Risk Shifting and Regulatory Arbitrage: Evidence from. Operational Risk

Transcription

1 Risk Shifting and Regulatory Arbitrage: Evidence from Operational Risk Brian Clark * clarkb2@rpi.edu Alireza Ebrahim alireza.ebrahim@occ.treas.gov June 23, 2017 ABSTRACT Regulations leading up to the financial crisis of provided incentives for banks shift their risk profiles toward less regulated areas. We focus on the case of operational risk which went from being a relatively benign and largely unregulated risk type to a major risk that now accounts for about 25% of large banks risk profiles. We show that capital-constrained banks aggressively took on operational risk as a means of regulatory arbitrage. Indeed, this contributed to operational risk s rise to prominence as a leading risk type in the financial sector and worsened the effects of the crisis. JEL classification: G00, G11, G18, G21, G28 * Brian Clark is the contact author. He is at Rensselaer Polytechnic Institute and the Office of the Comptroller of the Currency (OCC) and can be reached at or clarkb2@rpi.edu. Alireza Ebrahim is at the OCC and can be contacted at alireza.ebrahim@occ.treas.gov. The views expressed herein are those of the authors alone and do not necessarily represent the views of the US Office of the Comptroller of the Currency or the US Treasury. We thank Mike Carhill, Filippo Curti, David Malmquist, Jonathan Jones, Bill Francis, Christopher Martin, Marco Migueis, Robert Stewart, Qiang Wu, and seminar participants at Fordham University, Rensselaer Polytechnic Institute, Stony Brook, the OCC, the 2016 International Economics of Banking and Finance Conference, and the 2016 Risk Quantification Forum for helpful comments and suggestions. All errors are our own.

2 1. Introduction Given the complexity of today s banking markets and the sophistication of technology that underpins it, it is no surprise that the OCC [Office of the Comptroller of the Currency] deems operational risk to be high and increasing. Indeed, it is currently at the top of the list of safety and soundness issues for the institutions we supervise. This is an extraordinary thing. Some of our most seasoned supervisors, people with 30 or more years of experience in some cases, tell me that this is the first time they have seen operational risk eclipse credit risk as a safety and soundness challenge. Rising operational risk concerns them, it concerns me, and it should concern you. -Thomas J. Curry, Comptroller of the Currency (2012) 1 During the financial crisis of , large U.S. banks proved to be under-capitalized. While there is still debate as to the extent of the under-capitalization and the root cause, few would disagree that lapses in regulation were at least partially to blame and contributed to the excessive risk taking that ultimately resulted in the largest government bailout of the U.S. financial sector in history and led to the worst recession since the Great Depression of the 1930 s. In this paper, we show that weaknesses in regulations leading up to the crisis provided incentives for banks to increase their overall risk and shift their risk taking to less regulated risk areas, and in particular increase their exposure to operational risk. Such regulatory arbitrage not only contributed to banks under-capitalization in that time period, but also gave rise to the magnitude and importance of these less regulated risk streams, including operational risk, as components of the overall systematic risk in the financial industry. Indeed, the viability of operational risk as a mechanism for regulatory arbitrage during this time contributed to its rise to prominence as a leading risk type in the financial sector as highlighted by the above quote. More generally speaking, we show one channel by which unintended consequences of financial regulations can contribute to the emergence of new risks that can stretch well beyond the financial sector. In particular, operational risk was unregulated prior to the crisis in the sense that banks were not required to hold additional equity capital to cushion against operational losses. This provided banks with an incentive to shift their risk profiles and take on unprecedented levels of 1 This quote is from Thomas J. Curry s May 16, 2012 speech before the Exchequer Club. Full text is available at: Comptroller Curry is the chief officer of the Office of the Comptroller of the Currency (OCC). 1

3 operational risk and thus increase their overall risk exposure at the expense of the stability of the financial sector. Operational risk is broadly defined as the risk of a loss due to the failure of people or processes. In the banking industry, this essentially includes all risks outside of the traditional credit and market risks. Credit risk is largely driven by a bank s loan portfolio and market risk largely arises from trading activities. Operational risk, however, is more broadly defined and captures almost anything that does not fit into the other categories and today accounts for about 25% of the risk on large banks balance sheets. Examples of operational risks include process breakdowns that led to rogue traders such as the London Whale, 2 fraudulent activities such as the foreign exchange and LIBOR rate rigging scandals, operational failures related to the sale of mortgage back securities, incentive structures that lead to actions such as improper sales practices, and the resulting regulatory fines and class action lawsuits. The magnitude of these operational losses are huge and the underlying behaviors undoubtedly exacerbated the magnitude of the recent financial crisis. For example, the Boston Consulting Group (2017) estimates that North American and European banks have paid a total of $321 billion in fines since the crisis, primarily due to actions related to the above examples. The increase in operational risk in the banking industry also had real consequences because the effects of banks operations can reach beyond the financial sector and directly affect the real economy. For example, lax monitoring and controls by banks led to the foreclosure debacle that affected thousands of homeowners after the crisis as banks systematically mishandled mortgage documents, adversely affecting borrowers. Poor monitoring and incentives of bank employees have also led to operational failures such as the recent Wells Fargo cross-selling scandal where bank employees created fictitious accounts in customers names, thus directly affecting hundreds of thousands of consumers. Even operational events like the LIBOR and foreign exchange rate rigging scandals had far-reaching consequences on the economy as a whole as banks were accused of manipulating key interest and exchange rates. To highlight how important operational risk has become in the banking industry, Figure 1 2 The London Whale refers to the losses suffered by JP Morgan Chase as a result of a rogue trading incident. The details of the U.S. Senate report on the loss is United States Senate (2013) 2

4 shows the breakdown of banks risk profiles by risk type for nine large U.S. banks as of 2015:Q Overall, operational risk accounts for roughly 25% of large banks total risk profiles in terms of risk weighted assets (RWA) and is more than 2.75 times greater than the level of market risk exposure at these institutions. At the individual firm level, JP Morgan Chase attributed $400 billion of RWA to operational risk in 2015:Q3 which is nearly equivalent to Morgan Stanley s $423 total RWA. Morgan Stanley is the sixth largest U.S. bank. So by any measure, operational risk has grown to become a significant source of risk to U.S. banks. [Place Figure 1 about here] In addition to its economic magnitude, operational risk has a few characteristics that make it worthwhile risk type to study how banks respond to regulations and manage risk. First, it was largely unregulated leading up to the crisis which made it susceptible to regulatory arbitrage. Second, operational losses tend to be heavy-tailed, so increasing operational risk exposure is a viable way to take on, or manufacture, tail risk. As discussed by Acharya, Cooley, and Richardson (2010), leading up to the crisis banks had incentives to manufacture tail risks that were systemic in nature. Taking on operational risk was one channel through which banks could effectively expose themselves to tail risk without having to hold capital. Many of the large operational losses were also systemic in nature as they stretched across a number of banks that were involved in the same or similar events (e.g., high profile cases such as LIBOR manipulation and mortgage-related lawsuits). Third, the nature of operational risk is such that there is often a significant time lag between the decision to take on operational risk and the time when losses are incurred from an accounting standpoint. For example, a reluctance to invest in and maintain proper IT infrastructure increases net income by limiting short term costs but also increases the probability of major failures months or years down the road. Fraudulent behavior such as interest rate manipulation schemes also take time to detect, all the while a bank is (presumably) booking short term trading gains. Operational 3 The figure shows the percentage of risk weighted assets (RWA) allocated to the three main risk types operational, credit, and market and a fourth category of miscellaneous adjustments. The nine banks shown in the Figure 1 are the only ones publicly reported risk-based capital numbers under Basel II capital regulations as of 2015:Q3. The miscellaneous category includes credit value adjustments (CVA), assets subject to general risk-based capital requirements, and less excess reserves. 4 Note that the RWA numbers in Figure 1 based on Basel II regulations that were not in place prior to However, they are a useful benchmark to gauge the extent of operational risk exposure vis à vis other risk types in large financial institutions. 3

5 losses such as rogue traders often stem from a root cause of poor internal control systems that are put in place months or years before losses occur. In addition, bank managers may have the ability to prolong litigations in order to defer realization of certain operational loss types. These are important examples to understand the nature of operational risk because they show how managers can effectively book short term gains in the form of increased trading revenue, reduced operating costs, or inflated accounting profits by taking on operational risk. As such, operational risk management is not purely a cost minimization problem; rather mangers have profit motives for increasing operational risk exposure. For example, Chernobai, Jorion, and Yu (2011) show that managerial incentives that focus on short-term metrics are positively related to the frequency of operational losses. However, despite the sheer magnitude and apparent importance of operational risk to financial regulators, supervisors, market participants, and the economy as a whole, it is still up to debate as to how it came to play such a major role in recent years. We therefore ask the questions of how and why did operational risk grow from a seemingly innocuous risk type to play such a prominent role in bank risk management? We hypothesize that weaknesses in regulations contributed to the excessive amounts of operational risk in today s banking sector. The specific regulations we use to identify our tests are the Basel I capital accords. Under Basel I, U.S. banks were not required to hold capital for operational risk which meant that regulatory capital-constrained banks could shift their risk profiles in favor of operational risk to avoid capital charges; a process commonly known as regulatory arbitrage. Doing so enabled banks to increase their overall risk exposure without having to hold commensurate loss-absorbing capital buffers and thus contributed to the widespread effects of the crisis. Our main testable hypothesis is that capital constrained banks took on operational risk to shift their risk profiles and effectively engage in regulatory arbitrage. To identify our tests, we exploit a rich set of operational loss data collected by regulatory agencies for a sample of large U.S. banks. The data includes the universe of operational losses collected by our sample of banks. Depending on the institution, reliable operational loss data collection dates as far back as The data is collected by the Federal Reserve on a quarterly basis and is part of the FRB Y-14Q data series. We merge this data with data from the Federal Reserve s FRB Y-9C data to control for bank characteristics. 4

