Introduction
Banks hold regulatory capital not only for credit and market risk but also for operational risk.
Operational risk can arise from:
failed processes;
people;
systems; or
external events.
Because operational losses can range from small processing errors to major frauds, cyber incidents or business disruptions, regulators need a method for determining how much capital a bank should maintain against such risk.
Under the earlier Basel framework, operational-risk capital measurement developed through three approaches of increasing sophistication:
Basic Indicator Approach (BIA)
The Standardised Approach (TSA)
Advanced Measurement Approaches (AMA)
The current 2026 IIBF BFM syllabus expressly includes these three measurement methodologies, their shortcomings and the New Standardized Approach. In the official IIBF syllabus, these operational-risk topics appear under Module D, although the supplied course mapping identifies Module B.
The regulatory position has also changed significantly. Basel III replaced the earlier BIA/TSA/AMA structure with a single Standardised Approach. RBI issued corresponding directions on June 26, 2023, but stated that their implementation date would be communicated separately. Until those Directions take effect, RBI's existing operational-risk capital requirements continue to apply.
For CAIIB, therefore, learners should understand both the old approaches and the transition to the new approach.
Learning Objectives
After studying this topic, you should be able to:
explain why operational-risk capital is required;
understand the Basic Indicator Approach;
explain the old Standardised Approach;
understand the purpose and features of AMA;
compare BIA, TSA and AMA;
identify weaknesses in the earlier approaches;
understand why Basel introduced a new Standardised Approach;
distinguish the old TSA from the new Basel III Standardised Approach; and
explain the current RBI position in India.
Why Measure Operational Risk for Capital?
Operational-risk management uses tools such as:
RCSA;
KRIs;
internal loss data;
scenario analysis;
control assessment; and
incident reporting.
These tools help the bank identify and manage risk.
Regulatory capital measurement serves a different purpose.
It asks:
How much capital should the bank maintain to absorb operational losses?
The earlier Basel framework allowed approaches with progressively greater sophistication.
The basic idea was:
Simple proxy → Business-line differentiation → Bank-specific internal modelling
This created the progression:
BIA → TSA → AMA
Basic Indicator Approach — BIA
The Basic Indicator Approach is the simplest of the earlier operational-risk capital approaches.
It uses the bank's gross income as a broad proxy for the scale of operational-risk exposure.
The underlying assumption is simple:
A bank with a larger volume of business is likely to have greater operational-risk exposure.
Under RBI's currently applicable BIA treatment for Scheduled Commercial Banks, operational-risk capital is based on 15% of positive annual gross income averaged over the previous three years. Years in which gross income is zero or negative are excluded from both the numerator and denominator.
K(BIA) = [Σ(GI × α)] ÷ n
This estimates operational-risk capital using positive annual gross income and the prescribed alpha factor of 15%.
Refer to the Formula Section for a detailed explanation, variables, and solved examples.
Main Features of BIA
BIA is:
simple;
easy to implement;
based largely on financial information;
not dependent on sophisticated internal operational-loss models; and
relatively easy for regulators to compare across banks.
Its simplicity was useful during the early implementation of Basel II.
Main Weakness of BIA
Its greatest weakness is that gross income is only a crude proxy for operational risk.
Two banks may have similar gross income but very different:
technology dependence;
fraud exposure;
internal controls;
business complexity;
loss history; and
operational-risk profile.
Similarly, a bank with increasing income does not necessarily have proportionately increasing operational risk.
BIA therefore provides limited risk sensitivity.
The Standardised Approach — TSA
The old Standardised Approach (TSA) was intended to be more sophisticated than BIA.
Instead of treating the entire bank as one unit, TSA divided banking activities into eight business lines.
The Basel business lines were:
Corporate Finance
Trading and Sales
Retail Banking
Commercial Banking
Payment and Settlement
Agency Services
Asset Management
Retail Brokerage
Each business line used gross income as the exposure indicator, but different regulatory beta factors were applied according to the business line.
The objective was to recognise that different banking businesses can carry different degrees of operational risk.
