Ranee Jayamaha: Basel II – a roadmap for Sri Lankan banking system with international comparisons Opening remarks by Dr Ranee Jayamaha, Deputy Governor of the Central Bank of Sri Lanka, at an event of lecture series, organized by the Association of Professional Bankers, Colombo, 18 December 2006. * * * Mr. Theagarajah, Mr. Ajantha Madurapperuma, officials of the Association of Professional Bankers, distinguished participants, ladies and gentlemen. Thank you for the invitation to deliver the opening speech on “Basel II – a Roadmap for Sri Lankan Banking System with International Comparisons”. Let me deviate a bit from the topic and first deal with the flexible approach the Central Bank of Sri Lanka (CBSL) has adopted in moving forward for full compliance of Basel II in the next few years. I will then set out some of the key implementation issues which need to be addressed not only by us but also by the Basel Committee and all host/home supervisors. For international comparison, I will provide a brief a summary of how some of the other countries have fared in implementing Basel II from 2008 onwards. Mr Samarasiri, Director, Bank Supervision will outline a broad roadmap in implementing Basel II. The Basel Committee on Banking Supervision has released the document, “International Convergence of Capital Measurement and Capital Standards: A Revised Framework” in June 2004 which is well known as Basel II. Since then, the bankers and the regulators all over the world have been occupied with the adoption of the revised Framework. The Accord in full is meant for the internationally active banks but other banks are expected to follow suit. Although international institutions such as the IMF and the World Bank have announced that the adoption of Basel II will not be a yardstick for measuring compliance with the international best practice, sooner than later it will be the international norm and they will start monitoring the progress. So, there is no point in debating whether or not we should implement Basel II. The debate, if at all, should be how best to implement it and, where possible, be ahead of others. Overall, the benefits to the industry in terms of improvements in risk management and corporate governance and the supervisory action embedded in the Accord cannot be ignored. Basel II has three mutually reinforcing pillars, namely, the Minimum Capital Requirement under Pillar I, the Supervisory Review Process which is Pillar II and Market Discipline or Pillar III. The whole purpose of this exercise is to make capital the key shock absorber in banking operations. For that, simple risk mitigation measures in Basel I were not considered adequate. Therefore, a risk sensitive capital requirement and risk mitigation practices were combined in a more meaningful manner. Banking is a highly leveraged and risky operation and it is imperative to mitigate risks. With or without the Basel Capital Accord, banks and financial institutions must find ways and means to identify risks, assess them and put in processes and procedures to deal with such risks. Risk mitigation is not new to bankers all over the world and same is true for Sri Lanka. Most of you who are sitting here this evening are professional bankers of high calibre. Banking is like swimming across waters. Bankers know how to swim. Regulators need not teach you how to do it. We can warn you of bad weathers, choppy waters, high-tides and currents that can pull you down, but we cannot swim for you. That’s why the regulators expect the shareholders, boards of directors, CEOs, senior management and all employees of banks to understand potential risks of their own operations and be ready to deal with them if such risks were to occur. Therefore, all bank officials individually and collectively are responsible for risk mitigation. Basel II seeks to balance leveraging internal risk systems with supervisory prudence. It is also a reflection of the rapid change in financial market innovations, advances in risk management and enhanced supervisory approaches. In essence, we expect from the banking profession to objectively and reliably identify risks, evaluate them and come up with appropriate risk mitigation measures. Many enterprises fail due to unforeseen risks because they have not paid attention to risk mitigation. When it comes to banking and financial institutions, we need to be much more careful, because they are the custodians of other people’s money. Flexible approach by CBSL In the process of adopting Basel II, CBSL will endeavour to adhere to the Basel criteria as far as possible and to retain the spirit of the Accord. However, certain modifications have been made and will also be made in the future to suit local conditions. Since Basel II provides a menu of approaches for the measurement of risk to suit the level of sophistication of the banks, it is suggested that the banks in Sri Lanka adopt the simplest approaches, initially. Credit risk For the measurement of credit risk under pillar I, we have requested banks to adopt the Standardised Approach, which is very similar to the existing framework or Basel I and requires very little modifications to the existing risk management systems by banks. The key to the success of this Approach is the rating of counterparts. The banks should, as far as possible, encourage developing a culture of credit ratings. CBSL will consider the representations made with regard to reducing the risk weight applicable to below BB-rated entities initially in order to inculcate the rating culture, but this should