Under Basel III, which approach for calculating operational risk capital requires banks to use their own internal loss data combined with a business indicator component?