Regulation & Supervision: from old fault lines to emerging concerns
Your Excellencies, Distinguished Guests,
Sabah-al-khair and a very good morning.
I am delighted to return to this forum for the third time in a row, and I am grateful to
H.E. Dr. Abdulrahman A. Al Hamidy for inviting me to speak before this august
gathering.
Taking this opportunity today, I would like to touch upon two areas. First, where the
years of regulatory reforms have left us in terms of addressing the fault lines that global
financial crisis (GFC) laid bare, and second, what are the emerging regulatory &
supervisory concerns going forward.
Fixing the old fault lines
Let me start with the first question: where the years of regulatory reforms have left us?
It is well over a decade since the GFC took the financial world by storm. Around ten years
back, in 2009, the world was reeling from a financial crisis that was unique in both its
origin and scale. Epicenter of the crisis was advanced countries and the US in particular.
And in terms of scale, as research by BIS has highlighted, cumulative output loss since the
GFC has been a hefty 25% of the world's GDP, excluding the enormous social costs
associated with high unemployment and lost output.
Rising to the occasion, global leaders moved quickly to address the threats to global
financial system - a feat that appears particularly impressive in current times of trade
spats and growing nationalism. GFC also led to a fundamental shift in our approach to
banking regulation and supervision, essentially by exposing the fault lines in the
inadequacy of earlier regulatory architecture.
By now, those fault lines are well-understood. Banks held too little capital and of poor
quality. Inadequacy of capital was further weakened by the absence of a backstop
measure to contain excessive leverage. Banks that were too big to fail enjoyed the market
power but were not required to internalize the cost of risks they brought to the overall
system. Suitable measures of liquidity, in both funding and market sense, were lacking.
And the efforts to contain systemic risk, both in its time and structural dimension, were
hardly in sight. In a nutshell, the rule book was evidently deficient.
And if that was not enough, banking supervision was micro prudential in nature.
Supervisors believed that ensuring stability of individual institutions would make the
system as a whole stable, thus largely ignoring the buildup of systemic risk.
The GFC brought into sharp focus the gaps in our regulatory regime. As Paul Romer, a
Stanford Economist, once said, 'A crisis is a terrible thing to waste'. Thankfully, lessons
from the GFC were not wasted. Central banks and financial regulators made great strides
in building a more stable and resilient financial system. The regulatory reforms by the
BCBS under Basel III regime not only refined the existing rules but also introduced
wideranging measures which were earlier missing or inadequate.
Thanks to these efforts, the old fault lines have been largely fixed. Capital adequacy
regime has been enhanced, with higher and better quality capital. Additional capital
conservation buffer and countercyclical capital buffer requirements have also been put in
place to help banks maintain additional cushion and limit the buildup of systemic risk.
Likewise, leverage ratio has been phased in as a backstop to CAR. On the liquidity front,
Liquidity Coverage Ratio and Net Stable Funding Ratio have further strengthened banks'
capacity to withstand liquidity stress and to make their funding structure more stable. To
address structural dimension of systemic risk, capital charge for SIFIs has been added,
recovery and resolution regimes have been strengthened and safety nets have been
improved. Of course, this list is not exhaustive.
While the world has not seen a crisis similar to GFC to determine if these reforms have
made the financial system resilient enough, there is sufficient evidence to suggest that
our banks are considerably more stable than a decade ago. Even the impact of oil price
shock of 2014 on GCC banks have been muted at most, though degree of resilience
certainly varies from one country to another. Still, there is broader agreement that our
banks entered the low oil price environment from a position of strength which was built
through prudent regulatory reforms.
Now, as the rule book is mostly in place, it is time for supervision to step up. After all,
regulation can only go that far; without effective supervision, it is hard to ensure timely
and consistent implementation and achieve financial stability at large.
The role of effective supervision is also critical because not every risk can be pre-defined
in a rulebook. While overseeing the dynamic world of finance, supervisors must be agile
enough to suitably correct course in line with the constantly changing nature of the
banking industry or the emergence of new risks.
In the second part of my speech, I would like to touch upon two such emerging concerns;
cyber threats and climate change.
Addressing Emerging Concerns
Ensuring resilience against Cyber threats
First, consider the issue of cyber threats. Growing footprint of technology is influencing
every facet of the banking business, transforming banks' internal processes as well as
their engagements with customers. As the role of technology deepens from a mere
support function to a platform central to everything that banks do, the likelihood of new
risks emanating from ubiquitous and connected technologies loom large. Materialization
of such risks will not only disrupt vital financial services but will also undermine the
security and confidence in the financial system.
In fact, the scale and sophistication of cyber-attacks is already on the rise. Examples
include data breach at Target of 70 million credit card users, a cyber-attack on Equifax
compromising data of 143 million customers, and the hacking of over 100 million
customers' data at Capital One Bank.
