Minimum Capital Requirements for Operational Risk

Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment. 4 For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these events are recognized through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across banks. 5 Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to- market errors). While these events do not represent a true financial impact on the institution (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution’s financial statements. *This paragraph has been amended according to SAMA's circular No. (472014119), dated 01/03/1447H, corresponding to 24/08/2025G. 10. Exclusion of Losses from the Loss Component 10.1 Banks must obtain SAMA’s approval to exclude certain operational loss events when they are no longer relevant to the bank’s operational risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating the relevance of operational loss events to the bank’s risk profile, SAMA will consider whether the cause of the loss event could occur in other areas of the bank’s operations. Taking settled legal exposures and divested businesses as examples, SAMA expects the bank’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products. 10.2 The total loss amount and number of exclusions must be disclosed under Pillar 3 with appropriate narratives, including total loss amount and number of exclusions. 10.3 The Banks will exclude losses where a loss event should be greater than 5% of the bank’s average losses. In addition, losses can only be excluded after being included in a bank’s operational risk loss database for a minimum period of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period. 11. Exclusions of Divested Activities from the Business Indicator Banks must obtain SAMA’s approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed under Pillar 3. 12. Inclusion of Losses and BI Items Related to Mergers and Acquisitions 12.1 The scope of losses and BI items used to calculate the operational risk capital requirements must include acquired businesses and merged entities over the period prior to the acquisition/merger that is relevant to the calculation of the standardized approach (ten years for losses and three years for BI). 12.2 Losses and BI items from merged entities or acquired businesses should be included in the calculation of ORC immediately after the merger/acquisition, and should be reported in the first update of the bank’s total risk-weighted assets that comes after the merger/acquisition. 13. Application of the Standardized Approach Within a Group 13.1 At the consolidated level, the standardized approach calculations use fully consolidated BI figures, which net all the intragroup income and expenses. The calculations at a sub-consolidated level use BI figures for the banks consolidated at that particular sub-level. The calculations at the subsidiary level use the BI figures from the subsidiary.