---
kind: "section"
citation: "12 C.F.R. § 324.161"
title: "12"
number: "324.161"
heading: "Qualification requirements for incorporation of operational risk mitigants."
url: "https://uscodex.org/cfr/12/324.161"
---

# §324.161. Qualification requirements for incorporation of operational risk mitigants.

- (a) **Qualification to use operational risk mitigants.** An FDIC-supervised institution may adjust its estimate of operational risk exposure to reflect qualifying operational risk mitigants if:
  - (1) The FDIC-supervised institution's operational risk quantification system is able to generate an estimate of the FDIC-supervised institution's operational risk exposure (which does not incorporate qualifying operational risk mitigants) and an estimate of the FDIC-supervised institution's operational risk exposure adjusted to incorporate qualifying operational risk mitigants; and
  - (2) The FDIC-supervised institution's methodology for incorporating the effects of insurance, if the FDIC-supervised institution uses insurance as an operational risk mitigant, captures through appropriate discounts to the amount of risk mitigation:
    - (i) The residual term of the policy, where less than one year;
    - (ii) The cancellation terms of the policy, where less than one year;
    - (iii) The policy's timeliness of payment;
    - (iv) The uncertainty of payment by the provider of the policy; and
    - (v) **Mismatches in coverage between the policy and the hedged operational loss event.**
- (b) **Qualifying operational risk mitigants.** Qualifying operational risk mitigants are:
  - (1) **Insurance that—**
    - (i) Is provided by an unaffiliated company that the FDIC-supervised institution deems to have strong capacity to meet its claims payment obligations and the obligor rating category to which the FDIC-supervised institution assigns the company is assigned a PD equal to or less than 10 basis points;
    - (ii) Has an initial term of at least one year and a residual term of more than 90 days;
    - (iii) Has a minimum notice period for cancellation by the provider of 90 days;
    - (iv) Has no exclusions or limitations based upon regulatory action or for the receiver or liquidator of a failed depository institution; and
    - (v) Is explicitly mapped to a potential operational loss event;
  - (2) **Operational risk mitigants other than insurance for which the FDIC has given prior written approval.** In evaluating an operational risk mitigant other than insurance, the FDIC will consider whether the operational risk mitigant covers potential operational losses in a manner equivalent to holding total capital.

## Notes

### Authority

Authority: 12 U.S.C. 1815(a), 1815(b), 1816, 1818(a), 1818(b), 1818(c), 1818(t), 1819(Tenth), 1828(c), 1828(d), 1828(i), 1828(n), 1828(o), 1831o, 1835, 3907, 3909, 4808; 5371; 5412; Pub. L. 102-233, 105 Stat. 1761, 1789, 1790 (12 U.S.C. 1831n note); Pub. L. 102-242, 105 Stat. 2236, 2355, as amended by Pub. L. 103-325, 108 Stat. 2160, 2233 (12 U.S.C. 1828 note); Pub. L. 102-242, 105 Stat. 2236, 2386, as amended by Pub. L. 102-550, 106 Stat. 3672, 4089 (12 U.S.C. 1828 note); Pub. L. 111-203, 124 Stat. 1376, 1887 (15 U.S.C. 78o-7 note), Pub. L. 115-174; section 4014 § 201, Pub. L. 116-136, 134 Stat. 281 (15 U.S.C. 9052).

### Source

Source: 78 FR 55471, Sept. 10, 2013, unless otherwise noted.