fourpaper
Opinion Pieces
Key lessons for banking risk management following the financial crisis Received (in revised fo rm ): 30th Septem ber, 2014
Madelyn Antoncic is Vice President and Treasurer o f the W orld Bank, responsible fo r core treasury functions and three business lines: Asset M anagem ent w ith US$145 bn assets under m anagem ent (AUM), Debt and Asset M anagem ent A dvisory, and Financial and Catastrophic Risk M anagem ent S o lu tions, designing and executing hedging products fo r the W orld Bank G roup's (WBG's) c lien t countries. She began her career as an econom ist at the Federal Reserve Bank o f New York, spent 12 years at Goldm an Sachs and 10 years at Lehman Brothers. M adelyn holds a PhD in econom ics from the Stern School, New York University.
The W orld Bank, 1225 Connecticut Ave., NW, W ashington, DC 20433, USA Tel: +1-202-458-0774; E-mail: m antoncic@ w orldbank.org
A b s tra c t M a n y le s s o n s h a v e b e e n le a rn e d f r o m th e f in a n c ia l c r is is , a n d in its a f te rm a th n e w r e g u la t io n h a s b e e n im p le m e n te d t o a d d re s s is s u e s w h ic h w e re h ig h l ig h te d b y t h is c r is is . H o w e v e r , a r g u a b ly th e t w o k e y re a s o n s f o r th e c r is is (a la c k o f le a d e r s h ip a n d a d e q u a te g o v e rn a n c e , a n d a la c k o f f u n c t io n a l r e g u la t io n ) r e m a in o p e n i te m s . W it h o u t a g o v e rn a n c e f r a m e w o r k t h a t p r o v id e s a p p r o p r ia te c h e c k s -a n d -b a la n c e s , a n d w i t h o u t r e a l ig n in g r e g u la t io n a w a y f r o m b e in g d e te r m in e d a c c o r d in g t o a f in a n c ia l in s t i t u t io n 's in c o r p o r a t io n a n d to w a r d r e g u la t io n a c c o r d in g t o its b u s in e s s e s , p o l ic y m a k e rs , r e g u la to r s a n d th e f in a n c ia l in d u s t r y h a v e a ll m is s e d a n o p p o r tu n i t y t o b e b e t te r p o s i t io n e d to p r e v e n t a n o th e r s ig n i f ic a n t c r is is in th e fu tu r e . M o re o v e r , u n t i l t h e r e is a c r e d ib le a n d a p p r o p r ia te r e s o lu t io n m e c h a n is m , b a n k s re m a in t o o b ig t o fa i l .
Keywords: governance framework, regulation, too big to fail
Prior to the onset of the financial crisis, in December of 2006, I gave a speech in Geneva where I was supposed to speak about Managing Risk in Volatile Times. I stood up and said these were anything but volatile times and gave examples of how volatilities, across the globe and in every asset class, were at all-time lows and spreads were the tightest they had been in a very long while. So I went on to say that managing risk would be easy if markets were volatile, because people would want to listen. Instead, given how low volatility was, people thought things were different this time; the thinking was that we have reached nirvana and we have found the magic recipe to eliminating risk through diversification. The world was decoupled and asset
prices would grow to the sky. So, I spoke about managing risk and how complacency was the biggest risk, which, o f course, was the case and we saw events unfold that created havoc in so many people’s lives.1
I ended that speech by saying ‘everyone, at every company, has to view himself as a risk manager. In fact, sometimes, we are risk managers for each other, even outside our own firm. If one firm has a problem, it can affect all of us, and become our own problem, if it affects the industry’s reputation. We, as risk managers, are the guardians of our respective firms’ reputations, and by extension, the industry’s reputation.’
Since my Geneva speech the world experienced the worst financial crisis in nearly a century followed
31 4 Journal of Risk Management in Financial Institutions Vol. 7, 4 314-318 © Henry S tew art P ub lica tions 1752-8887 (2014)
Key lessons following the financial crisis
by unprecedented central bank policies and changes to financial regulation. In terms of risk management, some lessons have been learned the hard way and have led to changes in the industry, I call them consensual lessons. Other lessons have been less consensual or proved more difficult to address. Finally, the response to the crisis has led to unintended consequences and we should be attentive to ‘the lessons of the lessons’.
THE CONSENSUAL LESSONS There is a first set of rather consensual lessons about risk management in banks that have been or are being implemented.
The first one is that banks and in particular large international banks need to have more capital and better quality capital to support bad lending decisions that can never be prevented. With Basel 2.5, Basel III and the global systematically important financial institution (G-SIFI) agenda, most banks around the world have indeed significantly increased their capital base focusing on core equity. In particular, hybrid forms of capital, very popular before the crisis, are not considered under the Basel III core equity Tier 1 ratio, which is a positive development, given the limited track record of hybrid capital at absorbing bank losses during the crisis.
