Acquiring insurance against cyber risks and business interruptions from a third-party insurance company effectively transfers these operational risks away from the bank, reducing its risk profile.

• Option A is incorrect because using a captive insurance subsidiary does not transfer risk outside the consolidated entity; the risk essentially remains within the firm's broader balance sheet.
• Option B is incorrect because under the Basel framework (especially the current Standardized Measurement Approach), banks cannot simply deduct insurance premiums to directly reduce their required operational risk capital.
• Option D is incorrect because while operations can be outsourced, the ultimate accountability and credit/fraud risk cannot be fully transferred away; the bank ultimately remains responsible for the risks associated with its held loans.