No wonder, cyber risk features as a key concern in different industry surveys. For instance,
respondents to the Bank of England's Systemic Risk Survey of 2H-2018 quoted the risk of
a 'cyber attack' as the second major threat to the system, only behind the Brexit induced
political risk.
The growing threats of cyber risk need to be reflected in banks' operational risk capital
charge. Incidentally, the Basel Committee has revised its operational risk methodology by
replacing the existing three techniques with a simplified Standardized Measurement
Approach and expects that its implementation, due by January 2022, will increase capital
risk charge for operational risk by 18% for a group of banks currently using Standardized
Approach of the old regime. While it is not clear how much of the increase in operational
risk charge is driven by the recognition of growing cyber threats, greater capital allocation
for operational risk is a step in the right direction, given the increasing significance of such
low probability but high impact risks.
However, reliance on capital alone will not suffice. Supervisors must ensure that banks
improve their operational resilience by strengthening their ability to respond to and
recover from cyber-attacks. At a minimum, mitigating cyber threats would require
effective collaboration between regulators and the industry, adequate contingency and
recovery plans by banks and sound security practices by all participants of financial
market infrastructure. In Kuwait, we are in the process of putting in place an advanced
platform for effective information sharing about cyber threats that can later be used at
the regional level.
Supervisors in this regard can leverage CPMI-IOSCO guidance that calls for 'resilience by
design', encouraging to incorporate sound security features in the system right from its
earliest stage of conceptualization. This approach will help address the potential cyber
compromises that could stem from banks' dependence on legacy technologies.
To help strengthen cyber resilience of financial institutions, Financial Stability Board (FSB)
is currently working on 'identifying practices to help financial institutions recover from
and respond to cyber incidents'. Next year, they are planning to release a toolkit of
effective practices that banking industry can use in improving operational resilience
against cyber threats.
Coping with climate change
The second emerging issue warranting our close attention is climate change. According
to UN estimates, around 60 million people were affected by extreme weather events in
2018 alone. And within this year, we have witnessed the damaging impact of wildfire in
California, hurricane in Bahamas, cyclone in Bangladesh and typhoon in Japan.
Thankfully, the issue of climate change, after languishing on margins for years, has finally
caught policy makers' attention. As Victor Hugo once said, 'nothing is as powerful as an
idea whose time has come'. It seems that time has finally come for the climate change to
receive the attention it deserves.
Climate risks stem both from climate shocks like floods, hurricanes and other severe
weather events as well as from trends such as warming temperatures, melting glaciers
and rising sea levels. Broadly speaking, these weather developments pose two types of
risks to the financial sector; physical and transition. Increasing severity and frequency of
extreme weather events could pose serious physical risks by damaging the assets that
constitute banks' exposures. Additionally, natural disasters can damage public
infrastructure and destroy livelihood, hurting economic activity in general.
On the other hand, transition risk stems from the economic impact of a shift to a
lowcarbon economy. Factors like development of environment-friendly technologies,
changing public sentiments, and new laws to govern carbon emission can cause a shift in
economic activity towards greener projects. As a result, the value of carbon-intensive
assets might drop as investors' risk perception and preferences change. Sectors like oil,
gas, coal and utilities are particularly vulnerable in the long run as transition risk might
devalue their assets and displace their workforce.
International Energy Agency (IEA) estimates that achieving Paris Agreement target on
climate change would require, by 2050, about 80% decrease in the CO2 intensity of the
building sector, 95% of world energy supply to be of low carbon and 70% of new cars to
be electric. This will cause significant, even if slower, shift in the structure of our
economies with strong bearing on the financial sector.
That is why the NGFS, the Central Banks and Supervisors Network for Greening the
Financial System, has argued that 'climate related risks are a source of financial risk and
therefore fall squarely within the mandate of central banks and supervisors to ensure that
financial system is resilient to these risks'.
Regulators need to determine how best to incorporate and operationalize climate related
risks in their prudential policy settings. It would require expanding the risk matrix to
formally include climate related risks and enhancing the analytical tools to assess financial
sector exposures to extreme weather events. Bank of England has announced that in
2021, it will start stress-testing banks on different climate pathways. Ultimately, the key
is to retool the regulatory regime to factor in risks to climate change in a holistic fashion,
instead of adding on an additional item in the risk matrix.
Conclusion
Let me conclude.
While we have managed to fix the fault lines exposed by the GFC, our understanding and
ability to respond to some of the emerging risks remain limited. This is true for both cyber
threats and climate change. A feature common to these risks is their wider impact through
multiple entry points. Hence, the key to address both lies in sharing information and
strengthening cooperation.
If we are grappling with risks that transcend sectoral and national boundaries, so should
our response.
Thank you for your attention.
11/12/2019