(a) __Qualification to use operational risk mitigants__. A bank may
adjust its estimate of operational risk exposure to reflect qualifying
operational risk mitigants if:

(1) The bank’s operational risk quantification system is able to generate an estimate of the bank’s operational risk exposure (which does not incorporate qualifying operational risk mitigants) and an estimate of the bank’s operational risk exposure adjusted to incorporate qualifying operational risk mitigants; and

(2) The bank’s methodology for incorporating the effects of insurance, if the bank uses insurance as an operational risk mitigant, captures through appropriate discounts to the amount of risk mitigation:

(i) The residual term of the policy, where less than one year;

(ii) The cancellation terms of the policy, where less than one year;

(iii) The policy’s timeliness of payment;

(iv) The uncertainty of payment by the provider of the policy; and

(v) Mismatches in coverage between the policy and the hedged operational loss event.

(b) __Qualifying operational risk mitigants__. Qualifying operational
risk mitigants are:

(1) Insurance that:

(i) Is provided by an unaffiliated company that has a claims payment ability that is rated in one of the three highest rating categories by a NRSRO;

(ii) Has an initial term of at least one year and a residual term of more than 90 days;

(iii) Has a minimum notice period for cancellation by the provider of 90 days;

(iv) Has no exclusions or limitations based upon regulatory action or for the receiver or liquidator of a failed bank; and

(v) Is explicitly mapped to a potential operational loss event; and

(2) Operational risk mitigants other than insurance for which the [AGENCY] has given prior written approval. In evaluating an operational risk mitigant other than insurance, [AGENCY] will consider whether the operational risk mitigant covers potential operational losses in a manner equivalent to holding regulatory capital.

(a) If a bank does not qualify to use or does not have qualifying operational risk mitigants, the bank’s dollar risk-based capital requirement for operational risk is its operational risk exposure minus eligible operational risk offsets (if any).

(b) If a bank qualifies to use operational risk mitigants and has qualifying operational risk mitigants, the bank’s dollar risk-based capital requirement for operational risk is the greater of:

(1) The bank’s operational risk exposure adjusted for qualifying operational risk mitigants minus eligible operational risk offsets (if any); or

(2) 0.8 multiplied by the difference between:

(i) The bank’s operational risk exposure; and

(ii) Eligible operational risk offsets (if any).

(c) The bank’s risk-weighted asset amount for operational risk equals the bank’s dollar risk-based capital requirement for operational risk determined under paragraph (a) or (b) of this section multiplied by 12.5.