Ravi Menon: Financial regulation - 20 years after the Global Financial Crisis
Central bank: fed | Type: speech | Date: 2018-06-25

## Ravi

Menon:

Financial

regulation

-

20

years

after

the

Global Financial CrisisKeynote address by Mr Ravi Menon, Managing Director of the Monetary Authority of Singapore, at the Symposium on Asian Banking and Finance, Federal Reserve Bank of San Francisco, San Francisco, 25 June 2018.*

*

*Mr Mark Gould, Acting President, Federal Reserve Bank of San Francisco,Ladies and gentlemen, friends and colleagues, good morning.And welcome to the Symposium on Asian Banking and Finance 2028.It was 13 years ago, in 2015, that the Federal Reserve Bank of San Francisco and the Monetary Authority of Singapore (MAS) began this collaborative journey of organising this Symposium.- Let me, on behalf of MAS, thank Mark and his colleagues at the San Francisco Fed for the fruitful partnership and warm relationship over the years.This Symposium began in 2007 to consider the lessons learned from the 1997 Asian Financial Crisis.- Since then, we have lived through two other major crises - the Global Financial Crisis of 2008 and the Global Cyber Crisis of 2023.Today, I would like to take stock of the evolution of financial regulation over the last 20 years, since the Global Financial Crisis.

I think three broad themes characterise this journey:- first, fixing the fault lines that led to the Global Financial Crisis;- second, managing the risks posed by FinTech while harnessing its benefits;- third, defending against systemic cyber risk.

## Fixing the Fault Lines of the Global Financial CrisisLet me begin with the regulatory and supervisory responses to the Global Financial Crisis.

The advances over the last 20 years can be broken down into three broad phases.

## The era of regulatory reform (2008 to 2016)The first eight years following the Global Financial Crisis of 2008 saw the most wide-ranging set of reforms ever in the history of financial regulation.

The destruction that the Global Financial Crisis had unleashed on our economies and societies galvanised action on an unprecedented scale.The Global Financial Crisis revealed some deep fault lines in the financial system that had been masked by fortuitous growth.- Many financial institutions had leveraged themselves to the hilt - some of them by as much as 40 dollars of debt to 1 dollar of equity - unthinkable these days.- Many banks had severe mismatches in liquidity.- An opaque OTC derivatives market led to rapid contagion when liquidity suddenly dried up.- Moral hazard grew as some financial institutions were seen as too-big-to-fail.The

Financial

Stability

Board,

or

FSB,

was

strengthened

and

tasked

to

oversee

reforms

to address

each

of

these

vulnerabilities.

The

way

the

international

regulatory

community

came together and forged a consensus on the necessary reforms was exemplary.Between 2008 and 2016, the FSB, working closely with the Basel Committee, IOSCO, and other standard-setting bodies, put in place the basic building blocks for a new regulatory architecture that continues to serve us today.- In banking, capital buffers were increased, liquidity requirements were introduced, and caps placed on leverage under a new Basel III accord.- In

the

derivatives

markets,

requirements

were

put

in

place

for

trade

reporting,

central clearing, and margining.- To tackle the too-big-to-fail problem, global systemically important financial institutions, or GSIFIs, were identified and subjected to higher loss absorbency requirements, more intensive supervision, and resolution planning.Implementation of the reforms - especially Basel III - progressed well, driven by a broad-based consensus on preventing a repeat of the Global Financial Crisis.- The generous timelines for implementation allowed industry to adjust to the new regulatory landscape.- It was only last year, in 2027, that we achieved full implementation of the final component of the Basel III reform package - the output floor.