not be taken as the norm as we expect higher ratings to be considered for the purpose. The Basel II Framework provides a preferential risk weight of 75% for claims that fall within the regulatory retail portfolio. The qualifying criteria for retail and SME loans that would fall within this portfolio have been modified to suit the local conditions and agreed with the banks. However, in order to avail of the preferential risk weight, banks have to prove that this regulatory retail portfolio meet the qualifying criteria. Operational risk Basel II introduces an explicit capital charge for a bank’s operational risk, i.e. the risk of losses caused by inadequate or failed internal processes, people and systems or by external events such as natural disasters which calls for increased capital requirements. Throughout this year, the Central Bank insisted on banks having comprehensive business continuity plans to ensure that there are alternative arrangements if the core-banking functions or payment and settlement functions of banks were to fail. We issued guidelines, discussed with banks on one to one basis and I believe that action has been taken or is being taken to ensure that business continuity plans are done with utmost care and dedication. As with credit risk, Basel II provides a choice of 3 approaches to the measurement of operational risk and initially, the simplest approach which is called the Basic Indicator Approach is recommended for use by all banks. Accordingly, the capital charge will be based on the gross income of the banks. The most complex Advanced Measurement Approach (AMA) can be made applicable at later stages as techniques for the quantitative measurement of operational risk are still not widely used by Sri Lankan banks. However, regardless of the approach used, all banks are expected to, in their own interest, have in place sound internal operational risk management systems that are commensurate with the nature of their business activities. From the regulator’s point of view, it is difficult to leave risk evaluation entirely to each bank’s discretion particularly because of the need to assess how best each bank uses its capital efficiently in dealing with general and specific risks. For market risk, the present computation of the capital charge introduced in March 2006 will continue. The preparatory work in this area and parallel calculations are at a satisfactory level and we hope that banks will be fully ready by the beginning of 2008 to implement the processes they have already put in place. However, the implementation process does not stop there. The essence of Basel II is to move towards more advanced approaches which will require advanced risk management techniques and improved corporate governance. Adoption of advanced approaches For pillar I, CBSL will consider permitting those banks which wish to adopt the more advanced measurement approaches such as the Internal Ratings Based (IRB) approaches at a later stage, when the capabilities at both the supervisory level and at the banks have improved and the necessary infrastructure is in place. As a general principle, for the time being, CBSL will not mandate any of the licensed banks to adopt the IRB approaches. The banks themselves should conduct their own feasibility studies and analyze associated costs and benefits in order to decide whether to use the IRB approach. The adoption of IRB approach would entail significant changes to their existing systems, the collection of extensive data as well as the fulfillment of many other qualitative and quantitative requirements. Such banks are advised to start building up the necessary data systems now itself in order to be able to qualify for the advanced approaches and to plan the application of the ratings for their credit management. The IRB approach will permit the banks to use their own estimates for the measurement of credit risk with regard to certain parameters. CBSL will stipulate the minimum qualifying criteria regarding the comprehensiveness and integrity of the rating systems, including the ability for those systems to produce reasonably accurate and consistent estimates of risk. This will be done in consultation with the industry and by announcing a timeframe for permitting the Foundation IRB approach and the submission of applications in 2007. Irrespective of whether the advanced approaches are used or not, the Central Bank encourages all banks to study carefully the more advanced risk management concepts and practices embodied in Basel II and consider adopting those relevant to their risk management purposes, even though they may not use them for capital allocation as such. Pillar II – supervisory review process This is a critical and integral part of Basel II which aims at ensuring that banks have sufficient capital to support the risks in their business activities, encourage banks to develop and use better risk management techniques, and foster an active dialog between the banks and supervisors regarding capital adequacy and risk management standards. In this regard, banks are expected to have an internal process for assessing overall capital adequacy in relation to their risk profile and a strategy for maintaining the required level of capital, which is expected to be evaluated by the regulator, and intervene at an early stage to prevent banks’ capital from falling below prudent levels. Accordingly, the implementation of Pillar II will be an extension of the current regulatory practice and an elaboration and refinement rather than a radical change