Market, Interest-Rate and Operational Risk Regulation

Introduction

Banking regulation is concerned not only with whether a bank is solvent today, but also with whether it can withstand adverse market movements, changing interest rates, operational disruption and failures of important service providers. These risks are interconnected. A market shock may generate losses in a trading portfolio; a rapid change in interest rates may reduce the economic value of assets relative to liabilities; and an information-technology failure may prevent the bank from measuring, managing or reporting either exposure.

This chapter examines the principal regulatory approaches to three risk families: market risk, interest-rate risk in the banking book (IRRBB), and operational risk. It also considers business continuity, third-party dependencies and operational resilience. The emphasis is on the logic of regulation, the design of supervisory frameworks, quantitative measurement, governance and practical implementation.

The discussion is primarily informed by internationally used Basel standards, while recognising that national regulators may impose additional requirements. Regulatory rules differ across jurisdictions, so institutions must always apply the legislation, supervisory guidance and reporting instructions applicable in their country.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Distinguish trading-book market risk from banking-book interest-rate risk.
2. Explain the regulatory architecture for market risk, including standardised and internal-model approaches.
3. Calculate and interpret basic value-at-risk and expected-shortfall measures, while recognising their limitations.
4. Analyse IRRBB through earnings-based and economic-value-based perspectives.
5. Explain the components of the modern operational-risk framework.
6. Design a proportionate business-continuity and operational-resilience programme.
7. Evaluate risks arising from outsourcing, cloud services and other third-party dependencies.
8. Assess governance, data, model-risk and ethical issues in risk regulation.

1. The regulatory logic of risk measurement

A bank’s risk framework normally contains five linked elements:

• Identification: determining which exposures and processes can generate loss.
• Measurement: estimating potential loss using suitable metrics and scenarios.
• Limits and controls: defining risk appetite, delegated authorities and escalation thresholds.
• Capital and liquidity protection: holding resources against unexpected loss and ensuring survival during stress.
• Supervision and disclosure: requiring independent review, reporting and corrective action.

Regulation uses both quantitative and qualitative controls. Quantitative controls include capital charges, limits, stress tests and liquidity requirements. Qualitative controls include governance, model validation, internal audit, documentation, data quality, outsourcing controls and recovery planning. No single metric captures all relevant risk. A bank may satisfy a capital ratio and still fail because of weak governance, excessive concentration or an inability to restore critical services.

A useful distinction is between expected loss, which should normally be priced and provisioned, and unexpected loss, for which capital is held. Extreme but plausible losses are examined through stress testing. Risk measures are therefore complements rather than substitutes.

2. Market risk and trading-book regulation

2.1 Meaning and sources of market risk

Market risk is the risk of loss from movements in market prices. In a trading book, the principal risk factors include:

• interest rates and yield curves;
• foreign-exchange rates;
• equity prices;
• commodity prices;
• credit spreads;
• volatility and correlation;
• basis relationships between related instruments.

A trading book contains instruments held with the intention of short-term resale, profiting from actual or expected price movements, or benefiting from arbitrage. Classification is governed by regulatory rules rather than management preference. Moving a losing position from the trading book to the banking book merely to reduce capital requirements is not acceptable.

Market risk can be directional, such as a loss caused by rising yields on a bond position; basis risk, such as imperfect movement between two related rates; curvature risk, arising from non-linear instruments; or volatility risk, which is material in options. Derivatives create counterparty and collateral risks in addition to market risk.

2.2 Standardised and internal approaches

A regulatory market-risk framework generally permits a standardised approach and, subject to approval, an internal-model approach.

The standardised approach maps exposures to prescribed risk classes and risk factors. Under modern Basel market-risk reforms, it is designed to capture delta risk, vega risk and curvature risk, together with default risk and residual risk add-ons where relevant. Its advantages are comparability, transparency and reduced model risk. Its disadvantages are potential coarseness and a limited ability to reflect a bank’s specific portfolio characteristics.

The internal-model approach allows approved institutions to use internally developed models, subject to strict governance, data, validation, profit-and-loss attribution, back-testing and supervisory approval. It is not a licence to use any preferred model. Supervisors may restrict model use to trading desks and may require standardised capital where a desk fails eligibility tests.