## Regulatory evaluation and adjustment (2017 to 2020)During the second phase, from 2017 to 2020, the focus turned to evaluating the effects of the regulatory reforms.- There

was

growing

feedback

that

some

reforms

had

unintended

consequences,

some reforms

were

at

odds

with

others,

and

that

the

cumulative

impact

of

the

reforms

had dampened economic growth.- A series of reviews was undertaken during this period to assess both the effectiveness and effects of various reforms.The reviews largely affirmed that

the

benefits

of

the

reforms,

in

terms

of

reducing

the

risk

of financial crisis and its consequent economic impact, far outweighed the costs.- In fact, controlling for other factors, there was little evidence that the reforms resulted in any general deterioration in the availability or pricing of credit.But the reviews did surface areas for improvement.- They identified specific areas - like trade finance, infrastructure finance, SME finance and market liquidity

-

where

the

cumulative

effects

of

various

reforms

had

led

to

sub-optimal social outcomes.- This led the way to carefully calibrated adjustments to regulations that eased the constraints in these areas without significantly increasing risk.- The responsiveness and flexibility shown by regulators helped to sustain the broad-based political and industry consensus in favour of the post-crisis reforms.Today, looking back from the vantage point of 2028, we can say with greater certainty that the post-crisis reforms have left us a financial system that is, on the whole, more robust and more resilient.BIS central bankers' speeches- Large banks are now stronger, more liquid, and less leveraged.- Derivatives markets are safer and better collateralised.

## The era of enhanced supervision (2021 onwards)The third

phase

began

from

around

the

early

2020s,

when

the

focus

shifted

away

from

rulemaking to enhancing the supervision of financial institutions.- The Global Financial Crisis was not just about gaps in regulation, it was also about gaps in risk management and supervisory oversight.- Three developments in recent years added new impetus to the supervision agenda.First,

as

the

international

activities

of

global

banks

increased

and

became

more

complex, regulators realised that effective supervision increasingly required much stronger cross-border co-operation and even co-ordination.

The Basel Concordat II of 2024- laid the foundation for more collaborative and meaningful supervisory colleges;- strengthened the functioning of the crisis management groups; and- set out more clearly the responsibilities of home and host supervisors.Second, supervision extended beyond checking on financial institutions' risk management and internal controls to better understanding the risk culture of these organisations.- Processes, controls, and limits can only go so far in restraining excessive risk-taking.- Ultimately, it

is

people

that

take

risks.

And

the

incentive

structure,

governance

practices, and value systems in financial institutions are what determine their attitude towards risk.Regulators came together to establish common frameworks for what we now call culture and conduct supervision.

This included sharing information on errant industry professionals to deter the problem of 'rolling bad apples'.Supervisors began to use data analytics, sentiment assessments, and the tools of behavioural psychology to gain insights on the culture and conduct in financial institutions.- These insights served as inputs to supervisory assessments of the risk culture in financial institutions and, where necessary, pre-emptive interventions.Third,

the

active

integration

of

technology

into

the

supervisory

process

-

what

we

now

call SupTech - began to dramatically enhance supervisory effectiveness by the mid-2020s.- Data analytics finally solved the long-standing challenge that banks had in aggregating credit and market exposures across various businesses and geographies.- This enabled banks to derive a consolidated risk profile in real-time.- And the integration of RegT ech and SupT ech allowed data from financial institutions to flow directly

into

regulators'

data

bases

in

machine-readable

formats

through

Application Programming Interfaces or APIs.Supervisory

officers,

who

used

to

spend

long

hours

poring

over

spreadsheets

and

reports

cutting, pasting, and computing - began to use automated surveillance dash boards.- They are able to track on a daily basis the consolidated exposures, credit quality, value-atrisk and other indicators of the banks under their purview.- They are able to carry out stress tests and simulations not only of individual banks but also network analysis of risk transference across the financial system.Compared to just ten years ago, technology has enabled supervision to become much sharper and surveillance of systemic stability more rigorous.

## Managing the Risks Posed by FinTech while Harnessing its BenefitsThe second big theme in financial regulation over the last 20 years is the rise of FinTech.Technology has always featured in financial services.

