reporting standard, and the instructions to such a form, to correct technical, programming or logical errors, inconsistencies or anomalies; or
(b) the instructions to a form, to clarify their application to the form
without changing any substantive requirement in the form or instructions.
If APRA makes such a variation it must notify in writing each ADI that is required to report under this reporting standard.
Interpretation
In this reporting standard:
ADI means an authorised deposit-taking institution within the meaning of the Banking Act 1959.
APRA means the Australian Prudential Regulation Authority established under the Australian Prudential Regulation Authority Act 1998.
Australian-owned bank means a locally incorporated ADI that assumes or uses the word ‘bank’ in relation to its banking business and is not a foreign subsidiary bank.
authorised NOHC has the meaning given in the Banking Act 1959.
bank – advanced or applicant advanced means an Australian-owned bank or a foreign subsidiary bank that has APRA’s approval or is seeking APRA’s approval to use an internal ratings-based approach to credit risk and/or an advanced measurement approach to operational risk for capital adequacy purposes.
bank – standardised means an Australian-owned bank or a foreign subsidiary bank that uses the standardised approaches to credit risk and operational risk for capital adequacy purposes in respect of the whole of its operations.
branch of a foreign bank means a ‘foreign ADI’ as defined in section 5 of the Banking Act 1959, but does not include an SCCI that is a foreign ADI.
building society means a locally incorporated ADI that assumes or uses the expression ‘building society’ in relation to its banking business.
business days means ordinary business days, exclusive of Saturdays, Sundays and public holidays.
class of ADI means each of the following:
(i) bank – advanced or applicant advanced;
(ii) bank – standardised;
(iii) branch of a foreign bank;
(iv) building society;
(v) credit union;
(vi) other ADI;
(vii) provider of purchased payment facilities; and
(viii) a specialist credit card institution.
credit union means a locally incorporated ADI that assumes or uses the expression ‘credit union’ in relation to its banking business. and, for the purposes of this reporting standard, includes Cairns Penny Savings and Loans Limited.
foreign subsidiary bank means a locally incorporated ADI in which a bank that is not locally incorporated has a stake of more than 15%.
immediate parent NOHC means an authorised NOHC, or a subsidiary of an authorised NOHC, that is an immediate parent NOHC within the meaning of paragraph 10(b) of Prudential Standard APS 110 Capital Adequacy (APS 110).
Level 1 has the meaning in APS 110.
Level 2 has the meaning in APS 110.
locally incorporated means incorporated in Australia or in a State or Territory of Australia, by or under a Commonwealth, State or Territory law.
other ADI means an ADI that is not an Australian-owned bank, a branch of a foreign bank, a building society, a credit union, a foreign subsidiary bank, a provider of purchased payment facilities or a specialist credit card institution, but for the purposes of this reporting standard does not include Cairns Penny Savings and Loans Limited.
provider of purchased payment facilities means an ADI that is subject to a condition on its authority under section 9 of the Banking Act 1959 confining the banking business that the ADI is authorised to carry on to providing purchased payment facilities.
reporting period means a period mentioned in paragraph 6 or, if applicable, paragraph 7.
specialist credit card institution means an ADI that is subject to a condition on its authority under section 9 of the Banking Act 1959 confining the banking business that the ADI is authorised to carry on to the activities of credit card acquiring and credit card issuing in any credit card scheme that was designated as a payment system under section 11 of the Payment Systems (Regulation) Act 1998 on 11 April 2001.
stake means a stake determined under the Financial Sector Shareholdings Act 1998, as if the only associates that were taken into account under paragraph (b) of subclause 10(1) of the Schedule to that Act were those set out in paragraphs (h), (j) and (l) of subclause 4(1).
subsidiary has the meaning in the Corporations Act 2001.
APRA may make a determination in writing that an individual ADI of one class of ADI is to be treated, for the purposes of this reporting standard, as though it was an ADI of another class of ADI.