A practical reference for op risk analysts using ORX loss data — covering datasets, taxonomy, analytical techniques, regulatory applications, and common pitfalls.
ORX (Operational Riskdata eXchange Association) is a not-for-profit industry body that operates the world's largest repository of operational risk loss data. Founded in 2002, it enables member banks — over 100 major institutions across 30+ countries — to pool anonymised internal loss data and benchmark their own risk profiles against the industry.
For an op risk analyst, ORX data serves three core purposes: benchmarking your bank's loss experience against peers, supplementing internal data for low-frequency/high-severity (LFHS) events, and supporting regulatory capital calculations and ICAAP narrative.
ORX data is a consortium dataset — it reflects pooled, anonymised submissions from members. You are not seeing another bank's raw data; you are seeing aggregated industry distributions. This shapes how you can and cannot use it.
Anonymised pooled loss data from major global banks. Industry benchmark distributions. Standardised Basel taxonomy. Peer comparison statistics (percentiles, means, frequencies).
Not a raw feed of named bank incidents. Not a forward-looking risk indicator. Not a replacement for your internal loss database. Not a real-time data source.
ORX publishes several distinct data products. Understanding which to use for a given analytical task is essential.
| Dataset | Description | Primary Use | Granularity |
|---|---|---|---|
| ORX Reference | Core annual report; aggregated industry-wide loss statistics by Basel event type and business line | Benchmarking, peer comparison, ICAAP narrative support | Category-level; no individual events |
| ORX News | Public domain loss events collated from press, regulatory filings, court records — named events >€10m | Scenario identification, tail event research, regulatory intelligence | Individual named events with descriptions |
| ORX Scenarios | Industry scenario library with severity distributions, based on expert elicitation and ORX data | Scenario analysis, stress testing, ICAAP capital scenarios | Scenario-level with percentile estimates |
| ORX Member Benchmarking | Customised benchmark reports comparing a member's loss profile to peer cohorts | Internal capital adequacy assessment, Board reporting | Cohort-level percentiles vs. member actuals |
| ORX Topology | Causal mapping of op risk events to root causes and controls | Risk and control self-assessment (RCSA), control effectiveness | Causal taxonomy level |
For ICAAP capital modelling, the most relevant products are ORX Reference (for frequency/severity benchmarks) and ORX Scenarios (for tail severity estimates in LFHS event types like CPBP and EPWS).
All ORX data is structured around the Basel II/III operational risk taxonomy. This is the lingua franca of the dataset — every loss is classified along two dimensions: event type and business line.
| Code | Event Type | Examples | Typical Profile |
|---|---|---|---|
| CPBP | Clients, Products & Business Practices | Mis-selling, market manipulation, fiduciary breaches, GDPR fines | Low frequency, very high severity — tail-dominant |
| EPWS | Employment Practices & Workplace Safety | Discrimination claims, unfair dismissal, HR violations | Moderate frequency, moderate severity |
| EF | External Fraud | Payment fraud, phishing, card fraud, cyber theft | High frequency, broad severity range |
| IF | Internal Fraud | Rogue trading, unauthorised activity, employee theft | Low frequency, occasionally catastrophic (Barings, SocGen) |
| BDSF | Business Disruption & System Failures | IT outages, payment system failures, data centre incidents | High frequency, varies with infrastructure complexity |
| DPA | Damage to Physical Assets | Natural disasters, terrorism affecting premises | Very low frequency, potentially very high severity |
| EDPM | Execution, Delivery & Process Management | Transaction errors, settlement failures, data entry mistakes | High frequency, typically lower severity — high-volume tail |
| Code | Business Line | Relevance for Retail/Universal Banks |
|---|---|---|
| CF | Corporate Finance | Advisory, DCM, ECM activities |
| TS | Trading & Sales | Fixed income, equities, FX, derivatives |
| RB | Retail Banking | Core for retail-focused banks (AIB, PTSB, BOI); CPBP and EF dominant |
| CB | Commercial Banking | SME lending, corporate banking |
| PS | Payment & Settlement | Payments infrastructure, clearing |
| AS | Agency Services | Custody, fund administration |
| AM | Asset Management | Funds, discretionary portfolio management |
| RBk | Retail Brokerage | Direct investing platforms |
Not all banks segment identically to the Basel taxonomy. ORX requires members to map their internal business lines to Basel BLs at submission. For analysis, be aware that the mapping may not be 1:1 — a product like a mortgage can sit in Retail Banking or Commercial Banking depending on the member's structure. This creates comparison noise at the BL level.
