1.The qualitative standards referred to in Article 312(2) are the following:
(a)an institution's internal operational risk measurement system shall be closely integrated into its day-to-day risk management processes;
(b)an institution shall have an independent risk management function for operational risk;
(c)an institution shall have in place regular reporting of operational risk exposures and loss experience and shall have in place procedures for taking appropriate corrective action;
(d)an institution's risk management system shall be well documented. An institution shall have in place routines for ensuring compliance and policies for the treatment of non-compliance;
(e)an institution shall subject its operational risk management processes and measurement systems to regular reviews performed by internal or external auditors;
(f)an institution's internal validation processes shall operate in a sound and effective manner;
(g)data flows and processes associated with an institution's risk measurement system shall be transparent and accessible.
1.Losses stemming from merged or acquired entities or activities shall be included in the loss data set as soon as the business indicator items related to those entities or activities are included in the institution’s business indicator calculation in accordance with Article 315(1). To that end, institutions shall include losses observed during a 10-year period prior to the acquisition or merger.
2.EBA shall develop draft regulatory technical standards to specify how institutions are to determine the adjustments to their loss data set following the inclusion of losses from merged or acquired entities or activities as referred to in paragraph 1.
EBA shall submit those draft regulatory technical standards to the Commission by 10 January 2027.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.