The second lesson is that risks related to the management of a bank’s liquidity needed to be better understood and recognised. During the crisis banks did not fail so much because of a lack of capital, but owing to a lack of liquidity: usually, capital-related problems allow an institution to react and implement corrective measures; liquidity problems can destroy an entity almost overnight as we have seen again and again. The liquidity ratios introduced under Basel III are not perfect but they do represent a real improvement compared with pre-2008 as they attempt to address both leverage and asset and liability mismatch.
Thirdly, the risks of the securitisation and the originate-to-distribute model were not fully understood to say the least: they are now better taken into account with the ‘skin in the game’ and transparency requirements introduced by regulators.
A final consensual lesson is that regulators should not rely only on banks’ internal models to assess risks given the disparity across entities but need to
monitor unweighted data as well. The Basel leverage ratio attempts to compensate for the divergent models. While on the right track in terms of recognising the need to compensate for the divergent models, perhaps a more refined approach is needed rather than the new blunt-edged leverage ratio.
LESSONS THAT ARE LESS CONSENSUAL OR MORE DIFFICULT TO ADDRESS There are other lessons that are more or less acknowledged in principle but implementation is less straightfo rward.
First, for me, the 2008 crisis was not so much the consequence of too little regulation, but mostly of inconsistent regulation and inconsistently enforced regulation. Entities doing similar trades were applying different rules and were supervised by different regulators depending on their location and how they were incorporated or chartered. ACA Financial Guaranty Corporation, which was a monoline municipal bond guarantor that morphed into a collateralised debt obligation (CDO)2 enabler is a good illustration of the dangers of such a regulatory framework.
ACA, along with other municipal bond guarantors, played a critical role in the growth of subprime mortgage origination by providing packaged mortgage backed securities in the form of CDOs with guarantees. Because ACA was regulated- by the Maryland State Insurance regulator, it was governed under a statutory accounting basis, contrary to banks that are under banking regulators and governed under a marked-to-market accounting basis. This accounting and regulatory arbitrage was a significant driver in creating demand for subprime mortgages that fed the origination machine.
Beginning in October 2007, there was a domino effect of rating agencies putting these municipal bond guarantors on credit watch, ultimately downgrading some.3 S&P changed ACA’s rating from ‘A’ to ‘C C C ’ and put it on Credit Watch Developing. ACA collapsed in December 2007. By March 2008, as a result of the ratings actions, the subprime mortgage origination machine eventually shut down.
© Henry Stewart Publications 1752-8887 (2014) Vol. 7, 4 314-318 Journal of Sisk Management in Financial Institutions 315
Antoncic
The challenges presented by the shadow banking system are now well recognised and regulators are working at better identifying and monitoring its development, in particular to mitigate the spill-over effect between the regular banking system and the shadow banking system. However, in most jurisdictions, the financial regulation is still very much organised by legal entities rather than by real activity.
While there is talk of implementing ‘functional regulation’, we are still very far away from resolving that issue. In fact, some new rules established post-2008, have actually helped feed the shadow banking system. For example, new capital rules as well as the Fed’s ‘guideline’ preventing banks from making leveraged loans involving a target company that would end up having debt more than six times EBITDA4 is only serving to have hedge funds and private equity firms take up this slack and provide direct financing. This peer-to-peer is hardly the outcome intended by the regulators.
Second, the governance issue — which for me was the very root of the financial crisis — still needs to be tackled more comprehensively and more forcefully.
Strong governance is one of the three pillars of sound risk management, along with an independent risk management organisation and a well-functioning risk infrastructure. To me, a strong risk management framework should begin with overall governance, which is the primary key element to an institution’s control framework. Governance must be grounded in the realisation that nothing is as valuable as an institution’s reputation in protecting it over the long run. At the end of the day, each person must feel he or she is a risk manager and is responsible, in his or her own way, to protect the institution.
Part of governance is a strong risk awareness philosophy — a philosophy that needs to permeate the entire organisation. Risk management needs to be an all-encompassing philosophy about setting the right tone at the top, establishing the right risk culture, and hiring the right people to carry that culture. Governance is about leadership, which is about doing the right thing.
The other key ingredient of governance and therefore an effective risk management framework is proper checks and balances. No one should go
unchallenged. Proper governance is more than having an independent risk function. It is not about an organisation chart. It is about fostering an environment of effective challenge at every level. An institution where people go unchallenged is destined for failure.
I can share an illustration based on my personal experience. Before the financial crisis, Lehman’s risk-management framework was arguably one of the most advanced and sophisticated in banking ■—• a point noted even by the Lehman Bankruptcy Examiner.5 Many of the capital charges, associated with credit and default risk, now included under the various Basel frameworks, were taken into account in Lehman’s framework in the early 2000s. Also included in the framework was a capital allocation for the potential shortfall in business operating income owing to stressed economic scenarios, somewhat along the lines of elements of the Comprehensive Capital Analysis and Review (CCAR.), now a standard approach for running stress tests under the US regulatory framework.
So Lehman s collapse was not the consequence of a lack of capital as a result of poor risk management. It was not the consequence of being unaware of the risks that it faced. Lehman was brought down ultimately because of a lack of leadership at the top; a lack of willingness to do the right thing. It collapsed essentially owing to a gross violation of the governance framework that had been put in place and was universally followed until bit by bit it was dismantled by the very top of the firm until clearly a ‘new tone’ had been set. This was made possible by too much concentration of power.
