The Basel Committee on Banking Supervision sorts operational losses into seven event-type categories: internal fraud; external fraud; employment practices and workplace safety; clients, products, and business practices; damage to physical assets; business disruption and system failures; and execution, delivery, and process management. Together, these Basel operational risk categories give banks a common language for classifying losses, collecting data, and calculating regulatory capital. The framework defines operational risk as the risk of loss from inadequate or failed internal processes, people, and systems or from external events, and it explicitly includes legal risk while excluding strategic and reputational risk.1Bank for International Settlements. Definitions and Application – Calculation of RWA for Operational Risk
Internal Fraud
The first category covers acts intended to defraud, steal property, or circumvent regulations, the law, or company policy, where at least one internal party is involved.2CBB Rulebook. Appendix A Loss Event Type Classification Think of an employee embezzling funds, a trader hiding losses by misreporting positions, or a banker acting on inside information. Discrimination and diversity-related events are carved out and sit under employment practices instead.
The financial damage can be enormous. A single rogue trader concealing unauthorized positions has historically generated losses in the billions, and federal securities fraud convictions carry prison sentences of up to 25 years.3Office of the Law Revision Counsel. 18 USC 1348 – Securities and Commodities Fraud For the bank, the operational risk loss isn’t just the stolen money or trading loss. It also includes the legal costs, regulatory fines, and remediation expenses that follow. Segregation of duties, dual authorization for high-value transfers, mandatory vacation policies, and independent reconciliation are the standard controls used to make concealment harder.
External Fraud
External fraud covers the same kinds of intentional acts, but committed by people outside the bank: check forgery, robbery, phishing, ransomware, credential theft, and coordinated attacks on customer databases.2CBB Rulebook. Appendix A Loss Event Type Classification The scale runs from a single fraudulent wire to breaches that compromise millions of records.
Direct losses include reimbursed customer funds, but the downstream costs often dwarf the initial theft: forensic investigations, system overhauls, credit monitoring for affected customers, and regulatory penalties. Federal law requires banks to file a Suspicious Activity Report within 30 calendar days of initially detecting facts that suggest a reportable crime. If no suspect has been identified by that deadline, the bank gets an additional 30 days, but reporting can never be delayed beyond 60 days from initial detection.4Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions Digital fraud has largely overtaken physical crime as the dominant threat here, and it tends to be harder to detect until the damage is already done.
Employment Practices and Workplace Safety
This category captures losses from acts inconsistent with employment or health and safety laws, including workers’ compensation claims, discrimination lawsuits, and disputes over labor agreements.2CBB Rulebook. Appendix A Loss Event Type Classification It also picks up the discrimination and diversity events excluded from internal fraud.
Wage and hour violations are a common driver. When a bank fails to pay overtime properly or misclassifies employees, the Fair Labor Standards Act allows recovery of back pay plus an equal amount in liquidated damages, and employees can sue privately and recover attorney’s fees on top.5U.S. Department of Labor. Back Pay Class actions involving thousands of workers can push settlements into the tens of millions. Workplace safety incidents at branches, data centers, and offices produce workers’ compensation claims and potential regulatory fines, while harassment and wrongful termination suits add legal fees, settlement payments, and the harder-to-quantify cost of losing experienced staff.
Clients, Products, and Business Practices
Often the most expensive category for large banks, this one covers losses from failing to meet professional obligations to clients, from flawed product design, or from improper business practices.2CBB Rulebook. Appendix A Loss Event Type Classification The subcategories include fiduciary breaches, suitability and disclosure failures, improper trading, product defects, and advisory misconduct.
Fiduciary breaches occur when a bank or its employees put their own interests ahead of a client’s. For broker-dealer operations, the SEC’s Regulation Best Interest requires that any recommendation to a retail customer be in the customer’s best interest at the time it is made, with specific disclosure, care, and conflict-of-interest obligations that cannot be satisfied through disclosure alone.6U.S. Securities and Exchange Commission. Regulation Best Interest – The Broker-Dealer Standard of Conduct Violations lead to enforcement actions, restitution orders, and reputational damage that can shrink a client base for years.
Anti-money laundering failures also sit here. Banks that neglect customer due diligence under the Bank Secrecy Act face some of the largest penalties in the industry. In 2024, regulators assessed a $450 million civil penalty against a single institution for systemic failures in its AML program.7Office of the Comptroller of the Currency. OCC Issues Cease and Desist Order, Assesses $450 Million Civil Money Penalty Against TD Bank Churning customer accounts to generate commissions, mis-selling complex products, and misusing confidential customer information are all additional loss drivers.