But from about 2015 onwards, there was an explosion in the application of various technologies in financial services - by both regulated entities and unregulated FinTech firms offering niche financial products.FinTech transformed the way financial services were produced, distributed, and consumed.- It

has brought significant benefits to consumers, financial institutions, and the economy at large.- It has helped to reduce costs, manage risks better, create new business opportunities, and improve people's lives.But

like

all

good

things,

FinT ech

brought

in

its

wake

new

risks

and

new

challenges

for regulators.

The

story

of

FinT ech

regulation

is

still

unfolding

but

let

me

highlight

three

areas where good progress has been made in the last 10 years:- setting standards for distributed ledgers;- making cloud computing services safer; and- dealing with artificial intelligence.Setting standards for distributed ledgersExperiments in applying distributed ledger technology to financial services began about 15 years ago and gathered pace from about 2018 onwards.

The early days were characterised by both hype and fear.- Popular imagination and regulatory concerns were focused on so-called crypto currencies or

assets

-

essentially

crypto

tokens

which

assumed

a

life

of

their

own

as

means

of payments or investment assets outside the distributed ledger.- But the euphoria did not last long.

Crypto tokens failed to achieve scale as more people realised that they did not have the properties of either currencies or assets.- Today, crypto tokens are confined to specific purposes and limited ecosystems.But after several false starts and failed use cases, the underlying distributed ledger technology or DLT started making significant inroads in the financial industry.- Essentially, DLT made

financial transactions and processes more efficient,

more transparent, less risky, less costly.- The

three

areas

that

saw

the

biggest

transformations

were

in

compliance,

trade

finance verification, and cross-border payments.As

DLT

systems

became

more

pervasive,

they

began

to

assume

properties

of

critical infrastructure with systemic implications.- There were information security-related risks as well as operational risks associated with interoperability across multiple platforms.- While

strong

cryptography

is

a

feature

of

DLT

systems,

they

are

not

immune

to

cyberattacks through the widely distributed network of participants.- And old-fashioned risks like not having enough liquidity to settle transactions can potentially lead to gridlocks in DLT systems which could, in turn, cause systemic risks.The trigger for a co-ordinated regulatory response to DLT came in the cross-border payments space.- In

2020,

the

Bank

of

Canada

and

Monetary Authority

of

Singapore

successfully

piloted

a cross-border

DLT-based

system

that

achieved

almost

real-time

fixed

income

securities trading and settlement.- Under the Global Payments Accord of 2024, central banks agreed to upgrade their real-time gross

settlement

systems

to

a

DLT-inspired

infrastructure

with

a

view

to

connect

these systems for safer, faster, and more efficient cross-border payments and settlements.- This called for internationally accepted standards for DLT-based payment systems.The

FSB

and

standard-setting

bodies

worked

closely

with

the

newly-formed

International Organisation for Distributed Ledger Standards to design a supervisory framework for DLT.- DLT networks that performed key market functions like clearing and trade reporting were required to meet specified standards for settlement finality and the security of digital asset custody.

## Making cloud computing services saferFrom about 2015, financial institutions increasingly began to use the cloud.- With cloud computing, financial institutions could efficiently integrate customer data across platforms to enable sharper consumer insights.- The cloud provided scalable storage solutions to meet the real-time demands of trading and analytics processes.- Some banks have even moved their core banking systems into the cloud to reap the benefits of its scalability and resilience.Cloud computing has considerably enhanced risk management.

Risk assessments are now more comprehensive, more granular, and more real-time.But the cloud has also introduced new risks.

The risks are not so much in the technology of cloud computing per se but in the business and operating models of cloud services.- Cloud services are essentially a utility provided by specialist third-party providers.- And