Simple Example of the Logic
Payment and settlement operations may have very different operational-risk characteristics from asset management.
TSA therefore attempted to improve on BIA by asking:
Where is the income being generated?
rather than looking only at:
How much total income is being generated?
Why TSA Was More Risk-Sensitive Than BIA
BIA treats the bank as a single block.
TSA recognises that the bank performs different activities.
Therefore:
BIA → One bank-wide indicator
TSA → Separate business lines with different regulatory factors
This made TSA more differentiated than BIA.
TSA Still Had an Important Limitation
Although TSA differentiated business lines, it still relied heavily on gross income.
It did not directly measure:
quality of controls;
actual operational-loss experience;
frequency of fraud;
cyber resilience;
system failures; or
bank-specific operational-risk management.
Therefore, two banks with similar business-line income could still receive similar regulatory capital treatment despite having very different operational-risk profiles.
Alternative Standardised Approach — ASA
The earlier Basel framework also permitted an Alternative Standardised Approach (ASA) under specified conditions.
ASA was a variation of TSA designed to provide an alternative exposure indicator for certain business lines, particularly where gross income could produce distorted results.
For CAIIB, the important concept is:
ASA was a variant of the old standardised framework, not a separate advanced internal-model approach.
RBI's 2023 Directions expressly refer to the existing BIA, TSA/ASA and AMA approaches as the approaches that will be replaced once the Basel III Standardised Approach becomes effective in India.
Advanced Measurement Approaches — AMA
The Advanced Measurement Approaches represented the most sophisticated end of the earlier Basel operational-risk capital framework.
Under AMA, qualifying banks could use their own approved operational-risk measurement systems to determine regulatory capital.
Unlike BIA and TSA, AMA attempted to capture the bank's own operational-risk experience and risk profile.
Important AMA inputs traditionally included:
internal loss data;
relevant external loss data;
scenario analysis; and
Business Environment and Internal Control Factors (BEICFs).
Internal Loss Data
The bank examines operational losses it has actually experienced.
Examples include:
fraud losses;
processing errors;
system failures;
legal losses; and
failed settlements.
Past experience provides information about the bank's own operational-risk profile.
External Loss Data
A bank's own history may contain few extreme events.
Relevant external data can provide information about serious operational losses experienced elsewhere.
This is especially useful for:
rare;
high-severity
events.
Scenario Analysis
Experts consider severe but plausible operational-risk scenarios.
Examples include:
major cyberattack;
prolonged data-centre failure;
large internal fraud;
major third-party disruption; or
serious transaction-processing failure.
Scenario analysis is important because historical data alone may not contain every extreme event that could occur in the future.
Business Environment and Internal Control Factors
BEICFs seek to capture changes in the bank's:
business environment;
control quality;
staffing;
systems;
complexity; and
operational-risk management.
Thus, AMA was conceptually much more bank-specific than BIA or TSA.
BIA, TSA and AMA Compared
Basis | BIA | TSA | AMA |
|---|---|---|---|
Sophistication | Lowest | Intermediate | Highest |
Main Basis | Bank-wide gross income | Gross income by business line | Bank's internal risk measurement |
Business-Line Differentiation | No | Yes | Model dependent |
Internal Loss Experience | Not directly reflected | Not directly central to capital calculation | Important |
External Loss Data | No | No | Important input |
Scenario Analysis | No | No | Important input |
Internal Control Factors | Not directly reflected | Limited | Important |
Model Complexity | Low | Moderate | High |
Bank-Specific Risk Sensitivity | Low | Higher than BIA | Highest among old approaches |
Supervisory Requirements | Relatively simple | Stronger qualifying requirements | Extensive approval and validation |
Why Were the Earlier Approaches Reconsidered?
The old framework had several weaknesses.
BIA Was Too Simple
Gross income did not adequately distinguish between:
good and poor controls;
safe and risky operational structures; or
banks with different historical loss experience.
TSA Was Still Driven by Income
TSA improved business-line differentiation but still depended on gross income as the main exposure proxy.