6 Our data has several unique features that allow us to examine our research question. First, banks report every operational loss event above a low collection threshold so this is the most comprehensive set of operational loss data currently available and the cross-sectional nature makes it even richer than banks own internal data. Second, banks report detailed information for each loss. Importantly they assign and report an occurrence date, discovery date, and accounting date for each loss. The accounting date is the date at which the loss hits the income statement. The discovery date is when the operational event is discovered. The occurrence date is the date to which the bank is able to trace the root cause of the operational failure. The occurrence date is vital to our identification strategy because we use it to proxy operational risk exposure. In doing so we assume that loss occurrence amounts are proportional to overall operational risk exposure. This is important because measuring operational risk exposure is different from credit or market risk applications where you can define exposure based on the size of the current loan or trading asset portfolio. Additionally, we are more concerned with when banks take on operational risk exposure (i.e., the occurrence date) than when losses are realized (the accounting date) because we are hypothesizing that banks take on operational risk for regulatory arbitrage purposes. Therefore changes in exposure should be more indicative of risk shifting behavior as compared to the realization of losses which often occur months or years after managers shift their risk profiles toward operational risk. We discuss this in detail in Section 3. Our empirical design is similar to Acharya, Schnabl, and Suarez (2013) who test for regulatory arbitrage in the asset-backed commercial paper (ABCP) market. We start by regressing measures of operational risk exposure on measures of capital adequacy (regulatory capital and leverage ratios). We show that leverage, defined as equity divided by total assets, is negatively related to operational risk exposure. This finding is robust to several different model specifications. We focus on leverage because the relation between regulatory capital ratios and regulatory arbitrage is likely to be downward biased. The reason is that banks engage in regulatory arbitrage to increase regulatory capital ratios so the relation between regulatory capital and regulatory arbitrage should be muted to the extent that banks can effectively increase risk that is not reflected in their regulatory capital ratios. Also, as discussed by Acharya et al. (2013) and shown by Demirguc-Kunt, Detragiache, and Merrouche (2013), leverage ratios have been shown to be better predictors of financial distress and bank stock returns than regulatory capital ratios. 5

7 We conduct several robustness tests. First, we employ first-difference regressions to control for possible spurious correlations that could be driving the relation between capital adequacy and operational risk. We then test conditional models whereby we test the relation between economic capital ratios and operational risk conditional on banks regulatory capital ratios. Consistent with our expectation, banks operating closer to their regulatory capital minimums exhibit more aggressive risk shifting behavior because regulatory capital constraints push them to take on operational risks that carry no capital charge. We also consider a placebo test using loss accounting dates which should not have a strong relation with measures of economic capital because many of the losses are realized well after the operational risk exposure is undertaken. We find no relation between the realization of operational losses based on accounting dates and leverage. All of these robustness tests support our main finding. Additionally, we show that capital constrained banks are likely to increase the duration of operational risk exposure suggesting that operational exposures that prolong the realization of losses are preferred. 5 We contribute to the literature in several ways. First, we show that operational risk is one mechanism through which financial regulations can have unintended consequences that affect the real economy. In particular, our results suggest that the lack of regulation of operational risk leading up to the crisis contributed to the emergence of operational risk as a leading risk type in banks risk profiles in today s banking sector. Given the fact that operational risk, which was previously unregulated, now comprises roughly 25% of banks total risk, this is an important finding. Other papers show that regulations can have unintended consequences in other areas. For example, Keys, Mukherjee, Seru, and Vig (2009) show that more heavily regulated banks actually originated lower quality mortgages in the originate to distribute model leading up to the crisis. Gropp, Hakenes, and Schnabel (2011) show that public guarantees have unintended consequences beyond the obvious increase in moral hazard of regulated banks in that they actually make competitor banks more risky as well. Agarwal, Lucca, Seru, and Trebbi (2014) show that even the implementation of consistent regulations can vary in how they are implemented. More broadly, there is a stream of literature that focuses on how banks respond to government actions such as too big to fail guarantees and 5 Our measure of the duration of operational risk exposure is conceptually similar to the duration of a bond. It refers to a weighted average of the length of time between the date that banks take on operational risk exposure (the loss occurrence date) and when losses are realized from an accounting standpoint. A longer duration means losses take longer to realize. We define the measure in Section

8 deposit insurance. Most of these papers focus on the role of bailout policies on banks overall risk taking behavior. For example, Duchin and Sosyura (2014) show that bailed out banks increase their risk in ways that are difficult for regulators to detect. We contribute to this area by showing one specific risk type that allowed banks to leverage up while still complying with regulations. We also contribute to the closely related literature on regulatory arbitrage. Most papers that study regulatory arbitrage focus on weaknesses in the regulation of complex financial instruments such as mortgage backed securities (MBS) and other derivatives or examine large-scale investment decisions such as cross-border acquisitions (Karolyi and Taboada, 2015). For example, Acharya et al. (2013) show that banks underwrote ABCP conduits to shift risk off their balance sheets to avoid holding regulatory capital. The issuing banks retained much of the ABCP and suffered the losses when they defaulted during the crisis, thus suggesting that the risk transfer was done primarily to evade capital regulations. Demyanyk and Loutskina (2016) show similar evidence of regulatory arbitrage in the shadow banking market and in particular the securitized mortgage markets. Even prior to the crisis papers such as Jones (2000) provided caution that banks could effectively work around capital regulations to engage in regulatory arbitrage. A more recent paper by Boyson, Fahlenbrach, and Stulz (2016) shows that some banks issued trust preferred securities (TruPS) as a form of regulatory arbitrage but this behavior was limited to capital constrained banks suggesting that not all banks engage in regulatory arbitrage. We argue that taking on operational risk is fundamentally different than investing in or issuing specific financial products as in the aforementioned papers. Importantly, taking on operational risk exposure does not necessarily require banks to be involved with complex financial products such as ABCP (Acharya et al. (2013)), MBS (Demyanyk and Loutskina (2016)), or even TruPS (Boyson et al. (2016)). This is important to note because the majority of the papers in this area focus on specific loopholes in regulation that banks were able to exploit using innovative financial products. With regards to operational risk, regulators overlooked a broad type of risk present at all financial institutions that once measured turned out to account for roughly one quarter bank risk. In summary, we provide evidence that financial regulations can have far-reaching consequences that stretch beyond the financial sector. In particular, a lack of regulation of operational risk contributed to its rise to importance as a portion of banks risk profiles, ultimately culminating in a risk type that now accounts for about 25% of large banks total risk. We find evidence consistent 7

9 with the hypothesis that banks actively took on operational risk exposure prior to the crisis in an attempt to shift risk and engage in regulatory arbitrage. While new regulations require banks to hold capital for operational risk, it is an important source of risk that should not be overlooked by regulators or academics. Our results also support the notion that regulatory arbitrage in the banking industry does not necessarily have to involve complex financial instruments as much of the operational losses have little to do with complex financial instruments or financial innovations gone awry. One implication is therefore that human behavior, a driving force behind operational risk, is an important risk factor for banks. 2. Related Literature Although excessive risk taking is not specific to banking sector, it seems to be a more severe problem in banks. The classical concept of risk shifting refers to the moral hazard problem that arises from separation of ownership and control (Jensen and Meckling (1976)). However, the risk shifting in the banking industry that we refer to is a slightly different problem whereby banks have an incentive to take on excessive risk beyond their regulatory capital requirements. As such, banks shift from risks for which they would have to hold capital to risks that carry no explicit capital requirements. Extant literature suggests that securitization and other recent financial innovations have enabled banks to substantially elevate their portfolio risk relative to their regulatory capital through regulatory capital arbitrage. For example, Acharya et al. (2013) provide evidence of regulatory arbitrage in the ABCP market and Demyanyk and Loutskina (2016) show that regulated depository institutions were able to use the shadow banking sector to engage in regulatory arbitrage. Other papers show that inefficiencies or lapses in regulation contributed to the extent of risk shifting and regulatory arbitrage in the financial sector. Keys et al. (2009) argue that increased regulation of financial institutions actually worsened the moral hazard problem in the mortgage securitization market and as such market forces would have been more effective means to properly incentivize lenders than regulations. More generally, there are a number of papers that document changes in bank behavior in response to regulatory actions such as capital requirements, reserve requirements, and deposit 8

10 insurance premiums (see, Cumming et al. (1987),Baer, Pavel, et al. (1988), Jagtiani, Saunders, and Udell (1995), Pennacchi (1988), James (1988), Merton (1995)). These papers provide a context for our study that focuses on the link between risk shifting, regulatory capital requirements and operational risk. There are a number of theoretical reasons for risk shifting in banking sector. First, banks typically desire to have high levels of leverage and risk-seeking banks have incentives to take on risk beyond their regulatory limits. The most notable incentives are due to the presence of explicit and implicit government guarantees that result in privatized gains and socialized losses (see, e.g., Bhattacharya and Thakor (1993), Admati, DeMarzo, Hellwig, and Pfleiderer (2011), Admati and Hellwig (2014), and others). The opaqueness of banking assets and risk management practices also facilitates risk shifting (Myers and Rajan (1998), Diamond and Rajan (2000)). Another strand of literature suggests that regulatory arbitrage is an unintended consequence of minimum capital standards. These papers argue that regulatory standards would cause bank capital and asset risk to become substitutes and consequently, banks facing increased regulatory capital charges would achieve their desired total risk level by increasing their asset risk. Accordingly, these studies suggest a potential positive relationship between regulatory capital and risk in banks that operate at or above regulatory capital minimums (see Kahane (1977), Koehn and Santomero (1980), Kim and Santomero (1988), Gennotte and Pyle (1991), Blum (1999)). On top of the already sizable incentives to risk shift, incentives for risk shifting are stronger when shareholders stake in the bank is smaller. This is the main reason why capital requirements are in place to force shareholders to keep some skin in the game (Demirguc-Kunt et al. (2013)). Therefore, the presence of a negative relationship between changes in risk and capital (or leverage) ratios in risk seeking banks is a sign of risk shifting. There are several studies in the literature that document a negative relation between capital ratios and asset risk. For example, Furlong and Keeley (1989) demonstrate that capital requirements reduce banks risk-taking incentive. Also, Jacques and Nigro (1997) find that increases in banks capital ratios, caused by risk-based capital standards, resulted in lower portfolio risk in the banks. Focusing on the impact of FDIC improvement act of 1991, Aggarwal and Jacques (2001) find that while banks increased their capital ratios, they reduced their level of portfolio risk. More recently, Rampini, Viswanathan, and Vuillemey (2015) show that poorly capitalized banks banks tend to reduce hedging. 9