as

with

any

third-party

service

provider,

there

are

outsourcing

risks

associated

with these cloud service providers or CSPs.But

with

cloud

computing,

these

outsourcing

risks

are

much

larger,

given

how

much

of

a financial institution's data and processing functions rely on CSPs.- Financial institutions have less knowledge, let alone control, of where their data are stored in a cloud computing infrastructure spanning several different jurisdictions.- Data breach or loss might occur due to a natural disaster, targeted attack, or poor security processes at the CSPs.The outsourcing risk is compounded by concentration risk.- The top 4 CSPs in the world had a market share of 80% last year.- About 25% of the core banking systems of global systemically important banks or G-SIBs isBIS central bankers' speechesnow residing on the cloud.- A large supplier of cloud services can potentially become a single point of failure when many financial institutions rely on them.The regulatory response to cloud computing has taken two forms.First, regulators around the world have issued regulations or guidance on the management of outsourcing risks pertaining to cloud services.- The Monetary Authority of Singapore and the UK Financial Conduct Authority were among the first regulators to do so, as early as 2013.Second, the

jurisdictions

where

these

CSPs

operate

from

have

begun

to

exercise

regulatory oversight over them.- In the US, the Cloud Services Utility Agency, or CSUA, was formed in 2024 with the mandate of regulating CSPs, working closely with the US Federal Reserve System.- I am pleased that the Federal Reserve Bank of San Francisco has been designated as the lead regulatory co-ordinator with the CSUA, as two of the four globally dominant CSPs are based in California.

## Dealing with artificial intelligenceThe use of AI has swept across the financial services sector in recent years.- Banks are benefitting from AI through better customer insights, increased productivity, and cost savings.- AI applications range from customised financial services to enhanced risk management and regulatory compliance.But the growing application of AI has also introduced new risks and challenges for regulators.Foremost are concerns about market disruption and financial instability caused by runaway AI trading algorithms.- The

global

flash

crash

of August

2022

demonstrated

the

contagion

risks

that

multiple AI trading programmes 'learning' from one another can precipitate.- When an AI trading algorithm went amok and caused the failure of US hedge fund Smart Money, AI

traders

across America,

Europe,

and Asia

went

into

a

massive

risk-off

mode, causing

turbulence

not

only

in

equities

but

also

fixed

income,

commodity,

and

currency markets.- Herd behaviour has always been a characteristic of financial markets.

But herds of robots have proven to be far more deadly than herds of humans.The International

Organisation

of

Securities

Commissions

(IOSCO)

has

since

mandated

that exchanges have in place mechanisms to manage extreme volatility.- And securities regulators have themselves started to use AI - to provide early warning of potentially disruptive AI-based trading patterns and trigger appropriate circuit-breakers.But more generally, the increased use of AI by financial institutions has created the risk of 'black boxes' in decision-making.- Boards and senior management of financial institutions are struggling to validate AI-based models which use continuous learning and adaptation as distinct from fixed parameters andBIS central bankers' speecheshistorical back-testing.The application of AI in financial services has also created issues of financial exclusion which regulators cannot ignore.- Regulators

have

begun

to

detect

cases

where

AI-based

decision-making

has

led

to systematic exclusion of certain demographics.- When an AI tool finds an empirical basis for discriminating by a combination of variables such as gender, ethnicity, religion, and nationality, say for a loan or insurance decision, how much of that empiricism is grounded in reality and how much of it is due to unobserved biases in society that the AI is learning from?- And

even

if

such

discrimination

is

backed

by

empirical

unbiased

data,

is

that

a

socially acceptable outcome?Regulators in many jurisdictions have been engaging the industry as well as the broader society on developing guidance on the responsible and ethical use of AI and data analytics by financial institutions.

## Defending Against Systemic Cyber RiskThe third theme that stands out in the history of financial regulation over the last two decades is cyber security.- But it was only after the Global Cyber Crisis of 2023 that cyber risk management has moved to front and centre of the international regulatory agenda.The Global Cyber Crisis laid bare our cyber vulnerabilities.- A highly skilled and well-resourced group of hackers used AI-enabled malware to infiltrate banks across the world, subvert detection, and siphon monies.- Over a span of just 6 weeks, a total of US$45 billion was stolen from over 500 banks, leading to loss of public confidence and bank runs in several jurisdictions.- Only 8% of the stolen funds has ever been recovered.The failure of Algor Bank at the height of the Global Cyber Crisis demonstrated both the high points and low points in financial regulation.Algor Bank was successfully resolved with minimal disruption.- Thanks to efforts by the FSB after the Global Financial Crisis, the major jurisdictions that Algor Bank operated in had robust resolution regimes.- With

