Operational Risk in Panama Banking: Agreement 11-2018 Guide

Almost every bank has an operational risk manual. What the supervisor wants to see is something else: which events were recorded last year, who reported them and what changed in the processes afterwards. That is where operational risk management in Panama's banking sector breaks down. The manual exists, but the event database is nearly empty and the risk matrix was last updated for the previous audit.

What the Superintendency of Banks requires

The rule is Agreement 011-2018 of the Superintendency of Banks (SBP), dated September 11, 2018, "which issues new provisions on Operational Risk". It repealed Agreement 007-2011 and took effect on December 31, 2019. You can read the official text on the SBP website.

Who it applies to

Under Article 2, the management provisions apply to all general license banks and to international license banks for which the SBP acts as home supervisor. International license banks under host supervision must have their own operational risk management, subject to review. The Superintendent may require the same rules from them whenever it considers it appropriate.

The definition that governs

The Agreement defines operational risk as the possibility of losses from failures or shortcomings in human resources, processes, technology, infrastructure, management information, models or external events. It includes the legal risk associated with those factors. It excludes lost profits, reputational risk and strategic risk.

Note the order in Article 7: the second factor is internal processes, and the rule requires them to be documented, defined and permanently updated. Without a current process map, there is nowhere to hang the risks.

The Agreement is aligned with the Basel Committee principles. Their most recent revision is Revisions to the principles for the sound management of operational risk, from March 2021.

The building blocks of operational risk management

Article 8 sets out the stages: identification, measurement, mitigation, monitoring, control and reporting. In practice, that translates into six pieces that must exist and talk to each other.

Structure and accountability

The board of directors approves the strategy and the methodology, and Article 5 requires reviewing them every year. The risk committee oversees management. The risk management unit must be independent from the business areas. For identification, Article 9 has that unit work together with the process owner. If the process has no owner, identification has no counterpart.

This structure rests on the institution's corporate governance. We explain it in our guide to Agreement 005-2011.

Policies, manual and risk appetite

Article 6 lists the minimum content:

• the duties of each body,
• the detailed management process,
• the measurement tools,
• the approval process for new products,
• the form and frequency of reporting to the board, the committee and senior management.

The global limit and the specific limits translate risk appetite into concrete thresholds.

Risk matrices and maps

Operational risk matrices and inherent and residual risk maps are built process by process. Article 22 also requires a documented self-assessment of the control environment at least once a year.

The loss event database

This is the hardest piece. Article 23 requires a centralized database recording events and incidents across the whole bank, with 29 minimum fields per record: business line, process or area, risk type and cause according to the Agreement's annexes, dates of occurrence, discovery and accounting entry, exposure amount and recoveries, among others.

Two details get overlooked. Every event must carry an exposure amount, estimated if it cannot be quantified. And events that did not turn into a loss are recorded too, because they are the early warning.

Indicators and alerts

Key operational risk indicators (IRO, in the Spanish acronym) need defined thresholds and someone who acts when they are crossed. An indicator without a threshold is just a report.

New products and continuity

Before a product or service is launched, the risk unit gives its opinion on the operational risks it brings. Article 21 adds a business continuity plan, tested at least once a year, and an information security management system.

The January 31 annual report

Article 28 requires sending the SBP an annual operational risk management report by January 31. Its content is set out in General Resolution SBP-RG-0192-2019, dated November 25, 2019:

1. Organizational structure: risk committee members, the unit's organization chart and staff assigned to operational and legal risk.
2. Classification of products by business line and details of new launches, with the risk unit's prior opinion.
3. The unit's work plan, with its completion percentage at year end.
4. Ongoing training: date, topic, participants, organizer and hours of each session.
5. Tools: global limit, specific limits, early warning indicators and an inventory of updated matrices.
6. Behavior of events and incidents by risk type, and the five most critical causes with their action plan.

Banks with less than one year of operation submit only some of the items.

Item 6 is built from the event database. If the database was not fed during the year, there is no way to rebuild it in January. That is why this report is prepared from February to December, not in the two weeks before the deadline.

What I have seen in banks

In the banks where I have worked, the problem was rarely the methodology. It was that operational risk lived in a unit of two or three people and the rest of the bank saw it as one more form. Events arrived once there was already an accounting loss, never before. What moved the needle was not new software: it was naming a risk liaison in every area, tying every risk to a process with an owner and reviewing the event database in committee every month, not at year end.

If your processes are not mapped yet, start there. In our BPMN guide we explain how to do it step by step.

Checklist: your operational risk framework in 10 points

1. The board approved the strategy, methodology and limits, and reviewed them this year.
2. The risk management unit is independent from the business areas.
3. The process map is current and every process has a named owner.
4. Every risk in the matrix is tied to a process, with controls and an owner.
5. The event database has the Article 23 fields and a capture procedure.
6. Every area has a liaison who reports events and incidents, including those with no loss.
7. Risk indicators have thresholds and a defined action when they are crossed.
8. No new product goes out without the risk unit's prior opinion.
9. The continuity plan was tested in the last twelve months.
10. Training is recorded with date, topic, participants and hours.

Common mistakes in bank operational risk management

• A nearly empty event database. It does not mean nothing happens: it means nobody reports it. What is usually missing is a clear definition of an event and a simple channel to report it.
• Matrices built by the risk unit alone. If the process owner did not take part, the matrix describes a process that does not exist.
• Controls with no owner or evidence. A control nobody performs with a record mitigates nothing in an examination.
• Products launched without a risk opinion. They later show up in the annual report without the prior opinion that RG-0192-2019 requires.
• A report put together in January. Data rebuilt from memory, inconsistent with the accounting records.
• A continuity plan that was never tested. The Agreement requires testing it at least once a year, and the test is the evidence.

Where to start

An operational risk framework for banking in Panama is not built with another manual. It is built with documented processes, clear owners and an event database fed every week. At Alternative we help financial institutions map their processes and connect their risk matrices to real operations, with a team of 15+ years of experience. We do it through our banking and financial services practice and our SBP regulatory compliance practice.

If you want to know where your bank stands today against Agreement 11-2018, book a free 15-minute diagnosis.