Are Banks Ready for Basle II and what are they preparing for…

Are Banks Ready for Basle IIand what are they preparing for…

Operational Risk

Denis PellerinSenior Vice-President

Operational and Market Risk ManagementNational Bank of Canada

Montreal, April 13, 2007

forThe Third International Conference on Credit and Operational Risks

THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 2

AGENDA

A. CANADIAN BANKS SITUATION– Major Banks Targeted Approach for Operational Risk– Implementation Time Frame– Implementation Context– Role of Regulators and Market Pressure

B. REST OF THE WORLD – Op. Risk Implementation Efforts– Targeted Approaches– Time Frame– Role of Regulators and Market Pressure

C. PROS AND CONS OF EACH APPROACH FOR OP. RISK– Basic approach– Standardised approach : manages the risk– Advanced approach : measures the risk


A. CANADIAN BANKS SITUATION(a system highly concentrated)

A.1 Major banks targeted approach for Operational Risk

– 5 of the Big 6 are aiming for Standardized + 3 other.

– Most of them are also considering Advanced but no commitment.

– CIBC aims for Advanced, another did for a while.

– Banks have all implemented typical risk management framework.

– 5 of the Big 6 are subscribing to ORX.

– Usage of electronic tools to support RCSA rather limited.

– Interesting to note that all Big 6 are aiming for Advanced for credit.


A. CANADIAN BANKS SITUATION

A.2 Implementation Time Frame

– In Canada, BASLE II starts on NOVEMBER 1st, 2007

– All the Big 6 have been working on their Op. Risk implementation for 8 – 10 years

– Big 6 “WILL BE READY”

– OSFI will deliver certification this summer



A.3 Implementation Context

– During this time, several other regulatory or compliance driven initiative:

• Basle II Credit Risk

• Sarbane Oxley

• AML

• Reputational Risk Management

• Personal Information Privacy

• Pandemic Flu Preparedness

• Outsourcing Risk Management

and son on… and Operational Risk, of course…



A.3 Implementation Context

– Produced Regulatory Fatigue :• Risk Managers

• Business Lines

– Confusions from BU as to who does what.

– Most of these initiatives are seen by business lines people as overlapping if not repetitive.

– As banks are about to go live with their Op. Risk Capital Model, will they focus on migrating to Advanced Status?



A.3 Implementation Context (cont.) … Priority to convergence

– Initiative to integrate the various processes implemented to assess and improve internal control environment.

– Convergence main driver: Desire to simplify implementation by business lines (not quality or efficiency).

– Challenge is to preserve “quality” while integrating processes.

– One bank is piloting integrated Risk and Control Assessment Program.

– Other Banks at various preparation stages will all see more actions in the next 12 – 24 months.



A.4 Role of Regulators and Market Pressure (layman terms for Pilars II and III)

– Implementing a regulatory capital model for Op. Risk is a regulatory driven initiative. Role of regulators is key for smooth implementation.

– OSFI is the main regulator of most banks implementing Op. Risk models.

– Material from Basle needs to be completed by regulators guidelines for efficient design.

– If this is new to banks, it is also new to regulators – they too had to learn.

– At first, OSFI didn’t have a dedicated team but eventually they put their act together and started to oversee implementation efficiently.



A.4 Role of Regulators and Market Pressure (cont.)

Two streams – initiated 3 years ago:

1. Gap Analysis:• Consisting of analysis by individual banks to identify

framework shortfalls compared to OSFI and Basle Requirements

• Includes action plans and Timetable to fill in the gaps with regular monitoring

2. Three bench marking exercises: • Gross income mapping

• Loss data collection

• RCSA

• Very useful work also feeding into gap analysis


B. REST OF THE WORLD (Not an accurate picture of the rest of the world…)

B.1 Targeted Approaches

– 3 different approaches to determine regulatory capital for Op. Risk : Basic – Standardized – Advanced.

– They represent a continuum from least to most sophisticated.

– But to get approval to utilise a given model, regulators require that actual risk management practices of op. risk be in line with the selected model. They are also positioned on a continuum.

– There are also unwritten rules :i. prioritize credit risk over operational risk;ii. to be Advanced for operational risk you need to be

Advanced for credit risk as well;iii. the opposite is not true.


B. REST OF THE WORLD

B.1 Targeted Approaches (cont.)

– The amount of financial and human resources required to qualify for a given approach sharply increases as you go up the continuum.

– Natural tendency is for small banks to opt for Basic, midsize banks for Standardized and largest banks targeting Advanced.

– This is a general rule but there are exceptions. The most noticeable being large banks category:

• The largest banks’ group is made of banks with more than 200 G$;

• There are only approximately 40 banks that are aiming for Advanced (1 out of 3);

• 12 of them are American and had the Advanced approach imposed on them – somewhat disappointing – we will come back on this…



B.2 Time Frame

– Varying answers

– European banks generally target January 2008

– American authorities have postponed it by a year, January 2009

unless

– Are banks going to be ready? The vast majority will (confirmed by recent surveys)

– Timetable is set for Credit Risk. Gives Op. Risk implementation work ample time.



