Basel III Endgame's Operational Risk Capital Overhaul: What the Business Indicator Formula Means for Your Loss Data Program

TL;DR

• The March 2026 Basel III endgame re-proposals replace the model-based Advanced Measurement Approach (AMA) with a Standardized Approach for Operational Risk (SA-OR) using a Business Indicator Component
• The operational risk requirement would apply to Category I and II banks; Category III, IV and smaller banks could elect into the expanded risk-based approach but aren’t required to
• The 2026 re-proposal drops the Internal Loss Multiplier from the 2023 version, but loss history still counts: total operational losses are added into the noninterest component of the business indicator
• Comment period closed June 18, 2026; as of October 22, 2026, no final rule has been published
• Op risk teams at Category I and II banks, and at banks weighing an opt-in, should begin mapping their loss data collection, business indicator metrics, and category definitions to the new framework now

The Basel III endgame comment period closed June 18, 2026, and as of October 22 the agencies haven’t published a final rule. The capital planning conversation at most large banks has focused on credit risk RWA, the market risk revisions, and the aggregate capital impact. The piece that’s getting less attention from op risk teams — who are often not in the capital planning meetings — is the operational risk overhaul. And that piece replaces the model-based approach the largest banks have used since 2007.

The Context: Why the AMA Is Being Replaced

The Advanced Measurement Approach (AMA) for operational risk capital was introduced as part of Basel II, giving large banks the ability to use their own internal models to calculate operational risk capital requirements. In theory, bank-specific models should produce more accurate and risk-sensitive capital requirements. In practice, the AMA created a system where similar institutions could hold dramatically different operational risk capital based on modeling choices, not actual risk differences.

The Basel Committee on Banking Supervision identified three problems with the AMA that the standardized approach resolves:

First, excessive variability. Independent studies found that identical operational risk profiles at different banks produced capital charges that varied by a factor of several times depending on which modeling assumptions the bank used. Capital requirements that diverge that widely from any common benchmark aren’t measuring risk — they’re measuring model choice.

Second, limited comparability. Regulators and investors couldn’t meaningfully compare operational risk capital adequacy across institutions because the inputs weren’t standardized. A bank with $2B in operational risk capital under AMA and a bank with $1.5B might not reflect any real difference in underlying operational risk exposure.

Third, complexity without benefit. The AMA required significant investment in model infrastructure, documentation, and validation that didn’t demonstrably improve risk measurement accuracy relative to simpler approaches.

The Standardized Approach for Operational Risk (SA-OR) replaces this with a formula-based capital requirement that uses publicly available financial data — income components — rather than internal models.

The March 2026 Re-Proposal: What Changed from 2023

The federal banking agencies issued their original Basel III endgame NPR in July 2023. Significant industry pushback resulted in the March 19, 2026 re-proposals — three separate proposals from the Federal Reserve, OCC, and FDIC. The operational risk requirement sits in the expanded risk-based approach proposal (91 FR 14952).

For operational risk specifically, the key change between 2023 and 2026 is the treatment of loss history:

2023 proposal: Included an Internal Loss Multiplier (ILM) that scaled the entire operational risk capital charge up or down based on the bank’s average annual net operational losses relative to its business indicator component.

2026 re-proposal: Drops the ILM, which the agencies say is equivalent to setting it equal to one (they asked for comment on whether to bring it back). Instead, total operational losses are added directly into the noninterest component of the business indicator, inside its three-year average.

The practical effect: loss history still matters, and banks with significant historical losses still face higher capital requirements. But the capital impact is now capped at a direct additive rather than a multiplicative factor applied to the entire charge. For most banks, this produces a more predictable capital calculation.

Two other notable changes in the re-proposal:

Noninterest income measured net of expense. The re-proposal’s noninterest component nets total noninterest income against noninterest expense (excluding operational losses), rather than counting fee revenue on its own. That reduces the charge for banks with large fee businesses whose gross revenues far exceed net margins.

Investment management carve-down. The proposal would reduce by 70 percent the net noninterest income from investment management, investment services, and non-lending treasury services used in the noninterest component, citing FR Y-14Q data showing these activities have historically presented lower operational risk. That benefits trust and custody banks.