11 In sum, the literature shows that banks do indeed have incentives to shift risk to avoid capital charges. There is evidence that banks boost their capital ratios by artificially inflating their measures of capital or artificially decreasing measures of their asset risk through the exploitation of accounting standards or supervisory policy loopholes (Jones (2000)). Empirical papers such as Acharya et al. (2013) support that contention in the ABCP market. Likewise, Yorulmazer (2013) shows that credit default swaps (CDS) are another mechanism for banks to shift risk and engage in regulatory arbitrage. Karolyi and Taboada (2015) show that banks operating in countries with relatively strong regulatory regimes tend to acquire banks in countries with weak regulatory regimes and earn positive returns on these acquisitions. We contribute to this literature by showing evidence of another significant channel by which banks risk shift and engage in regulatory arbitrage, namely via taking on operational risk. There are a limited number of studies in the finance literature regarding operational risk and the factors that drive operational risk exposure (see, e.g., Chernobai et al. (2011), Abdymomunov, Curti, and Mihov (2015), Basak and Buffa (2016), Chernobai, Ozdagli, and Wang (2016)). We show that under Basel I capital regulations, banks had incentives to shift risk toward operational risk because it did not carry an explicit capital charge. Our results also suggest that banks did not necessarily have to use complex financial instruments, such as derivatives or structured finance instruments, to evade capital regulations as they could simply increase operational risk exposure by cutting monitoring and control costs without having to hold additional capital. 3. Institutional Background This section describes the institutional background surrounding the recent history of operational risk. We first define operational risk and give a few examples. We then discuss the regulatory environment that we hypothesize to have pushed capital-constrained banks to take on excessive amounts of operational risk and finish with a discussion of how banks shifted their risk profiles to increase operational risk exposure and thus avoid holding capital. 10

12 3.1. Operational Risk Defined Operational risk is defined by the Basel Committee on Banking Supervision (BCBS) as the risk of direct or indirect loss resulting from inadequate or failed internal processes, people, and systems or from external events (Basel Committee on Banking Supervision (2004)). Essentially, this encompasses losses that cannot be attributed to credit or market risk. BCBS defines seven event types for losses and banks are required to report losses accordingly. The seven event types are given below in Table 1. [Place Table 1 about here] Table 2 shows the percentage of losses by event type in our sample. The losses are aggregated across banks each year and normalized by total equity of all banks in our sample. The proportions in the table represent the percentage of the annual total attributable to each event type. For reasons discussed later, the losses are aggregated by the date at which the operational loss event occurred, which in many cases is months or even years before the losses are realized in an accounting sense. Of these loss event types, clients, products, and business practices (CPBP) accounts for by far the highest losses in dollar amount, followed by execution, delivery, and process management (EDPM). CPBP losses include the large legal settlements that have made headlines in recent years. EDPM losses include major breakdowns in processes such as mishandling of mortgage foreclosure practices. [Place Table 2 about here] CPBP and EDPM losses account for the majority of aggregate operational losses because they tend to be large, heavy-tailed losses. Having heavy-tailed loss distributions is a key feature of operational loss events which means operational risk exposure tends to be driven by a relatively few large loss events Regulatory Setting Prior to the implementation of Basel II capital regulations, U.S. banks operated under Basel I and were not required to hold capital explicitly for operational risk exposure. RWAs were computed using a fixed schedule by which banks were required to hold capital based on a predefined level of the 11

13 riskiness of their assets. For example, cash and U.S. Treasuries carried no capital charge whereas speculative grade corporate lending carried a 100% capital charge meaning that banks held no capital for Treasuries but were required to hold 8% of the dollar amount of their speculative grade corporate exposure in capital. Importantly, there was no explicit capital charge for operational risk embedded in the RWA formulas. Initially published in 2004, Basel II superseded Basel I and brought with it several important changes pertinent to this study. First, a primary objective was to move away from the Basel I fixed RWA schedule and allow banks to compute RWAs using internal risk-based capital models. Second, Basel II introduced an explicit capital charge for operational risk. In particular, the U.S. final rule (Federal Register (2007)) states that banks must hold capital equivalent to the 99.9th percentile of the estimated aggregate operational loss distribution over a one year horizon (i.e., the 99.9% one-year value-at-risk). The internal risk-based methodology for computing operational risk under Basel II is called the advanced measurement approach (AMA). Practically speaking, banks use a combination of internal loss data, external loss data (i.e., other banks losses), scenario analysis, and business environment and internal control factors to compute the aggregate operational loss distribution. The result is converted to an equivalent RWA for operational risk defined as 12.5 times the 99.9th percentile of this distribution. The 12.5 factor reflects the requirement for banks to hold operational risk capital equivalent to 8% of the effective operational RWA. The AMA methodology is used by the banks to compute the operational risk RWAs shown in Figure 1. In practice, the AMA models are heavily dependent on banks internal loss data history which prompted the collection of detailed operational loss data which forms our main database. This collection started for most large banks around The details of the data collection are described in the next section. Although Basel II was initially published in 2004, it was not implemented until 2008 in most countries. In the U.S., the first banks entered a trial period for Basel II in 2010 and others followed. However, during this so-called parallel run period, banks continued to operate under Basel I regulations until they received explicit approval from their primary supervisor (the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and/or the Federal Reserve Board). This transitional period was termed parallel run because banks continued to report and operate under Basel I regulations but privately reported Basel II capital 12

14 numbers to supervisors so they could assess and vet their risk-based capital models. The first U.S. banks exited parallel run and began to publicly report Basel II capital regulations in 2014Q2. 6 Even during the early stages of the parallel run period, it was widely regarded within the industry that the operational risk capital charge would not be nearly as large of a component of banks overall RWA as the numbers in Figure 1 show. In large part, this was because Basel published standardized and basic indicator approaches for computing operational risk capital that were essentially factor models calibrated on historical and much less severe loss data as compared to the losses suffered around the crisis. As such, even though banks knew that they would eventually be required to hold capital for operational risk, it was not until several years into the parallel run period when banks and supervisors realized the significance of the capital charges, which now account for roughly 25% of large U.S. banks RWA. In other words, banks willingness to take on operational risk had not diminished to a point where the practice of taking on operational risk to avoid capital charges was eliminated until sometime during the parallel run period. While it is difficult to prove empirically what bank managers considered to be the impact of Basel II on operational risk capital and when their outlook changed, we can offer the following example. JP Morgan Chase voluntarily disclosed operational risk economic capital numbers in their annual reports leading up to the parallel run period when banks were required to disclose the numbers. 7 In their filings, they state that they consider the economic capital for operational risk to be equivalent to the Basel II required capital numbers computed using the risk-based AMA approach. From 2007 to 2011, they reported operational risk capital numbers of between $5.6 and $8.5 billion. In 2012, this number increased to $15.9 billion and in 2014 when the bank exited parallel run the number was increased to $32 billion (which corresponds to the equivalent RWA of $400 billion shown in Figure 1). As such, even though Basel II was published during our sample period, banks did not consider it a meaningful capital charge until it was officially regulated post parallel run. We therefore end our sample in 2012Q4, which is about the midpoint of the parallel run period, to cover the time period when banks were not holding capital for operational risk (i.e., the time period over which banks had the incentive to shift their exposures to operational risk to commit The economic capital numbers were included in the bank s annual reports which can be downloaded at 13

15 regulatory arbitrage). We run robustness tests varying the end date between and find similar results. In the end, we feel that ending the sample in 2012 balances the need to extend our sample as long as possible without extending the sample to a period over which operational risk was explicitly being regulated. We also considered using the entrance and/or exit of parallel run as a natural experiment to help identify the causal relation between capital adequacy and operational risk because banks officially started reporting Basel II numbers at different points in time. However, there are drawbacks that prevent this from being a viable identification strategy. For one, the first banks officially started reporting Basel II numbers in 2014Q2 and available data ends in Compounding this issue is the gray area while banks were in parallel run and aware of the looming changes in regulations but unsure of the ultimate consequences so identifying the exact date of the regulatory change is difficult. Additionally, there is often a significant time lag between the occurrence and discovery of especially large operational events. As such, it is likely that there is operational exposure toward the end of our dataset that has yet to be realized. Therefore, ending the sample in 2012 has the additional benefit of letting the outstanding losses as of 2012 realize from an accounting standpoint and reducing the likelihood of having a biased dataset due to censoring of the recent losses Incentives for Risk Shifting and Regulatory Arbitrage There are several reasons for banks to engage in regulatory arbitrage and evidence that they did so in other areas. The fact that operational risk was unregulated made it an especially attractive vehicle for such behavior. In other areas, Acharya et al. (2013) show that banks shifted credit risk off their balance sheets by issuing asset backed commercial paper (ABCP) and retaining the credit risk while skirting capital regulations. Others argue that banks use complex financial instruments such as credit default swaps, structured finance products, and other complex derivatives to shift risk off their balance sheets and reduce capital requirements (see, e.g., Demyanyk and Loutskina (2016), Agarwal et al. (2014), Keys et al. (2009)). A major contribution of our paper is to show that banks do not necessarily have to use complex financial instruments to commit regulatory arbitrage. While the amount of operational risk 8 Note that a loss that was discovered and accounted for in 2015 that has a loss occurrence date before 2012Q4 would still be in our sample. 14

16 exposure banks took on was undoubtedly linked to the financial instruments that played a large part in the economic risk amassed by banks in the lead up to the crisis, they are only a subset of operational risk. That is, banks could shift risk off their balance sheets simply by taking on operational risk which does not necessarily involve financial derivatives. For example, banks can relax controls, implement un-tested models, reduce headcount, or engage in outright fraud in areas that are unrelated to complex financial instruments. To understand how banks may use operational risk to shift risk in an attempt to reach for yield, we provide the following examples: 1. Cost cutting on employee monitoring: Banks, like any other institution, have control systems in place designed to prevent operational losses for everything from human errors to internal fraud. These control systems are costly and the payoff is often difficult to measure because they are preventative measures. As such, reducing budgets for internal control systems or the monitoring of employees positively affects profitability by reducing costs. However, it comes at the expense of increased operational risk in the form of a higher likelihood of internal fraud, execution risk, or even systems failures. For example, banks who fail to adequately monitor employees may be exposed to a higher risk of incidences of rogue trading, misuse of company resources, or even organized fraud such as the LIBOR and foreign exchange rate rigging scandals. 2. Model risk: Large banks today rely on hundreds if not thousands of internal models for everyday tasks such as risk management, asset allocation, and capital modeling. As such, they are exposed to substantial amounts of model risk the risk that models will not perform as intended. Basak and Buffa (2016) formalize this argument and develop a theoretical model whereby banks intentionally take on operational risk in the form of model risk in an attempt to save the costly implementation of sound internal models. Again, the benefits of these cost savings are booked immediately, but the realization of losses is generally put off until the models fail to perform as desired. Others such as Rajan, Seru, and Vig (2015) argue that improperly aligned incentives can also contribute to model risk and provide evidence from the securitized subprime mortgage market. 15

