Risk Advisory · Operational risk capital
Operational risk capital is the Pillar 1 capital a bank holds against losses from inadequate or failed internal processes, people and systems, and from external events. From 1 January 2027, UK banks and building societies calculate it under one standardised approach in the PRA’s Basel 3.1 rules: a Business Indicator drawn from the financial statements, multiplied by marginal coefficients, with the internal loss multiplier set at one.
We size the new Pillar 1 charge against today’s, rebuild the Pillar 2A scenario analysis and rewrite the ICAAP’s operational risk chapter, so the board approves the 2027 capital plan knowing how far the number moved and why.
What changes
Standardised approach for operational risk
One standardised approach replaces the existing approaches, the advanced measurement approach (AMA) included.
The PRA’s final Basel 3.1 rules, published on 20 January 2026 in PS1/26, take effect on 1 January 2027. The Operational Risk Part of the PRA Rulebook, which holds the calculation, has no rules in force before then. The same day, the PRA withdraws SS14/13, its supervisory statement on operational risk, Basel 3.1 reporting begins, and small domestic deposit takers move to their own regime, built on the same approach with simplifications.
The change is to Pillar 1 only. The PRA’s Pillar 2A method for operational risk sits in a separate document, SoP5/15, and in May 2026 PS15/26 confirmed the PRA did not propose changes to it. Swap the formula, leave the ICAAP chapter as it was, and you have moved a number without the argument behind it.
Sources: PRA, PS1/26, 20 January 2026, paras 1.23, 1.26 and 2.14; PS17/23, para 5.2; PRA Rulebook, Operational Risk Part, effective 1 January 2027; PS15/26, 28 May 2026, para 3.1; PS4/26, 20 January 2026.
The calculation
The own funds requirement is the Business Indicator Component multiplied by the internal loss multiplier, and the multiplier is one.
| Business Indicator | Marginal coefficient |
|---|---|
| Up to £0.88 billion | 12% |
| Above £0.88 billion, up to £26 billion | 15% |
| Above £26 billion | 18% |
The coefficients are marginal, so each rate applies only to the slice of the Business Indicator inside its band. The indicator comes from the financial statements: an interest, leases and dividend component, a services component and a financial component.
The internal loss multiplier, which in the Basel standard scales the charge by historical losses, is set at one by the PRA, so your own losses neither raise nor lower the Pillar 1 figure. They stay in the review: the ICAAP must present them, the Pillar 2A method starts from them, and the Operational Risk Part carries loss data rules from the same date.
Sources: PRA Rulebook, Operational Risk Part, rules 4.1, 5.2, 5.8 and 5.9; PRA, PS1/26 Appendix 1 (CRR Instrument 2026); PS17/23, para 5.20; BCBS, Basel III: Finalising post-crisis reforms, 7 December 2017.
Capital impact
It depends on where your Business Indicator sits against the bands and on what you hold today.
The rate on the last pound of indicator is 12%, 15% or 18% depending on the band, a clean loss record earns no reduction, and only a calculation on your own figures will tell you.
Pillar 2A moves with it. The PRA has said it would not double count the same risks in Pillar 1 and Pillar 2A, and that a one-off, off-cycle review, needing no full ICAAP, will adjust Pillar 2 for any double counting and rebase variable Pillar 2A and the PRA buffer. The Basel 3.1 Pillar 2 data collection (reference date 31 December 2025, submitted by 31 March 2026) feeds it.
So the board needs the total, run beside today’s figures on the same quarter-end and reconciled line by line. In drafts we review, the Pillar 1 recalculation is usually done and the Pillar 2A line carried forward from last year with no reference to the new figure.
Sources: PRA, PS9/24, 12 September 2024, paras 6.2 and 6.6; PRA, Basel 3.1 data collection exercise; PRA Rulebook, Operational Risk Part, rules 5.8 and 5.9.
Pillar 2A
Through SoP5/15, the PRA’s methodologies for setting Pillar 2 capital: current version published 28 October 2025, effective 1 July 2026, with a further version listed for 1 January 2027.
Its purpose is to make sure idiosyncratic risks Pillar 1 does not capture well are considered, including past operational risk losses. The PRA weighs the firm’s business model and exposure; the ICAAP analysis, with a focus on historical losses where available and on the design and severity of the scenarios; the quality of the firm’s own assessment; engagement with the firm; and peer comparison. The method mainly applies to significant firms, though the PRA may extend it, and it produces three loss estimates:
Supervisory judgement sets the add-on from that range and the quality of the assessment, scenario process, loss data and framework. As we read it, the operational risk section of SoP5/15 makes no reference to the Business Indicator, and PS15/26 left it unchanged: the scenarios and losses the PRA reads are the ones it read before Basel 3.1.