of existing practices. Where necessary, the Central Bank will consider imposing higher capital adequacy levels for certain banks, depending on their risk exposure. This is expected to result in developing a transparent and systematic approach for evaluating the capital assessment processes of the banks and refinement of the CBSL’s risk-based approach to supervision to cover the Pillar II aspects. Its aim is to ensure the quality of risk management standards rather than just setting capital against risks. In particular, the emphasis on other non-credit risks such as interest rate, market, liquidity, concentration, operational, strategic, legal and reputational risks should increase. This would be a natural extension of the risk-based approach to supervision that is already applied and it should be viewed as a means of fostering closer interaction between the industry and the regulator, rather than an imposition of regulations. To enable the process, CBSL has begun to examine the legal requirements in this regard. The internal capital adequacy assessment processes (ICAAP) of banks should cover the identification and measuring of the risks and assessing how much capital is needed to support such risks. After implementation, the CBSL will review banks’ ICAAP as part of the risk-based supervisory process. In addition, there will be an ongoing evaluation of the capital adequacy of banks, including stress tests. In the process of evaluation, CBSL will review and evaluate the risk profile of the banks, the adequacy and reliability of the ICAAP, and identify any weaknesses or inadequacies and necessary prudential measures. Pillar III – market discipline The purpose of this Pillar is to complement Pillars I and II by encouraging market discipline through the public disclosure of key information on risk exposures and capital adequacy. Disclosures are applicable at the bank level as well as supervisory level. The level and content of Pillar III disclosures will vary according to the measurement and calculation approaches adopted by a relevant bank. In terms of Basel II, the disclosures would have to be made on an annual and semi-annual basis. The implementation process will be developed in 2007 along with the Sub-committee appointed for the purpose. Key implementation issues I. What is the appropriate capital adequacy ratio? Under Basel I, the minimum capital adequacy requirement was fixed at 8% of risk-weighted assets which is expected to be the minimum even under Basel II. In Sri Lanka, we have specified the minimum capital adequacy to be at 10% from 2003, because it was considered necessary to have a cushion of additional 2%, so that any unforeseen risks could be covered to some extent. Under Basel II, the minimum capital adequacy ratio could be well above 10% or even lower than 10% if the bank concerned is absolutely sure that it can mitigate all risks that are associated with its banking operations. We will continue to use the yardstick of 10% for measuring the minimum capital adequacy ratio consisting of 5% for Tier I. The other related issue is “Will 10% be adequate to cover market and operational risks as specified in Basel II?” This is where the regulator is going to leave it in the hands of the banks, but insist that the two new areas of risks are covered and all risks in banking operations are calculated in an objective manner. It is also necessary for the banking institutions to go one step further and take into account the risks of their clients also in a meaningful manner. This is certainly a challenge for both the bank and also the supervisor. This challenge is not unique to Sri Lanka, but common to all countries which have opted to comply with Basel II requirements. To address this issue, banks in other countries have created a dedicated post in their institutions, i.e. Chief Risk Manager, who will not only look into the risks in the bank’s own portfolios, but also to the clients’ portfolios. The job of the Chief Risk Manager is to identify, evaluate risks and make recommendations to set out appropriate processes in managing the relevant risks. The processes should be acceptable to the senior management and the boards of the banks and also to the external auditors and the regulators. II. Appropriate risk evaluation techniques Application of appropriate techniques for risk evaluation is an implementation issue. This is where the modeling comes into play. Modeling is used as a popular technique for identifying, quantifying and analyzing risks to enable the management of banking and financial institutions to decide on the allocation of capital. But one need not entirely depend on modeling and be out of reality as modeling will produce a statistical outcome depending on the data you feed into a set of equations or a simulation model. Modeling also involves issues such as focus on loss data, validation, calibration and issues on floors and ceilings. A practical issue on loss data is a different reporting system by banks, especially when it comes to large losses. Secondly, some institutions may not reveal large losses at all, but there are implications for operational risks. III. Financial reporting and accounting issues It is equally important for banks to take care of the financial reporting framework, be it international accounting standards or local accounting standards given that Basel II requires financial reporting on international accounting standards. Most banks in Sri Lanka will have to apply local accounting standards and make necessary adjustments in their financial