B.2 Time Frame (cont.)

Other factor:

– The most delicate implementation is for Advanced Banks. This is for the biggest banks that have more financial and human resources.

– There will be few exceptions.

– Banks that are falling behind with their credit implementation program will not get regulatory clearance for operational risk model.

– Few smaller banks that decided to aim for standardized despite their small size.



B.3 Role of Regulators and Market Pressure

– Influence of regulators; a delicate topic.

– American authorities’ decision in the public domain.

– Generally speaking, regulators probably low key for Op.Risk – not the case for Credit.

– Large European banks felt strong market pressure.

– No pressure for smaller banks, yet…


C. PROS AND CONS OF EACH APPROACH Views of a professional Op. Risk Manager on the 3 approaches

C.1 Basic Approach

– Major impact being increased of regulatory capital may be significant. Even the most sophisticated of them, with economic capital model, were probably carrying less than 15% for Op. Risk.

– Impact on competitiveness.


C. PROS AND CONS OF EACH APPROACH

C.2 Standardized Approach – manages the risk

What it does:

– Prior to Basle II, Op. Risk was intuitive;

– After Basle II, Standardized approach will make them better risk managers.

Feature:

– Separate risk discipline;

– Transparent and disciplined;

– Consistent across all business lines.



C.2 Standardized Approach – manages the risk (cont.)

– Standardized model provides for capital to be calculated by multiplying Beta 12, 15 or 18% and gross income.

– Resulting capital hardly risk sensitive and delivers little benefits.

– Main benefit comes by implementing risk management framework:

• Op. Risk governance;

• Loss data collection;

• RCSA Program;

• Risk indicators.



C.2 Standardized Approach – manages the risk (cont.)

– Loss data collection• Increases awareness (specially for low impact)• Creates a demand for forward looking tools

– RCSA Program : BU managers• Assesses risks• Evaluates adequacy of controls• Implements action plans

– Risk indicators• Monitoring tool operating on continuous basis• Not necessarily accurate but directionally correct

– KRT • Supposed to offer capability to set risk limit or tolerances.

More work needed to demonstrate predictability and correlation.



C.2 Standardized Approach – manages the risk What it does…

Not only better management. Two other features:

– Decentralized : unlike Credit and Market Risk

• Central unit, define and design. No limit setting.

• BU implements, assumes ownership.

– Risk based : concentrates on important risks

• Op.Risk is everywhere.

• Most risks minor and frequently prohibitive to eliminate.

• BU are very good at addressing important risk.



C.2 Standardized Approach – manages the risk What it does… (cont.)

– BU don’t do it for the regulators.

– Respond to their needs.

– Value creation.

– Very different from other compliance work which is viewed as unproductive and cost of doing business.



C.2 Standardized Approach – manages the risk What it doesn’t do…

– No objective tools to set Op. Risk limit. Limit setting either reactive or subjective.

– Because:• Method requirements vague and unclear;

• KRI still primitive.

– Major Negative:• Capital calculation hardly risk sensitive;

• Might not produce a lower amount of capital than Basic;

• May produce irrational behaviour.



C.2 Standardized Approach – manages the risk What it doesn’t do… (cont.)

Conclusion:

– Brings better risk management;

– Contributes to value creation;

– Does not necessarily deliver lower capital – which should be expected from better management.



C.3 Advanced Approach – measures the risk What it does…

– Good management from Standardized.

– Requirement more demanding: aiming at better integrating management and measurement.

– Big plus is efforts to better measure capital requirement in a more risk sensitive manner.

– LDA provides for capital being determined by unexpected loss for each risk type.



C.3 Advanced Approach – measures the risk What it does… (cont.)

– You need to understand your severity distribution and impact distribution for each risk type.

– Results is regulatory capital by risk type and BU.

– This creates risk management possibilities:• Charging capital to businesses;

• Limiting capital to certain business lines.

– Another benefit is clearly capital reduction which is a very strong attraction to this method.



C.3 Advanced Approach – measures the risk What it doesn’t do…

– Scepticism amongst community of professional Op. Risk Managers.

– Explains why several large banks like HSBC are not implementing it, at least for now.

– The general view is that most of the benefits from better risk management comes with Standardized and to walk the extra mile for Advanced requires more assurance of capital reduction.

– No banks internal loss database contains the data required to estimate tail end of loss distribution.



C.3 Advanced Approach – measures the risk What it doesn’t do… (cont.)

– Regulators knew it but, to encourage banks to go Advanced, proposed means of filling the gaps.

– Scenario analysis : external loss database.

– Work is being done to make these processes more robust.

– Major obstacle not regulators but CFOs. Even if regulatory capital decreases, real capital will not.



C.3 Advanced Approach – measures the risk What it doesn’t do… (cont.)

Conclusion

– Advanced approach has great potential to bring to Op. Risk managers a really risk sensitive approach.

– In the short term, the availability of data is an important obstacle.

– I suggest that this be addressed progressively and, eventually, as internal loss database becomes more reliable, more banks will move to Advanced.

Thank you!

Are Banks Ready for Basle II and what are they preparing for…

Documents