The Business Indicator Component: How It Works

The Business Indicator Component (BIC) is the foundational element of the SA-OR calculation. It’s a proxy for bank business volume — similar in concept to a revenue-based approximation of operational risk exposure.

Under the re-proposal, the business indicator is the sum of two components, each built from three-year rolling averages of financial statement data:

The business indicator component then rises at three marginal rates: 12 percent of the business indicator up to $1 billion, 15 percent from $1 billion to $30 billion, and 18 percent above $30 billion (thresholds indexed to inflation). Operational risk-weighted assets equal 12.5 times the business indicator component — the multiplier that converts the measure into an 8 percent capital equivalent.

The formula produces a number that increases when:

• Business volume grows (larger business indicator)
• Operational losses increase (they’re added into the noninterest component)

And decreases when:

• Noninterest expense offsets noninterest income (the component is net)
• Investment management, investment services and non-lending treasury services make up more of the business mix (70% reduction)

Which Banks Are Affected — and Who Can Opt In

The expanded risk-based approach — and with it the operational risk capital requirement — would apply to Category I and Category II banking organizations. The categories come from the agencies’ 2019 tailoring rules:

• Category I: U.S. global systemically important banks (G-SIBs), including JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Morgan Stanley, Bank of New York Mellon, and State Street
• Category II: Firms with $700 billion or more in total assets, or $75 billion or more in cross-jurisdictional activity
• Category III: Firms with $250 billion to $700 billion in total assets, or $100 billion or more with $75 billion or more in certain risk indicators
• Category IV: Firms with $100 billion to $250 billion in total assets

The critical point for op risk teams: Category III and IV banks are not required to hold operational risk capital under this proposal. The proposed rule text says the expanded risk-based subpart applies to any Category I or II banking organization and any banking organization that elects to use it. Banks with significant trading activity (generally $5 billion or more in trading assets and liabilities) that aren’t Category I or II would apply the revised market risk framework but otherwise stay on the standardized approach — and the agencies’ companion standardized-approach proposal (document 2026-05960) states there is no separate operational risk capital requirement under the standardized approach.

That makes the opt-in a real decision for Category III and IV banks. The agencies estimate three Category III or IV holding companies would see capital requirements fall by three to seven percent if they chose the expanded risk-based approach instead of the revised standardized approach. Electing in brings the operational risk charge, the independent operational risk management function the proposal requires, and the Category I and II definition of capital (including accumulated other comprehensive income).

For Category I and II banks, the change is a conversion: they’re moving off AMA models, which have been part of the advanced approaches since 2007, onto a formula.

What This Means for Your Op Risk Data Program

If you’re at a Category I or II bank, or a Category III or IV bank modeling an opt-in, the SA-OR calculation depends on data your op risk team may or may not be collecting systematically today.

Business indicator data. The calculation requires clean, consistently categorized income and expense data across the two components: interest/lease/dividend and noninterest, including a clean split of investment management, investment services and non-lending treasury services. Most large banks track this through their financial reporting infrastructure. But if your income categorization doesn’t map cleanly to the SA-OR component definitions, that translation work needs to happen now — not when you’re implementing the final rule.

Operational loss data. Because total operational losses flow into the three-year average of the noninterest component, you need three years of complete loss data. The proposal sets a $20,000 threshold for mandatory collection of operational loss events. Most programs categorize losses by the seven Basel event types:

1. Internal fraud
2. External fraud
3. Employment practices and workplace safety
4. Clients, products, and business practices
5. Damage to physical assets
6. Business disruption and system failures
7. Execution, delivery, and process management

Banks that already have a mature operational loss event database aligned to Basel categories are in good shape. Banks that have been tracking operational losses in an ad hoc or inconsistently categorized way — which includes many Category III-IV institutions that have never been subject to AMA capital requirements and are weighing an opt-in — have remediation work to do.

Minimum data thresholds. The proposal’s $20,000 mandatory collection threshold (indexed to inflation) could change in a final rule. Ensuring your loss data collection process captures events at (and below) that threshold, with consistent documentation of event type, date, gross loss, and net recovery, is foundational to a credible capital calculation.