The Basel Committee later found that business-line differentiation was not sufficiently effective as a risk driver and moved toward a broader Business Indicator approach.
AMA Became Too Complex
AMA introduced greater sensitivity but also created problems.
Different banks could use different:
models;
assumptions;
distributions;
scenario methods; and
modelling judgements.
This reduced comparability and created significant model complexity.
A highly sophisticated model did not automatically guarantee a more reliable capital estimate.
Comparability Became Difficult
Regulators need capital measures that are:
reasonably risk-sensitive; and
comparable across institutions.
The old framework created a difficult trade-off:
BIA/TSA → simpler but less risk-sensitive
AMA → more risk-sensitive in concept but complex and less comparable
This contributed to Basel's decision to replace the three approaches with a single revised approach.
New Basel III Standardised Approach
The revised Basel framework replaced BIA, TSA and AMA with a single Standardised Approach for operational-risk capital.
The current Basel framework describes the approach using a broader financial-statement-based Business Indicator (BI) and associated components rather than the earlier BIA/TSA/AMA structure.
RBI's 2023 Directions adopt the same broad structure for future implementation in India.
The main components are:
1. Business Indicator — BI
BI is a financial-statement-based proxy for the scale of operational risk.
Under RBI's framework, it combines:
Interest, Lease and Dividend Component;
Services Component; and
Financial Component.
This is broader than the simple gross-income measure used under BIA.
2. Business Indicator Component — BIC
The Business Indicator is converted into the Business Indicator Component using prescribed marginal coefficients.
The coefficients increase with the size of the BI, meaning larger banks can attract higher marginal factors.
3. Internal Loss Multiplier — ILM
For relevant larger banks with sufficient high-quality loss history, internal operational-loss experience can influence the capital requirement through the Internal Loss Multiplier.
RBI's framework provides for the use of historical operational-loss information in the ILM for applicable banks.
This addresses an important weakness of BIA and TSA:
Actual operational-loss experience can become relevant to the capital calculation instead of relying only on an income proxy.
Old TSA vs New Standardised Approach
This is a major CAIIB confusion area.
The word Standardised appears in both frameworks, but the approaches are different.
Basis | Old TSA | New Basel III Standardised Approach |
|---|---|---|
Framework | Earlier Basel II framework | Revised Basel III framework |
Structure | Eight business lines | Business Indicator-based framework |
Main Exposure Proxy | Gross income by business line | Broader Business Indicator |
Business-Line Beta Factors | Yes | No old eight-line beta structure |
Internal Loss Experience | Not central to calculation | Relevant through ILM for applicable banks |
Relationship with AMA | AMA existed as separate alternative | AMA replaced |
Current Direction of Basel Framework | Superseded methodology | Revised operational-risk methodology |
Current RBI Position in India
This is especially important for current exam preparation.
RBI issued the Reserve Bank of India (Minimum Capital Requirements for Operational Risk) Directions, 2023 on June 26, 2023.
The Directions state that when they come into effect:
BIA;
TSA/ASA; and
AMA
will be replaced by the Basel III Standardised Approach.
However, RBI also expressly states that the effective date will be communicated separately.
RBI's current regulatory handbook continues to show:
Current approach: Basic Indicator Approach; and
Proposed approach: Basel III Standardised Approach, with implementation date to be communicated later.
Therefore, as of September 3, 2026, the correct Indian regulatory interpretation is:
Current regulatory capital approach for applicable SCBs → BIA
Future notified framework → Basel III Standardised Approach
This distinction should be remembered carefully.
Practical Banking Interpretation
Consider three hypothetical banks.
Bank A — Simple Operations
Bank A has limited complexity and basic operational-risk systems.
Under the old framework, BIA required no sophisticated internal capital model.
Bank B — Multiple Business Lines
Bank B operates:
retail banking;
commercial banking;
trading;
payments; and
asset management.
The old TSA attempted to recognise differences among these business lines instead of applying one bank-wide indicator.