Understanding the data fields in ORX submissions is critical for correctly interpreting statistics. When members submit to ORX, each qualifying loss event includes a standardised set of fields.
| Field | Definition | Analyst Notes |
|---|---|---|
| Gross Loss | Total financial impact before recoveries (insurance, legal, provisions) | Primary severity measure; always use gross for capital modelling |
| Net Loss | Gross loss minus recoveries | More relevant for P&L impact reporting; lower than gross |
| Date of Occurrence | When the event actually happened | May differ significantly from date of discovery or accounting date |
| Date of Discovery | When the bank became aware of the event | Controls date for provisioning; lag from occurrence can be years (IF events) |
| Accounting Date | When loss was booked to P&L | Used for period-specific reporting; can create timing distortions |
| Basel Event Type | Primary classification from the 7 ET codes | One event, one primary ET — though complex events may have secondary ET |
| Basel Business Line | Business line where loss originated | Subject to member mapping conventions (see Section 3) |
| Collection Threshold | Minimum loss amount for inclusion; typically €20k or €10k | Critical for frequency analysis — threshold differences distort comparisons |
Loss events have three potentially different dates: occurrence, discovery, and accounting. A rogue trading event may occur over 2 years, be discovered in Q3, and be booked in Q4. When filtering ORX data by time period, always clarify which date axis you are using — this significantly affects frequency counts and severity distributions.
Operational risk capital models decompose loss distributions into a frequency model (how often events occur) and a severity model (how large they are when they do). ORX data feeds both components.
In practice:
The most common use of ORX Reference data is positioning your bank's loss experience relative to peers. Follow this approach:
Raw loss amounts are not comparable across banks of different sizes. Express losses as basis points of Gross Income, Total Income, or RWA to enable like-for-like comparison.
ORX segments members by bank type (retail, investment, universal) and size. Comparing a mid-sized retail bank to a global investment bank is not meaningful. Use the cohort that matches your business model.
Your aggregate loss ratio may look in-line, but you may be an outlier on one specific ET. Granular ET-level analysis surfaces true anomalies (e.g. elevated CPBP losses from a legacy mis-selling issue).
A high aggregate loss may result from high frequency of small events (an EDPM data quality issue) or low frequency but severe events (a single CPBP regulatory fine). The capital and management implications differ entirely.
ORX News contains named public loss events from press and regulatory filings. For scenario analysis, it is invaluable for calibrating severity anchors — especially for LFHS events your internal data cannot capture.
You are developing a CPBP scenario for a retail mortgage book. Internal data shows no events above €5m in 10 years. ORX News shows multiple European retail banks incurring €50–500m in mis-selling settlements. ORX Scenarios for CPBP Retail Banking shows a 99th percentile severity of €120m for a mid-sized retail cohort. Your scenario should set its severe outcome around this range, not at your internal maximum of €5m.
Under the SSM's SREP framework and EBA ICAAP guidelines, banks must hold internal capital for operational risk that reflects their actual risk profile — not just the Standardised Approach (SA) or Basic Indicator Approach output. ORX data is a central evidential input to this assessment.
| ICAAP Component | ORX Role |
|---|---|
| Internal Loss Distribution | ORX data supplements internal data for LFHS events; used to scale or calibrate tails |
| Scenario Analysis | ORX Scenarios provides pre-built scenarios with severity percentiles; ORX News anchors severity estimates |
| Business Environment Factors | ORX topology and causal data supports qualitative risk adjustments to modelled capital |
| Benchmarking / Plausibility | ORX Reference used to sanity-check internal capital estimates against peers; ECB will scrutinise outliers |
| Concentration Risk | High share of losses in one ET (e.g. CPBP >60% of capital) flagged against ORX cohort norms |
The ECB SREP assessment for operational risk increasingly scrutinises the quality and completeness of internal data and the credibility of scenario calibration. Key expectations include:
EBA Guidelines on ICAAP (EBA/GL/2019/02) explicitly state that institutions should use external data sources to supplement internal loss data, particularly for event types where the institution has limited internal experience. ORX Reference and ORX News are the standard accepted sources for this purpose under SSM.
