R Jayamaha: Basel II and operational risk Keynote address by Dr R Jayamaha, Deputy Governor of the Central Bank of Sri Lanka, at the 10th SEACEN-FSI Regional Seminar for Bank Supervisors and Regulators, Colombo, 12 December 2005. * * * It is indeed an honour to have been invited to deliver the keynote address at this SEACEN - FSI Regional Seminar for Bank Supervisors and Regulators on the implementation of Basel II and Operational Risk. I would like to take this opportunity to share some thoughts on this important subject, which is currently engaging the attention of the Bank regulators, not just in our region, but worldwide. I will first deal with why Basel II requires a separate capital allocation for operational risk and what it intends to accomplish. Next, I will discuss how Basel II deals with operational risks and how it contributes to financial system stability. Finally, I wish to mention a few steps regulators can take in preparation for adopting Basel II and mitigating operational risk. 2. Deregulation and globalization of financial services, together with the growing sophistication of financial technology are making the activities of banks and their risk profiles more complex. In this context, not only well known credit, interest rate and market risks, but also other risks can be substantial and threaten the stability of a financial system. A growing number of high-profile operational losses worldwide have led banks and supervisors to increasingly view operational risk as an integral part of risk management policy. Management of specific, more common or day-to-day operational risks is not a new practice; it has always been important for banks to prevent fraud, maintain the integrity of internal controls and reduce errors in data transaction processing, ensuring the availability of information technology infrastructure and their back up systems when needed. More often than not, operational risks are taken as given and very little attention has been paid to it. Operational risk is intrinsic to financial institutions and it should be an important component of their firm-wide risk management systems. However, operational risk is harder to quantify and model than market and credit risks. Operational risk differs from other banking risks. It is a risk that is not willfully incurred in return for an expected reward but is implicit in the ordinary course of banking business and has the potential to affect the risk management process. However, ignorance of operational risks or failure to properly manage such risk can result in a misstatement of an institution's risk profile and expose the institution to significant losses. Such institutions can become a regulatory burden. These and a few other factors have led the Basel Committee to recommend a separate capital for operational risk. 3. Definition of operational risk has evolved rapidly over the past few years. First, it was commonly defined as every type of unquantifiable risk faced by a bank, which has been refined considerably to include modern day risks. According to the Basel Committee on Banking Supervision, operational risk is the “risk of loss resulting from inadequate or failed internal processes, people and systems or from external events”. This definition is based on the underlying causes of operational risk at the broadest level and includes legal risk, but it excludes strategic and reputational risks. The Basel Committee has also asserted, “the most important types of operational risk involve breakdowns in internal controls and corporate governance.” That’s why Basel II aligns with a variety of other regulations and supporting frameworks for enhancing corporate governance. 'Management of operational risk is thus taken to mean the 'identification, assessment and / or measurement, monitoring and control of mitigation of this risk. While many of these risks are inherent and visible in day to day operations of banks, some components are applicable to supervisors and regulators. 4. The banking industry’s awareness of operational risk and efforts to manage it have accelerated in recent years, driven in part by an increasing desire to improve operating efficiency, reduce earnings volatility, rationalize the allocation of capital between competing businesses. It is not easy to get banks to identify and assess the operational risk inherent in all material products, activities, processes and systems and in particular to follow such practices when new products are introduced. To encourage banks to focus attention on assessment of operational risk on products and processes, regulators should be aware of new products, improvements in management information systems and computing technology that have opened the way for improved operational risk measurement and management. In the next few years, financial institutions and their regulators will continue to develop various approaches for operational risk management and capital budgeting techniques. 5. Let me focus on some key areas of operational risks and regulatory responsibility in the interest of financial system stability. 