Insurance as Capital under the Basel Accord: Can Banks Use Insurance to Reduce Required Capital?

Book: Structured Finance and Insurance: The ART of Managing Capital and Risk Author: Christopher L. Culp Publisher: Wiley Finance, 2006 ISBN: 978-0-471-70631-1

One of the central ideas in this entire book is that insurance can work as a substitute for capital. A company that buys insurance to protect against a specific risk needs less equity to absorb potential losses from that risk. The economics are clear.

But economics and regulation are different things. This chapter, written by Barbara T. Kavanagh, an independent risk management consultant who spent 14 years at the Federal Reserve, asks a specific question: does the Basel II framework let banks use insurance to reduce their regulatory capital requirements?

The answer is: sort of. With a lot of caveats.

Why Banks Are Special

Banks are heavily regulated because they sit at the center of every economy. In the US, when a bank’s capital is exhausted, the FDIC steps in. Regulators care deeply about how much capital banks hold and what counts as capital.

For decades, national regulators defined “adequate capital” differently, creating competitive inequities as banking went global. The Bank for International Settlements (BIS) in Basel, Switzerland, tried to fix this. The first Basel Accord (Basel I) came in 1988. It was simple: hold $8 in capital for every $100 in loans.

Basel II, released in June 2004, was vastly more complex. It addressed credit risk, market risk, and, for the first time, operational risk. It also included a separate chapter on securitization. The shift from Basel I’s simplicity to Basel II’s attempt to capture every risk dimension was dramatic.

Operational Risk: The New Category

Basel II defined operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” It includes legal risk but excludes strategic and reputational risk.

From an insurer’s perspective, this definition is incredibly broad. The BIS identified seven subcategories:

1. Internal fraud. Employee theft, insider trading, intentional mismarking of positions.
2. External fraud. Third-party theft, forgery, check kiting.
3. Employment practices and workplace safety. Discrimination, personal injury, workers’ comp.
4. Clients, products, and business practices. Suitability issues, market manipulation, money laundering.
5. Damage to physical assets. Natural disasters, terrorism, vandalism.
6. Business disruption and system failures. Utility outages, hardware/software failures.
7. Execution, delivery, and process management. Data entry errors, delivery failures, vendor disputes.

Look at that list and you’ll notice something: existing insurance products already cover pieces of it. Blanket bond insurance handles some fraud risk. Business interruption policies cover system failures. “Rogue trader” coverage emerged after the trading room blowups at Barings and others.

But the list also makes clear that many operational risks aren’t covered by conventional insurance. And that creates a headache for regulators trying to figure out how to give capital relief for partial risk transfer.

Three Ways to Measure Operational Risk

Basel II offered three approaches.

The Basic Indicator Approach (BIA) assigns a single percentage of gross income to operational risk. Simple but crude.

The Standardized Approach (SA) assigns different capital percentages to different business lines based on revenue.

The Advanced Measurement Approach (AMA) lets banks use their own internal models and data to calculate operational risk capital, subject to regulatory approval.

Here’s the important part: Basel II provides zero capital relief for insurance under the BIA or SA. You only get credit for insurance if you’re using the AMA. And in the US, all banks subject to Basel II (those with $250 billion+ in assets or $10 billion+ in foreign exposure) must use the AMA.

The 20% Cap

Under the AMA, insurance can reduce a bank’s operational risk capital charge by up to 20%. That’s the maximum. And to qualify for any relief, the insurance must meet several minimum criteria:

• Initial policy term of at least one year, with haircuts for shorter remaining maturities (100% haircut at 90 days or less to expiry).
• Minimum 90-day notice for cancellation.
• The insurer must have at least an A rating.
• Insurance must come from a third party. If a captive writes the policy, the risk must be transferred to an external party for the parent to get capital relief.
• No exclusions for supervisory actions. The policy can’t become void just because the bank gets into regulatory trouble.
• The bank must publicly disclose its use of insurance for capital relief.

