Shamshad Akhtar: Pakistan – changing risk management paradigm – perspective of the regulator Speech by Dr Shamshad Akhtar, Governor of the State Bank of Pakistan, at the ACCA Conference “CFOs: The Opportunities and Challenges Ahead”, Karachi, 13 March 2007. * * * A paradigm shift has taken place in the banking sector of Pakistan in recent years. Today, the sector is relatively more robust, market based and highly profitable than it was ever before. The new paradigm has emerged largely as a result of the flexible monetary management, adoption of market oriented banking sector policies, transfer of ownership both in private and foreign hands, clean up and resolution of banks’ loan portfolios, and strengthening of regulatory and supervisory standards. In this session, I will discuss the (i) overall risks Pakistani banks face as a result of the changing economic and banking paradigm, (ii) identify the role bank regulations and supervision play in risk management, (iii) share perspectives on the key risks facing Pakistani banks and briefly touch on the emerging trends, and (iv) highlight central bank and banking industry’s initiatives to strengthen the banks and system-wide risk management. Emerging challenges and risks from changing paradigm Most critical among this is recognition: • First, that Pakistani banks like other emerging economies have benefited from macroeconomic stability and resilience of the economy, there is ample evidence that emerging economies, including Pakistan, are more significantly prone and exposed to shocks than developed countries. • Second, Pakistani banks are today faced with new forms of risks which have altered the nature and type of risk they are exposed to – aside from standard corporate assets whose credit risks is changing with the size and complexities of businesses, banks are now engaging in diverse businesses and sectors and are now extending their exposure to household sector and growth in bank trading books has increased exposure to market risk – a recent phenomena in Pakistan. Concurrently, banks’ overall risk profile is also affected by the complex interdependencies now emerging because of cross ownership of financial institutions and corporate sector. • Third, that enhanced risk exposures can, however, be well managed given that today world is more informed about what drives exogenous and endogenous shocks and how to effectively deal with them through improved measurement, management and mitigation of a wide array of risks i.e. macroeconomic risks, credit risk, liquidity risk, market risks, solvency risks and operational risks. • Fourth, bulk of banks now being under private ownership can no longer count on taxpayer funds to rescue them and recognition that uncompetitive institutions have to be prepared to exit or to fast restructure. Existing regulatory and supervisory framework – principles and approaches As a regulator, SBP has established a comprehensive and well balanced regulatory and supervisory system to inculcate a culture of sound risk management within banks. Simultaneously SBP’s capacities have been enhanced to effectively regulate and supervise banks and assess system wide risks, both on a quarterly and annual basis. Generally, banking regulations have been designed keeping in perspective Pakistan’s economic and political realities, prevailing banking practices, and environment for legal recourse and property registry systems all of which constitute integral elements of the risk management infrastructure. Regulatory framework offers guidance on risk measurement and management and its tools. After being overhauled in 2004, the regulatory framework currently enforced has a good blend of conservatism and prescription while allowing for flexibility and pragmatism to relax exposures when banks have developed effective capacities and systems to mitigate risks. The main elements of regulatory framework are to; (i) Encourage establishment of well capitalized banks – all banks are expected to meet the minimum capital requirements of $100 million by 2009. The requirement for capital has facilitated gradual consolidation and emergence of stronger banks, while allowing banks to take greater risk exposures to the extent that a set of regulations are linked to the equity base of banks. Currently, 8 banks are fully complying with these requirements and others are striving to accelerate compliance, (ii) Encourage banks to contain risk exposures. For instance, both the individual or group exposure is linked to borrowers’ capacity as well as bank’s equity base. Similarly, banks have to contain their trading books through a set of regulations that define the exposure to investment and lending in stock market (Prudential Regulation R-6), (iii) While encouraging sector diversification through a set of development oriented prudential regulations for agriculture, small and medium enterprises and microfinance etc., the regulations are by and large advocating better risk management and controls to help diversify and extend bank’s outreach, (iv) Encourage financial stability through guidelines on corporate governance, anti-money laundering, risk management, internal controls, stress testing, on country risk management, information technology security etc, (v) Encourage financial innovation while keeping in perspective bank’s capacity to manage risks. Keeping in view the role derivatives play in risk management, SBP formulated Financial Derivatives Business Regulation (FDBR 2004). SBP grants Authorized Derivative Dealer (ADD) status to banks that has been assessed to have adequate systems and expertise to conduct derivatives business. Banks which are now allowed to sell derivatives not only to hedge for their customers’ interest rate and foreign exchange risks, but take on for the management of the risks in their own books, and (vi) Enhancement of Disclosure requirements: The SBP in collaboration with the ICAP and the commercial banks has facilitated adoption of International Accounting standards (IAS) by the banks. In 2006, SBP revised the reporting formats for banks to incorporate the significant regulatory developments as well as modifications in the International Financial Reporting Standards (IFRS). With these changes, the quality of disclosure in the Annual Accounts of Pakistani banks has become at par with international best practices. To ensure effective enforcement of regulations, besides day to day oversight, SBP has substantially enhanced its on-site inspection and off-site surveillance capacity. Regular onsite inspections of all financial institution provide an assessment of FIs/banks overall financial condition, evaluate its management and Board performance and check compliance with legal and regulatory requirements. Keeping in view the developments taking place in the financial sector, increase in its size and complexity and introduction of new and innovative financial products, State Bank inspection is also updating its tools and methodologies. We have already realized that going forward specialized skills will be required to assess and evaluate areas like consumer financing, Islamic Banking, treasury, foreign exchange, information technology etc. We have also identified other critical areas for our supervisory focus like Basel II, Anti Money Laundering, internal risk models etc. and capacity building initiatives are being taken in these areas. In line with practices of regulators, SBP has introduced IRAF (Institution Risk Assessment Framework). It offers a composite rating drawing from offsite and onsite feedback, findings of management of banks on board, to establish their rating regarding their compliance with standards, codes and guidelines issued by SBP. IRAF once fully operational will make the supervisory process an all-inclusive and comprehensive exercise which includes information from SBP, Board and Management as well as market vigilance regarding the health of banks. Perspective on key risks facing Pakistani banks Like all other regulators, SBP is encouraging banks to strengthen their risk assessment capability and testing their capacity to withstand shocks under different scenarios. SBP offers its perspective on system wide risks publicly through its Financial Sector Assessment Report and Quarterly Banking Surveillance Reports. The findings of these reports confirm that thus far banks risks are diversified and managed in line with the banking regulations. An analysis of trends in different types of risk would offer better appreciation and perspective on changes in banks’ risk profile: Credit risk: In Pakistani banks, credit operations remain the main source of banks income and have been supported by strong economic activity. Given its size, credit operations are a primary source of risk. Supported by growth in businesses and gradual improvement in internal credit reviews, on balance credit risk have been well managed. The net NPLs to net loan ratio have declined in the last few years and fell to 1.8% by September 2006. In recent years, the macroeconomic environment has been supportive of the growth of banking systems but the growing fiscal imbalance and the external imbalances have enhanced domestic demand pressures. While the vulnerabilities of banking system have been well managed, the shocks arising from external sources can be a cause of concern. Exposure to perceived risks arise from the (i) structural problems facing the real sector whose resolution is critical to maintain the momentum in credit operations, and (ii) high domestic asset prices given high interest rates, equity prices and property prices. Underlying the credit growth is altering risk exposures which need to be well tracked to ensure their effective risk management. There is a broader concern that the growing domestic demand have impact on bank asset quality and the growing exposure of household sector to consumer financing could have their attendant risks. Consumer finance has risen from 2.4% in 2002 to 14.3% by September 2006 and number of borrowers of consumer finance from 0.25 million to 2.6 million, respectively. Thus far credit risks on the banking books associated with some assets has been limited. For instance, the housing finance is barely $1 billion (or 2.3% of total loan outstanding) and mortgage business non-existent. Market risk: Banks market risk exposure largely stems from the interest rate risk as the equity price and exchange rate risks are not substantial given their exposure in balance sheet is limited. Interest rate risk emanates from movements in interest rates, which are determined both by the liquidity available and its response to short term rates and the future expectations of economy, the longer term yield curve. Interest rates in Pakistan have remained volatile in line with demand pressures during the past few years. After the 9/11, initially growth in liquidity resulted in fall in interest rates and by August 2003 the interest rates