An in-depth analysis of the RBI’s October 2026 amendment, the Basel III Standardised Approach, operational loss-data requirements and what Indian banks must do before implementation.
The Reserve Bank of India (RBI) has announced an important development in India’s banking regulatory framework by confirming that the Basel III Standardised Approach for Operational Risk Capital Requirements will come into effect on 1 April 2027.
Through the Reserve Bank of India (Commercial Banks – Forthcoming Instructions) Second Amendment Directions, 2026, issued on 23 October 2026, RBI has clarified the calculation of operational risk capital, introduced indicative financial statement mappings and refined the treatment of historical operational losses.
The amendment builds upon the RBI’s November 2025 Directions and reflects additional clarifications issued by the Basel Committee on Banking Supervision.
For Indian banks, the significance extends beyond a revised capital calculation. The framework strengthens the relationship between a bank’s business activities, historical operational losses, data quality and regulatory capital requirements.
It also raises important questions about the preparedness of banks to identify, classify, measure and report operational risks consistently.
1. What Is Operational Risk Under the RBI Basel III Framework?
Operational risk refers to the risk of financial loss arising from inadequate or failed internal processes, people, systems or external events.
The regulatory definition includes legal risk but excludes strategic and reputational risk.
In today’s increasingly digital banking environment, operational risk can arise from several sources:
- Internal and external fraud: Unauthorised transactions, employee misconduct, forged documentation and cyber-enabled fraud.
- Technology and system failures: Core banking disruptions, payment processing errors and failures of critical technology infrastructure.
- Process and control weaknesses: Incorrect transaction execution, reconciliation failures, data-entry errors and inadequate authorisation controls.
- Third-party and outsourcing risks: Operational failures involving technology providers, payment intermediaries and other outsourced service providers.
- Legal and regulatory events: Certain penalties, settlements and losses arising from failures to meet legal or regulatory obligations.
Unlike credit risk, which primarily concerns borrowers failing to repay their obligations, operational risk concerns failures in the systems, processes and controls through which banking activities are conducted.
An important distinction is that an operational incident does not automatically translate into an equivalent regulatory loss amount. Banks must apply the RBI’s loss-recognition, recovery and classification requirements when determining eligible operational losses.
2. Why Has RBI Introduced the New Operational Risk Capital Framework?
Under the existing Basic Indicator Approach (BIA), operational risk capital is primarily linked to a bank’s gross income.
The BIA generally calculates the capital requirement using 15% of average positive annual gross income over the prescribed three-year period.
While this approach offers simplicity, it provides limited differentiation between banks with similar income levels but significantly different operational risk experiences.
For example, two banks may generate comparable income, yet one may have experienced substantial fraud losses, system failures or operational disruptions.
A calculation based primarily on gross income may not adequately reflect these differences.
The Basel III Standardised Approach addresses this limitation by incorporating two dimensions:
- Business activity and scale, measured through the Business Indicator Component.
- Historical operational loss experience, reflected through the Internal Loss Multiplier where applicable.
Consequently, the framework creates a closer connection between operational risk experience and capital requirements.
However, it is important to recognise that the new approach is a regulatory capital measurement methodology, not a substitute for robust operational risk management, effective internal controls or operational resilience planning.
3. RBI Operational Risk Capital Rules 2026: What Are the Key Changes?
The October 2026 amendment introduces several important clarifications to the framework established in November 2025.
A. Implementation Date Confirmed as 1 April 2027
RBI has confirmed that Chapter IV of the 2025 Forthcoming Instructions Directions, as amended in October 2026, will become effective from 1 April 2027.
The Basel III Standardised Approach will replace the existing Basic Indicator Approach for banks covered by the framework.
Applicability: The 2025 parent Directions cover commercial banks but exclude Small Finance Banks, Local Area Banks, Payments Banks and Regional Rural Banks.
The new framework does not mean that these excluded institutions have no operational risk obligations. Rather, this particular capital calculation framework does not apply to them under these Directions.
B. Clearer Mapping of Business Indicators to Financial Statements
One of the important changes concerns the calculation of the Business Indicator (BI).
RBI has introduced an indicative mapping between BI components and relevant schedules of banks’ balance sheets and profit and loss accounts.
The mapping covers:
- Interest income, interest expenses and interest-earning assets.
- Fee and commission income and expenses.
- Other operating income and expenses.
- Trading book and banking book profits or losses.
- Relevant provisions and expenses arising from operational loss events.
The RBI has also clarified that where financial statement classifications differ from the regulatory definitions, banks must follow the descriptions and sub-items prescribed under the operational risk capital framework.