ORX data is high-quality relative to most external datasets, but has well-documented limitations that analysts must understand and explicitly address.
Events below the collection threshold (€10k–€20k) are excluded. For high-frequency/low-severity ETs like EDPM and BDSF, this can significantly understate true frequency. Adjust frequency parameters upward when using ORX benchmarks.
Members may delay reporting large events pending litigation settlement. The most severe losses in ORX often appear with 2–5 year lags. Recent-year statistics are systematically understated — do not compare to current year as if contemporaneous.
Members classify events differently within the Basel taxonomy. A cyber-fraud event could be EF or BDSF depending on the member's convention. This creates noise particularly in boundary categories.
ORX membership is self-selected — larger, more sophisticated banks with mature frameworks. Smaller, less sophisticated banks are underrepresented. ORX benchmarks may understate the risk of less mature institutions.
ORX data spans decades and multiple currencies. When comparing historical severity to current estimates, always adjust for inflation. A €50m loss in 2005 is not comparable to €50m in 2024 in real terms.
ORX member banks have very different business models. Even within a named cohort (e.g. "European Retail"), product mix variation means the distribution reflects a heterogeneous pool, not a single archetype.
If you pull ORX Reference data for 2023, the statistics for 2022 and 2023 will be materially lower than for 2018–2021. This is not because op risk improved — it is because large CPBP and IF losses are still in litigation or pending regulatory settlement and have not been submitted. Always treat the most recent 2–3 years of ORX data as incomplete and use 5-year rolling averages for calibration.
A suggested end-to-end workflow for using ORX data in a capital assessment or ICAAP context.
Confirm which ORX dataset(s) you are using, the time window (exclude last 2 years as incomplete), and the appropriate ORX peer cohort for your bank's size and model.
Pull your internal loss database, apply the same Basel taxonomy, and normalise gross losses by Gross Income or RWA. Identify gaps — ETs with zero or very few internal events.
Compare internal frequency and severity metrics (mean, median, 75th, 95th percentiles) to ORX cohort statistics for each ET. Document where you are materially above or below.
For ETs with <10 internal events, use ORX Reference severity distributions as the primary severity input, scaled for your bank's size. For LFHS ETs (CPBP, IF), use ORX Scenarios and ORX News for severity anchors.
For each material scenario, search ORX News for comparable real-world events. Use these as the "severe but plausible" anchor for your 1-in-20 or 1-in-100 scenario severity.
For each ORX-sourced parameter, document: the cohort used, the time window, any threshold adjustments, the currency/inflation treatment, and any known taxonomy mapping issues. Supervisors will ask.
After running your capital model, compare the output (as % of Gross Income or RWA) to the ORX cohort median. If your estimate is below the 25th percentile or above the 75th, investigate why before presenting to senior management or the ECB.
| Use Case | Primary ORX Source | Secondary Source |
|---|---|---|
| Capital model frequency calibration | ORX Reference (event counts by ET) | Internal loss database |
| Capital model severity calibration (body) | ORX Reference (percentiles by ET) | Internal loss database |
| Capital model tail calibration (LFHS) | ORX Scenarios | ORX News events |
| ICAAP scenario severity anchor | ORX News | ORX Scenarios |
| Peer benchmarking / Board reporting | ORX Reference / Member Benchmarking | Public annual reports |
| RCSA calibration / control gaps | ORX Topology | ORX News (causal descriptions) |
| Emerging risk identification | ORX News (recent events) | Regulatory publications |