reached lowest levels and the differential between the interest rates on Rupee and Dollar squeezed. Low interest rates added to the revaluation gains especially for those banks which were holding longer term fixed investment securities and carrying positive duration GAP. Subsequently, interest rates rose with the building up of inflationary pressures. Consequently, banks with significant interest rate exposures had to bear the risks related to their positions. The impact of these trends was manageable as banks were able to hedge their positions in response to the SBP clear monetary policy signals. To evolve better risk management, SBP has allowed derivatives to hedge the open positions of the banks. With the increased knowledge, and realizing the importance of managing the interest rate risks, large banks have established systems and models to better assess and manage interest rate risks. Banks use different quantitative techniques, like VaR models, to assess the risk of loss focusing on tail events. Under the guidance of SBP, they recognize the duration of their assets and liabilities and conduct appropriate sensitivity analysis. With these analytical tools, banks have better understanding of their interest rate risk profile and accordingly better management of such risk exposures. However, banks need to move to more broad based and refined risk management systems so as to capture the right risks at right time. Independently, SBP reviews market risk profile and the mismatches in the assets and liabilities of banks, which generally remain with in the acceptable limits. Liquidity risk: Banks need to be equipped to deal with the changing monetary stance which shapes the overall liquidity trends and the FIs/banks own transactional requirements and repayment of shortterm borrowings. In the modern financial markets, banks have to manage their liquidity through money-market operations which offer a range of options and at any given point has ready providers and buyers of liquidity. In case of temporary liquidity squeeze banks can resort to discount window operation, and in situation where it threatens bank solvency they can resort to the lender of the last resort facility. As highlighted above, from 1999-2003 banks liquidity position was comfortable supported by easy monetary policy. With the growing monetary tightening the central bank has focused on strengthening its capacities for liquidity forecasting and management and conducted effective OMOs to ease or tighten liquidity pressures. In general banks have contained their liquidity risks, but liquidity position of banks has been tightened as evident from rising loans to deposits ratio at 73.2% with some banks reporting above these averages. Liquidity risks can, however, be effectively managed if banks address the fundamental problem of maturity mismatches stemming largely because of bank’s unwillingness to extend their deposit tenor which has limited bank’s capacity to lend long too. Operational risk: Growth in business did stress the individual and system wide financial infrastructure. However, industry is launching initiatives to strengthen its operational capacities by augmenting its systems and processes & adapting information technology solution and outsourcing. Growing wave of mergers and acquisitions leading to conforming business practices have introduced fresh complexity in the operational processes and procedures of the financial institutions. Besides, introduction of new risk management processes and products and hedging strategies, which although reduce credit and market risk but may create additional operational risks, which are on the rising trends. SBP is encouraging banks to adopt best practices to manage their operational risks and has issued guidelines on the areas of Business Continuity Plan, Internal Control, and IT Security. Operational risk was not effectively recognized and captured under the Basel I framework and as such there was no capital charge specifically prescribed for operational risk. Revised Basel Capital Accord (called Basel II), recognizes and defines the operational risks and its dimension and has prescribed capital charge for it to be calculated based on the gross income of the bank. Under Basic Indicator approach (BIA), capital charge for operational risk is a fixed percentage of average positive annual gross income of the bank over the past three years. Whereas, under the standardized approach all the business activities of the banks will be divided into eight business lines: corporate finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services, asset management, and retail brokerage. The capital charge for each business line is based on gross income from that line, and ranges from 12% to 18% of the average gross income of last three years Despite increasing attention to operational risk, little systematic information exists on the extent and impact of operational risk as the losses can result from a complex confluence of events, making it difficult to predict or model contingencies. The biggest challenge for Pakistani banks is the availability of relevant and accurate data within the affordable cost to develop robust and solid operational risk measurement systems for quantification of expected and unexpected losses resulting from people, systems, internal process, procedures and external events. Major initiatives underway to strengthen risk management of banking industry Besides being a regulatory