Damage to Physical Assets
This category covers losses from the destruction or damage of physical assets caused by natural disasters or other external events: floods, fires, earthquakes, hurricanes, acts of terrorism, and vandalism.8Bank for International Settlements. Standardised Approach – Calculation of RWA for Operational Risk When a branch, data center, or headquarters is physically damaged, the bank absorbs repair costs, replacement of destroyed equipment, and lost revenue during the closure.
For terrorism-related losses, the federal Terrorism Risk Insurance Program provides a backstop of shared public and private compensation for qualifying insured losses. The program, administered by the Treasury Department, is currently authorized through December 31, 2027.9U.S. Department of the Treasury. Terrorism Risk Insurance Program Banks still absorb deductibles and co-pays, but the program prevents catastrophic losses from concentrating on a single institution.
The line between this category and business disruption comes down to cause. A hurricane that destroys a data center is damage to physical assets. A software bug that crashes the same data center’s servers is the next category.
Business Disruption and System Failures
The sixth category captures losses from disruptions to business operations or failures in technology systems: hardware crashes, software glitches, telecommunications failures, and utility outages that take down digital banking platforms.8Bank for International Settlements. Standardised Approach – Calculation of RWA for Operational Risk The distinguishing feature is that the loss stems from the system itself failing, not from an external physical event destroying it.
Modern banking runs almost entirely on technology, which makes this category increasingly consequential. A major outage that prevents customers from accessing accounts, processing payments, or executing trades can last hours or days. Direct costs include lost transaction revenue, emergency IT remediation, and potential contractual penalties to counterparties. Regulators have imposed fines for repeated or prolonged outages, treating them as evidence that a bank lacks adequate operational resilience.
U.S. banking regulators define operational resilience as the ability of a firm to prepare for, adapt to, withstand, and recover from disruptions while continuing critical operations. The interagency guidance on resilience applies primarily to the largest and most complex firms, generally those with $250 billion or more in average total consolidated assets, which must identify critical operations and set tolerances for how long those operations can be disrupted before causing serious harm.10Federal Reserve. Interagency Paper on Sound Practices to Strengthen Operational Resilience
Execution, Delivery, and Process Management
The final category is the broadest and, in many banks, the most frequent source of operational risk events. It covers losses from failed transaction processing or process management, including problems arising from relationships with trade counterparties and vendors.2CBB Rulebook. Appendix A Loss Event Type Classification Data entry errors, miscommunications, missed settlement deadlines, incomplete legal documentation, and flawed collateral management all fall here.
A misplaced digit in a wire instruction can move millions to the wrong account. Failing to properly perfect a lien on collateral leaves the bank exposed if a borrower defaults. Incomplete or inaccurate documentation can block a bank from enforcing a contract in court. Individually mundane, these errors happen constantly across thousands of daily transactions.
Third-party vendor failures also belong here. When a bank outsources payment processing, data hosting, or IT maintenance, the vendor’s operational failures become the bank’s operational risk. U.S. banking regulators expect institutions to manage vendors through a documented lifecycle covering onboarding, ongoing monitoring, and offboarding, with oversight scaled to how critical the vendor is to the bank’s operations.
Why the Category Matters for a Given Loss
Classifying each loss into one of the seven categories is not just an organizational exercise. It feeds directly into the capital calculation under the Basel III standardised approach, which replaced the earlier Advanced Measurement Approach and combines a bank’s size with its actual loss history.11Bank for International Settlements. Basel Committee Issues Proposed Revisions to the Operational Risk Framework For larger banks, historical losses feed an Internal Loss Multiplier that scales required capital up or down: heavier losses mean a higher multiplier and more capital held.12Bank for International Settlements. Standardised Approach – Calculation of RWA for Operational Risk
The framework requires at least 10 years of high-quality annual loss data, with a five-year floor for banks transitioning to the standardised approach for the first time. Events that straddle categories, like a cyberattack that both steals customer data (external fraud) and exposes suitability failures (clients, products, and business practices), have to be allocated carefully. The framework also draws a boundary with other risk types: operational losses already captured in credit risk-weighted assets are excluded from the operational risk dataset, while operational losses related to market risk stay in and are treated as operational risk for capital purposes.12Bank for International Settlements. Standardised Approach – Calculation of RWA for Operational Risk Undercounting losses in a category can produce an artificially low multiplier and insufficient capital; overcounting ties up capital unnecessarily. That is why most large banks run dedicated operational risk teams whose primary job is making sure every reportable loss is captured, categorized, and validated against the seven definitions.