These are Basel-level minimums. Each national regulator can add their own requirements on top.

Is 20% Enough?

At first glance, 20% sounds small. But Kavanagh makes two important points.

First, the 20% cap was set as a “first approximation.” Regulatory surveys at the time showed that no market participant came anywhere close to that level of insurance coverage for operational risk. The cap wasn’t binding.

Second, and more importantly, regulators explicitly said they were open to raising the cap. They expected product innovation in the marketplace. They expressed willingness to modify the number as long as contracts were enforceable, insurers demonstrated willingness to pay promptly, and the relief could be analytically justified.

So the 20% isn’t a hard ceiling forever. It’s a starting point.

The Data Problem

A big reason the cap was set conservatively is that nobody had good data on operational risk losses. Financial institutions hadn’t historically tracked this information systematically. Even where data existed, sample sizes for tail events were tiny. Banks had plenty of data on frequent small losses but almost nothing on rare catastrophic events.

The AMA requires five years of historical data. That can be a mix of internal and industry-wide data. But institutions still need to justify why external data is relevant to their specific situation. And for new business lines with no history at all, the data problem is acute.

Commercial data sources and industry pooling emerged after Basel II signaled its intent to charge capital against operational risk. But data biases, small samples for tail events, and applicability questions remained significant challenges.

Four Things Banks Need to Do

Kavanagh outlines four precursors before banks can have productive conversations with regulators about operational risk capital relief through insurance:

1. Map existing insurance to operational risk subcategories. Which policies cover which of the seven risk types? This sounds obvious but most banks hadn’t done it.

2. Justify use of external data. If you’re supplementing your own data with industry data, you need to explain why that data is relevant to your institution.

3. Assign probability of insurer payment. Your model needs to account for the chance that the insurer won’t pay when you file a claim. This must be substantiated. Regulators in both the US and Europe are concerned about willingness to pay and timeliness of payments.

4. Address willingness to pay in any proposed structure. Any insurance or risk transfer product seeking capital relief must deal head-on with the risk that the insurer delays, disputes, or denies the claim.

That last point is really interesting. Regulators aren’t just worried about whether insurance exists. They’re worried about whether it actually works when you need it. And given the insurance industry’s reputation for coverage disputes, that’s a reasonable concern.

The Market Opportunity

Kavanagh is optimistic. She sees the market for operational risk transfer products growing dramatically. The capital charges for operational risk are not trivial. Some major institutions estimated their operational risk capital allocation could equal or exceed their market risk capital allocation. If insurance can reduce that charge, even by 20%, the economic incentive is significant.

The constraints will come from practical issues: insurers who fight claims, difficulty writing multiyear policies that look like capital from a regulatory perspective, and the challenge of getting multiple regulatory agencies (in the US, this involves several different regulators) to agree on approving novel products.

But the direction is clear. Basel II explicitly acknowledges insurance as a capital substitute for operational risk. The framework provides a mechanism for relief. And regulators say they’re willing to expand it.

My Take

This chapter is a snapshot of a moment in time, the early days of Basel II implementation, but the underlying question is timeless. If insurance really does transfer risk (and this whole book argues that it does), then it should logically reduce the amount of capital a bank needs to hold.

The regulators’ caution makes sense though. Insurance has a maturity mismatch problem: capital is permanent, but insurance policies expire. Insurance has a counterparty risk problem: what if the insurer can’t or won’t pay? And insurance has a measurement problem: how do you calculate the capital relief when the data on operational risk losses is still thin?

What I find most telling is that no bank had even proposed a structured operational risk transfer transaction to regulators at the time of writing. The theory was ahead of the practice. Everyone knew the capital charges were coming. Everyone knew insurance could help. But nobody had actually built the product yet.

That gap between theory and practice is where the interesting work happens.

Previous: Weather Derivatives vs Insurance Next: SPEs, VIEs, and FIN46R Accounting