How operational risk can hit banks, brokers and exchanges

Not every financial loss comes from market moves. Sometimes systems crash, staff make errors or hackers break in. These are operational risks. This page explains what operational risk means, real examples from markets and how firms and regulators manage it.

Quick answer

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Examples include technology outages, human errors, fraud, cyber attacks and natural disasters. The definition is used by the Basel Committee for banks. Exchanges, brokers and fund houses also face operational risk and must keep strong controls and backup systems.

Key takeaways

• Operational risk comes from processes, people, systems and outside events.
• Examples include outages, errors, fraud and cyber attacks.
• Banks hold capital against it under Basel rules.
• NSE faced a trading halt of several hours in February 2021.
• SEBI requires cyber security and business continuity plans.

What is operational risk?

The Basel Committee on Banking Supervision defines it as the risk of loss from failed internal processes, people and systems, or from external events. It is separate from market risk, which comes from price moves, and credit risk, which comes from borrowers not repaying.

Every financial firm faces it, because every firm depends on people, software and processes that can fail.

Types of operational risk

A well-known type is the 'fat finger' error, where a trader types a wrong number, such as an extra zero, and places a far larger order than intended. Such errors have caused sudden price swings in markets around the world.

Real examples from Indian markets

On 24 February 2021, NSE halted trading in its cash and derivatives segments for several hours because of a technical issue linked to its telecom links. Traders could not manage positions during the halt. The exchange later reviewed its systems, and SEBI asked for stronger business continuity arrangements.

Brokers have also faced app outages on busy trading days, leaving clients unable to place or exit trades. These events show that technology failures can directly affect investors.

How is operational risk managed?

Banks hold capital against operational risk under Basel rules adopted by the RBI. Firms use internal controls, separation of duties, regular audits and staff training to reduce errors and fraud.

SEBI requires market infrastructure institutions and regulated entities to have business continuity and disaster recovery plans. In 2024, SEBI issued a Cybersecurity and Cyber Resilience Framework for regulated entities, setting standards for protection, detection and recovery.

What can investors do?

Choose regulated brokers and keep your login details secure. Enable two-factor authentication, avoid sharing OTPs and keep your contact details updated so you get trade alerts. Know how to reach your broker by phone if the app fails.

In short, this risk is about things going wrong behind the scenes. Strong controls by firms, plus simple care by investors, help reduce its impact.

Frequently Asked Questions