FRM Exam Part II · Risk Mitigation

Insurance and Risk Transfer for Operational Risk

Updated 11 October 2026 · Fact-checked

Operational risk insurance moves part of a loss to an insurer for a premium. You keep the deductible and any loss above the policy limit. Under Basel's advanced approach, insurance could reduce capital only if strict conditions were met, and the cap was 20% of the capital charge. Key problems are moral hazard, basis risk and counterparty risk.

Understand Insurance and Risk Transfer for Operational Risk

Operational risk is the risk of loss from failed processes, people, systems or external events. Some of these losses are rare and large: fraud, cyber attacks, fires, litigation. A bank can control them, accept them, or transfer them. Insurance is the most common form of transfer.

In an insurance contract the bank pays a premium. The insurer pays covered losses. Three terms set how much you recover. The deductible is the loss you absorb first. The limit is the most the insurer will pay. Coinsurance (if present) is a share of the loss you also keep. A loss above the limit comes back to you. So insurance cuts the tail of the loss distribution only up to the limit.

The opposite is self-insurance: you hold your own capital, provisions or reserves instead of buying cover. Expected losses are usually covered by pricing and provisions. Insurance suits low-frequency, high-severity events. Self-insurance suits high-frequency, low-severity events, where premiums would mostly refund your own losses plus the insurer's costs and margin. Many firms also use a captive (a subsidiary insurer) as a middle route. A captive keeps the risk within the group.

Insurance brings its own problems. Moral hazard: once insured, the bank may take less care, or spend less on controls. Adverse selection: banks with weaker controls are keener to buy cover, and the insurer cannot see this fully. Basis risk: the policy does not pay exactly when and as much as the loss occurs, because of exclusions, definitions of covered events, or gaps in cover. Counterparty risk: the insurer may fail or dispute the claim. Payment delay also matters, since a slow payout leaves the bank exposed to a liquidity shortfall.

Basel II allowed banks using the Advanced Measurement Approach (AMA) to recognise insurance as a mitigant. The recognition was capped at 20% of total operational risk capital. Conditions included a strong insurer rating, a policy term of at least one year with a residual term haircut for shorter policies, a minimum notice period for cancellation, no exclusions triggered by supervisory action or bank failure, and a transparent method that reflects the policy in the capital model. Under the revised Basel III standardised approach (SMA), the capital charge is based on the business indicator and loss history, and insurance is not recognised as a capital reducer. It still has value for managing risk economically.

Alternative risk transfer (ART) covers tools beyond standard policies, such as captives, finite risk contracts, and insurance-linked securities or catastrophe bonds. These can give wider cover or capital market capacity, but they bring their own basis and structuring risks.

Key formulas to remember

Loss retained by the bank (single loss, no coinsurance): Retained = min(Loss, D) + max(0, Loss − (D + L)); D = deductible. L = limit, which is the maximum the insurer pays, applied after the deductible. If your policy states the limit as an overall cap on the loss, check the wording.
Insurer payout (single loss): Payout = min(max(Loss − D, 0), L); Pays nothing below the deductible, then pays the excess up to the limit.
Payout with coinsurance share c borne by the insured: Payout = (1 − c) × min(max(Loss − D, 0), L); Use when the question gives a percentage the bank keeps.
Basel AMA insurance recognition cap: Insurance mitigation ≤ 20% of total operational risk capital charge; Applied under the old AMA. Not available as a capital reducer under the SMA.
Net operational risk capital after insurance (AMA): Net capital = Capital before insurance − recognised mitigation; Recognised mitigation = the smaller of the modelled benefit and the 20% cap.

How to solve Insurance and Risk Transfer for Operational Risk questions

Use this order for any question on operational risk insurance, whether it is numeric or conceptual.

1Identify what is asked: a payout or retained loss calculation, a Basel recognition question, or a problem such as moral hazard or basis risk.
2For calculations, write down the loss, deductible, limit and any coinsurance. Note whether the limit applies per event or in aggregate.
3Apply the deductible first, then cap the payout at the limit, then apply coinsurance if given.
4Compute the retained loss as loss minus payout. Check that retained loss is never below the deductible when the loss exceeds it.
5For Basel questions, state which framework applies: AMA allowed recognition up to the 20% cap; the SMA does not recognise insurance.
6For problem-identification questions, match the symptom: less care after buying cover is moral hazard; weak banks buying more is adverse selection; policy not matching the loss is basis risk; insurer failing or disputing is counterparty risk.
7Compare against the options and watch for answers that overstate cover, such as insurance eliminating the risk.

