Operational Risk

A rogue trader hides losing positions until they balloon into billions. A bank's payment system sends the wrong amount to the wrong account. A cyberattack takes a clearing system offline for a day. A regulator fines a firm for mis-selling a product to customers who didn't understand it. None of these are market bets going wrong or a borrower failing to repay — they're failures of process, people, or systems. That entire category is operational risk, and it is treated as seriously as market and credit risk in modern bank capital rules.

A wide net, deliberately

Regulators define operational risk broadly enough to cover internal fraud (an employee falsifying records for personal gain), external fraud (a third party hacking accounts), employment practices failures, damage to physical assets, business disruption and system failures, and failures in execution, delivery, and process management. The breadth is intentional: operational losses don't come from a single identifiable source the way market risk comes from price moves, so the category has to be defined by what kind of failure occurred, not by which market was involved.

Worked example

A bank's back office processes thousands of trade settlements a day. Most operational losses are tiny — a handful of mis-keyed trades corrected within hours, costing a few thousand dollars total per month. But once every several years, a control gap lets a single employee conceal a large unauthorized trading position for months; by the time it's discovered, the loss runs into hundreds of millions of dollars. Both are operational risk, but a capital framework built only around the frequent small losses would badly underestimate the exposure — it's the rare severe tail event that actually drives the required capital charge.

What this means in practice

Modern operational-risk capital frameworks (Basel's Standardised Measurement Approach) size the charge using a combination of business volume and the bank's own historical loss experience, so a firm with a track record of large operational losses is required to hold more capital than an otherwise-identical firm without one. This creates a direct financial incentive to invest in controls: fewer and smaller operational losses over time literally lowers the capital charge.