accounts to comply with Basel II principles. The Institute of Chartered Accountants is proposing to adopt the International Financial Reporting Standards (IFRS), in particular IAS 39 and 40. CBSL will monitor the impact this will have on the regulatory capital of banks and formulate policies in this regard taking into consideration the international developments and practices of other regulators. IV. Single borrower limits and other sub-limits Should the regulators and supervisors continue with the regulations imposed on single borrower limits, group borrower limits and aggregate limits that are in operation under Basel I, when they proceed to Basel II from 2008 onwards? and when will the supervisors lift sub-limits such as the single borrower limits that are currently in place and give more flexibility to the financial intermediaries? There is no clear answer to this, but we hope that some of the commercial banks which are conscious of the fullscale risk mitigation would be able to put in place appropriate processes and convince the supervisors of their ability to move to advanced approaches of risk mitigation. At that point we need to adopt more flexible attitudes towards limits and sub-limits in lending. V. Involvement of boards, senior management and governance issues Basel II requires the involvement of the senior management in the process of identification, evaluating and mitigating risks. Does this mean that the senior management and the board members should use some supervisory and monitoring powers to ensure that the technical and other officers continue to engage in risk mitigation activities and that the board is satisfied with action taken by them? When there are several layers of supervision, you might need a liaison officer to communicate with the management and the board. The bank management should address this issue early and avoid serious governance issues. VI. Capturing new risks When financial market innovation takes place globally, new products such as derivatives, securitization will be introduced and they are likely to bring in new risks including operational risks. How do we balance these new risks with other internal risks, systems, processes and also with supervisory prudence? It is evident that Basel II enables banking to be based on more market driven systems which is conducive to financial innovation and it requires setting aside risk mitigation processes to deal with ever increasing financial innovation. VII. Handling of operational risks Should banks use stress testing or best practices in handling operational risk? Stress testing is merely a tool which gives results on a reliable set of data. The banks need to compile a reliable database for all operational risks that have arisen in the past 5 years or so and assess losses recorded during the period. It is only then one can simulate and assess how much capital should be allocated if a similar operational risk were to take place. Stress testing therefore is not only an add-on, but also a cushion for management of risks in terms of validation and allocation of capital and it is one of the highly accepted and commonly used tools. VIII. Cross-border transferability issues This is relevant to both supervisors and banks where home and host supervisors require to agree on a common approach. Do banks which have global operations adequately take into account legal issues, capital issues and assumptions about liquidity or capital transferability? How well are local managers able to respond to host supervisory concerns? Currently, there is no sufficient data or experience to deal with these issues. All know there are legal issues in transferring capital on cross-border basis which are relevant to banks which have assets linked internationally. IX. Compliance by financial conglomerates Generally, a financial conglomerate is defined in terms of combined activities, such as banking, securities and insurance. To what extent the financial conglomerate would use regulatory arbitrage and not adequately assess the systemic problems is a key element under Basel II? This is particularly relevant when it comes to similar financial products that can be packaged as an insurance product, a banking product or a securities product as same business can be undertaken by either a bank, investment bank or an insurance company. A key implementation issue is how to delineate the double gearing and how to make available capital to deal with risks of both insurance and securities products. As far as the EU is concerned, the financial conglomerates directive has already been issued and they are expected to comply with them. USA’s umbrella supervisory provisions are included in the Graham Leach – Bliley Act. In Sri Lanka, we still have not come to terms in dealing with a consolidated or a group-wide financial conglomerate. X. Proper definition of capital How do you identify new capital instruments such as hybrid capital and perpetual debentures? Should it be Tier I or Tier II? One needs to be cautious here as hybrid capital can disappear given its derivative nature. Currently, there is a wide disparity between the Basel II preparation processes in Europe, USA and Asia. The issue of treating hybrid capital is significant as many Asian banks are moving towards synthetic securitization in producing hybrid capital and exposing their portfolios to credit risks, especially when equity participation has been synthetically securitized. The Basel Committee has now decided to pay greater attention to give a standard definition for capital, hopefully