Good cop/bad cop
Speech given by
Sam Woods, Deputy Governor, Prudential Regulation and Chief Executive Officer,
Prudential Regulation Authority
Mansion House City Banquet, London
25 October 2018
I am grateful to Ivar van Hasselt and Joanna Keeble for their assistance in preparing this speech and
to other colleagues for comments and contributions.
1
All speeches are available online at www.bankofengland.co.uk/speeches
Lord Mayor, Ladies and Gentlemen,
Andrew and I have worked together for a long time, and we've often found it useful to adopt a regulatory
good cop/bad cop routine. In the context of Mansion House, the rules are simple: whoever gives the shortest
speech is good cop! Now Andrew I timed you just now, and with a few edits I think I can sneak in under the
line...
But why am I talking about the police at all? Police metaphors are dangerous, but as it happens "good
cop/bad cop" is a good analogy for two different aspects of our role as regulator:
 First, bad cop: areas where we need actively to insert the public interest into privately or
mutually-owned firms, because some of the costs of their failure would be externalised and they
therefore have an incentive to run too much risk. Here there is inherently a degree of conflict
between regulator and firm - it is the way our system is set up. Capital is the most obvious example
of these battlegrounds, where reasonable people with different objectives quite naturally come to
different answers. But there are many others.
Second, good cop: areas where we and firms are collectively facing a shared challenge. There is no

inherent conflict between the public and private interest - we have a shared interest in mitigating the
risk, and there is a role for both public and private sectors. Cyber is the classic case of these shared
endeavours.
With the post-crisis reform job now largely complete, I will set out what firms should expect to see from the
PRA across these areas as we enter a new phase.
Bad cop
Let me turn first to areas where our incentives and those of firms are not perfectly aligned, and where there
may therefore be a degree of tension between us as we seek to secure the benefits of the new system we
have spent the last decade putting in place. I will give you five examples - in highly abridged form, as I'm
determined to beat Andrew's time.
First, our brand-new retail ring-fence, the last major section of which was erected by a team at RBS on the
weekend of 12 August. This has been a truly massive operation, including the three largest-ever bank
authorisations here in the UK, over £800 billion of assets moved and over 1.3 million sort code changes.
So I would like to say a big thank you to all of the teams at the PRA and at the banks for some really hard
work during the construction phase.
But now that the fence is up, we need it to do its job. It is of course a twenty-first century, modern fence - not
a medieval stone wall, and as part of this it was electrified by Parliament in order to discourage attempts to
2
All speeches are available online at www.bankofengland.co.uk/speeches
climb over it: the legislation empowers the PRA to use a group restructuring tool to require a banking group
to sell its ring-fenced bank or other parts of its group.
Hopefully the prospect of electrocution will discourage any blatant attempts to climb over the fence. But there
is still perhaps the possibility of wicked burrowing under the fence, passing things through it or even perhaps
using a drone to create mischief. We are therefore setting up a border patrol of PRA staff who will police the
fence.
The patrol will ensure there is compliance with restrictions on activities performed by the ring-fenced entities
and independence from the rest of the group. In particular, we will closely monitor governance arrangements,
seeking evidence that ring-fenced banks can identify conflicts of interest and are able to make decisions on
their own. We will set capital and liquidity for the ring-fenced banks, and more generally keep an eye on the
risks they face.
Let me move to my second example: accountability. As with the ring-fence, we and firms have gone to great
lengths to bring in the Senior Managers Regime here in the UK. But the SMR is not an end in itself - the
accountability it delivers should contribute to safety and soundness. Firms should therefore expect us to
make more use of the SMR to deliver supervisory priorities. There is no magic to this: we will simply ask,
when we set out those priorities, which senior manager is on the hook to deliver them, and what will happen
if they do not?
We want to know who is on the hook if things go badly wrong, and have recently asked firms to spell this out
in developing areas such a crypto-assets, operational resilience and algo-trading. And enforcement cases
have shown that we can, and will, take action against Senior Managers if our red lines are crossed.
However, we are not an enforcement-led regulator: in my opinion, the real prudential value of the regime lies
in creating opportunities for preventative or remedial action through supervision.
Which brings me to my third example: pay. This has been another area of massive reform. No pay system is
perfect, but I remain convinced that the 100% cash, paid out up-front bonus systems which existed for
risk-takers in some of our largest firms before the crisis were an important part of what broke the financial
system. The new system of deferral, malus and clawback is much safer. So we are not planning to come up
with some new approach at this stage - seven year deferral is long enough, and has a pleasingly biblical ring
to it. But we are going to ask more pointedly and regularly than before: how is the pay of that senior manager
who is tasked with delivering a major supervisory priority going to be affected by their success or failure in
that task?
