For any debt (held as an asset by a bank), the market can provide a risk premium. This is often computed by comparing the risk premium of the debt with that of a Treasury bond with a similar maturity, which is interpreted as being about as risk-free as you can get. The higher the spread is between the yields of these two bonds, the riskier the asset. An associated capital requirement could then be calculated accordingly. Credit default swaps could also help here.
While this is arguably the best method, it isn't perfect. Often the market is just as wrong as everyone else -- like we saw with the housing bubble. In late 2006, subprime mortgage-backed securities were still seen as being quite safe by virtually everyone in the market, so the credit spread didn't accurately dictate the real risk much better than the bonds' AAA-ratings. You could also argue that the market can sometimes overreact when it panics, and that could cause a credit crisis to deepen even more quickly, if capital is tied to worried investors.
Regulator Risk Metrics
Why don't regulators just create their own risk metrics for various types of assets? Well, that's exactly what the private rating agencies attempted to do during the housing bubble. We all know how that turned out. Are we really expected to believe that regulators would do better than the private risk evaluators did? After all, regulators didn't call the housing bust either.
Moreover, there's some possibility that regulators could err on the side of being too conservative. More prudent regulatory rules applied to capital levels are a legitimate response to the financial crisis. But regulators could take things too far, since they have no incentive to strike the appropriate balance.
Reliance on Internal Models
Presumably, this means banks' internal models of risk. For every asset a bank owns, it calculates how much it's worth. As the risk of the asset changes, so will its price.
This option has the opposite problem of the regulators controlling the models. Just as they could develop rules that are too conservative, banks could be too liberal. Financial institutions would want their assets to count for as much capital as possible. Even if they learn that asset quality is deteriorating, they won't want to ante up more capital to cover them. So they'll be slow -- at best -- to revise their models to be more conservative as the market evolves.
So none of these ideas is a silver bullet, But maybe if you combine all these, you come up with a winner? Perhaps, but it's hard to see how. Do you create a weighting for each of the three? Do you have different market triggers where the capital metric changes as economic shocks hit? Reconciling three very different methods of assessing risk might not be easy. Unfortunately, there's no perfect solution. Because the market, regulators, and banks won't ever be certain of the future, very accurate risk assessments will never be possible. The question, then, is whether some of these proposals can do better than the rating agencies.