before the implementation begins in 2008. International Comparison Many countries have not tackled all these issues associated with Basel II, but there is notable progress; some slowly, some moderately and some at a faster phase. For example, the Development Bank of Singapore (DBS), the largest bank in Singapore and the 5th largest group in Hong Kong with universal banking, providing full range of products and services for consumer, small and medium enterprises, corporate banking, investment banking, fund management, trade finance, cash management, securities and treasuries has taken a keen interest over the last 2-3 years in meeting the Basel capital adequacy requirements and to implement the same in 2008. At present, it has a Tier I capital ratio of 10.1% and a total capital ratio of 14.1%. The main philosophy behind the DBS’s approach is a balanced and enlightened one based on the management of capital. The approach is led by the DBS’s board and senior management and it is embedded within business of a whole group. It is constantly reviewed by supervisors and communicated to the markets. The DBS group has implemented a large-scale Basel II governance structure at several levels which is a success factor. Its governance structure is based on DBS’s credit model risk policy which sets out the minimum principles and standards for the oversight control and management of all credit risks models in the group and the roles and responsibilities. Several committees have been set up at the board level and at group credit level to identify and manage risks. In terms of modeling, the model owner will design, select and parameterize the key elements of the model. The model implementation is also by the model owner who will work closely with the model users and performance monitoring unit. Above them, are the model validators who are under the oversight by a Group Credit Risk Committee. The Board’s Risk Management Committee sits above these groups. It is a tightly knitted process which is transparent throughout the DBS group and they are moving progressively, using internal rating in the management of credit risks. Despite using several internal rating models and regardless of the types of the models used, DBS continuously review the risks which need to be mitigated using its practical knowledge throughout the group. So the commonsense approach prevails there too. Countries like Sweden have also begun addressing issues of Basel II implementation. Their case is much more difficult than ours as they have spread among few of the Nordic countries in a significant way. They are plagued with issues such as options and national discretions, different interpretations and practices, reporting requirements across the EU system and the difference between legal and operational structures in banking groups, basically, issues under pillar II. As a country within the EU-system, Sweden will have to comply with common reporting frameworks for capital requirements and have consolidated financial data. They have to deal with common recognition processes for external credit assessment institutions and comply with home/host country guidelines. Sweden is attempting to deal with these issues in a systematic manner during 2007, following the regulations to be passed by its Parliament. Fortunately, Sri Lanka does not have to deal with such cross-border issues as in many other countries. South Africa is well ahead in terms of handling implementation issues on time targets. During 19992003, they have complied with core principles for banking supervision issued by BIS. In 2004, Basel II regulations were issued and economic impact studies were completed in 2005. In 2006, consultations have begun and in 2007 parallel runs will be conducted to implement Basel II in 2008. In fact, South Africa has begun data capturing and mandatory requirements way back in 2004 and had discussed appropriate models with banks opting to use internal rating based models. Informal field tests were also conducted in 2006. In order to avoid supervisors performing redundant and uncoordinated approval and validations of models and risk assessment by banks, South Africa has established supervisory colleges to share information and coordinate supervisory actions. They have also prepared “to-do” lists and MOUs with home/host supervisors. Australia has defined capital more precisely and is on a moderate phase in moving towards Basel II. The basic rule for Tier I and Tier II capital have been that Tier I capital should be of high quality with no debt claims. They are permanent capital and also helps prevent failures. Tier II capital is subordinated to depositors. Non-payment is a default and it is treated as an additional cushion in a failure. These are some of the examples we were able to pick when Mr. Samarasiri and I attended the Executives’ Meeting of East Asia and the Pacific (EMEAP) held in Hong Kong last week. It gave us some comfort that we are not that bad in international comparison. But, we need to recognize that many countries have already laid down solid processes and procedures which are more comforting than ours. The dedication of some of the banks like DBS is also worth noting as they have begun their homework with great commitment across the group over the last couple of years. Although the progress made by banks in Sri Lanka is satisfactory, we need to be more committed and move ahead in 2007, faster than we did in 2006 in readiness for Basel II implementation. Ladies and gentlemen, thank you very much for your patient hearing.