17 3. Off balance sheet exposure: Another area whereby banks take on large amounts of operational risk is by shifting risk off their balance sheets to avoid holding capital. An area that has been especially prone to this behavior was the sale of MBS with representation and warranty (R&W) claims. Essentially, banks securitized and sold mortgages in the form of MBS with guarantees that held them liable for losses if the MBS defaulted and it could be proven that the underwriting bank defrauded or misled investors as to the quality of the underlying assets in the security. As such, banks retained downside risk on the assets they sold to reduce regulatory capital charges. This was a common practice in the banking industry from the early 2000s up to the crisis as banks continuously built up this operational risk by increasing their R&W exposure. Since the crisis, banks have settled the majority of the outstanding R&W claims with various parties including regulators, governing bodies, and investors for tens of billions of dollars. The above examples are neither mutually exclusive nor all encompassing. However, they do share a few characteristics common to operational losses in general. First, they tend to delay the realization of costs related to the initial decision to take on operational risk. For example, selling securities with R&W immediately transfers credit risk off a bank s books even though they still have a significant amount of downside exposure. This delay helped to make operational risk an effective mechanism for regulatory arbitrage for banks because they could transfer regulated credit risk to unregulated operational risk. Second, operational loss events tend to be heavy tailed. As noted by Acharya et al. (2010), one viable way for banks to evade capital regulations is to take on excessive tail risk. The reasons are that tail events are notoriously difficult to predict and the probability of tail events occurring is often underestimated which makes it ripe for regulatory arbitrage. 4. Data We use a unique dataset of operational loss events collected by the Federal Reserve Board (FRB) and shared with the Office of the Comptroller of the Currency (OCC) that is part of the FRB Y 14Q series. The data is reported by BHCs subject to annual regulatory stress tests mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act of We are bound by a 16

18 strict confidentiality agreement that prohibits us from disclosing statistical properties of the data that would allow readers to identify specific loss amounts or distributions from any institution. As such, we report summary statistics at the aggregate level. Any information regarding specific operational loss event examples will be limited to publicly available information. Other papers such as Chernobai et al. (2016), Chernobai et al. (2011), and others use publicly available operational loss data such as the Financial Institutions Risk Scenario Trends (IBM Algo FIRST). One drawback of this data is that it only covers publicly available losses so it is censored because it does not include events that banks do not publicly disclose. It also only has the date at which the loss was made public. In some cases inferences can be drawn about when the operational risk exposure was taken on but in general it does not contain the date at which the operational failure that led to the loss actually occurred. Again, an important feature of our data is that by knowing the loss occurrence date, we can trace the decisions to take on operational risk back to a specific point in time. This gives us a better real time proxy for operational risk exposure that is aligned with managerial decisions. In the remainder of this section, we describe the details of our data including the sample period, bank coverage, and how we measure operational risk exposure Sample Selection Our sample is restricted to the 19 BHCs that have a national bank supervised by the OCC. 9 We drop five subsidiaries of foreign owned BHCs and retain the 14 U.S. BHCs. We drop the foreign-owned BHCs because it is possible that they can be subsidized by a foreign parent or have alternative ways of managing their regulatory capital ratios unavailable to U.S. owned BHCs. The time period of our sample is from 2001:Q1 through 2012:Q4. The data is reported through 2015 but we restrict the sample to 2012 to cover the period where operational risk was largely unregulated (see the above discussion in Section 3). We aggregate losses quarterly for each bank. In all we have 449 bank quarter observations. The panel is unbalanced for two reasons. One, we only have data for banks currently subject to the Dodd Frank Act stress tests and some of the BHCs were not in existence in their current form over the entire sample period. Two, some BHCs loss data collection did not start in 2001:Q1. 9 Although the OCC supervises the national banks, the data is reported at the BHC level so that is what we use throughout the paper. 17

19 We match the FRB Y-14Q operational loss data with BHC balance sheet data and regulatory capital data from the FRB Y-9C series, which is the detailed regulatory reporting form for BHCs. We also use Compustat data and some macroeconomic data (GDP growth from the FRB). Figure 2 shows the aggregated total assets of our sample relative to the aggregated total assets of all U.S. commercial banks as per the FRB H8 data series. Despite having only 14 BHCs, our sample covers an average of 64% of the total commercial banking assets in the U.S. over our sample period. The coverage steadily increases from about 45% in 2001 to over 80% after [Place Figure 2 about here] The increase in percentage coverage can be largely explained by the fact that there was a substantial amount of consolidation of the largest U.S. banks culminating in several large mergers around the crisis. The banks responsible for making the largest acquisitions are supervised by the OCC and thus in the sample. It is also apparent from the figure that the majority of the growth in U.S. commercial banking assets was driven by the banks in our sample as the absolute difference between the series is relatively constant Detailed Data Description In December 2007, the FRB, OCC, and FDIC jointly published a document widely known as the Final Rule that details implementation standards for Basel II in the U.S. (Federal Register (2007)). 10 Among other things, the document describes how banks should collect and maintain operational loss data. Of particular note is that the final rule defines an operational loss event as an event that results in a loss and is associated with any of the seven operational loss event type categories (pg ), where the seven event types are defined in Table 1. It goes on to state that operational losses included all expenses associated with an operational loss event except for opportunity costs, forgone revenue, and costs related to risk management and control enhancements implemented to prevent future operational losses (pg ). This means that operational losses are collected at the event level such that all losses that can be tied to a single control failure are grouped together as a single event. For example, if a hacker stole credit card information and ran 10 Although the Final Rule was published in 2007, BHCs were aware of Basel s effort to enhance and standardize operational loss data well before 2007 so standardized data collection efforts began as early as 2000 for large U.S. BHCs. 18

20 up fraudulent charges on 1,000 accounts, the loss would be treated as a single operational loss event not 1,000 individual losses because it stemmed from a single root cause. Banks are allowed to choose a data collection threshold below which they are not required to collect detailed operational loss data. In our sample the data collection threshold has a maximum of $20,000 so we drop all losses for all banks below $20,000. The fraction of the aggregate loss amount below $20,000 varies by bank and event type, but is a very small percentage of the aggregated quarterly average loss of about $337 million. 11 Of particular relevance for our study are the three loss dates reported for each event. The occurrence date is the earliest date to which a bank can trace either the operational failure or decision to take on the operational risk that led to the ultimate loss. For example, in the case of R&W settlements, the occurrence date would be when a bank first started selling the securities for which they were later sued for breach of contract. The discovery date is the date when the bank first realized the operational failure, perhaps when a law suit was filed. The accounting date is the date when the loss hits the income statement which in this example would be the legal settlement date. For 42.8% of loss events, the occurrence quarter is equal to the accounting quarter. However, for the major events that tend to drive operational risk exposure the occurrence date is often months or even years before the discovery and accounting dates. Accordingly, only 25.1% of the total dollar amount of operational losses has the same accounting and occurrence quarters Operational Risk Exposure Measure Measuring operational risk exposure is somewhat different than measuring credit or market risk where one can at a minimum bound the exposure based on the portfolio of loans or securities held by a bank and use historical loan or market data to develop a risk measure such as the expected loss amount or value at risk (VaR). As mentioned above, Basel II requires banks to measure operational risk exposure using a VaR model largely based on operational loss history. While this is a sensible measure of operational risk exposure, measuring the operational VaR is infeasible in our setting because of the nature of the data. In particular, BHCs following the AMA approach to computing Basel II capital for operational losses generally use their entire dataset to calibrate the VaR model, 11 Although the losses below the threshold are not reported, the authors have knowledge of the aggregated amounts of losses below collection thresholds at many of the banks in our sample and they would not have a material effect on our study as they make up a very small percentage of the total loss amounts and are relatively stable over time. 19

21 and even then the models can be relatively unstable. As such, developing a time series VaR measure is infeasible. We instead use the time series of operational loss amounts as of the loss occurrence date as a proxy for operational risk exposure because the realized loss amounts should be proportional to exposure. In doing so we assume that the operational loss occurrence date should serve as a reasonable proxy for the timing of the risk exposure because it represents the date that the process or human failure first occurred that resulted in an ultimate loss. This is a very important date for large events such as legal cases that may take years to settle because they provide insight as to when the operational risk exposure began and in particular when managers made the decision to take on operational risk. As such, to measure operational risk exposure we start by aggregating total bank-quarter loss amounts based on the loss occurrence date. For most losses, this serves as a reasonable measure of when the bank took on the operational risk. However, sometimes large loss events can unfold over time. The easiest example to consider would the case of banks that sold MBS with R&W claims and were eventually sued. The occurrence date for the loss would again be the date at which the bank first sold the securities and began to take on operational risk. However, as is well documented in court cases and the popular press, this event unfolded over several years leading up to the crisis and banks did not begin to settle until well after the crisis. As such, back-loading the entire loss amount to the occurrence date when banks first began selling the securities in question is likely to over-state the operational risk exposure at that time. In light of this, we define our measures of operational risk exposure by spreading long-term loss events over time in order to better proxy for banks time-varying operational risk exposure. In particular, we spread loss event amounts between the loss occurrence and loss discovery dates. This assumes that banks curtailed the operational behavior(s) that led to losses at the time when the failure was first discovered (e.g., when a law suit was filed or a model was first determined to be not working properly). Due to the amount of growth in bank assets over our sample, we allocate the loss events over time proportionally based on total assets. This assumes that banks took on operational risk as a fixed proportion of total assets which we feel is a reasonable assumption. Ultimately, we have two measures of operational risk exposure defined as follows: 20

