Basel III/IV, Explained to a Developer
In the article on default risk, I drew the line between expected loss, provisioned ahead of time, and unexpected loss, the kind that shows up when several borrowers default at once. Basel III, and its update often called Basel IV, are the regulatory answer to that second category: how much capital does a bank have to hold in reserve so that unexpected loss doesn't put the bank itself into default?
The problem, in engineering terms#
It's the equivalent of a redundancy standard imposed from the outside rather than chosen by the team running the system. Left to itself, a bank could decide its own safety margin, the same way an infrastructure team could pick its own replica count or its own capacity buffer. Basel imposes a non-negotiable floor, because a bank failing costs far more than its own balance sheet: the whole financial system absorbs the shock, not just the struggling institution.
RWA: weighting risk, not just adding up exposures#
The first idea to grasp is that Basel doesn't require capital proportional to a bank's total assets, but proportional to their risk-weighted value, RWA (Risk-Weighted Assets). A loan to an AAA-rated government and an unsecured loan to a B-rated company don't carry the same weight in the calculation, even at an identical amount: the first has a risk weight close to zero, the second a substantially higher one.
Two approaches coexist for computing that weight:
| Approach | Principle | Who uses it |
|---|---|---|
| Standardized | Weights set by the regulator, usually from the borrower's external rating | Mid-sized banks, or institutions without a validated internal model |
| IRB (Internal Ratings-Based) | The bank computes the weight itself, from its own PD, LGD and EAD (see the article on default risk) | Large banks, with internal models validated by the regulator |
This is exactly where the link to the previous article gets concrete: under the IRB approach, it isn't flat regulator-set weights that determine the required capital, it's directly the three parameters, PD, LGD and EAD, that the bank estimated itself and had validated. On two identical exposures, the risk weight changes everything:
CET1, Tier 1, Tier 2: capital quality matters as much as quantity#
Not all regulatory capital is equal. Basel ranks it in layers, from most able to absorb a loss immediately to most limited:
| Layer | Made of | Loss-absorbing capacity |
|---|---|---|
| CET1 (Common Equity Tier 1) | Common shares, reserves | The highest, absorbs losses continuously, not just in a failure |
| Additional Tier 1 | Hybrid instruments convertible into shares under a trigger | High, but only kicks in once a threshold is breached |
| Tier 2 | Subordinated debt | Absorbs losses only in a liquidation |
Three pillars, in brief#
| Pillar | What it covers |
|---|---|
| Pillar 1 | Minimum capital requirements, computed from RWA |
| Pillar 2 | Individualized supervision, including stress tests: a bank vulnerable to a given scenario has to hold more than the Pillar 1 minimum |
| Pillar 3 | Market discipline: the obligation to publish ratios and methodology, so the market itself can apply pressure |
Basel III to Basel IV: the output floor, the real change#
What people call Basel IV isn't a separate new text from Basel III, it's its finalization, phased in starting 2023 depending on the jurisdiction. The most concrete change concerns the IRB approach: a bank computing its own risk weights with internal models can no longer drop below 72.5% of what it would get under the standardized approach.
That's a guardrail with a direct engineering equivalent: an internal model is a proprietary risk engine, finely tuned on the bank's own data. The standardized approach is the reference implementation everyone has to at least match. Without a floor, nothing stops an internal model from gradually drifting toward ever-lower risk weights, not because the actual risk went down, but because the model was tuned to look less risky. The output floor caps that gap: the internal model stays allowed, but it can no longer drift indefinitely away from the shared reference.
A simplified worked example#
Bank's total RWA = 800,000,000 EUR
CET1 capital held = 64,000,000 EUR
CET1 ratio = CET1 capital / RWA
= 64,000,000 / 800,000,000
= 8%
Basel III minimum requirement = 4.5% (minimum) + 2.5% (conservation buffer)
= 7%
This bank meets the minimum requirement, with roughly a one-point margin. That margin isn't a luxury: an additional countercyclical buffer can be activated by the regulator during a period of excessive credit growth, which raises the required threshold further without the bank having changed its own risk profile at all.
Why this is good territory for a curious developer#
What makes Basel interesting beyond the regulation itself is that it forces two worlds that naturally distrust each other to coexist: a statistical model optimized to be accurate, and an external standard designed to stay robust even when the model is wrong. It's the exact same trade-off found in engineering between a system optimized for the average case and the guardrails that protect against the case where the optimization itself becomes the problem.
