The full text on this page is automatically extracted from the file linked above and may contain errors and inconsistencies.
Speech Governor Randall S. Kroszner At the Federal Reserve Bank of Boston AMA Conference, Boston, MA May 14, 2008 Risk Management and Basel II I am delighted to be here today at this impressive conference. I thank my hosts, President Rosengren and his staff at the Federal Reserve Bank of Boston, for the invitation. I also thank President Rosengren for providing such interesting and informative introductory remarks. Over the next two days, you will be having a number of discussions on specific aspects of operational risk and the advanced measurements approaches (AMA) for calculating risk-based capital requirements under Basel II. Therefore, I can probably best contribute to this conference by offering a broader perspective about risk management and Basel II, using examples from the field of operational risk management. I will discuss the implementation of Basel II, including enhancements to the framework being undertaken by the Basel Committee on Banking Supervision in light of recent market events, as well as a proposal to implement in the United States a less complex version of the Basel II framework, known as the standardized approach. Background I believe focusing on risk management today is certainly topical, given some of the risk management challenges that financial institutions have faced over the past year. Recent market events have shown that a number of institutions have not maintained satisfactory risk management practices; however, we also can point to many examples of sound risk management practices during the recent disruptions.1 Individual institutions are responsible for maintaining sound risk management practices. But supervisors, of course, also have a role to play both in promoting effective risk management and offering incentives for bankers to make improvements to their practices. There are a number of methods supervisors use to that end--some informal, some formal--including speeches, one-on-one discussions, supervisory guidance, onsite examinations, formal supervisory actions, and regulations. One substantial initiative that seeks to improve risk management practices at banking organizations is Basel II. Importance of Basel II As you all know, banking activities must be supported by both sound risk management and strong capital levels. For example, even where robust internal controls are in place, the potential for losses from fraud can never be fully eliminated, meaning that institutions need to hold sufficient capital to offset unexpected losses. Determining the right level of capital to hold for fraud and other elements of operational risk is not necessarily easy, as many of you here can attest. But the AMA is designed to make that determination more risk sensitive and more accurate. In this manner, Basel II represents a major step forward in banking regulation. While the existing Basel I capital regime was a significant advance when introduced in 1988, it has become outdated for large, internationally active banking organizations. Retaining Basel I for these institutions would have widened the gap between their regulatory capital requirements and their actual risk profiles. That is one reason why the Federal Reserve supports Basel II so strongly. With regard to credit risk, the advanced approaches of Basel II improve regulatory capital measures by requiring banks to distinguish among the credit quality of individual borrowers. Generally speaking, banks holding riskier credit exposures are required to hold more capital. Similarly, the AMA framework requires a more systematic approach for assessing the operational risk to which a bank is exposed and ties an explicit regulatory risk-based capital requirement to these exposures. Under Basel I, this charge was indirect and embedded in credit and market risk measures. In contrast, under the AMA, banks with higher levels of operational risk--such as those more heavily involved than others in activities that have elevated loss potential from fraud, business disruption, or systems failure--generally should have higher capital requirements. By establishing a much more refined approach that requires banks to hold capital commensurate with the actual risks of their exposures and activities, Basel II should lead institutions to make better decisions about assuming, retaining, and mitigating risks. Not only does Basel II establish more risk-sensitive and meaningful regulatory capital requirements, it also encourages ongoing improvements in banks' risk management practices. The U.S. final rule for Basel II includes extensive system and process requirements and U.S. supervisors have high standards for banks seeking to qualify. One reason for such high standards is that the framework will only function as intended if Basel II banks have solid risk management infrastructures and robust quantification methods on which to base capital requirements. Another reason for such high standards is that the risk management improvements in Basel II offer broader safety and soundness benefits, beyond those associated with capital requirements. Risk Management and the AMA There are strong linkages between the AMA and supervisory expectations for sound management of operational risk. The AMA builds upon the longtime best practices of banks to develop techniques for identifying, measuring, and attributing capital for operational risk. I commend those of you here today who have made strides in improving operational risk management, and heartily encourage you to maintain your efforts. Supervisors have been working actively with bankers to improve operational risk management and help bankers move toward