Loss recovery tracking. Track losses both gross and net of recoveries (including insurance recoveries) — the 2023 proposal’s ILM was built on net losses, and the agencies asked whether to bring it back. This means your loss event database needs to capture recoveries, including insurance payouts, as updates to individual loss events. If your current loss event tracking closes the event at gross loss and doesn’t systematically update for recoveries, that’s a data quality gap.

One practical approach: use your existing KRI framework to monitor the operational risk indicators that connect to your loss data program — incident frequency, loss event severity, recovery rates, and loss event categorization quality. That starts with a clean loss log. The Loss Monitoring & Event Tracking Kit records losses and near misses across the seven Basel event types, calculates net loss and escalation tier for every event, and trends losses by category, business line and quarter. Get it here: buy.stripe.com/fZu7sE4kXdS3azPg5w6J20b.

Connecting ORC to Your Risk Management Infrastructure

The SA-OR is a capital calculation — it tells you how much capital to hold, not how to manage operational risk. But the two aren’t separate.

The inputs to the SA-OR (income components and loss history) should be the same data your op risk program uses for risk identification and trend analysis. If your internal op risk processes are tracking a different set of loss events than what you’ll need for the capital calculation, or if your loss categorization doesn’t align to Basel event types, you’re building two parallel systems that will diverge.

The better approach: align your loss event database, your RCSA, and your KRI framework now so that the data needed for capital calculation is a byproduct of your regular risk management processes — not a separate annual data-gathering exercise.

For the full Basel III endgame context for regional banks, including credit risk and overall capital impact, see this earlier post. For the operational loss data collection fundamentals that feed into this calculation, see the operational loss data collection framework here.

Timeline: What Happens After June 18

The comment period closed June 18, 2026. The three re-proposals — the expanded risk-based approach for Category I and II banks, the revised standardized approach, and the G-SIB surcharge changes — are in the finalization phase. As of October 22, 2026, no final rule has been published in the Federal Register.

What to plan around:

• Final rule: Not yet published. Industry commentary has pointed to late 2026; treat that as an expectation.
• Transition: The proposal includes transition periods for some elements (for example, a five-year transition for certain capital deductions). Confirm the operational risk transition in the final rule.
• Opt-in decision: Category III and IV banks will need to decide whether electing into the expanded risk-based approach is worth the operational risk charge and infrastructure.

For Category I-II banks that already have AMA infrastructure, the transition involves converting existing loss data and income mapping to the formula. Three years of loss data means the data you’re collecting in 2024, 2025, and 2026 is what the first calculations will run on.

So What?

The Basel III endgame operational risk capital changes are going to require more from op risk teams than the credit risk and market risk revisions — partly because the data infrastructure requirements are different, and partly because any Category III-IV institution that opts in would be building this from scratch.

If you’re at a Category I or II bank, or a Category III or IV bank weighing an opt-in, this is the moment to:

1. Map your existing income and expense data to the business indicator’s two components and identify classification gaps
2. Assess your operational loss event database against Basel’s seven loss type categories
3. Confirm your loss recovery tracking captures insurance and other recoveries as event-level updates
4. Identify which of your existing KRIs connect to loss data quality and business indicator accuracy

The comment period is closed. The final rule hasn’t published yet. The institutions that start the data infrastructure work now will have optionality when the final rule publishes — institutions that wait won’t.

Sources:

• Federal Register: Expanded Risk-Based Approach Proposal (91 FR 14952, March 27, 2026)
• Federal Reserve Board: Agencies Request Comment on Proposals to Modernize the Regulatory Capital Framework (March 19, 2026)
• Deloitte: Basel III Endgame & Operational Risk Capital Standard
• Freshfields: Basel III Endgame, Take Two — 8 Key Takeaways from the Federal Banking Agencies’ Capital Re-Proposals
• ABA Banking Journal: Rethinking Operational Risk in the Basel III Endgame
• American Bankers Association: Over-Estimation of the Basel III Endgame Operational Risk Capital Requirements