Part II, Title I, Article 32 · Commission Delegated Regulation (EU) 2026/1167

Contents

Article 32Attributes#

1.Institutions shall assign to each loss event all the applicable of the following attributes:^noteAttributesDescriptionLegal risk – MisconductAs defined in Article 4, point (52a), (d), of Regulation (EU) No 575/2013.Legal risk – Other than MisconductAs defined in Article 4, points (52a)(a), (b), (c),(e), (f) and (g) of Regulation (EU) No 575/2013.Model riskAs defined in Article 4, point (52b) of Regulation (EU) No 575/2013.ICT risk – not related to CyberAs defined in Article 4, point (52c) of Regulation (EU) No 575/2013, excluding losses from cyber-attacks.ICT risk – related to CyberLosses induced by cyber-attacks as defined in Article 3, point (14), of Regulation (EU) 2022/2554.Credit risk (where not included in credit risk weighted assets)Operational risk losses related to credit assets, including credit frauds (committed by the client on its own account or by a third party through identity theft), unenforceable credit contracts or collateral failures, that have been unpaid and are not accounted for in the risk-weighted exposure amount for credit risk.Market riskThe following events, and the related losses, shall be classified as operational risk related to financial transactions and market risk:

(a)events due to operational and data entry errors, including the following:

(i)failures and errors during the introduction or execution of orders;

(ii)loss of data or misunderstanding of the data flow from the front to the middle and back offices of the institution;

(iii)errors in classification;

(iv)incorrect specification of deals in the term-sheet, including errors related to the transaction amount, maturities and financial features;

(a)natural persons;

(a)retail and private banking: lending and deposits, transactional and saving accounts, ATMs services, banking services, financial leasing, guarantees and commitments, trusts and estates, investment advice, card services (debit and credit cards, merchant/commercial/corporate cards, private labels);

(a)equities: equity portfolios and indices;

(a)corporate finance: mergers and acquisitions, underwriting, privatisations, securitisation, initial public offering and private placements, advisory services, municipal and government finance, merchant banking;

(b)events due to failures in internal controls, including the following:

(i)failures in properly executing an order to unwind a market position in case of adverse price movements;

(ii)unauthorised positions taken in excess of allocated limits, irrespective of the type of risk they relate to;

(b)SMEs (small and medium-sized enterprises) as defined in Article 5, point(9), of Regulation (EU) No 575/2013.

(b)retail brokerage: reception, transmission and execution of client orders, placing of financial instruments without a firm commitment basis.

(b)fixed income and credit trading;

(b)payments and settlements for external clients: payments and collections, funds transfer, cash and securities clearing and settlement; payment and settlement losses related to a institution´s own activities shall be incorporated in the affected business line;

(c)events due to inadequate data quality and unavailability of IT environment, including technical unavailability of access to the market resulting in an inability to close contracts.

(c)foreign exchange;

(c)agency services for the account of clients: custody services (escrow, depository receipts, corporate actions, etc.), corporate trust and agency (issuer and paying agents);

(d)commodities and energy products;

(d)asset management: discretionary and non-discretionary fund management, including portfolio management (pooled, segregated, retail, institutional, closed, open, private equity);

(e)money market, funding, repos and securities lending;

(e)corporate items: for purely corporate level items, including those affecting the Board of Directors, misreporting financial statements, or other events that can only be categorised at corporate centre.

(f)derivatives.

Third-party riskLosses that may arise for an institution in relation to its use of services provided by third-party service providers or by subcontractors of the that provider, including through outsourcing arrangements.Those losses include losses due to failures in managing third-party relationships and risks appropriately, including developing and maintaining an adequate third-party control framework (including due diligence including selection of third-party service providers, ongoing monitoring) or defining and implementing adequate contractual arrangements / service level agreements.Environmental, social and governance risksLosses that may arise from environmental, physical, and transition risks, as defined in Article 4, points (52e), (52f), and (52g) of Regulation (EU) No 575/2013. Losses that may arise from social and governance risks, as defined in Article 4, points (52h) and (52i), of Regulation (EU) No 575/2013.Greenwashing riskThe scope of application includes greenwashing risk, with reference to the losses arising from practices whereby sustainability related statements, declarations, actions, or communications do not clearly and fairly reflect the underlying sustainability profile of an entity, a financial product, or financial services. Those practices may be misleading to consumers, investors or other market participants.Business continuityFailure to provide and maintain appropriate business continuity management and event management framework (including ICT business continuity and ICT recovery and response aspects as referred to in Articles 11 and 12 of Regulation (EU) 2022/2554), and in Articles 24, 25 and 26 of Commission Delegated Regulation (EU) 2024/1774^note, including inadequate business continuity plans.Retail (including banking and retail brokerage)Operational events and losses linked to retail clients, including:The list of activities for this attribute includes:Trading and salesOperational events and losses linked to activities including flow business and sales, brokerage, market making, treasury, position taking, and proprietary positions managed by trading desks, as defined in Article 4, point (144), of Regulation (EU) No 575/2013.The list of products for this attribute includes:Commercial bankingOperational events and losses linked to activities including lending and deposits, guarantees, leasing and factoring, trade finance, project finance, real estate.Other business lines (including corporate finance, payment and settlement, asset management, agency services, corporate items)This attribute includes the remaining operational events and losses linked to activities, other than those referred to in in the Retail, trading and sales, and Commercial banking attributes, including the following:

2.By way of derogation from paragraph 1, institutions shall assign to each loss event at least one attribute among ‘Retail (including banking and retail brokerage)’, ‘Trading and sales’, ‘Commercial banking’ and ‘Other business lines (including corporate finance, payment and settlement, asset management, agency services, corporate items)’.

3.By way of derogation from paragraph 1, institutions shall assign the attributes ‘Legal risk – Misconduct’, ‘Legal risk – Other than misconduct’ and ‘Model risk’ to Level 1 event types and Level 2 categories in accordance with the Annex.