Practical implication: Banks cannot rely solely on an automated extraction of accounting figures. Finance and risk teams must ensure that source data is mapped correctly to the regulatory definitions.
C. Clarification on Interest Rate Derivative Assets
The amendment clarifies that certain interest rate derivative assets affecting interest income must be included in interest-earning assets.
These derivative assets are to be measured using their positive fair value rather than their notional value.
Negative fair values must not be deducted.
This distinction matters because derivative notional amounts can be substantially higher than the actual fair values recorded in financial statements.
D. Historical Operational Loss Data Requirements
The framework generally requires 10 years of high-quality annual operational loss data for calculating the Loss Component used in the Internal Loss Multiplier.
However, the October 2026 amendment clarifies that when a bank first becomes subject to ILM calculation, it may use five or more years of qualifying data if a complete 10-year history is unavailable.
This provision is particularly relevant to banks still developing comprehensive operational risk loss databases.
The availability of five years of data alone does not establish compliance. The data must also meet the RBI’s prescribed quality, identification, collection and validation requirements.
E. Treatment of Damage to Bank Assets
The amendment also clarifies how losses should be measured when bank-owned assets are damaged or destroyed.
Three circumstances are addressed:
| Situation | Operational loss measurement |
|---|---|
| Asset not repaired or replaced | Reduction in book value, plus applicable residual clean-up or disposal costs |
| Asset fully repaired or replaced | Repair or replacement cost, plus applicable residual costs |
| Asset partially repaired | Repair cost, remaining reduction in book value and applicable residual costs |
These clarifications reduce ambiguity in the reporting of operational losses arising from physical damage or destruction of bank assets.
Get more details about the Operational Risk Management Certification provided by RMAI here.
4. How Is Operational Risk Capital Calculated Under Basel III?
The Basel III Standardised Approach uses three components:
Step 1: Calculate the Business Indicator (BI)
The Business Indicator is a financial statement-based proxy for the scale and nature of a bank’s business activities.
It consists of three elements:
BI = ILDC + SC + FC
Where:
- ILDC: Interest, Lease and Dividend Component.
- SC: Services Component.
- FC: Financial Component.
The framework prescribes detailed calculations using relevant financial information generally measured across three years.
For example, the Services Component includes relevant fee and commission activities, while the Financial Component captures prescribed trading book and banking book gains or losses.
Step 2: Calculate the Business Indicator Component (BIC)
The BIC is calculated using marginal coefficients that increase with the size of the Business Indicator.
| Business Indicator range | Marginal coefficient |
|---|---|
| Up to ₹8,000 crore | 12% |
| Above ₹8,000 crore up to ₹2,40,000 crore | 15% |
| Above ₹2,40,000 crore | 18% |
These coefficients are applied progressively, rather than applying the highest applicable percentage to the entire Business Indicator.
Illustrative calculation
Consider a bank with a Business Indicator of ₹10,000 crore.
The BIC would be calculated as follows:
- First ₹8,000 crore × 12% = ₹960 crore.
- Remaining ₹2,000 crore × 15% = ₹300 crore.
Total BIC = ₹1,260 crore.
This provides the starting point for determining the applicable operational risk capital requirement.
Step 3: Calculate the Internal Loss Multiplier (ILM)
For qualifying banks in the second and third BI buckets, the Internal Loss Multiplier reflects historical operational risk losses.
The formula is:
ILM = ln [e − 1 + (LC / BIC)^0.8]
Where:
LC = 15 × Average Annual Operational Risk Losses (net of recoveries)
The resulting ILM may increase or decrease the capital requirement relative to the BIC, depending on the bank’s qualifying loss experience.
For example, if the bank in the previous illustration has average annual qualifying operational losses of ₹100 crore:
- BIC = ₹1,260 crore.
- Loss Component = 15 × ₹100 crore = ₹1,500 crore.
- Calculated ILM ≈ 1.0536.
The operational risk capital requirement becomes approximately:
₹1,327.54 crore = BIC × ILM
The corresponding operational risk-weighted assets would be approximately:
₹16,594.22 crore = Operational Risk Capital × 12.5
This is an illustrative calculation, assuming that the bank qualifies for ILM-based measurement and has sufficient high-quality loss data.
Importantly, banks in the first BI bucket use BIC as their operational risk capital requirement.
Banks in buckets 2 and 3 without five years of qualifying loss data generally must hold capital at least equal to BIC, subject to the RBI’s supervisory provisions.
5. Why Is Operational Loss Data Quality Critical Under the RBI Framework?
The new approach makes historical operational loss data particularly important for larger banks.