qualification under AMA. A good example is the research and analysis conducted by my colleagues here at the Federal Reserve Bank of Boston: their useful papers have covered such topics as estimating operational risk loss distributions, evaluating various measurement techniques, and analyzing the reputational impact of operational risk losses. Supervisors have also conducted a series of loss-data collection exercises in which many of you have participated. More generally, I think supervisory attention on operational risk management has provided support to risk managers striving to improve practices within their organizations. The AMA has specific qualification requirements that are intended to bring about risk management improvements. For example, institutions are required to categorize operational risk losses by event type, which promotes identification of the underlying risk drivers of each category. The AMA also requires consistent comprehensive operational risk capture, which promotes an enterprise-wide assessment across all business units within an entire organization. Moreover, qualifying for the AMA requires strong senior management and board oversight of the entire process. In designing AMA requirements, supervisors decided against creating a mandated, standard treatment and instead allowed for considerable flexibility. Allowing more flexibility lets banks create an AMA reflective of their organization, and it promotes innovation in AMA approaches. But that flexibility makes banks more responsible for creating a solid and robust process rather than simply providing inputs to a supervisory-determined formula. Operational risk management is a relatively new field, and a number of challenges remain, such as collecting sufficient and relevant data and developing appropriate modeling techniques to capture low probability events of high severity. Naturally, validating the techniques used in the AMA is also very important, as with any quantitative models. Pillar 2 and Pillar 3 While Pillar 1 minimum capital requirements are very important, people sometimes forget that Basel II has three pillars of equal significance. Under Pillar 2, banks are required to have an internal capital adequacy assessment process (ICAAP), subject to rigorous supervisory review. The bank's ICAAP should ensure that the bank is holding enough overall capital to support its entire risk profile, and it should provide a cushion against the potential impact of periods of financial or economic stress. In its ICAAP, for example, an institution may choose a solvency standard for overall capital adequacy that is higher than the 99.9 percent implied by the AMA--for example, a solvency standard of 99.95 or 99.97 associated with a certain credit rating. As most of you know, estimating capital needs in the tail of a loss distribution becomes more and more difficult the farther out one goes, so simply "scaling" the AMA measure will likely not suffice for truly assessing capital adequacy against a higher solvency standard. More broadly, one of the supervisory expectations surrounding the ICAAP is that institutions should understand the limitations of models and conduct stress testing and scenario analysis to provide greater information about potential losses and capital needs. Even good models have their limits-such as incomplete data or assumptions that have not been tested across business cycles--and need to be supported by more qualitative measures and sound judgment. Put another way, Pillar 2 is not just about using "one number," but requires institutions to develop a robust process to evaluate the full range of potentially adverse outcomes that could affect capital adequacy. This process certainly includes considering the potential for operational risk losses becoming correlated with losses in other risk areas. Recent events provide ample evidence that underestimating the potential for concurrent losses in multiple risk areas can put pressure on capital levels. Pillar 3 plays an important role in providing greater information on banks' risk profiles and their ability to manage them. In addition to disclosing their capital requirements for operational risk under the AMA, banks will have to provide a description of their AMA process, including their measurement approaches and relevant internal and external factors considered. They will also have to provide information about the use of insurance to mitigate operational risk. As a strong believer in market discipline and the importance of information in market transactions, I believe Pillar 3 will improve bank disclosures about risk profiles and enhance discussions between bankers and market participants about risk-management practices. Next Steps with Basel II Implementation In the United States, Basel II has been an official regulation for just over a month. But the full implementation process will take time. While I believe that expeditious application of Basel II will have significant benefits, it is of the utmost importance that the implementation be undertaken thoughtfully and deliberately. As you know, following a successful four-quarter parallel run, a banking organization would have to progress through three transitional periods--each lasting at least one year--before being able to fully implement Basel II. A banking organization would need approval from its primary federal supervisor to move into each of the three transition periods. Of course, we recognize the substantial work that bankers have undertaken over the past several years to prepare themselves for Basel II, and we think that preparation will pay off. Thus, before setting a parallel run target start date, we strongly recommend that banks conduct a sober and frank self-appraisal