Sources: PRA, SoP5/15, 28 October 2025, paras 4.4A, 4.9A to 4.9D, 4.15 and 4.16; PS15/26, 28 May 2026, paras 1.12 and 3.1.
The ICAAP
SS31/15, the PRA’s statement on the ICAAP and the supervisory review process, sets the minimum; the current version was published on 28 October 2025 and took effect on 1 July 2026.
Firms must have policies and processes to evaluate and manage their operational risk exposure, and an approach, proportionate to the nature, size and complexity of the business, that captures potentially severe exposures at a soundness standard comparable to a 99.9% confidence interval over one year. Scenario analysis should cover at least all the Basel event types in Annex 2 of the Operational Risk Part; smaller firms may aggregate their scenarios in a simplified way.
At a minimum the ICAAP carries brief information on how the firm manages operational risk, the scenarios it has considered, and the available data on historical, expected and forecast losses, drawing on internal and external loss data where the firm runs a measurement framework.
From 1 January 2027 the Operational Risk Part adds loss data rules of its own; as we read them, and subject to which firms the Part brings into scope, they ask for documented collection procedures under independent review, losses mapped to the Annex 2 categories, and gross losses recorded apart from recoveries. In drafts we review, the loss table in the ICAAP and the register the first line keeps rarely reconcile, because different people maintain them on different thresholds. We check that first. Our ICAAP page covers the whole document.
Sources: PRA, SS31/15, 28 October 2025, paras 2.18A to 2.18E and 2.18J; PRA Rulebook, Operational Risk Part, loss data rules, effective 1 January 2027.
How we help
As advisers we challenge the numbers and the scenarios before the board or the PRA does. As consultants we do the work and hand it over with the assumptions written down.
The Business Indicator Component on your own financial statements, run beside your current requirement on the same quarter-end and reconciled, so the board sees where the change comes from. For the wider recalculation see Basel 3.1.
We design and run the scenario workshops, build the C1 to C3 range and write the Pillar 2A assessment as the firm’s own view rather than a copy of the PRA’s method, with loss data procedures ready for the Operational Risk Part’s rules.
We write the operational risk chapter, or review yours against SS31/15 and SoP5/15 and give the board a written gap report before approval. More on ICAAP support.
The Basel 3.1 versions of the RisKIT capital models calculate operational risk under the new standardised approach beside credit, counterparty credit and CVA risk: pre-built, open Excel, perpetual licence, every formula visible, set-up and validation supported.
Senior practitioners who have held the roles do the work: former CROs and heads of risk, former regulators and interim executives, with model and quant specialists. Work they have led includes operational risk scenarios for a NYSE-listed market maker, after which the PRA accepted its revised operational risk capital and ICAAP, and a risk taxonomy and assessment policies that helped a major UK bank keep its approval to use the advanced measurement approach for operational risk capital. Board sessions come from Risk Education, and if the work shows a gap in the team, Risk Talent can fill it.
FAQ
Yes. It no longer moves the Pillar 1 figure, but SS31/15 expects the ICAAP to present historical, expected and forecast losses, the PRA’s Pillar 2A method focuses on historical losses where available, and the Operational Risk Part carries loss data rules from 1 January 2027.
Yes, as the Pillar 1 base of the SDDT capital regime, which takes effect on the same date under PS4/26, with simplifications. Pillar 2A operational risk for an SDDT follows the simplified methodologies in SoP5/25 rather than SoP5/15, and SDDT ICAAPs follow SS4/25 from 1 January 2027. See our SDDT regime page.
PS1/26 withdraws SS14/13 from 1 January 2027, the day the single standardised approach replaces the existing approaches. The scenario and loss data capability built for an advanced measurement approach is still needed, because SS31/15 and SoP5/15 ask for both in the ICAAP and the Pillar 2A assessment.
Yes. We review the chapter, the scenario set and the loss data against SS31/15 and the factors in SoP5/15, and give the board a written view of the gaps before it approves the document.
One expert firm
Insights
The Business Indicator is the measure of size that sets a UK bank’s Pillar 1 operational risk capital from 1 January 2027. It is the sum of three components taken mainly from the income statement, each...
By Mark Dougherty · 8 min readPillar 2A is the firm-specific capital the PRA requires a bank or building society to hold on top of its Pillar 1 minimum, for risks Pillar 1 does not capture or does not capture fully, such...
By Mark Dougherty · 7 min readBasel 3.1, the PRA's version of the final Basel III reforms, applies to UK banks and building societies from 1 January 2027. It reworks the standardised approaches and phases in an output floor that reaches 72.5% of standardised risk-weighted assets on 1 January 2030.
By Mark Dougherty · 8 min readNext step
Tell us which approach you use today, whether you are a significant firm or an SDDT, and when the board meets. In 30 minutes we will tell you what it would take to have the Pillar 1 and Pillar 2A numbers ready for 1 January 2027.
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.