22 1. OpsExp Eq: We refer to the first measure as the equally weighted operational risk exposure. For this measure, we break up the total loss event amount and allocate it over time such that the total loss amount in each quarter between the loss occurrence and loss discovery date is an equal proportion of total assets while the sum of the quarterly loss amounts is equal to the total loss event amount. As an example, consider a $10 million operational loss event with a loss occurrence date of 2005:Q1 and loss discovery date of 2007:Q2. The OpsExp Eq loss amount would be equal to $1 million per quarter every quarter from 2005:Q1 through 2007:Q2 assuming the bank s total assets remained constant. 2. OpsExp Cum: We refer to the second measure as the cumulative operational risk exposure. It captures the cumulative amount of operational risk outstanding over time and is defined as the cumulative sum of the above measure (OpsExp Eq). For the above $10 million loss example, OpsExp Cum amount would be $1, $2,... $10 million from 2005:Q1 through 2007:Q2, respectively. Ultimately, the idea is to proxy the amount of operational risk banks take on over time. For example, the decision to sell MBS with R&W claims was not a single point in time decision, banks continuously increased their exposure over time by selling more securities. Each of our two measures capture this dynamic but have pros and cons. OpsExp Eq preserves the total loss amount in the data and is a good measure of the marginal increases in operational risk exposure over time. However, it does not capture the total amount of outstanding exposure as it cumulates over time so the total exposure outstanding near the discovery date understates the realized loss amount. OpsExp Cum is robust to this issue but the total amount of operational exposure for a given bank is greater for this measure than the total loss amount in the raw data because exposure is cumulated over time. In the end, the two measures are highly correlated (0.91 in sample) and offer slightly different perspectives on operational risk management - however our findings are robust across both. Another point of concern with our data is that there was a considerable amount of mergers and acquisitions by the banks in our sample. Fortunately, banks are required to retain and report detailed operational loss data from any major acquisition as part of their FR Y 14Q submission 21

23 and there is a data field to indicate losses from acquisitions and the source of the data (i.e., the acquired institution). While this is helpful, not all the losses are relevant to our study. In particular, any loss that was accounted for prior to the acquisition should not affect the acquiring bank s operational risk profile as it should have been priced into the acquisition. However, losses that occurred prior to the acquisition but had yet to be discovered and accounted for at the time of the acquisition represent outstanding operational risk exposure that the acquiring bank took on as part of the acquisition. We believe that this is a relevant amount of exposure that should be considered when assessing the acquiring bank s operational risk profile. We therefore manually search for the acquisition date for every loss that was coded as being from an acquisition. We then drop losses whose accounting date is prior to the acquisition. For losses that have an occurrence date prior to the acquisition but an accounting date after the acquisition (meaning that the acquired bank has measurable outstanding operational risk exposure), we replace the original occurrence date by the date of the acquisition. Again, the idea is to account for the operational risk associated with making an acquisition. After the acquisition all losses are treated the same. Finally, we aggregate the losses by bank-quarter. We follow Acharya et al. (2013) and scale the losses by total equity because we want to measure exposure as a fraction of size. We take the natural log of the scaled losses because of the heavy-tailed nature of operational risk. In particular, the raw realized losses are highly skewed and tend to follow heavy-tailed distributions which is in line with how banks and regulators measure operational exposure under the current Basel II guidelines. However, as shown in Figure 3, the distribution of our main dependent variable (ln approximately normally distributed. OpsExp Cum Equity ) is [Place Figure 3 about here] 4.4. Descriptive Statistics Due to the confidential nature of our data, we only provide aggregate descriptive statistics. Because operational risk has received relatively little attention in the academic literature, our first goal is to describe the importance of operational risk to banks overall risk profiles. Under the 22

24 Basel II framework, operational risk accounts for about 25% BHC total RWAs, which on its own merit is a staggering number. Table 3 describes the losses and leverage ratios of our sample. As alluded to above, operational losses tend to be heavy tailed as the means are consistently higher than the medians and the maximum annual operational loss to total equity is 31.8%. In dollar terms, the 14 BHCs in our sample experienced an average quarterly loss of about $337 million, or over $1.3 billion per year. In total, this amounts to a cumulative loss of over $150 billion for our sample of 449 bank-quarters. The maximum quarterly loss in our sample is over $20 billion and we have 30 bank-quarters where the quarterly loss exceeds $1 billion, which is reflective of both the heavy tailed nature and the materiality of the operational losses. There is also substantial time series and cross sectional variation in the loss amounts as well as the leverage ratios. [Place Table 3 about here] 5. Empirical Design and Results Our empirical design largely follows Acharya et al. (2013) who test the relation between capital ratios and ABCP exposure. The main difference is that our dependent variable is operational risk exposure. In particular, we run various specifications of the following regression: OpsExposure it = α i + δ t + βcapitalratio it 1 + γx it 1 + ɛ it (1) where OpsExposure it is the operational loss exposure at bank i at the loss occurrence quarter t and OpsExp Eq OpsExp Cum is defined as either ln Equity or ln Equity ; α i are bank fixed effects; δ t are year fixed effects; CapitalRatio it 1 is the capital ratio for BHC i at time t 1; X it 1 are a set of control variables; and ɛ it is the residual. As discussed above, we use two measures of capital ratios. The first is the tier one regulatory capital ratio which is closely watched by regulators. It is defined as the ratio of tier one regulatory capital to RWA (T ier1ratio). The other is the economic capital, or leverage ratio, which we define as total book equity to assets (Leverage). 23

25 One potential concern with the above empirical setup is the possibility that the presence of equity in the denominator of the dependent variable and the numerator of our key independent variable (Leverage) could induce a mechanical negative relation and hence bias us in favor of finding support for our hypothesis. 12 We address this issue as follows. First, we use two alternative scaling variables in constructing our dependent variable to reduce the likelihood of inducing a negative mechanical relation between leverage and operational risk exposure: total assets (Assets) and the number of full time employees (F T E). If anything, Assets is likely to induce a positive correlation since it appears in the denominator in both sides of the equation and hence bias us against finding support for our hypothesis. F T E is another measure of size but it is not perfectly correlated with either equity or assets. As such it should reduce the likelihood of a mechanical correlation that is unrelated to our risk shifting and regulatory arbitrage hypothesis. Second, we implement several robustness tests including change regressions, a placebo test, and conditional regressions, which are all described below. Our results are robust to these specifications. We expect negative relations between both capital ratio measures and operational exposure measures. And we expect a stronger relation between leverage and operational loss exposure than regulatory capital and operational loss exposure because banks engage in regulatory arbitrage for the purpose of increasing regulatory capital ratios (see Jones (2000), Acharya et al. (2013)). As such, if successful, the relation between regulatory capital and operational loss exposure should be a downward biased estimate of the extent of regulatory arbitrage. We also control for several bank characteristics following Acharya et al. (2013). They are the natural logarithm of assets (Size), return on assets (ROA), the amount of loans to total assets (LoanShare), short-term debt to total assets (ST Debt), and deposits to total assets (DepositShare). We control for the GDP growth rate (GDP ) to account for the macroeconomic environment which is shown to influence operational risk (Abdymomunov et al. (2015)) Main Results Table 4 shows the main regression results for Equation (1). OpsExp Cum first four columns is ln Equity and in the last four columns is ln The dependent variable in the OpsExp Eq Equity. The even columns 12 We note that we take the natural logarithm of the ratio of operational risk exposure divided by equity. This decreases the likelihood of a spurious correlation as Leverage is a simple ratio. However, it is still a potential source of bias that we address. 24

26 include year fixed-effects. Throughout the paper, all regressions include bank fixed-effects to control for time invariant unobservable bank specific factors that could influence the level of leverage or operational risk exposure. Standard errors are robust and clustered at the bank level. [Place Table 4 about here] As hypothesized, the coefficients on the capital ratio variables are all negative. The Leverage coefficient is always negative and statistically significant at a minimum of 5% confidence level. These results are consistent with our hypothesis that banks used operational risk to shift their risk profiles toward non-regulated risks and thereby engage in regulatory arbitrage. Consistent with previous studies such as Acharya et al. (2013) we find much stronger results on Leverage than T ier1ratio because the relation between regulatory capital ratios and operational losses is likely to be a downward biased estimate of regulatory arbitrage. In terms of the economic significance of the results, we focus on the coefficients on Leverage. In particular, a decrease in Leverage of about 160 bps from the sample mean of 9.9% to the 25th percentile of 8.3% translates to a 58.1% or 64.1% increase in OpsExp Cum or a 32.8% or 30.0% increase in OpsExp Eq in columns (1), (2), (5), and (6) of Table 4, respectively. 13 Each of these results is economically meaningful. The coefficients on OpsExp Cum are larger because this measure captures the cumulative exposure of operational risk which is larger for events with longer durations as compared to OpsExp Eq. Figure 4 shows the impact of changes in leverage on operational risk exposure. The horizontal axis shows the change in the leverage ratio relative to the sample mean in basis points (bps). The vertical axis shows the percentage change in the quarterly operational risk exposure for each of our measures, OpsExp Cum and OpsExp Eq. The relation between operational risk exposure and leverage is consistent with our priors regarding operational risk because it is extremely heavy-tailed meaning that operational risk exposure grows exponentially. [Place Figure 4 about here] As alluded to above, one potential concern with the results in Table 4 is the possibility of a spurious correlation between Leverage and the dependent variable because equity is present in the 13 The economic significance of Leverage in column (1) is calculated as e β Leverage 1 where β is the coefficient on Leverage (-28.64) and Leverage is the change from the mean value of Leverage, 160 bps in this case. 25

27 denominator on the left hand side and in the numerator of Leverage. Although our dependent variable is in log form which should mitigate this concern to a certain extent, we scale our measures of operational risk exposure by two other variables and present the results in Table 5 for robustness. [Place Table 5 about here] In particular, we use both Assets and F T E to scale OpsExp Cum in Table 5. We only show the results for models with bank and year fixed-effects. Scaling by total assets should, if anything, bias OpsExp Cum us toward finding a positive relation between Leverage and ln Assets because Assets is present in the denominator on both sides of the equation. As such we expect to find weaker results here if the mechanical correlation is a significant issue. We find that the coefficient on Leverage (-22.94) and T ier1ratio (-16.97) do indeed decline in columns (1) and (2) of Table 5 as compared to the comparable coefficients (-30.94) in column (2) and (-20.26) in column (4) of Table 4, respectively. However, they do remain statistically and economically meaningful. Additionally, because F T E is a measure of size that is not perfectly correlated with equity or assets, the results are expected to lie somewhere between the results using Equity or Assets as a scaling variable. This is exactly what we find in columns (3) and (4) of Table 5. Therefore, although there is some evidence that there may be a mechanical relation between Leverage and ln OpsExp Cum Equity, it does not appear to be a first-order concern for our results. Nevertheless we next move on to several additional robustness tests Robustness While the above results are supportive of our regulatory arbitrage hypothesis, there are other possible explanations. We address concerns that other factors could be driving the results in several ways First-Difference Regressions One such concern is that there are omitted variables related to both leverage and operational risk exposure that are driving a spurious relation between the two variables. In Tables 4 and 5 we lagged the right hand side variables one quarter to help account for this issue. We also included bank and year fixed-effects to control for any unobservable time invariant bank-specific factors or 26