of their current state as well as their ability to meet requirements of the final rule. Systems development can take time, for example, and it is important to make sure that these systems function appropriately. As stated in the final rule, and as the U.S. agencies articulated several years ago, a key instrument in the qualification process is a bank's implementation plan. This written implementation plan, approved by a bank's full board of directors, is a detailed and tangible representation of how the bank complies, or intends to comply, with the rule's qualification requirements. Our hope is to provide a bit more information in the next month or so about our expectations for these plans, so I will only provide high-level comments here. One important part of a credible implementation plan is a thorough assessment of how the bank intends to address the gaps it has identified between its existing practices and the qualification requirements set forth in the rule for the advanced approaches that cover all consolidated subsidiaries. The implementation plan also must include objective, measurable milestones-including delivery dates--and a target date when the bank expects its advanced approaches to be fully operational. The bank must establish and maintain a sound, comprehensive planning and governance process to oversee implementation efforts, and it must demonstrate to the full satisfaction of its supervisor that it meets the qualification requirements. Because the implementation plan (including the gap analysis) is the only requirement to enter parallel run, the agencies have high expectations for its overall quality and the reasonableness of the approach taken by the banks in assessing their current state. The large, internationally active banks subject to the final rule on a mandatory basis--the core banks-have until October 1st of this year to adopt an implementation plan and have it approved by their board of directors. This deadline for submission of plans by core banks is intended to ensure that the board of directors will provide the necessary resources and oversight and prevent delays in implementation efforts. Of course, banks may always submit their plans earlier. Once they have adopted an implementation plan, banks have ample time to fully meet the qualification requirements, since the final rule allows a bank up to 36 months before it would have to exit parallel run and enter the first transition period. As with all things, however, waiting until the last possible moment leaves little margin for error. Again, as supervisors, we understand that banks face challenges in implementing Basel II, and we stand ready to assist bankers as they work to meet the high standards we expect. For one, we have already engaged in a number of discussions with bankers to address their questions on certain aspects of the final rule. In that effort, supervisory staffs of all the U.S. agencies are working together to ensure that we give consistent messages to bankers, and we intend to maintain such cooperation among the agencies throughout the implementation process. We have also been preparing our examiners to assess banks' practices during the qualification process. In this manner, we have been working to ensure that qualification is done thoroughly, fairly, and consistently. Enhancements to the Basel II Framework One of the substantial benefits of the Basel II framework is its overall flexibility and adaptability to new practices, instruments, and circumstances. That is, Basel II provides a robust structure within which to integrate new information and enhanced risk management practices as needed. As such, the Basel II framework is well suited to address some of the current challenges seen with the current Basel I framework. For example, the new framework's credit risk capital charges for mortgages vary with the underlying riskiness of the exposures unlike Basel I. Basel II also takes into account off-balance sheet exposures much better than the Basel I framework. Just as lessons learned from recent events can help bankers improve risk management practices, they can also help supervisors further increase the effectiveness of the Basel II framework. Indeed, members of the Basel Committee on Banking Supervision recently announced plans to strengthen the resiliency of the framework based on the lessons we have learned over the past year. The Basel Committee's plans to enhance aspects of Basel II are entirely consistent with what we have done in the past with regulatory capital rules upon receiving new information and represent good supervisory practice. These proposals to enhance the resiliency of the Basel II framework are fully consistent with one of its key objectives--improving risk management--and should in no way interfere with institutions' efforts to meet the process and system requirements in the U.S. final rule. The Basel Committee's enhancements, which it outlined in an April 16 press release,2 are intended to improve Basel II's ability to make the banking system more resilient to financial shocks. For one, the Committee will revise the framework to establish higher capital requirements for certain complex structured credit products, such as so-called "resecuritizations" or collateralized debt obligations (CDOs) of asset-backed securities, which have been the source of many losses during the recent market disturbances. There are also plans to strengthen the capital treatment of liquidity facilities extended by banks to support off-balance sheet vehicles such as asset-backed commercial paper conduits. Furthermore, the Committee will strengthen the capital requirements in the trading book, given the large growth in trading-book assets and the wide range of instruments