The bank must have documented, validated and independently audited procedures for identifying, collecting and treating internal loss data, based on a 10-year observation period (minimum five years on an exceptional basis, including all good-quality years beyond five) (OPE25.15-25.16). Data must be comprehensive across activities, subsystems and locations, with a collection threshold of 20,000 euro, which supervisors may raise to 100,000 euro for buckets 2 and 3 (OPE25.18). For each event it must record gross loss, dates of occurrence, discovery and accounting, recoveries and descriptive causes (OPE25.19), and be able to map losses to Level 1 event types on request (OPE25.17). Credit-related losses already in credit RWA are excluded, while market-related operational losses are included (OPE25.20-25.21). Gross loss must include direct charges, directly linked costs, provisions and pending losses, and exclude maintenance, enhancement spending and insurance premiums (OPE25.26-25.27). Losses are net of recoveries only once payment is received (OPE25.25), dated by accounting date, with legal losses no later than when a reserve is set (OPE25.28). The bank must independently review data accuracy (OPE25.22). Exclusions of events no longer relevant need supervisory approval, strong justification, a materiality threshold and minimum retention period, and Pillar 3 disclosure (OPE25.30-25.32).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.