2.3 Value at risk and expected shortfall

Value at risk (VaR) estimates a loss threshold over a specified horizon and confidence level. If daily loss is represented by the random variable L, then VaR at confidence level c is the appropriate quantile of the loss distribution:

Here, L is non-negative when it represents loss, c is a probability such as 0.99, and the result is expressed in a currency amount. VaR does not state how large losses may be beyond the threshold. It is also sensitive to the selected horizon, confidence level, historical window, valuation method and assumptions about liquidity.

Expected shortfall (ES) measures the average loss in the tail beyond VaR. For a continuous loss distribution, it may be written as:

The symbol E denotes expected value. ES is generally more informative than VaR about tail severity and has a desirable property known as subadditivity under standard conditions. In practice, however, ES remains dependent on data, scenario design and model assumptions. It does not make extreme events predictable.

A simple example illustrates the distinction. Suppose a portfolio’s simulated daily losses at the 95% tail are 6, 8, 9, 12 and 20 monetary units, and the selected VaR threshold is 10. VaR is 10 monetary units under the stated convention. If the losses beyond the threshold are 12 and 20, the corresponding tail average is:

This example is illustrative rather than a regulatory calculation: actual regulatory methodologies use prescribed horizons, liquidity horizons, risk-factor treatment and stress data.

2.4 Stress testing and back-testing

Stress testing asks what would happen under a severe but plausible scenario. Scenarios may be historical, hypothetical or reverse-stress scenarios. Examples include a parallel yield-curve shift, a sharp currency depreciation, widening credit spreads, a volatility spike and reduced market liquidity.

Back-testing compares model-generated risk estimates with subsequent trading outcomes. An exception occurs when the actual loss exceeds the model’s estimate. A high number of exceptions may indicate poor calibration, omitted risk factors, unstable data or excessive model complexity. Back-testing is informative but not conclusive: a model may pass several years of testing and still fail under an unobserved regime change.

2.5 Governance of trading-book risk

Effective governance requires:

• clearly documented trading-book boundary policies;
• independent valuation and price verification;
• prudent valuation adjustments for uncertainty, liquidity and model risk;
• desk-level limits and escalation procedures;
• independent model validation;
• controls over new products;
• collateral and margin management;
• daily profit-and-loss attribution;
• reliable risk-factor and position data.

Senior management must understand the economic meaning of model outputs rather than treating regulatory capital as an automatic measure of safety.

3. Interest-rate risk in the banking book

3.1 Nature of IRRBB

IRRBB is the risk to a bank’s capital, earnings or economic value arising from movements in interest rates in positions outside the trading book. Typical banking-book instruments include loans, deposits, mortgages, bonds held for investment and funding arrangements.

The principal sources are:

1. Repricing risk: assets and liabilities reset at different times.
2. Yield-curve risk: rates at different maturities move by different amounts.
3. Basis risk: instruments reprice using imperfectly related reference rates.
4. Option risk: borrowers, depositors or counterparties exercise embedded or explicit options.
5. Behavioural risk: customer behaviour changes when rates move, affecting deposit duration, prepayments or drawdowns.

IRRBB is not simply the risk that rates rise. A bank can suffer when rates fall if asset yields decline faster than funding costs, or if customers exercise options in an adverse manner.

3.2 Earnings and economic-value perspectives

Two perspectives are particularly important.

The net interest income (NII) perspective examines the effect of rate changes on earnings over a defined period, often one to three years. It is useful for budgeting, profitability and early-warning analysis, but it may not capture the full present value of long-term cash flows.

The economic value of equity (EVE) perspective examines the change in the present value of expected asset cash flows minus the present value of liability cash flows. A simplified representation is:

where PV means present value under specified discount rates. The change under a scenario is:

A negative ∆EVE indicates a reduction in economic value. The calculation requires assumptions about contractual and behavioural cash flows, discount curves, embedded options and the treatment of equity. It is not a market price of the bank and should not be interpreted without those assumptions.

3.3 Present value and duration

For cash flows CF_t received at times t, discounted at rate r per period, present value is:

The formula assumes a consistent compounding convention and rate per period. If cash flows are annual, t is measured in years and r is an annual effective rate.