Bank C — Sophisticated Global Bank
Bank C has:
extensive internal loss databases;
scenario-analysis capability;
advanced modelling;
strong validation; and
detailed control information.
Under the earlier framework, it could potentially qualify for AMA subject to supervisory approval.
Under the revised Basel approach, however, banks no longer choose between BIA, TSA and AMA in this manner. The new framework moves to a common Standardised Approach.
The key evolution is:
Simple proxy → Business-line proxy → Internal model → Common revised standardised methodology
CAIIB Exam Focus
Remember these high-value points:
BIA, TSA and AMA belong to the earlier operational-risk capital framework.
BIA is the simplest approach.
BIA mainly uses bank-wide gross income as a proxy.
Under RBI's currently applicable BIA treatment, alpha is 15%.
Zero or negative gross-income years are excluded from the BIA averaging calculation.
TSA is more sophisticated than BIA.
Old TSA divides activities into eight business lines.
TSA applies regulatory business-line factors rather than one bank-wide factor.
ASA is a variant of the old Standardised Approach.
AMA is the most sophisticated of the three earlier approaches.
AMA relies significantly on bank-specific operational-risk measurement.
Internal loss data, external loss data, scenario analysis and BEICFs are important AMA inputs.
Greater model sophistication does not automatically mean greater comparability.
BIA and TSA were criticised for excessive dependence on income-based proxies.
AMA was criticised for complexity and model variability.
Basel III replaced BIA, TSA/ASA and AMA with a single revised Standardised Approach.
The new approach uses the Business Indicator and Business Indicator Component.
Internal loss experience can affect the revised framework through ILM for applicable banks.
Old TSA and new Basel III Standardised Approach are different.
RBI issued its new framework in 2023, but its commencement date is still to be separately notified.
As of September 3, 2026, RBI's current regulatory handbook continues to identify BIA as the current operational-risk capital approach for applicable SCBs.
Common Exam Traps
Trap 1: “BIA directly measures the bank's actual operational losses.”
Incorrect. It mainly uses gross income as a proxy for operational-risk exposure.
Trap 2: “TSA and BIA use exactly the same structure.”
Incorrect. BIA uses a bank-wide indicator, while TSA separates activities into business lines.
Trap 3: “TSA is the most sophisticated old operational-risk approach.”
Incorrect. AMA represented the most advanced approach.
Trap 4: “AMA allows a bank to choose any model without regulatory control.”
Incorrect. AMA was subject to demanding qualitative and quantitative standards and supervisory approval.
Trap 5: “Internal loss data are central to the BIA capital calculation.”
Incorrect. Internal loss experience was much more important in AMA and in the revised Basel III approach.
Trap 6: “The new Basel III Standardised Approach is simply another name for the old TSA.”
Incorrect. Their structures and calculation concepts are materially different.
Trap 7: “Basel III retained AMA as the preferred method for sophisticated banks.”
Incorrect. The revised framework replaced AMA along with BIA and TSA.
Trap 8: “RBI's 2023 Operational Risk Directions immediately replaced BIA in India.”
Incorrect. RBI expressly stated that the effective implementation date would be communicated separately.
Trap 9: “As of September 2026, Indian SCBs are already calculating operational-risk capital under the new Basel III Standardised Approach.”
Incorrect according to RBI's current published regulatory position. BIA remains the current approach until the new Directions become effective.
Trap 10: “Higher income automatically proves higher actual operational risk.”
Incorrect. Income is a regulatory proxy under the simpler approaches, not a direct measurement of the bank's control quality or actual loss probability.
Memory Technique
Remember the old approaches as B–S–A:
B — BIA = Bank-wide income
S — TSA = Separate business lines
A — AMA = Advanced internal measurement
Think of increasing sophistication as:
One Indicator → Eight Business Lines → Internal Models
For the revised framework, remember B–B–I:
B — Business Indicator
B — Business Indicator Component
I — Internal Loss Multiplier, where applicable
The most important current-position memory rule is:
Old approaches remain examinable → Basel III replaces them → RBI transition is notified but not yet effective as of September 3, 2026.