28 bank invariant time-specific factors that could be driving the results. In Table 6, we show the results of change regressions where all the variables are first-differenced to examine the relation between changes in leverage and changes in operational risk exposure. [Place Table 6 about here] OpsExp Cum The results in Table 6 are consistent with our hypothesis. The dependent variable is ln X OpsExp Eq in the first four columns and ln X as indicated in the bottom row of the table (Equity or F T E). 14 in the last four columns, where X is the scaling variable We find consistently significant and negative coefficients on Leverage in all models suggesting that decreases in Leverage correlate to increases in operational risk exposure. The coefficients on T ier1ratio are negative but statistically insignificant. This is consistent with other papers such as Acharya et al. (2013) who find weaker relations between measures of regulatory capital and regulatory arbitrage as compared to measures of leverage and regulatory arbitrage for reasons explained above. [Place Table 6 about here] We believe the change regressions in Table 6 are more robust as compared to the level regressions in Tables 4 and 5 because they are less likely to be affected by spurious relations between Leverage and operational risk exposure driven by unobserved omitted variables. As such, we only report the results of change regressions going forward when testing our main hypothesis. The results of the level regressions for the models below are available upon request Conditional Models Since banks are more likely to shift risk and commit regulatory arbitrage when they are regulatory capital constrained, we also run models conditional on banks regulatory capital ratios. We first generate dummy variables corresponding to the quartiles of T ier1ratio. The variables RC 1, RC 2, RC 3, and RC 4 are dummy variable set equal to one if an observation is within the first, second, third, or fourth quartile of the sample T ier1ratio, respectively; and zero otherwise. Our regression equation is therefore: 14 The results scaling by Assets are very similar to the models where the dependent variable is scaled by F T E and are available upon request. We do not show them for brevity. 27

29 OpsExposure it = α i + δ t + β j Leverage it RC j + µ j RC j + γ X it + ɛ it (2) where RC j is the dummy variable for quartile of the T ier1ratio variable and j = 1:4; X represents a first difference of variable X; and all other variables are defined as in Equation (1). 15 [Place Table 7 about here] OpsExp Cum The results are shown in Table 7. The dependent variable is ln X in the first two OpsExp Eq columns and ln X in the last two columns, where X is the scaling variable Equity or F T E as indicated on the bottom row of the table. Our hypothesis is that the coefficient on the leverage interaction terms should be increasingly negative as banks become more capital constrained, i.e., as they approach the lowest quartile of T ier1ratio. The results largely support our hypothesis as the coefficients on Leverage it RC 1 and Leverage it RC 2 are negative and the only statistically significant interaction terms meaning that banks in the lower half of the sample in terms of T ier1ratio are more aggressive in using operational risk to engage in regulatory arbitrage. However, the rank ordering of the first two quantiles is not as expected. In particular the coefficients on Leverage it RC 1 are smaller in absolute magnitude than those of Leverage it RC 2. This is a somewhat puzzling finding because we expected a monotonic relation between leverage and operational risk exposure as banks become more constrained with regards to their regulatory capital ratios. However, one plausible explanation is that the banks in the lowest quantile of T ier1ratio are so capital constrained that they cannot increase their operational risk exposure as much as those banks in the second quantile. Alternatively, it could be explained by the nature of the relation between regulatory arbitrage and T ier1ratio alluded to above. That is, banks that are particularly effective at engaging in regulatory arbitrage may actually have higher T ier1ratios. As such, it is possible that the banks in the second quantile of T ier1ratio are simply more effectively engaging in regulatory arbitrage so they show a stronger relation between Leverage and operational risk exposure. 15 Note that there is no constant term so we can estimate the equation including all four dummy variables simultaneously. 28

30 Placebo Test Our next robustness test is a placebo test. Much of the discussion surrounding our data throughout the paper has focused on the occurrence and accounting dates of the losses. In this section we show the importance of distinguishing between these dates. We use the loss accounting dates as a placebo test. Our hypothesis is that there should not be a strong relation between being capital constrained and the accounting dates for losses whose accounting date comes after the occurrence date. That is, to the extent that the timing of the realization of the losses from an accounting standpoint is a random variable we should not expect to see a strong relation between Leverage and operational loss accounting dates because accounting dates should not be reflective of the timing of managerial decisions. For example, the timing of settlements of major lawsuits stemming from the crisis depended on several factors unrelated to the timing of managerial decisions to take on operational risk such as the post crisis legal climate in the U.S., backlogs at Federal regulators such as the Department of Justice, and the magnitude of the housing market crash that caused toxic MBS to default. In other words, when bank managers decided to take on operational risk, they did not know if or when the losses would hit their books. As such, we don t expect to see a strong relation between Leverage and operational losses based on accounting dates. To test our hypothesis, we first drop all losses where the loss occurrence and accounting dates are the same because for these losses, the timing of managerial decisions to take on operational risk is perfectly correlated with the accounting date of the losses. We then aggregate the remaining losses by bank-accounting quarters to get a variable OpsExp Accounting and estimate Equation 1 in first-difference form. We show the results in Table 8 of the first-difference regressions although the level regressions show similar results. The dependent variable is ln OpsExp Accounting X, where X is the scaling variable Equity or F T E as indicated on he bottom row of the table. Notably, OpsExp Accounting we do not find any meaningful relation between Leverage and ln X which is supportive of our main hypothesis and lends further support to our argument that banks actively took on operational risk as a means for engaging in regulatory arbitrage. [Place Table 8 about here] 29

31 The Duration of Operational Risk Exposure In Section 3 we argue one reason that operational risk is a viable mechanism for banks to engage in regulatory arbitrage (in addition to loopholes the Basel I capital regulations) was that operational failures tend to unfold over time and as such there is often a significant time lag between the loss occurrence date and the accounting date when the loss hits the financial statements. As such, managers can essentially book short term gains in the form of increased trading revenue, reduced operating costs, or inflated accounting profits by taking on operational risk at the expense of amassing future loss exposure. We examine the validity of this claim by again leveraging the different operational loss dates in our dataset. In particular, having the loss occurrence and loss accounting dates for every loss in our sample allows us to compute a measure of duration of operational loss exposure. Our measure of duration is meant to capture the weighted average amount of time between loss occurrences (i.e., when managers decided to take on operational risk) to loss accounting dates (i.e., when the loss hits the bank s financial statements). We define duration for every bank-quarter observation as follows: Duration it = n j=1 t j OpsLoss j (1+r) t j n OpsLoss j j=1 (1+r) t j (3) where, i is the index for each bank at occurrence quarter t; OpsLoss j is the dollar amount of individual operational loss j; t j is the time difference in years between the accounting date and occurrence date of OpsLoss j ; n is the number of operational losses in a given bank-quarter; and r is the discount rate which is assumed to be 5% per annum. Duration is measured in years. We construct two measures Duration Cum and Duration Eq based on our operational risk exposure measures OpsExp Cum and OpsExp Eq, respectively. Intuitively Duration captures the weighted average of the time between when operational risk is taken on (the loss occurrence date) and when the losses are realized (the loss accounting date). High values of duration mean that operational losses take longer to realize. For example, if a bank only had one operational event with an occurrence date of 2005:Q1 and an accounting date of 2007:Q1, it would have a duration of two years. Conversely, if all of a bank s losses in a given 30

32 quarter had the same loss occurrence and accounting dates it would have a duration of zero for that quarter. Our hypothesis is that the level of duration should be negatively related to Leverage because taking on operational risk exposure with longer durations allows managers to effectively book short term gains at the expense of building up large amounts of long term loss exposure. We test this hypothesis by estimating a variation of Equation 1 where we replace the dependent variable with our two measures of duration, Duration Cum and Duration Eq. We show the results in Table 9. [Place Table 9 about here] As expected, the coefficient on Leverage is statistically significant and negative in columns (1) and (3). This means that banks are more likely to increase the duration of their operational risk exposure as leverage declines. Again, we find negative but weaker relations with T ier1ratio for the reasons discussed above. This helps to support our claim that banks actively used operational risk as a mechanism to engage in regulatory arbitrage. It will be interesting to see going forward if this relation continues to hold after banks are fully operating under Basel II and/or III capital regulations where there is an explicit capital charge for operational risk exposure. However, we must leave this for future research as newer data becomes available. 6. Summary We show that weaknesses in regulations leading up to the crisis provided incentives for banks to increase their overall risk and shift their risk taking to less regulated risk areas, and in particular increase their exposure to operational risk. Such regulatory arbitrage not only contributed to banks under-capitalization during that time period, but also gave rise to the magnitude and importance of less regulated risks such as operational risk as components of the overall systematic risk in the financial industry. More broadly, we show one channel by which unintended consequences of financial regulations can contribute to the emergence of new risks that can stretch well beyond the financial sector. We focus on operational risk because it was unregulated prior to the crisis in that banks were not required to hold additional capital to cushion against operational losses. This weakness in 31

33 regulation provided banks with an incentive to shift their risk profiles and take on unprecedented levels of operational risk and thus increase their overall risk exposure at the expense of the safety of the financial sector. The increase in operational risk in the banking industry also had real consequences because the effects of banks operations can reach beyond the financial sector and directly affect the real economy. Our paper makes three contributions. One, we are the first to document that operational risk was a viable mechanism for banks to engage in regulatory arbitrage. This is notable in large part because operational risk does not require banks to be involved with complex financial instruments such as ABCP, MBS, or TruPS as others have shown. As such, by focusing on the regulations of complex financial products and innovation, regulators may be missing more fundamental risks that are key to the stability of the financial system. Two, we show novel evidence of how the design of financial regulations can have far reaching, yet unintended consequences, as banks operations affect the real economy. Three, we document one significant factor that contributed to the dramatic increase in operational risk over our sample period. Our findings suggest that studying banks operations is a worthwhile endeavor from both a practical and academic perspective. Going forward, we advocate for additional research that furthers our knowledge of additional factors that drive operational risk in banks. While regulatory arbitrage contributed to the rise of operational risk, it cannot be the only driving factor. Additionally, more research is needed to develop effective means of measuring and forecasting operational risk exposure so it can be properly regulated. 32