For a plain fixed-rate instrument, modified duration provides a first-order approximation of price sensitivity:

Here, P is price, D_mod is modified duration in years, and ∆y is the change in yield expressed as a decimal, not percentage points. The approximation assumes a relatively small yield change and ignores convexity. For large shocks or instruments with material options, full revaluation is preferable.

For example, if modified duration is 4.5 years and yield rises by 0.01, the approximate price change is:

Thus, price falls by approximately 4.5%, subject to the assumptions above.

3.4 Regulatory expectations for IRRBB

Supervisory frameworks generally require banks to:

• maintain a board-approved IRRBB policy;
• define risk appetite and limits for NII and EVE;
• identify material currencies and risk concentrations;
• perform prescribed and institution-specific shock scenarios;
• model non-maturity deposits and prepayment behaviour prudently;
• validate assumptions and conduct sensitivity analysis;
• hedge exposures where appropriate;
• report significant deterioration to senior management and supervisors.

Supervisors commonly use threshold tests to identify institutions whose EVE or NII sensitivity is unusually high relative to capital or earnings. Such tests are screening tools, not replacements for supervisory judgement.

3.5 Hedging and limitations

Banks may use swaps, futures, options and natural balance-sheet matching to manage IRRBB. A pay-fixed, receive-floating interest-rate swap, for example, can reduce the exposure of a floating-rate liability to rising rates, but it introduces counterparty, collateral, basis and valuation risks.

Important limitations include uncertainty about deposit duration, modelled prepayments, future loan growth and customer behaviour. A hedge that appears effective under a parallel rate shock may be ineffective under a steepening or flattening curve. Governance must therefore focus on the economic rationale of hedges, not only accounting or regulatory treatment.

4. Operational-risk regulation

4.1 Definition and scope

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but normally excludes strategic and reputational risk from the formal definition, although those risks may result from operational failures.

Examples include payment-processing errors, cyberattacks, fraud, conduct failures, model-data errors, unsuitable change management, premises disruption and failure of a critical supplier. Operational risk exists in every business line and cannot be eliminated through diversification alone.

4.2 Regulatory capital and management framework

Modern Basel reforms replaced complex calculation options with a standardised operational-risk capital approach based broadly on two elements: a business indicator reflecting the scale and composition of activity, and an internal loss multiplier reflecting the institution’s historical operational losses. The exact regulatory formula and parameters are jurisdiction-specific and must be taken from the applicable rulebook.

Capital is only one component of operational-risk management. A sound framework includes:

• a board-approved operational-risk appetite;
• a three-lines model of business ownership, independent risk oversight and internal audit;
• risk and control self-assessments;
• incident and near-miss reporting;
• loss-data collection and external event analysis;
• key risk indicators;
• scenario analysis;
• business-process mapping;
• issue management and remediation tracking;
• insurance and risk transfer where appropriate.

Operational loss data must be classified consistently. Under-reporting small incidents can conceal deteriorating controls, while excessive aggregation can prevent root-cause analysis.

4.3 Cyber, fraud and model-related operational risk

Cyber risk is operational risk with distinctive speed, interdependence and systemic potential. Controls should include identity and access management, segregation of duties, privileged-access monitoring, secure development, patching, network resilience, backups, threat intelligence and tested incident response.

Fraud controls require more than transaction screening. They include staff conduct standards, customer authentication, segregation of duties, whistleblowing channels, analytics, investigation protocols and protection against social engineering.

Model risk arises when a model is incorrectly designed, implemented, used or interpreted. It is operational as well as quantitative. Independent validation, version control, documentation, performance monitoring and human challenge are essential, especially when models use machine learning.

5. Business continuity and operational resilience

Business continuity asks how an institution will continue or resume activities after disruption. Operational resilience is broader: it asks whether the institution can continue delivering important business services within a stated tolerance for disruption, even when prevention fails.

5.1 Important business services and impact tolerances

A resilience programme begins by identifying important business services, such as retail payments, cash access, securities settlement or critical lending operations. The bank maps the people, processes, facilities, technology, data and third parties supporting each service.

An impact tolerance defines the maximum tolerable level of disruption, such as a maximum duration, volume of unprocessed transactions, data loss or customer harm. It differs from a recovery-time objective (RTO): an RTO is a recovery target, whereas an impact tolerance expresses the maximum disruption acceptable from a customer, market or safety-and-soundness perspective.