Loss records must be comprehensive, reliable, appropriately classified and supported by documentation.
Under the framework, banks must capture qualifying operational losses across business lines, systems, relevant geographical locations and outsourced activities.
Important RBI Loss-Data Requirements
Minimum reporting threshold: An operational loss event is included in the relevant calculation dataset when its cumulative net loss within the calculation window is at least ₹1 lakh.
Recognition of recoveries: Recoveries from insurers, perpetrators of fraud or other eligible third parties must be appropriately captured.
Event dates: Banks need to distinguish between the date an event occurred, when it was discovered and when its financial impact was recognised.
Data validation: Procedures for loss-data identification, collection and treatment are subject to validation and independent review, including periodic audit requirements.
Avoiding double counting: Operational losses related to credit risk that are already accounted for in credit risk-weighted assets must not be duplicated in the operational loss dataset.
These requirements demonstrate why operational risk reporting should not be restricted to maintaining a basic incident register.
Banks need reliable linkages between incident reporting, accounting records, recovery processes and regulatory capital calculations.
6. Real Banking Incidents: Why Operational Risk Measurement Matters
Actual banking incidents illustrate the importance of identifying and monitoring operational risks before they develop into substantial financial exposures.
Case Study 1: Punjab National Bank Fraud, 2018: Internal Controls and Operational Risk
The Punjab National Bank fraud disclosed in 2018 involved allegedly unauthorised Letters of Undertaking issued through the SWIFT messaging system.
The reported exposure ran into billions of US dollars.
Investigative reporting subsequently highlighted weaknesses in transaction monitoring, internal controls and supervision. The incident also prompted regulatory attention to the integration of SWIFT messaging and core banking systems.
Operational risk lessons:
- Technology systems should not operate outside effective reconciliation and authorisation controls.
- Segregation of duties must be consistently enforced.
- Transaction monitoring should help detect irregular activities before exposures accumulate.
- Operational loss events require reliable documentation and investigation.
The incident illustrates the significant financial consequences that can arise when process, technology and control weaknesses interact.
It does not, however, establish how the entire reported fraud exposure would be classified under the 2027 operational risk capital framework. Actual regulatory treatment depends on the applicable loss-recognition and credit-risk rules.
Case Study 2: UCO Bank IMPS Incident, 2023: Payment Processing and Reconciliation Risk
In November 2023, UCO Bank disclosed erroneous credits of approximately ₹820 crore linked to Immediate Payment Service transactions.
The transactions resulted in credits to certain UCO Bank customer accounts without corresponding funds being received from the originating banks.
On 16 November 2023, the bank reported that approximately ₹649 crore, or 79%, had been retained or recovered. Further recovery actions continued thereafter.
The incident highlighted the importance of timely reconciliation, transaction controls, incident detection and recovery procedures.
Operational risk lessons:
- Payment system reconciliation must identify mismatches promptly.
- Banks need effective automated exception monitoring.
- Incident response procedures should support timely containment and recovery.
- Gross incident exposure and final net operational loss must be measured separately.
The distinction between erroneous transaction value, funds recovered and ultimate financial loss is particularly relevant when maintaining high-quality operational risk datasets.
Together, these incidents illustrate that operational risk involves more than technology failure or fraud in isolation. It also concerns how effectively organisations identify, control and respond to failures.
Strengthen Your Operational Risk Management Expertise with RMAI
As banks prepare for the revised Basel III Operational Risk Capital Framework, professionals must strengthen their understanding of operational risk identification, assessment, measurement, internal controls and regulatory compliance. The Risk Management Association of India (RMAI), through Smart Online Course, offers a comprehensive, self-paced Operational Risk Management Training Programme covering Basel frameworks, Risk and Control Self-Assessments (RCSA), Key Risk Indicators (KRIs), loss-event management, operational resilience and practical case studies. The programme includes dual certification opportunities involving RMAI and the BFSI Sector Skill Council of India, subject to applicable assessment requirements.
Nominations are now open for banking, risk, compliance, audit and finance professionals.
7. How Will the New Basel III Framework Affect Indian Banks?
The implementation of the revised framework has implications across multiple banking functions.
Impact on Chief Risk Officers and Operational Risk Teams
Risk management functions will need to assess whether existing operational loss databases meet the required standards.
Priorities include strengthening risk-event classification, reviewing loss-data completeness, maintaining recovery histories and improving the linkages between key risk indicators, incidents and capital calculations.
Impact on Finance and Regulatory Reporting Teams
Finance teams must ensure consistency between financial statements and the new Business Indicator definitions.