34 References Abdymomunov, A., Curti, F., Mihov, A., U.s. banking sector operational losses and the macroeconomic environment. Available at SSRN Acharya, V., Schnabl, P., Suarez, G., Securitization without risk transfer. Journal of Financial Economics 107, Acharya, V. V., Cooley, T., Richardson, M., Manufacturing tail risk: A perspective on the financial crisis of Now Publishers Inc. Admati, A., Hellwig, M., The bankers new clothes: What s wrong with banking and what to do about it. Princeton University Press. Admati, A. R., DeMarzo, P. M., Hellwig, M. F., Pfleiderer, P. C., Fallacies, irrelevant facts, and myths in the discussion of capital regulation: Why bank equity is not expensive. MPI Collective Goods Preprint. Agarwal, S., Lucca, D., Seru, A., Trebbi, F., Inconsistent regulators: Evidence from banking. The Quarterly Journal of Economics 129, Aggarwal, R., Jacques, K. T., The impact of fdicia and prompt corrective action on bank capital and risk: Estimates using a simultaneous equations model. Journal of Banking & Finance 25, Baer, H. L., Pavel, C. A., et al., Does regulation drive innovation? Federal Reserve Bank of Chicago Economic Perspectives 12, Basak, S., Buffa, A. M., A theory of operational risk. Available at SSRN Basel Committee on Banking Supervision, International convergence of capital measurement and capital standards: a revised framework. Bank for International Settlements. Bhattacharya, S., Thakor, A. V., Contemporary banking theory. Journal of financial Intermediation 3,

35 Blum, J., Do capital adequacy requirements reduce risks in banking? Journal of Banking & Finance 23, Boyson, N. M., Fahlenbrach, R., Stulz, R. M., Why don t all banks practice regulatory arbitrage? evidence from usage of trust-preferred securities. The Review of Financial Studies 29, Chernobai, A., Jorion, P., Yu, F., The determinants of operational risk in us financial institutions. Journal of Financial and Quantitative Analysis 46, Chernobai, A., Ozdagli, A. K., Wang, J., Business complexity and risk management: Evidence from operational risk events in us bank holding companies. Available at SSRN. Cumming, C., et al., The economics of securitization. Quarterly Review pp Demirguc-Kunt, A., Detragiache, E., Merrouche, O., Bank capital: Lessons from the financial crisis. Journal of Money, Credit and Banking 45, Demyanyk, Y., Loutskina, E., Mortgage companies and regulatory arbitrage. Journal of Financial Economics 122, Diamond, D. W., Rajan, R. G., A theory of bank capital. The Journal of Finance 55, Duchin, R., Sosyura, D., Safer ratios, riskier portfolios: Banks response to government aid. Journal of Financial Economics 113, Federal Register, Risk-Based Capital Standards: Advanced Capital Adequacy Framework - Basel II; Final Rule, vol. 77. Federal Register. Furlong, F. T., Keeley, M. C., Capital regulation and bank risk-taking: A note. Journal of banking & finance 13, Gennotte, G., Pyle, D., Capital controls and bank risk. Journal of Banking & Finance 15, Gropp, R., Hakenes, H., Schnabel, I., Competition, risk-shifting, and public bail-out policies. Review of Financial Studies 24,

36 Jacques, K., Nigro, P., Risk-based capital, portfolio risk, and bank capital: A simultaneous equations approach. Journal of Economics and business 49, Jagtiani, J., Saunders, A., Udell, G., The effect of bank capital requirements on bank offbalance sheet financial innovations. Journal of Banking & Finance 19, James, C., The use of loan sales and standby letters of credit by commercial banks. Journal of Monetary Economics 22, Jensen, M. C., Meckling, W. H., Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of financial economics 3, Jones, D., Emerging problems with the basel capital accord: Regulatory capital arbitage and related issues. Journal of Banking and Finance 24, Kahane, Y., Capital adequacy and the regulation of financial intermediaries. Journal of Banking & Finance 1, Karolyi, G. A., Taboada, A. G., Regulatory arbitrage and cross-border bank acquisitions. The Journal of Finance 70, Keys, B. J., Mukherjee, T., Seru, A., Vig, V., Financial regulation and securitization: Evidence from subprime loans. Journal of Monetary Economics 56, Kim, D., Santomero, A. M., Risk in banking and capital regulation. The Journal of Finance 43, Koehn, M., Santomero, A. M., Regulation of bank capital and portfolio risk. The journal of finance 35, Merton, R. C., Financial innovation and the management and regulation of financial institutions. Journal of Banking & Finance 19, Myers, S. C., Rajan, R. G., The paradox of liquidity. The Quarterly Journal of Economics 113, Pennacchi, G. G., Loan sales and the cost of bank capital. The Journal of Finance 43,

37 Rajan, U., Seru, A., Vig, V., The failure of models that predict failure: Distance, incentives, and defaults. Journal of Financial Economics 115, Rampini, A. A., Viswanathan, S., Vuillemey, G., Risk management in financial institutions. Available at SSRN the Boston Consulting Group, Staying the course in banking. Global Risk. United States Senate, JP Morgan Chase Whale Trades: a Case History of Derivatives Risks and Abuses. Permanent Subcommittee on Ivestigations: Committee on Homeland Security and Geovernmental Affairs. March 15, Yorulmazer, T., Has financial innovation made the world riskier? cds, regulatory arbitrage and systemic risk. CDS, Regulatory Arbitrage and Systemic Risk (April 23, 2013). 36

38 Table 1: This table shows the seven Basel operational loss event types. The event type is given followed by a brief description. Event Type Description Losses due to acts of a type intended to defraud, misappropriate Internal Fraud (IF) property or circumvent regulations, the law or company policy, excluding diversity/discrimination events, which involves at least one internal party. External fraud (EF) Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party/ Employment practices and workplace safety (EPWS) Losses stemming from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events. Clients, products, Losses stemming from an unintentional or negligent failure to meet and business practices (CPBP) a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Damage to physical assets (DPA) Losses arising from loss or damage to physical assets from natural disaster or other events. Business disruption and system failures Losses arising from disruption or business or system failures (BDSF) Execution, delivery, and process management (EDPM) Losses from failed transaction processing or process management, from relations with trade counterparties and vendors. 37

39 Table 2: This table shows the breakdown of operational loss events by Basel event type and year. The figures represent the percentage of all losses in a given year for each of the seven event types. IF is internal fraud; EF is external fraud; EPWS is employment practices and workplace safety; CPBP is clients, products, and business practices; DPA is damage to physical assets; and EDPM is execution, delivery, and process management. Year IF EF EPWS CPBP DPA BDSF EDPM % 2.7% 0.9% 81.1% 13.4% 0.1% 0.8% % 2.4% 0.9% 90.1% 0.1% 0.2% 5.6% % 1.1% 1.5% 91.0% 0.1% 0.1% 5.6% % 0.8% 2.0% 90.8% 0.2% 0.1% 5.5% % 0.8% 1.4% 92.1% 0.2% 0.1% 5.1% % 0.9% 1.0% 93.1% 0.0% 0.1% 4.6% % 0.4% 0.7% 96.4% 0.0% 0.0% 2.3% % 1.4% 2.2% 84.7% 0.1% 0.3% 10.1% % 2.9% 2.8% 78.7% 0.0% 0.4% 14.2% % 1.2% 1.9% 81.6% 0.0% 0.7% 13.9% % 1.3% 1.6% 84.4% 0.1% 0.4% 11.6% % 1.1% 1.7% 76.6% 0.4% 0.6% 18.7% Total 0.7% 1.4% 1.6% 86.7% 1.2% 0.3% 8.2% 38

40 Table 3: This table describes the distributions of annual operational losses as a fraction of equity and leverage defined as equity over total assets. The operational loss distribution is the adjusted distribution that spreads loss amounts over time between the occurrence and discovery dates ( OpsExp Cum Equity ). Operational Losses / Equity Equity / Total Assets Year Mean 25th 50th 75th Max Mean Min 25th 50th 75th Max % 0.1% 1.0% 3.6% 4.6% 8.5% 7.8% 7.8% 8.1% 9.4% 9.6% % 0.3% 1.6% 4.9% 5.9% 7.9% 5.6% 7.3% 7.8% 9.0% 10.3% % 0.1% 0.3% 1.4% 11.8% 8.0% 5.6% 6.6% 7.9% 9.7% 10.3% % 0.1% 0.3% 2.7% 13.6% 8.7% 5.6% 7.7% 9.1% 9.8% 10.9% % 0.1% 0.3% 4.1% 12.4% 8.8% 7.3% 8.1% 8.9% 9.6% 10.7% % 0.1% 0.2% 1.6% 14.2% 9.9% 6.4% 8.4% 9.4% 10.2% 17.8% % 0.1% 0.4% 2.9% 31.8% 9.9% 5.2% 8.3% 9.1% 10.8% 17.5% % 0.2% 0.3% 1.2% 13.0% 9.9% 5.8% 7.9% 9.7% 10.6% 16.5% % 0.2% 0.5% 1.0% 3.4% 10.4% 6.0% 9.0% 10.4% 11.3% 15.7% % 0.2% 0.5% 1.1% 3.8% 10.4% 5.9% 9.5% 10.3% 12.0% 13.4% % 0.2% 0.5% 1.0% 4.6% 10.8% 7.0% 9.8% 10.7% 12.0% 14.7% % 0.2% 0.4% 0.8% 3.8% 10.8% 8.0% 10.1% 11.0% 11.8% 13.1% Total 1.5% 0.2% 0.4% 1.2% 31.8% 9.9% 5.2% 8.3% 9.8% 11.0% 17.8% 39

41 Table 4: This table gives the results for regressing Equation (1). The dependent variable for the first four columns is the natural logarithm of the ratio of total quarterly operational losses divided by total equity where operational losses are cumulated over time based on asset size between the loss occurrence and loss discovery dates (OpsExp Cum). The dependent variable for columns (5) through (8) is the natural logarithm of the ratio of total quarterly operational losses divided by total equity where operational loss events are defined as OpsExp Eq. T ier1ratio is the tier 1 regulatory capital ratio. Leverage is book equity divided by assets. The other independent variables are defined in Section 4. All independent variables are lagged one quarter. All models include bank fixed effects. The sample covers 2001 through Standard errors are robust and clustered at the bank level. OpsExp Cum Equity OpsExp Eq Equity Dependent Variable: ln Dependent Variable: ln Variables (1) (2) (3) (4) (5) (6) (7) (8) Leverage t *** *** ** ** (-3.264) (-3.168) (-2.616) (-2.407) T ier1ratio t ** ** * (-1.566) (-2.420) (-2.557) (-2.025) Size t ** * (2.487) (0.448) (1.777) (0.366) (1.308) (1.018) (1.118) (0.816) ROA t (0.203) (0.369) (-0.218) (0.261) (0.212) (0.284) (-0.295) (0.270) LoanShare t (1.109) (1.274) (0.940) (1.019) (1.415) (1.012) (0.823) (0.760) ST Debt t (-0.384) (-0.324) (-0.286) (-0.043) (0.191) (-0.075) (-0.085) (0.054) DepositShare t (0.013) (0.513) (0.531) (0.739) (-0.563) (-0.034) (-0.431) (0.110) GDP t (0.625) (1.509) (0.420) (1.177) (-0.064) (0.366) (-0.235) (0.306) Constant -2.81** -4.64* -4.32*** -4.92* -5.77*** -5.80*** -5.81*** -5.53*** (-2.491) (-1.790) (-3.274) (-1.778) (-5.710) (-3.179) (-4.622) (-3.299) Observations R-squared Year FE No Yes No Yes No Yes No Yes *** p<0.01, ** p<0.05, * p<0.1 40