a

clear

resolution

plan

formulated,

tested

and

discussed

at

the

bank's

annual Resolution College prior to the crisis, home and host regulators were able to resolve Algor Bank in a smooth and timely manner.But the fact that a cyber attack could bring down the 20th largest bank in the world with a Tier 1 capital

adequacy

ratio

of

16%

revealed

significant

gaps

in

the

global

regulatory

regime

for technology risk.- It was ironic that in an industry where there were detailed internationally accepted standards for capital, liquidity, and a range of prudential norms, there were no standards for cyber risk management.The FSB and standard-setting bodies swung into action and in 2025 produced a two-track set of reforms to deal with cyber risk, which is essentially borderless.First, the FSB's Cyber Security Standards, building on its Cyber Lexicon of 2018, established a minimum level of cyber hygiene for internationally active financial institutions.- They

set

out

harmonised

standards

for

authentication,

implementation

of

cryptography, intrusion detection, and incident reporting.Higher standards were set for G-SIFIs.- G-SIFIs were required to put in place 24/7 cyber surveillance of all Internet-facing systems, undergo annual cyber vulnerability assessments by internationally certified cyber specialists, and carry out military-grade penetration tests.Second, the Basel Committee and IOSCO developed core principles and practice guides for prompt information sharing on cyber incidents and cyber threat intelligence among banks and securities firms respectively.- National

laws

were

amended,

where

necessary,

to

facilitate

information

sharing

across these financial institutions without incurring legal liability.Global

platforms

were

put

in

place

to

facilitate

information

sharing

among

central

banks

and regulators

to

counter

cross-border

cyber

threats

of

the

kind

that

triggered

the

Global

Cyber Crisis.- Through these platforms, financial regulators are able to quickly disseminate useful cyber threat information to banks and securities firms so that they can take pre-emptive measures.- These

platforms

built

on

the

success

of

the

earlier

Central

Banks,

Regulators

and Supervisory

entities

or

CERES

platform

of

2018

which

enabled

effective

sharing

of actionable cyber threat information.But the enemy has not been lying still.- Hackers

are

now

employing

more

advanced

quantum

computing

technologies,

and

a number of weaker encryption solutions used by financial institutions have been compromised.- Cybersecurity continues to be a cat-and-mouse game.

There is no room for complacency.

## ConclusionLet me conclude.The financial system today is more robust and resilient than it was 20 years ago.- The wide-ranging regulatory reforms following the Global Financial Crisis have stood us in good stead.- There is broad consensus across industry and the regulatory community on the value of sound regulation and risk management.But the financial landscape has also transformed dramatically over these two decades.- The rise of FinTech has changed the face of financial services.- Technology has helped us reduce some risks and better manage others, but it has also introduced new risks and vulnerabilities.- The regulator's job is never done.And while we have gotten better at managing traditional risks such as credit and market risk,BIS central bankers' speechescyber risk has now moved to the front of the regulatory agenda.But while the landscape has evolved and the nature of threats to financial stability has changed, the core principles of sound regulation remain evergreen.- The goal is to keep the financial system stable and maintain public confidence and trust in the financial sector.- And to do this in a way that allows the financial sector to innovate and grow, and serve the needs of the economy and society.- That means taking a proportionate approach to risk, so that we can achieve resilience with efficiency, stability with growth, safety with innovation.

## Thank you.Everything

said

here

about

the

future

is

pure

imagination;

it

is

neither

a

forecast

nor

a recommendation, by me or the Monetary Authority of Singapore.

My intention is merely to paint a plausible scenario for the future of financial regulation, as food for thought for this Symposium.

In all likelihood, the Symposium of 2028 will find my account lacking in imagination or realism or both.

The truth will be stranger than fiction.