This includes reviewing data mappings, accounting classifications and reporting systems used to calculate operational risk capital and risk-weighted assets.
Impact on Internal Audit Functions
Internal audit teams have an important role in independently reviewing data quality, operational risk controls and the reliability of calculation procedures.
Banks should also evaluate whether significant incidents, recovered losses and provisions have been treated consistently across reporting periods.
Impact on Senior Management and Board Risk Committees
The new methodology may affect operational risk capital requirements depending on a bank’s business profile and historical losses.
Boards and senior management should therefore consider how the new calculations interact with capital planning, risk appetite, operational resilience and the Internal Capital Adequacy Assessment Process.
The critical question is not simply whether banks can calculate operational risk capital, but whether they have the systems, controls and data quality needed to support those calculations.
8. Operational Risk Capital Compliance Checklist: What Banks Should Do Before April 2027
With implementation scheduled for 1 April 2027, covered banks should focus on the following preparation areas.
| Priority | Recommended action |
|---|---|
| Regulatory applicability | Confirm entity-level applicability and relevant reporting scope |
| BI calculations | Reconcile the prescribed BI components with financial statement data |
| Loss-data quality | Review the availability and completeness of 5–10 years of qualifying loss data |
| Risk classification | Validate fraud, system failure, process failure and outsourcing-related loss classifications |
| Capital impact assessment | Calculate expected BIC, ILM and operational risk-weighted assets |
| Technology readiness | Test calculation engines, reporting processes and data interfaces |
| Independent review | Arrange validation, internal audit review and remediation of identified weaknesses |
| Governance | Report implementation readiness and material capital implications to appropriate management and Board committees |
These are recommended implementation priorities, not a separate checklist expressly mandated by the October 2026 amendment.
Banks should also consider conducting internal simulations of the new calculations before implementation.
Although the 2025 Directions do not require a formal parallel run comparing the new approach with the discontinued methodology, internal readiness exercises can help identify data inconsistencies and potential capital impacts in advance.
9. Frequently Asked Questions on RBI’s Operational Risk Capital Requirements
When will RBI’s new operational risk capital rules become effective?
The Basel III Standardised Approach under Chapter IV of the RBI’s 2025 Forthcoming Instructions Directions, as amended on 23 October 2026, will become effective on 1 April 2027.
Which banks must comply with the new operational risk capital framework?
The framework applies to covered commercial banks. The parent Directions exclude Small Finance Banks, Local Area Banks, Payments Banks and Regional Rural Banks.
What is the difference between the Basic Indicator Approach and the Basel III Standardised Approach?
The Basic Indicator Approach uses a gross income-based measure. The Basel III Standardised Approach uses the Business Indicator Component and, where applicable, an Internal Loss Multiplier reflecting qualifying historical operational losses.
Are 10 years of operational loss data compulsory for every bank?
No. The requirement depends on the bank’s BI bucket and applicability of the ILM. Eligible banks first becoming subject to ILM calculation may use five or more years of high-quality operational loss data when a full 10-year history is unavailable.
Does the new framework automatically increase operational risk capital requirements?
Not necessarily. The impact depends on the bank’s Business Indicator, applicable marginal coefficients, historical loss experience and data quality. Some banks may experience higher requirements, while others may experience lower requirements compared with their existing capital charge.
10. Conclusion: Operational Risk Data and Governance Will Become Increasingly Important
The RBI’s October 2026 amendment represents an important step towards implementing the revised Basel III operational risk capital framework in India.
By confirming the implementation date and clarifying the treatment of financial statement components, operational losses and damaged assets, the RBI has provided greater certainty for banks preparing for the transition.
The broader significance lies in the connection between historical operational loss experience, business scale and regulatory capital.
For Indian banks, 1 April 2027 should be viewed not merely as a regulatory implementation date, but as an opportunity to strengthen operational risk data, governance, reporting and control effectiveness.
Institutions that invest in reliable loss-data management, effective reconciliation, stronger internal controls and operational resilience will be better positioned to implement the framework and manage emerging operational risks.
References and Regulatory Sources
- Reserve Bank of India – Commercial Banks (Forthcoming Instructions) Second Amendment Directions, 2026, dated 23 October 2026
- Reserve Bank of India – Commercial Banks (Forthcoming Instructions) Directions, 2025, dated 28 November 2025
- Reuters / Business Standard – Internal Control Weaknesses in the Punjab National Bank Fraud, June 2018
- The Indian Express – UCO Bank IMPS Incident and Recovery Update, 16 November 2023