Figure: Operational resilience links important services to tolerances, dependencies and testing.

5.2 Continuity capabilities

A credible continuity programme includes business-impact analysis, recovery strategies, alternate processing locations, resilient telecommunications, backup and restoration, crisis communications, staff succession, manual workarounds and clear decision rights. Plans should distinguish short disruption, prolonged outage, cyber compromise and loss of a critical supplier.

Testing must be practical. Tabletop exercises assess decision-making; technical tests assess restoration; scenario exercises test cross-functional coordination; and severe-but-plausible tests examine whether impact tolerances are breached. Test results should generate owners, deadlines and verified closure—not merely a report.

6. Third-party dependencies and concentration risk

Outsourcing can improve efficiency and access to specialist technology, but it does not transfer regulatory accountability. The bank remains responsible for services performed by vendors.

Third-party due diligence should examine financial condition, ownership, security controls, resilience, subcontractors, data location, regulatory access, incident history, insurance and exit capability. Contracts should address service levels, audit rights, notification, data protection, business continuity, testing, subcontracting, termination and secure deletion or return of data.

Cloud concentration creates a distinctive issue: several banks may rely on the same infrastructure provider, region, software component or telecommunications network. Individual vendor risk assessments may therefore underestimate systemic concentration. Institutions should identify common dependencies, portability constraints and realistic exit strategies. A theoretical right to terminate a contract is not an operational exit capability unless staff, data, architecture and alternative capacity are available.

7. Governance, data and emerging technology

The board is responsible for approving risk appetite and ensuring that management has adequate systems, expertise and challenge. Senior management translates this into limits, policies, staffing, investment and escalation. The chief risk officer should have sufficient independence, authority and access to the board. Internal audit evaluates the design and effectiveness of the overall framework.

Risk data must be timely, complete, accurate and traceable. Aggregation failures can arise from inconsistent product identifiers, fragmented legacy systems, manual spreadsheets and incompatible definitions. Regulatory reporting should be reconciled to financial and risk systems, with controls over lineage and adjustments.

Artificial intelligence can improve anomaly detection, fraud monitoring, scenario generation and operational forecasting. It can also create opacity, bias, data leakage, unstable performance and third-party dependence. Governance should require a defined purpose, explainability proportionate to impact, human accountability, validation, monitoring for drift, security testing and the ability to suspend or override the system. A model’s predictive accuracy does not by itself establish that its use is fair, lawful or operationally safe.

8. Integrated case: resilience failure at Meridian Bank

This is an illustrative fictional case.

Background

Meridian Bank used a cloud-based payments platform, a separate fraud engine and an internal customer database. Its board received monthly operational-loss reports and approved a two-hour recovery-time objective for retail payments. The bank had performed annual tabletop exercises but had not tested restoration from a complete loss of the primary cloud region.

Problem

A software update caused incompatible data formats between the payments platform and fraud engine. The resulting queue stopped payment processing. At the same time, a subcontracted identity service became unavailable. Meridian had backup data, but restoration required a decryption key held by a different supplier. Customer transactions accumulated, fraud alerts could not be processed reliably and call-centre staff lacked a current manual procedure.

Analysis

The immediate incident was a technology failure, but the root causes were broader:

• dependency mapping stopped at the primary vendor and omitted subcontractors;
• the recovery plan measured systems rather than the end-to-end payment service;
• the impact tolerance was not connected to customer harm and transaction backlogs;
• recovery dependencies, including keys and identity services, were not tested together;
• change management did not require a full compatibility test;
• management information reported incidents but not near misses or unresolved resilience gaps.

The bank’s capital position was not the central issue. Its problem was the inability to deliver an important service within its tolerance.

Approach and solution

Meridian established a service owner for retail payments, mapped all supporting resources and defined an impact tolerance based on maximum outage duration, unprocessed volume and customer-access consequences. It created an independent recovery environment, held encryption keys under a controlled arrangement, and required critical vendors to disclose subcontractors and participate in testing. It also introduced release segregation, canary deployment, reconciliation controls and a manual payment process for limited emergency use.

