15 / 11 / 2019 opening remarks 11th edition of the european ssm roundtable / international bankers forum margarita delgado deputy governor good morning and welcome to banco de espana for this 11th edition of the european ssm roundtable, organised by the international bankers forum ( ibf ). the topic for today ’ s roundtable is the management of non - financial risk. this is an issue which is always in the spotlight and, at the same time, is quite hard to tackle. the concept of risk is continuously used in banking regulation. a quick search in the crr1 or crr2 text will reveal that it is mentioned nearly 1, 500 times in each. banks are certainly familiar with the regulatory requests to understand, measure, hedge, control, assess, address or mitigate risk. i believe it is fair to say that any firm that has survived the crisis and its long aftermath, without public support, has been largely successful in fulfilling these risk - related tasks. of course, supervisors are also permanently concerned about risk ; to some extent, it is what we are paid for. still, i believe both banks and supervisors tend to feel rather comfortable when we assess financial risk. don ’ t misinterpret me. we are perfectly aware of the consequences that a mismanagement of financial risk can entail, but we tend to look at financial risk in a more natural and intuitive way. things get a lot stickier when we look at non - financial risk. what is the nature of non - financial risk? and what makes it different from more traditional financial risk? the concept of risk is always linked to a loss which is, by definition, uncertain. any loss which is certain is not a risk anymore ; it is simply a cost. nevertheless, financial risk is always the consequence of specific financial choices ; namely, the decision to purchase an asset or grant a loan gives rise to certain risks for the institution. despite the uncertainty, the financial risks posed by that given transaction can generally be measured, in the sense that losses tend to be limited and associated with known events, which are likely to occur with a certain probability. the rationale of banks ’ business models is to take on this financial risk and generate profit from it. of course, banks should assess this profitability jointly with the level of risk assumed in order to take informed decisions. however, the nature of non - financial risk makes it far more difficult for banks and supervisors to tackle. non - financial risk, whether related

- called front - end, namely the customer experience. there is a lot of talk about the interaction with the client and the quality of apps, but i would like to stress that it is even more important to undertake technological change focusing on the back - end processes. needless to say, i am talking about client data, which is the basic commodity of this fourth industrial revolution. importantly, client data is currently controlled by banks, though some recent developments, such as the psd2 in the eu, might alter this situation. accordingly, institutions should strive to make the best out of their current dominant position. banks should be capable of extracting, exploiting and analysing their customers ’ data. management must fully consider this information to take decisions. otherwise, reevaluation and transformation of the business model will not be possible. therefore, a clear conclusion would be that the business criticality of it and cyber resilience has also soared, compared to the situation 20 years ago. this makes the investments and controls in this area a key element of the future. let me refer briefly to business conduct. the crisis has reminded us, rather painfully, that conduct is another key factor to consider in any sustainable business model. i would like to point out that conduct change is the only means of responding to the challenge the sector faces to restore its image and reputation. society has changed in terms of its demands of the financial sector, including also higher standards for aml - cft. the rules governing customer - bank relations have likewise changed. banks should, therefore, move to respond to the new social and regulatory reality. it is worth recalling that a very positive consequence of this policy is that it increases legal certainty, significantly reducing potential litigation costs. in many cases, implementing these policies involves a top - down cultural change. this kind of change is doomed to fail unless there is full commitment and support from banks ’ senior officers and management. indeed, without adequate governance and a clear ‘ tone from the top ’ there is no chance of success. 4 / 6 as i like to point out in many of my interventions, governance is always a precondition for any significant change to occur within an organisation, but of course it is just a precondition. evidently, other elements must be implemented in order to tackle appropriately the management and control of non - financial risk. one initial element relates to the involvement of the board, which should consider nonfinancial risk management as part of their regular monitoring