A fourth area is a more traditional battleground for firms and regulators: internal models, where we need to
lean against the natural incentive firms have to maximise their room for manoeuvre above regulatory
requirements by minimising those requirements.
We are keeping a close eye on risk-weights for large UK banks. Average risk-weights have fallen
substantially over the past two decades: from over 60% in the 1990s to 31% today. Many drivers are benign
3
All speeches are available online at www.bankofengland.co.uk/speeches
- genuine de-risking, in part as a direct result of the strengthening of our prudential framework.
But where a reduction is caused by model design or calibration changes firms should expect us to demand
strong evidence of a corresponding decrease in real risk. We are also looking at whether parts of our
risk-weight framework are too cyclical - in particular for mortgages. These challenges reinforce the
importance of having a leverage ratio to complement a risk-weighted regime for bank capital. Nevertheless,
the leverage ratio has challenges of its own: we are having a closer look at whether it appropriately captures
all forms of secured financing.
My last example is more specific to the insurance side of our work. In the area of equity-release mortgages
(ERMs) we have consulted on measures to ensure that investments1 in that asset class, which is growing by
more than 10% a year, are appropriately and consistently reflected in the regulatory balance sheet. We want
to do this both for prudential reasons and to facilitate competition by establishing a level playing field. Our
proposition is a simple one: house price growth above the risk-free rate is a risk to which ERM providers are
exposed; it should not therefore be assumed and banked up-front as capital in the form of the Matching
Adjustment, even if a reasonable person could expect house prices to increase in that way
- instead, that benefit should be earned if and when the house price growth actually materialises. We have
received many strong views in response to this suggestion, and are considering them now before reaching a
final view.
Good cop
I will turn now to the other part of our work - areas where, as I see it, there is generally no inherent conflict
and we and firms are engaged in a shared endeavour to deal with the challenges we face. You may be
relieved to hear that, in my determination to be the Mansion House good cop this year, I will only touch on
two examples of this - though each of them is a huge topic.
Operational Resilience
First, what we call 'operational resilience' - the ability of firms to keep going operationally as well as
financially. Compared to our framework for things like capital, liquidity and accountability, the regulatory
framework for operational resilience is thoroughly under-developed not only here in the UK but also
internationally.
This matters more than it used to for a number of reasons, but let me pick out two. First, the emergence of
cyber-attacks is a clear and present danger to the financial system which our forebears simply did not have
to worry about. And second, as more and more of us access banks and insurance companies digitally, with a
major programme of bank branch closures in full swing, and in the age of social media where problems
become very visible very quickly, operational failures hurt more than they used to. For the same reasons the
Treasury Select Committee is rightly taking a strong interest in this topic.
1
£20bn as at year-end 2017
4
All speeches are available online at www.bankofengland.co.uk/speeches
We therefore published during the summer - jointly between the PRA, FCA and Bank as supervisor of
market infrastructure - a discussion paper proposing a new framework for thinking about these issues. The
central idea is a simple one: how much operational disruption to key business services should firms, the
PRA, the FCA, and the wider Bank of England be prepared to tolerate? We call this 'impact tolerance'.
The focus of our future policy will be on the continuity of the business services that a firm's customers and
the wider economy rely upon. Preventative mitigation is obviously very important, but having impact
tolerance means acknowledging that disruptive events will happen, and that firms need to be able to recover
within their set tolerance. I'm talking about planning for scenarios that are severe but plausible - we expect
firms to be resilient against a wide range of scenarios, but not against Armageddon.
I think it likely that the ordering of these impact tolerances between firms and the PRA will often be the
opposite way round from capital. On capital, inserting the public interest means that as a general matter we
will require firms to hold more capital than they would if left to their own devices - hence, a battleground.
For operational resilience, a firm is likely to experience significant private costs - for instance, impact on their
profits or damage to their brand - before their safety and soundness is at risk.
The exception to this may be a subset of operations whose failure might pose a systemic risk to financial
stability. But in most cases, I think interests are likely to be aligned - we all just need to get better at
managing this set of risks, as some recent events have illustrated all too painfully. In this context, I will
expand briefly on the PRA's particular focus in this important area.