held there, some of them quite complex and less liquid. The current value-at-risk based treatment for assessing capital for trading book risk is limited in its ability to capture extraordinary events that can affect many complex and less liquid exposures. The Committee is working with the International Organization of Securities Commissions (IOSCO) on an interim treatment for certain instruments held in the trading book, such as complex securitizations, and will conduct further analysis to determine a suitable longer-term approach. The Committee plans to issue Pillar 2 guidance in a number of areas to help strengthen banks' practices and help them better prepare for financial shocks that could affect capital adequacy. Areas under consideration include proper asssessment of the risks from off-balance sheet exposures and securitizations, as well as the need to address reputational risk and apply proper stress testing. These efforts relating to Pillar 2 are certainly in line with my earlier comments that bankers must understand the limitations of their more formal risk models, and think creatively to ensure that they have captured all risks and addressed them appropriately. Going forward, the Committee will monitor Basel II minimum requirements and capital buffers to evaluate their appropriateness. It will also assess banks' internal capital management processes and associated risk management practices. This oversight will be particularly important given some of the breakdowns in risk management at institutions over the past year and the associated pressures on capital ratios. The Committee is also working to promote better disclosures by banking organizations under Pillar 3. Standardized Approach in the United States As a final point, I would like to mention that U.S. agencies plan, fairly soon, to publish for public comment a set of proposed rules that would provide an optional capital framework--known as the standardized approach--for those banks not subject to the advanced approaches of Basel II. The proposed standardized approach would help increase risk sensitivity and foster competitive equity. Since we have not yet formally issued the proposed rules for public comment, I will provide just a brief overview on aspects of the proposal that the agencies have already discussed publicly. The proposed U.S. standardized approach will be based on the approach of the same name in the international Basel II framework, modified in some areas to suit the U.S. banking system. The standardized approach would enhance risk sensitivity by increasing the number of risk-weight categories to which a bank would assign credit exposures. It also would increase capital requirements for certain off-balance sheet exposures, such as liquidity commitments, and allow for broader recognition of credit risk mitigants, such as collateral and guarantees. In addition, the approach will include a specific capital requirement for operational risk. Banks not required to adopt the Basel II advanced approaches are facing a choice about whether to opt-in to them. Some of these banks may be sophisticated institutions that exhibit sound risk management, but they might not wish to undertake the extensive effort to meet the advanced approaches of Basel II. The agencies recognize that such institutions should be afforded an alternative to more-risk-sensitive capital requirements, one not as complex as the advanced approaches. Therefore, the proposal is being developed as an optional risk-based capital framework for all banking organizations not required to adopt the Basel II advanced approaches. We plan to retain our existing Basel I-based regulatory capital framework for those banks that would prefer to remain under that regime. I encourage all interested parties to review and comment on this proposal once it has been issued. We are keenly aware of the need for capital requirements to make sense from a standpoint that considers safety, soundness, and competitiveness; we recognize that a one-size-fits-all approach is probably not the best for our banking system, in light of our wide range of institutions. We remain sensitive to the principle that if we have multiple regulatory capital frameworks they must work together to support the safety and soundness of our entire banking system without artificially creating competitive inequalities. Conclusion My remarks today have focused on the risk management aspects of Basel II, with particular emphasis on operational risk. Events of the past year have shown that institutions should never let their guard down when it comes to risk management. Even though most of the high-profile losses during the past year have--so far--stemmed from market and credit risks, one should not, therefore, assume that less attention should be paid to operational risk management. The Basel II capital framework is a positive step forward through its combination of more risk-sensitive capital requirements with strong incentives for improved risk management. In this manner, we expect Basel II to make the U.S. banking industry more resilient in the face of future financial turbulence and generally more safe and sound. Footnotes 1. Randall S. Kroszner (2008), “The Importance of Fundamentals in Risk Management,” speech delivered at the American Bankers Association Spring Summit Meeting, Washington, DC, March 11. See also President’s Working Group Issues Policy Statement To Improve Future State of Financial Markets, and Report of the Financial Stability Forum on Enhancing Market and Institutional Resilience. Return to text 2. Basel Committee on Banking Supervision announcement on strengthening the banking system, http://www.bis.org/press/p080416.htm. Return to text Return to top
@FedFRASER