Quickest way: Layer method for payout questions

When to use it: Use for any numeric question with a deductible and a limit.

Draw three layers: bank keeps up to D, insurer pays the next L, bank keeps anything above D + L.
Place the loss in the layers.
Add the bank's two retained pieces to get the retained loss.
For Basel questions, remember: AMA cap 20%, conditions on insurer strength and cancellation, none under SMA.

Common mistakes in Insurance and Risk Transfer for Operational Risk

Applying the limit before the deductible, or treating the limit as the total loss covered including the deductible.
Policy wording varies and students assume one layout.
Fix: Follow the question's wording. By default, deduct first, then cap the payout at the limit.
Saying insurance fully removes operational risk.
Insurance feels like a complete hedge.
Fix: It transfers part of the loss only. Deductibles, limits, exclusions, basis risk and counterparty risk remain.
Confusing moral hazard with adverse selection.
Both arise from information gaps.
Fix: Moral hazard is behaviour after cover is bought. Adverse selection is who chooses to buy cover before it is bought.
Saying Basel recognises insurance without limit or conditions.
Students remember recognition but not the cap.
Fix: Remember the 20% cap, insurer quality, cancellation notice, and the point that the SMA gives no recognition.
Using insurance for high-frequency small losses.
Students assume more cover is better.
Fix: Those are expected losses. Handle them by pricing, provisions and self-insurance. Insure rare large losses.
Ignoring payout delay and insurer credit quality.
Focus stays on the loss amount.
Fix: Treat late payment and insurer failure as part of counterparty and liquidity risk. Check the insurer's rating.

Worked examples

Example 1

A bank has a cyber fraud policy with a deductible of $2 million and a limit of $20 million, with no coinsurance. A loss of $27 million occurs. How much does the bank retain?

Show the solution

Apply the deductible: the bank bears the first $2 million.
Loss above the deductible = 27 − 2 = $25 million.
The insurer pays up to the limit: min(25, 20) = $20 million.
Retained loss = 27 − 20 = $7 million.
Check by layers: 2 (below deductible) + 5 (above 22) = $7 million.

Answer: The bank retains $7 million. The insurer pays $20 million.

Example 2

A bank using the AMA has an operational risk capital charge of $400 million before insurance. Its model shows insurance would reduce capital by $110 million, and all Basel conditions are met. What is the capital charge after recognition?

Show the solution

Compute the cap: 20% × 400 = $80 million.
Compare the modelled benefit of $110 million with the cap of $80 million.
Recognised mitigation = min(110, 80) = $80 million.
Net capital = 400 − 80 = $320 million.

Answer: The capital charge is $320 million, because recognition is capped at 20%.

Exam tips

Numeric questions are usually layer problems. Draw the layers before computing.
Learn the Basel AMA conditions and the 20% cap, and know that the SMA gives no insurance recognition.
Match the scenario wording to the right problem: behaviour change, weak buyers, mismatched cover, or insurer default.
Distinguish insurance (transfer) from self-insurance (retention) and captives (retention within the group).
Reject options that say insurance removes risk or reduces expected loss to zero.

Practice questions from Risk Mitigation

Insurance and Risk Transfer for Operational Risk: frequently asked questions

What is the difference between insurance and self-insurance for operational risk?

Insurance transfers part of a loss to a third party for a premium. Self-insurance means the bank keeps the risk and funds it through provisions, reserves or capital. Self-insurance suits frequent small losses. Insurance suits rare large ones.

Does Basel recognise insurance for operational risk capital?

Under the AMA in Basel II, insurance could reduce capital up to 20% of the capital charge if strict conditions were met. Under the Basel III standardised approach (SMA), insurance does not reduce the capital charge.

What is moral hazard in operational risk insurance?

It is the risk that a bank takes less care or underinvests in controls because it is insured. Deductibles, coinsurance and requiring good controls reduce it.

What is basis risk in operational risk insurance?

It is the gap between the loss the bank suffers and what the policy actually pays. Exclusions, narrow definitions of covered events, and limits all create it.

What is alternative risk transfer?

ART covers tools beyond standard policies, such as captive insurers, finite risk contracts and insurance-linked securities. They widen capacity but add structuring, basis and counterparty issues.