Our general statutory objective is safety and soundness, with policyholder protection on the insurance side
and a secondary objective to facilitate competition. But nested within these objectives is an instruction that
our objectives are to be advanced by avoiding adverse effects on the stability of the UK financial system.
In other words, although our work is primarily microprudential we have an important role to play in ensuring
financial stability.
What does this imply for how the PRA should take an interest in operational resilience? It implies that we
are
interested in operational resilience for its own sake, not just because its absence can have a financial
consequence for firms. But we are interested only to the extent that it could have a negative impact on safety
and soundness and/or the stability of the UK financial system.
That is a fairly high bar. In practice this is likely to mean that we put more emphasis on operational resilience
for larger firms doing activity whose disruption could have a financial stability impact. For smaller firms we
are only strongly interested where something is going on that is big enough to threaten the firm's safety and
soundness.
So for example: if you are a big bank you can expect us to take an interest in your ability to process
payments; if you are an insurer with a large annuity book, we will want to know what the operational risks are
to your ability to supply people's retirement income; and if you are a smaller firm spending huge sums on a
5
All speeches are available online at www.bankofengland.co.uk/speeches
major IT project, we will be interested in that. Across all of these, we will also want to dig into systemic
risks - most obviously those associated with cyber-attacks and the risks associated with a heavy
concentration of activity across firms with a handful of outsourcers.
But there is also a much wider set of more day-to-day operational issues and problems which arise for firms,
and given the increasing importance of digital service delivery firms need to get much better at this.
Sometimes these issues will engage the FCA's objectives, which will be a judgement for Andrew and his
team. But in general, they will only be a priority for the PRA if they meet the criteria I have just mentioned.
With sufficient but limited resource we need to focus our efforts where they can have the biggest impact in
terms of advancing our statutory objectives.
Brexit
Now Lord Mayor, I admit that I am very tempted to conclude this speech without a mention of the B-word, not
least because this would surely guarantee a speech shorter than Andrew's. But our philosophy on Brexit
issues happens to illustrate the point I am making here about shared endeavours.
Because getting from A to B on Brexit is very much a shared endeavour, although let's be honest it doesn't
always feel like that! Of course there are some debates between us and firms as they restructure, in
particular where we see structures that appear overly complex or lacking in proper accountability. But in
general this is not a battleground where the incentives of regulator and regulated are inherently in tension:
we all want as smooth a transition as possible, and to reduce cliff-edge risks as best we can.
Actions speak louder than words so I will simply mention three key actions we have in hand, with the help of
Government and Parliament:
 First, Parliament has been asked to approve our Temporary Permissions Regime (TPR), on which
John Glen led for the government in the House of Commons debate yesterday. Simply put, this will
allow us to bridge incoming EU27 firms for three years from March of next year while they seek an
authorisation to continue business in the UK. We encourage all firms to opt into the regime because
it will provide certainty until March 2022, independent of the existence and duration of any wider
implementation period. This is a straightforward, common sense way of lowering the risk of
disruption to the City of London.
 Second, our efforts to avoid disruption to financial contracts. To allow for those firms exiting the UK
to wind down their operations here in an orderly manner, the UK government is drafting temporary
recognition and run-off regimes so that contracts written before Brexit can still be appropriately
cleared and serviced after it, and I hope Parliament will support this. I strongly urge colleagues in the
EU27 to take similar steps. I see no tension on this issue between the interests of regulators and
firms - we all want to reduce the risk of disruption.
6
All speeches are available online at www.bankofengland.co.uk/speeches
 Third, just in case things go badly we have been working with firms to ensure they have in place
liquidity sufficient to accommodate a severe dislocation in financial markets. This is another shared
endeavour - we all need to be ready for a range of outcomes.
Conclusion
I have aimed to describe in this speech two different modes in which we often find ourselves operating at the
PRA.
First, 'battlegrounds' where there is an inherent degree of tension between our interests and those of firms,
and we play the bad cop role. This covers many of the more traditional areas of prudential regulation such as
capital and we should not be discomfited by a certain amount of conflict on these as we come out of the
reform phase.
Second, 'common grounds' where we and firms collectively face a challenge and have a shared interest in
tackling it. In these areas we are good cop and we should simply find the most effective and pragmatic way
of dealing with problems. The Brexit risks are the most pressing current example of these shared
endeavours and I hope that we, firms and EU27 colleagues will succeed in working together to mitigate
them.
7
All speeches are available online at www.bankofengland.co.uk/speeches