tool for capital adequacy, the new Basel II accord encompasses a comprehensive risk management system. The basic philosophy that the capital should be commensurate with the level of risks has a lot of merit. There is a direct incentive to be more discerning in identifying risk differentials among a set of opportunities and going about managing these risks in a prudent manner. Efficient utilization of capital is the prime goal of Pillar I (MCR) of the accord. Once the Basel framework is in place, banks with superior risk management skills would be able to get a competitive advantage over their counterparts. Recognizing this, Pakistan’s roadmap for implementation of Basel II Accord advocates that banks adopt the standardized approach from January 2008 – progress on this front varies from bank to banks. Bank’s ability to move towards Basel II would require them to address a number of challenges. There is, among others, need for; (i) Collective action to encourage corporate sector to become credit rated; as in absence of recognized credit rating of borrowers, banks would end up allocating more capital than warranted and this would render them uncompetitive, (ii) Development of allied and support infrastructure that facilitates the process e.g. the internal control and IT systems within the banks is absolutely imperative if the framework is to succeed, (iii) Presently the Basel II framework requires banks to apply a capital charge of 15% of average positive gross income of last three years for operational risk (under BIA) there is a need to clearly distinguish between a strong versus weak operational risk environment, (iv) Availability of historical data, for the purpose of carrying out quantitative analysis, and (v) Intensive capacity building of industry and SBP. To discuss these and other challenges SBP has set up a working group to first assess the current state of preparedness of the industry on a standard and agreed template for Basel II compliance and identify joint collaborative action to facilitate smooth transition. Developing rating industry and encouraging entry of raters which have been identified under Basel Accord-II would be critical for an effective implementation of Basel II for Pakistani Banks. SBP would have to draw its own understanding and linkages with the raters to ensure it is applying standards for weighing risks effectively across industry. SBP is in the process of developing a “Banking Supervision Risk Assessment Model” (BSRA) which will help SBP to better quantify the credit and market risks of the individual banks in terms of “Value at Risk” and forecast banks’ position under various stress scenarios on a quarterly basis. BSRA model would use information from the Data warehouse (data received through Reporting Chart of Accounts (ROCA)) for market risk and electronic Credit Information Bureau (eCIB) for credit risk. For operational risk, key risk indicators (e.g. frauds, systems breakdown etc) would be identified and captured and processing would be carried out after a sufficient database is maintained. Once fully implemented and live, the risk assessment model will help Banking Supervision Department to strengthen its surveillance system through monitoring and measuring the risk profiles of the individual banks, even under stressed scenarios. The model will also help BSD to understand and monitor the credit and market risk appetite of the individual banks and proactively take corrective measures, if required. Conclusion The changing economic and banking paradigm has increased the complexities and risk facing banks. While the industry has been bracing up to face the changing risk paradigms which have included not only enhanced exposures to corporate sector but now banks are extending their outreach to household sector, SME and microfinance whose exposures need to be better managed through effective risk management. SBP has adopted sound regulations and proactive supervision to ensure effective surveillance of banks and is advising banks to manage their risks prudently. Despite the growth and diversity in businesses and emerging macroeconomic pressures, banking system has shown a degree of resilience. Results from latest stress tests for all Banks for Third Quarter of 2006 while applying different credit and market shocks to calibrate its impact on solvency i.e. the capital adequacy ratio of the banks indicates that after shock CAR of all banks remain above 11%. Like in previous years, credit risk weight remains high and is assigned bulk of the capital, while market risk is confined to largely interest rate risk with equity risk now being an emerging phenomenon. The liquidity shocks do reflect a decline in liquidity coverage ratio of varying order among different institutions – a 5-10% decline in the liquid liabilities would lower liquidity coverage ratio by 3-7%. In the short term, while banks would have to continue effective risk management through better assessment of credit and market risks, but going forward in anticipation of Basel –II Accord, more fundamental changes in approaches and methodologies of both individual categories of risk is required and extending its reach to operational risk which is currently not accounted for. SBP will continue with its close consultations with the banking industry to get aligned with the international regulatory standards and solve the challenges arising out of these standards jointly with the industry in a congenial environment.