(a) Qualification to use operational risk mitigants. A [bank] may adjust its estimate of operational risk exposure to reflect qualifying operational risk mitigants if:
(1) The [bank]’s operational risk quantification system is able to generate an estimate of the [bank]’s operational risk exposure (which does not incorporate qualifying operational risk mitigants) and an estimate of the [bank]’s operational risk exposure adjusted to incorporate qualifying operational risk mitigants; and
(2) The [bank]’s methodology for incorporating the effects of insurance, if the [bank] uses insurance as an operational risk mitigant, captures through appropriate discounts to the amount of risk mitigation:
(i) The residual term of the policy, where less than one year;
(ii) The cancellation terms of the policy, where less than one year;
(iii) The policy’s timeliness of payment;
(iv) The uncertainty of payment by the provider of the policy; and
(v) Mismatches in coverage between the policy and the hedged operational loss event.
(b) Qualifying operational risk mitigants. Qualifying operational risk mitigants are:
(1) Insurance that:
(i) Is provided by an unaffiliated company that has a claims payment ability that is rated in one of the three highest rating categories by a NRSRO;
(ii) Has an initial term of at least one year and a residual term of more than 90 days;
(iii) Has a minimum notice period for cancellation by the provider of 90 days;
(iv) Has no exclusions or limitations based upon regulatory action or for the receiver or liquidator of a failed depository institution; and
(v) Is explicitly mapped to a potential operational loss event; and
(2) Operational risk mitigants other than insurance for which the [AGENCY] has given prior written approval. In evaluating an operational risk mitigant other than insurance, [AGENCY] will consider whether the operational risk mitigant covers potential operational losses in a manner equivalent to holding regulatory capital.
(a) If a [bank] does not qualify to use or does not have qualifying operational risk mitigants, the [bank]’s dollar risk-based capital requirement for operational risk is its operational risk exposure minus eligible operational risk offsets (if any).
(b) If a [bank] qualifies to use operational risk mitigants and has qualifying operational risk mitigants, the [bank]’s dollar risk-based capital requirement for operational risk is the greater of:
(1) The [bank]’s operational risk exposure adjusted for qualifying operational risk mitigants minus eligible operational risk offsets (if any); or
(2) 0.8 multiplied by the difference between:
(i) The [bank]’s operational risk exposure; and
(ii) Eligible operational risk offsets (if any).
(c) The [bank]’s risk-weighted asset amount for operational risk equals the [bank]’s dollar risk-based capital requirement for operational risk determined under paragraph (a) or (b) of this section multiplied by 12.5.