The bank conducted a severe-but-plausible exercise involving simultaneous loss of the cloud region and identity provider. The exercise revealed that the alternative provider could not process the required volume. Meridian therefore reduced dependency concentration, pre-positioned data and contracted tested capacity. Board reporting was revised to show tolerance breaches, open remediation actions and evidence from tests.

Outcome

A later controlled test restored critical payment functions within the revised tolerance, although non-critical reporting remained unavailable longer. The bank accepted that resilience did not mean preventing every failure; it meant limiting customer harm, detecting failure quickly, recovering safely and learning from evidence.

Learning points

1. Operational resilience is service-centred, not merely infrastructure-centred.
2. Outsourcing does not outsource accountability.
3. Recovery objectives must be tested against realistic dependencies and volumes.
4. Concentration and subcontracting risks require enterprise-wide visibility.
5. Governance improves when reports show evidence, tolerances and remediation rather than only incident counts.

9. Challenges and limitations of regulation

Regulation faces several persistent difficulties. First, historical data may not represent future market regimes or cyber threats. Second, standardised rules promote comparability but can encourage mechanical compliance. Third, internal models may create an illusion of precision. Fourth, operational risk is difficult to quantify because losses are infrequent, heterogeneous and affected by reporting incentives. Fifth, resilience is partly systemic: a bank may be well controlled individually but vulnerable to a shared cloud, payment or telecommunications dependency.

There is also a proportionality challenge. Excessively complex controls can divert resources from material risks, while weak controls expose customers and the financial system. Supervisors and boards must therefore combine rules with judgement, evidence and continuous challenge.

Best-practice checklist

A mature institution should be able to demonstrate that it:

• maintains a clear boundary between trading and banking books;
• measures market risk using complementary models, limits and stress tests;
• validates IRRBB behavioural assumptions and examines both NII and EVE;
• records operational incidents, near misses and root causes consistently;
• identifies important services and explicit impact tolerances;
• maps fourth-party and common-provider dependencies;
• tests restoration, communications and manual workarounds;
• maintains realistic exit and substitution strategies;
• governs AI and models through independent validation and human accountability;
• reports unresolved vulnerabilities directly to accountable senior leaders and the board.

Chapter Summary

Market risk regulation controls losses from trading-book price movements through book-boundary rules, standardised measurements, approved internal models, stress testing, back-testing, limits and governance. VaR provides a quantile-based loss threshold, while expected shortfall describes average loss in the tail; both depend on assumptions and data.

IRRBB concerns rate effects on banking-book earnings and economic value. Repricing, yield-curve, basis, option and behavioural risks must be analysed together. NII and EVE provide complementary perspectives, while duration offers a useful but limited first-order approximation for fixed-income sensitivity.

Operational-risk regulation addresses failures of people, processes, systems and external events. Capital requirements must be supported by controls, incident data, scenario analysis, cyber security, fraud prevention and model governance. Business continuity and operational resilience extend this analysis to important services, impact tolerances and end-to-end dependencies. Third-party arrangements create concentration, subcontracting, data, exit and accountability risks. Effective regulation therefore combines quantitative discipline with governance, testing, evidence and ethical responsibility.

Key Terms

Market risk: Risk of loss from movements in market prices or risk factors.

Trading book: Positions held for trading-related purposes under regulatory classification rules.

Banking book: Positions generally held outside the trading portfolio, including lending and funding positions.

Value at risk (VaR): A specified loss quantile over a stated horizon and confidence level.

Expected shortfall (ES): Average loss in the tail beyond a selected VaR threshold.

Stress testing: Analysis of outcomes under severe but plausible scenarios.

Back-testing: Comparison of model risk estimates with subsequent realised outcomes.

IRRBB: Interest-rate risk arising from banking-book positions.

Net interest income (NII): Interest income minus interest expense over a defined period.

Economic value of equity (EVE): Present value of assets less present value of liabilities.

Repricing risk: Risk caused by different timing of asset and liability rate resets.

Basis risk: Risk that related reference rates do not move together.

Operational risk: Loss risk from inadequate or failed processes, people, systems or external events.

Impact tolerance: Maximum acceptable disruption to an important business service.

Recovery-time objective (RTO): Target time for restoring a process or system.

Operational resilience: Ability to continue important services within tolerances during disruption.

