Purchasing insurance from a third-party provider is an effective operational risk transfer strategy, particularly for high-severity, low-frequency events such as cyber attacks or major business interruptions.

Option A is incorrect because using a captive insurance subsidiary does not genuinely transfer risk outside the consolidated banking group. Option B is incorrect because under the newer Basel III Standardised Measurement Approach (SMA) for operational risk, insurance mitigation is generally no longer recognized for capital deduction purposes as it was under the Advanced Measurement Approach (AMA). Option D is incorrect because while operations can be outsourced, the ultimate accountability and risk (especially regulatory and credit risk) cannot be completely transferred; outsourcing merely changes the nature of the risk but does not absolve the bank of responsibility.