6. Sound management of operational risk is particularly important in payment, clearing, and settlement systems as such risks can spread across systemically. All owners and operators of payments, clearing and settlement systems face operational risks but the degree may vary from system to system and from country to country. Operational problems in a payment, clearing, and settlement system may impede the control of, or even exacerbate, other types of risk such as market, liquidity, or credit risk in an unanticipated way that could pose a systemic risk, resulting in participants incurring significant losses. It may not stop there. Payment and settlement related operational risks could filter into businesses of banks’ clients, governments and the country’s international correspondents as well. This aspect of banking operations was ignored for many years and it is fairly recently that regulators and banks started addressing payment and settlement related operational risks. Today’s consensus is that payments, clearing, and settlement systems must be safe, reliable, efficient, and secure, which are critical to financial system stability. That’s why most regulators, the central banks in particular, have become owners and operators of clearing and settlement systems. Although the tendency is to outsource this function, many regulators at some stage or other have owned or operated these systems. 7. Another technology related risk is the desire of banks to acquire the leading edge with propriety systems, stand alone systems and specific IT systems. Banks tend to hang onto this short-lived approach. Individual systems are costly not only to banks themselves, but also to customers. The norms should be not attracting customers, but reducing their operational risks and reduction of transaction costs to customers. Both are often forgotten or ignored by banks and continuous reminding has become a regulatory responsibility. Despite moral suasion banks in many countries have not realized the gains of having common ATM platforms, back-up sites, disaster recovery sites and sharing of costs. 8. It may also be necessary to for banks to recognize that different risks matter in different lines of businesses. A comparison of business unit economic capital requirement by risk type indicates that operational risk is highest in fund management, private banking, and in retail banking when compared to corporate banking, insurance business (if banks are allowed to engage in). The new operational risk element is expected to hit banks specializing in areas - such as custodian arrangements and asset management. The regulators should be mindful of high operational risks in these businesses and bring them to the attention of banks. 9. Uncertainties, regulatory challenges in promoting banks In a lighter vein, operational risks can be categorized into two, i.e. man-made risks (mistakes, faulty models, frauds, terrorism, wars etc.,) and god-made risks (earthquakes, floods, Tsunami disasters, electrical blackouts, telecom interruptions etc.) Some of these are well known and banks handle them in their own ways. Complexity of the assessment process and required changes to it, uncertainty in the implementation date of Basel Accord, the US and some European banks’ attitude towards implementing the Accord, variability in data reporting are a few factors that have created uncertainties in banks as well as regulators’ minds. I believe that these challenges can be overcome if banks can be encouraged to adopt a systematic approach as set out in Basle II. First and foremost, regulators have to get banks to commit to a risk mitigation cycle which consists of (a) risk diagnosis (i.e. prioritization of objectives, documentation review/meetings and building up of a risk control culture profile); (b) risk identification within a framework; (c) risk assessment and preparation of action plan; and (d) risk reporting. 10. The choice of the approach/models banks wish to adopt may have significant implications. Score card, loss distributions and internet modeling are some of the popular risk models. All of them have implementation challenges, in particular, skills shortage, non-availability of reliable data and suitable IT systems. In-house training courses tailored to each business unit, commitment by senior management of banks, understanding of benefits of implementing Basel II by all stakeholders and hiring of right skills would help in mitigating skills shortage related risks. Regulators and supervisors have to be at it to assess progress within a reasonable time frame. 11. Without data, there are no models and without models, the risk management capability is reduced. This does not mean that commonsense approach in handling matters should be discarded altogether. Given the heavy competition and highly leveraged nature of businesses, banks, at minimum, should record historical data for computing the probability of default loss, and operational risk losses. This is a difficult task. The challenge for banks is to build up databases for operational losses, both historical and potential future losses. The challenge for regulators is to ensure that banks start collecting this type of data in a systematic manner. Banks often see regulators as a pain in the neck due to constant nagging. Perhaps, moral suasion and organizing peer pressure might encourage banks. 12. Unbundling risk related capital charges in the new Basel II Capital Accord requires an explicit capital charge for operational risk. Calculating such a capital charge has proved extremely difficult because of a lack of an accepted methodology and credible industry data. This has required the adoption of a strategy to permit banks to use their own internal measurement approaches – subject to quantitative and qualitative criteria and, on a transitional basis, to a minimum or floor capital charge. Assessing and validating different internal risk mitigation measures would be a regulatory challenge. 