Third-party risk: Risk arising from reliance on external providers or their subcontractors.

Concentration risk: Excessive dependence on a provider, technology, market or common infrastructure.

Model risk: Risk of adverse consequences from incorrect model design, implementation or use.

Three lines model: Business ownership, independent risk oversight and internal audit.

Review Questions

Short Answer Questions

1. What is the principal difference between market risk in the trading book and IRRBB?
2. Define expected shortfall and state one limitation of VaR.
3. Identify four sources of IRRBB.
4. What is an impact tolerance?
5. Why does outsourcing not remove a bank’s regulatory accountability?

Long Answer Questions

1. Explain the roles of the standardised approach, internal models, stress testing and back-testing in trading-book regulation.
2. Compare the NII and EVE perspectives for measuring IRRBB, including their assumptions and limitations.
3. Discuss how operational-risk capital requirements should be integrated with incident management, scenario analysis and control frameworks.
4. Explain how a bank should design and test a business-continuity and operational-resilience programme.
5. Evaluate the governance challenges created by cloud outsourcing, subcontracting and common third-party dependencies.

Analytical / Application Questions

1. A fixed-income portfolio has modified duration of 4.5 years. Using the small-change duration approximation, estimate the percentage price change if yield rises by 0.75 percentage points. State the assumptions and limitations of your answer.
2. A bank reports low operational losses but has never tested recovery from the simultaneous failure of its cloud provider and identity service. Assess whether its operational-risk profile can reasonably be considered low, and recommend evidence that management should obtain.
3. A bank’s EVE falls materially under a steepening yield curve, while its one-year NII rises. Explain how both results can occur and identify governance actions that should follow.

Multiple Choice Questions with Answers

Question 1

Which measure describes the average loss beyond a selected tail threshold?

A. Expected shortfall

B. Net interest income

C. Modified duration

D. Recovery-time objective

Correct Answer: A. Expected shortfall

Question 2

A portfolio has modified duration of 4 years. If yield rises by 0.01, the approximate percentage price change is:

A. +4%

B. −4%

C. +0.04%

D. −0.04%

Correct Answer: B. −4%

Question 3

Which risk arises when assets and liabilities reset at different times?

A. Basis risk

B. Repricing risk

C. Residual risk

D. Settlement risk

Correct Answer: B. Repricing risk

Question 4

What does EVE primarily measure?

A. The present-value effect of rate changes on assets minus liabilities

B. Only the next day’s trading loss

C. The number of operational incidents

D. The time required to restore a system

Correct Answer: A. The present-value effect of rate changes on assets minus liabilities

Question 5

Which is an example of operational risk?

A. A bond price decline caused by a yield movement

B. A currency position losing value after depreciation

C. A payment-processing failure caused by an incompatible software update

D. A customer choosing a fixed-rate mortgage

Correct Answer: C. A payment-processing failure caused by an incompatible software update

Question 6

What is the principal purpose of back-testing a market-risk model?

A. To compare model estimates with subsequent realised outcomes

B. To determine a vendor’s ownership structure

C. To calculate employee turnover

D. To replace all stress testing

Correct Answer: A. To compare model estimates with subsequent realised outcomes

Question 7

An impact tolerance specifies:

A. The maximum acceptable disruption to an important business service

B. The minimum return required on a trading position

C. The accounting life of a derivative

D. The number of vendors a bank must appoint

Correct Answer: A. The maximum acceptable disruption to an important business service

Question 8

Which statement about outsourcing is correct?

A. Outsourcing transfers regulatory accountability to the vendor

B. Outsourcing eliminates concentration risk

C. The bank remains accountable for outsourced activities

D. Outsourced services need not be tested

Correct Answer: C. The bank remains accountable for outsourced activities

Question 9

Why can EVE and NII show different effects from the same rate scenario?

A. They use different time horizons and perspectives

B. They always use identical cash flows and assumptions

C. EVE excludes liabilities

D. NII measures only market prices

Correct Answer: A. They use different time horizons and perspectives

Question 10

Which control is especially relevant to model risk?

A. Independent validation and performance monitoring

B. Removing all human oversight

C. Using only one historical observation

D. Avoiding documentation to preserve flexibility

Correct Answer: A. Independent validation and performance monitoring