Changes to the DFSA operational risk framework: Spotlight on the DFSA’s latest consultation

Changes to the DFSA operational risk framework Spotlight on the DFSAs latest consultation

On 10 March 2025, the Dubai Financial Services Authority (the DFSA) published Consultation Paper No. 164 (CP164) on the calculation of risk-weighted assets (RWA) for operational risk. 

The proposals set out in CP164 reflect the DFSA’s continued efforts to harmonise the DFSA’s prudential regime with Basel III, which is the international standard issued by the Basel Committee on Banking Supervision. The DFSA has previously implemented various Basel III measures, including the liquidity coverage ratio and leverage ratio.

The purpose of this briefing note is to highlight some of the key proposals in CP164.

Background to the proposed changes

Authorised Firms in the Dubai International Financial Centre that are subject to the “Basel regime” are currently operating under the Basic Indicator (the default methodology), the Standardised or the Alternative Standardised Approach for calculating their regulatory capital requirement for operational risk. This position is consistent with the Basel II framework, which was introduced internationally in 2004 and was implemented by the DFSA in 2012.

The shortcomings of the Basel II framework were highlighted by the global financial crisis, which found that the approaches used for calculating operational risk relied too heavily on internal models and lacked standardisation. These shortcomings arose in part from the use of gross income as a proxy indicator for operational risk exposure.

In this context, the Basel III framework, including the revised operational risk framework, was developed. Through CP164, the DFSA proposes to transition its rules for calculating the RWA on operational risk from the Basel II framework to the new approach under Basel III.

Definition of operational risk

CP164 proposes to harmonise the DFSA’s definition of operational risk with the Basel III definition by expressly excluding strategic risk and reputational risk. While legal risk has been retained in the proposed definition, the DFSA is proposing to introduce guidance from Basel III into the Prudential - Investment, Insurance Intermediation and Banking Module (PIB).

This guidance clarifies that legal risk shall include, among other elements, exposures to fines, penalties, punitive damages or settlements resulting from supervisory actions, as well as exposures to claims arising from private disputes.

Formula for calculating RWA on operational risk

CP164 proposes to replace the existing three standardised approaches for calculating the operational risk capital requirement with a single risk-sensitive standardised approach that all Category 1, 2 or 5 Authorised Firms must use. Category 3A Authorised Firms that are currently subject to the Basel regime will also need to adopt the new standardised approach.

Under the DFSA’s proposed changes, firms must multiply their business indicator (see below) by a set of regulatorily determined marginal coefficients. The result is then multiplied by 12.5 to arrive at the RWA for operational risk, as set out in the formula below:

Operational Risk RWA = 12.5 * Business Indicator * Marginal Coefficient

Taking each component in turn:

The Business Indicator is a financial statement-based proxy for operational risk, consisting of three elements, each calculated as the average over a period of three years:

1. An interest, leases and dividend component;
2. A services component; and
3. A financial component.

The Marginal Coefficient in the formula will be determined in accordance with the size of the Business Indicator for the firm, using the following table.

The effect of historical losses

Under the Basel III framework, for firms in buckets 2 and 3 above, a portion of the Business Indicator component is multiplied by the Internal Loss Multiplier (ILM). The ILM is a scaling factor that allows for the adjustment of the RWA upwards or downwards, based on the firm’s actual record of operational losses collected within a historical 10-year observation period.

Relevantly, Basel III allows national regulators to decide whether to require institutions to include the ILM into the operational-risk capital calculation. For at least the next 10 years, the DFSA has decided to exclude the ILM and therefore neutralise the effect of historical losses on the regulatory capital charge. This approach is consistent with approaches taken by other regulators internationally (ie, in Australia and in the EU).

The practical effect of excluding ILM from the operational risk RWA formula will be negligible because the vast majority of firms supervised by the DFSA fall into bucket 1. Further, where a firm is large enough to fall into bucket 2 or 3, the DFSA will retain its supervisory powers to assign a specific capital charge for operational risk in case the capital resources of the firm are not sufficient to cover the associated risks.

Conclusion

Given the DFSA’s previous efforts to bring its prudential rules into closer alignment with the Basel III framework, the proposals contained in CP164 should not come as a surprise to affected firms.

CP164 proposes to make significant changes to how affected firms calculate operational risk capital requirements, moving from three distinct standardised approaches to a single standardised approach that scales with the size of the financial institution. If the proposals set out in CP164 are adopted, an increase in affected firms’ own funds should be expected.

The deadline for comments on CP164 is 12 May 2025. Subject to the outcome of consultation, the DFSA is proposing an implementation date of 1 July 2026 for the revised PIB rules.

This article has been written by Middle East Partner and Head of Financial Services Regulatory Matthew Shanahan and associate Jack Abrehart.

Should you have any queries or questions, please get in touch with one the key contacts listed below.