42 Table 5: This table gives the results for regressing Equation (1). The dependent variable for the first four columns is the natural logarithm of the ratio of total quarterly operational losses divided by total assets (Assets) in Columns (1) and (2) and full time employees (F T E) in Columns (3) and (4). Operational losses are cumulated over time based on asset size between the loss occurrence and loss discovery dates (OpsExp Cum). T ier1ratio is the tier 1 regulatory capital ratio. Leverage is book equity divided by assets. The other independent variables are defined in Section 4. All independent variables are lagged one quarter. The sample covers 2001 through All models include bank and year fixed-effects. Standard errors are robust and clustered at the bank level. OpsExp Cum Assets Dependent variable: ln Dependent variable: ln Variables (1) (2) (3) (4) Leverage t ** ** (-2.465) (-2.644) T ier1ratio t * * (-1.967) (-2.004) Size t (0.475) (0.387) (0.644) (0.550) ROA t (0.310) (0.250) (0.220) (0.146) LoanShare t (1.321) (1.130) (1.071) (0.859) ST Debt t (-0.352) (-0.186) (-0.271) (-0.090) DepositShare t (0.538) (0.715) (0.327) (0.539) GDP t (1.382) (1.133) (1.438) (1.174) Constant -7.77** -7.76** (-3.011) (-2.769) (0.399) (0.356) Observations R-squared *** p<0.01, ** p<0.05, * p<0.1 OpsExp Cum F T E 41

43 Table 6: This table gives the results for regressing Equation (1) in change form. All variables are first-differenced. The dependent variable for the first four columns is the change in the natural logarithm of the ratio of total quarterly operational losses divided by either equity or full time employees (F T E) as indicated in the bottom row. Operational losses are cumulated over time based on asset size between the loss occurrence and loss discovery dates (OpsExp Cum). The dependent variable for columns (5) through (8) is the natural logarithm of the ratio of total quarterly operational losses divided by total equity where operational loss events are defined as OpsExp Eq. T ier1ratio is the tier 1 regulatory capital ratio. Leverage is book equity divided by assets. The other independent variables are defined in Section 4. The sample covers 2001 through All models include bank and year fixedeffects. Standard errors are robust and clustered at the bank level. OpsExp Cum OpsExp Eq Dependent Variable: ln X Dependent Variable: ln X Variables (1) (2) (3) (4) (5) (6) (7) (8) Leverage ** * *** ** (-2.931) (-1.801) (-3.104) (-2.178) T ier1ratio (-0.853) (-0.432) (-0.551) (-0.205) Size (-1.146) (-0.703) (-0.744) (-0.456) (-0.186) (0.101) (0.080) (0.294) ROA * (1.541) (1.455) (0.551) (0.856) (1.819) (1.746) (0.821) (1.081) LoanShare (-0.559) (-0.941) (-0.571) (-0.826) (-0.816) (-1.131) (-0.599) (-0.784) ST Debt (-0.758) (-0.740) (-0.051) (-0.323) (-0.905) (-0.898) (-0.209) (-0.419) DepositShare ** 0.08* 0.09* 0.09* (1.696) (1.703) (1.496) (1.520) (2.230) (2.153) (1.809) (1.838) GDP (0.131) (0.100) (0.123) (0.101) (0.185) (0.159) (0.195) (0.178) Constant 0.50*** 0.49*** 0.57*** 0.54*** ** 0.25* (5.061) (4.418) (5.966) (5.040) (1.449) (1.259) (2.241) (1.816) Observations R-squared Scaling Variable (X) Equity FTE Equity FTE Equity FTE Equity FTE *** p<0.01, ** p<0.05, * p<0.1 42

44 Table 7: This table gives the results for Equation (2). All variables are first-differenced. The dependent variable is the first-difference of the natural logarithm of the ratio of total quarterly operational losses divided by total equity (Equity) or full time employees (F T E) as indicated in the bottom row. Operational losses are cumulated over time based on asset size between the loss occurrence and loss discovery dates (OpsExp Cum) in Columns (1) and (2). Operational losses are defined as OpsExp Eq in Columns (3) and (4). Leverage is book equity divided by assets. RC 1, RC 2, RC 3, and RC 4 are dummy variables set equal to one if the observation is in the 1st, 2nd, 3rd, or 4th quartile of the sample regulatory capital ratios, respectively. The other independent variables are defined in Section 4. The sample covers 2001 through All models include bank and year fixed-effects. T-statistics are shown in parenthesis. Standard errors are robust and clustered at the bank level. OpsExp Cum Dependent Variable: ln X OpsExp Eq Dependent Variable: ln X Variables (1) (2) (3) (4) LeverageXRC ** * ** ** (-4.396) (-2.683) (-4.555) (-3.138) LeverageXRC ** ** ** ** (-6.055) (-4.818) (-5.925) (-4.924) LeverageXRC (-0.139) (1.182) (-0.506) (0.594) LeverageXRC (-1.012) (-0.579) (-0.767) (-0.460) RC ** 0.45** (4.252) (3.967) (1.114) (1.016) RC ** 0.56** (5.183) (4.835) (1.536) (1.430) RC (1.700) (1.650) (-0.059) (-0.056) RC * 0.55* (2.919) (2.866) (1.048) (1.049) Size (-0.857) (-0.582) (-0.061) (0.092) ROA (0.398) (0.344) (0.803) (0.743) LoanShare (0.183) (-0.275) (0.030) (-0.355) ST Debt (-1.171) (-1.135) (-1.237) (-1.220) DepositShare * 0.07* (1.705) (1.784) (2.625) (2.590) GDP (0.279) (0.246) (0.331) (0.303) Observations R-squared Scaling Variable (X) Equity FTE Equity FTE *** p<0.01, ** p<0.05, * p<0.1 43

45 Table 8: The dependent variable is the first difference of the natural logarithm of the ratio of total quarterly operational losses at the accounting date (OpsExp Accounting) divided by either equity (Equity) or full time employees (F T E) as indicated in the bottom row. All variables are first-differenced. Operational losses are cumulated over time based on asset size between the loss occurrence and loss discovery dates (OpsExp Cum). The dependent variable for columns (5) through (8) is the natural logarithm of the ratio of total quarterly operational losses divided by total equity where operational loss events are defined as OpsExp Eq. T ier1ratio is the tier 1 regulatory capital ratio. Leverage is book equity divided by assets. The other independent variables are defined in Section 4. All independent variables are lagged one quarter. The sample covers 2001 through All models include bank and year fixed-effects. Standard errors are robust and clustered at the bank level. OpsExp Accounting Dependent Variable: ln X Variables (1) (2) (3) (4) Leverage (-0.063) (0.720) T ier1ratio (-1.467) (-1.016) Size * (1.674) (1.953) (1.355) (1.627) ROA (0.979) (0.979) (1.057) (1.108) LoanShare (0.036) (-0.168) (-0.437) (-0.579) ST Debt (-0.473) (-0.452) (-0.682) (-0.873) DepositShare (0.954) (1.011) (0.955) (0.927) GDP (1.528) (1.498) (1.475) (1.454) Constant 0.82* 0.81* 0.78* 0.75 (1.907) (1.829) (1.809) (1.672) Observations R-squared Scaling Variable (X) Equity FTE Equity FTE *** p<0.01, ** p<0.05, * p<0.1 44

46 Table 9: The dependent variable is the duration of operational loss exposure as defined by Equation (3). The first two columns calculate duration using OpsExp Cum and the second two use OpsExp Eq. All dependent variables are in levels and lagged one quarter. Leverage is book equity divided by assets. The other independent variables are defined in Section 4. The sample covers 2001 through All models include bank and year fixed-effects. T-statistics are shown in parenthesis. Standard errors are robust and clustered at the bank level. Variables (1) (2) (3) (4) Leverage t ** ** (-2.269) (-2.538) T ier1ratio t (-1.660) (-1.655) Size t (0.873) (0.891) (0.602) (0.585) ROA t (1.214) (0.943) (1.252) (1.016) LoanShare t (-0.014) (-0.047) (0.399) (0.252) ST Debt t (-0.736) (-0.419) (-0.616) (-0.277) DepositShare t (1.062) (1.533) (0.428) (0.988) GDP t * (1.782) (1.628) (1.627) (1.536) Constant 8.61*** 7.67** 6.41** 5.82** (3.737) (2.707) (2.882) (2.231) Observations R-squared *** p<0.01, ** p<0.05, * p<0.1 45

47 % Risk Weighted Assets by Risk Type 25.0% 62.5% 9.0% Total WFC USB SSC NT MS JPMC GS Citi BNYM 0.0% 10.0% 20.0% 30.0% 40.0% 50.0% 60.0% 70.0% 80.0% 90.0% 100.0% % RWA - Ops % RWA - Credit % RWA - Market % RWA - Misc Fig. 1. RWA by Risk Type. The figure shows the percentage of risk-weighted assets (RWA) by risk type as of 2015:Q3. The data is publicly available for banks that compute capital ratios using Basel II advanced approaches. Ops is operational risk and is calculated using the Advanced Measurement Approach (AMA), credit risk is calculated using the Internal Ratings Based (IRB) approach, and market is risk is computed using the advanced market risk rule. Miscellaneous adjustments include credit value adjustments (CVA), assets subject to general risk based capital requirements, and less excess reserves. 46

48 Fig. 2. Sample Coverage. This figure shows the sample coverage relative to the total assets for all U.S. commercial banks by quarter. The dashed line is the aggregate total assets in our sample. The solid line is the total assets of all U.S. commercial banks from the Federal Reserve Board H8 data series. The dotted line shows the ratio of the two series in percentage. 47