13. The Basel Committee has put forward a framework consisting of three options for calculating operational risk capital charges in a ‘continuum’ of increasing sophistication and risk sensitivity. There are three approaches under Pillar I: (i) the Basic Indicator Approach for Operational Risk I, which requires a flat rate of 15% or a fixed percentage of gross annual income; (ii) the Standardized Approach for Operational Risk II which requires a risk charge based on annual income per each business line, multiplied by a risk factor per business line; and (iii) Advanced Measurement Approach for Operational Risk III which requires full reliance on bank’s internal risk management system subject to supervisory review. Many Central Banks including the Central Bank of Sri Lanka propose to initially allow banks to adopt the Basic Indicator Approach for computing regulatory capital for operational risk. They are expected to move along the range towards more sophisticated approaches as they develop acceptable operational risk management systems and practices, which meet the prescribed qualifying criteria. According to DC Independent Survey 2003 and KPMG’s 2nd Global Survey on Basel Readiness Assessment of 190 institutions in 19 countries, increasingly, banks appear to be moving towards Advanced Measurement Approach rather than Standardized Approach in dealing with operational risk. As for the Central Bank of Sri Lanka, we have decided to follow a consultative process while implementing Basel II norms and move in a gradual, sequential and co-coordinated manner, for which dialogue has already begun with the banks. A steering committee comprising representatives of banks and supervisors is taking stock of all issues relating to its implementation. Here too, the regulators need to be on top of things to assess readiness of banks. 14. Conclusion Let me sum up the key messages of this address. Today, the degree of sophistication in financial markets urge all market participants, including regulators and supervisors, to increase their focus on risk management in an effort to build more robust and sound financial systems and to position themselves to participate more fully in this complex and fast-paced financial environment. In that sense, Basel II, aiming at further strengthening of the soundness and stability of the international banking system, offers a unique opportunity to respond to all these concerns and pay attention to the main sources of risk and vulnerability that could pose challenges for the financial system stability. 15. Implementation of Basel II has been described as a long journey rather than a destination by itself. The journey is certainly tougher than we thought. Undoubtedly, it would require commitment of substantial capital and human resources on the part of banks and the supervisors. For banks, the main challenges appear to be the skills shortages and data inadequacies coupled with uncertainties regarding costs associated with implementation. Banks all over the world have started to voice concerns over the mounting regulatory costs. It is a regulatory responsibility to encourage banks to have a phased implementation programme starting from a traditional baseline scenario of identification of operational risks, assessment, and awareness monitoring and integrating these elements over a period. Basle II implementation and operational risk mitigation process puts heavy burden on supervisors to detect problems in banks, to stay on top of the latest advances in risk management and to avoid abuses of many powers that are given to supervisors. All these are too much for supervisors to bear as many of us are still on the learning curve. Exchange of information both within and outside the region would be very important particularly in capacity building for evaluation and validation of risk assessment models of banks. This seminar is one such joint effort by the Central Bank of Sri Lanka and the SEACEN Centre, which would provide a good opportunity to exchange information and learn from each other. 16. Basel II is expected to foster financial stability through its risk sensitive framework through encouragement of banks to adopt improved risk management practices. Supervisors and regulators are required to review the efficiency of banks’ risk management practices and capital allocation methodologies, and empower market participants to make informed judgments on the efficiency of banks. Despite challenges, many researchers suggest that Basel II leads to rising rewards and discipline in banking industry. The indicators are that pay back for getting Basel II right and for looking beyond mere compliance to the real business benefits will be greater than originally anticipated. Encouraging banks to understand and believe that enhanced economic capital framework would be the key to high performance is undoubtedly a regulatory challenge. 17. I believe the deliberations of this seminar will improve our knowledge on ways and means of dealing with regulatory challenges posed by Basel II and operational risk mitigation measures. I wish the seminar a success and thank you all for your attention.