Recent developments in leading banks and investment firms demonstrate that this culture of checks and balances is still lacking in many organisations.
To improve governance and ensure that the right decisions are taken by the senior management and the Board, a strong and independent risk management function and organisation is necessary. It requires a function that has a seat at the table at the very top of the organisation and is empowered to say ‘no’.
It is very important that the risk function reports directly into the board and is an equal partner with risk takers. Importantly, effective risk managers have
316 Jo u rn a l o f Risk M a n a g e m e n t in F inancial Institu tions Vol. 7, 4 314-318 © Henry Stewart Publications 1752-8887 (2014)
Key lessons following the financial crisis
to be experts who understand the business and act as much as an ‘enabler’ as a ‘guardian’. There is a fine line between the two roles of ‘enablers’ and ‘guardians’ but both of them have to be played for risk-management to be effective. Indeed, a risk-management organisation that always says no is as useless and dangerous as one that always agrees with the business.
THE UNINTENDED CONSEQUENCES OR THE 'LESSONS OF THE LESSONS' In addition to these lessons, some of which have brought about change, others of which have not, there is a third set of issues that are not derived from the crisis itself but from the measures taken afterwards by governments and regulators. We need to learn some ‘lessons from the lessons’ to prevent more unintended consequences o f the measures taken after the crisis to improve risk management in the banking industry.
Some of them are due to the fact that a very significant portion of the lessons taken and addressed have focused on weaknesses and loopholes in the financial sector of advanced economies, mainly in the US and Europe, as they were at the core of the 2008 crisis. Therefore, they have not been necessarily fully thought out in terms of the implications for non-US/non-European banks, and in particular for banks in emerging markets and developing economies (EMDEs).
In terms of capital requirements, Basel III implementation has caused some banks in advanced economies to deleverage and change their business models, making them reluctant to make loans to specific sectors of the economy, especially — and worryingly — to small and medium enterprises (SMEs) and infrastructure projects.
New capital rules also affect banks from EMDEs. Although in aggregate, they already have capital ratios that exceed the Basel III minimum capital requirements, they may be pushed to hold much higher capital, based on pressures from external rating agencies, correspondent banks and investors. The new liquidity ratios are also having an impact in EMDEs with limited ‘high quality liquid assets’ owing to their limited capital markets (an issue that the finalised
version of the Liquidity Coverage Ratio does acknowledge). In addition, the efforts to reduce asset— liability mismatch in banks seem to adversely impact long-term finance, especially in infrastructure funding.
CONCLUSION So are the risks in banks being managed better and more cautiously? At the individual level, risk management has made significant progress even though room for improvement still exists as described above; but what about at the aggregated level? Are banks now not too big or too interconnected to fail?
A tremendous amount of work has been, and continues to be, devoted to the question of the resolution of large, complex and international financial institutions: cross-border crisis management groups have been established, recovery and resolution plans have been drafted, supervisors have been empowered to request changes to the legal structure of financial entities and Europe has established the single supervisory mechanism, to list but a few initiatives. In an effort to facilitate an orderly resolution o f a major banking firm, 18 large banking organisations have agreed to sign onto a new protocol providing a 48-hour temporary stay on certain default and early termination rights within standard International Swaps and Derivatives Association (ISDA) derivatives contracts in the event one of the large banking organisations is subject to an insolvency or resolution proceeding in its home jurisdiction.6
However, my sense is that we still do not know how to properly address the failure of a large international financial firm with hundreds of legal entities across the globe and it will not change any time soon because to do so would entail harmonising the bankruptcy legislation of all major financial centres, something even the European Union has not been able to achieve over the past 50 years. This is probably the most important lesson from the crisis and the most difficult to address.
Lessons from Lehman should make it clear this needs to be addressed. At the time of its failure, Lehman had a US$640bn balance sheet with many legal entities. Upon its break-up each entity went its own separate way to maximise its value. However, the problem was that prior to the bankruptcy
© Henry Stewart Publications 1752-8887 (2014) Vol. 7, 4 314-318 Journal of Risk Management in Financial Institutions 317
A n to n c ic
because of the different regulatory regimes, long positions were often hedged with short positions, each booked in different legal entities (cash bonds hedge with derivatives, for example). A wind-down of the entire firm should have taken this into consideration and positions with their hedges should have been wound down together to maximise value. However, the various overseers each responsible for winding down their respective different legal entities were looking to maximise the value of the entity under their responsibility; not the value of the firm as a whole. O f course, it was the different regulatory regimes that gave rise to this practice of booking different asset classes in different entities in the first place. That practice still continues and therefore this issue has not been addressed through, for example, better harmonisation that makes having meaningful ‘living wills’ or resolution mechanisms more of an aspiration than a reality. Perhaps the new Federal Reserve rule requiring a foreign banking organisation with a significant US presence to establish an intermediate holding company over its US subsidiaries7 can enhance the resolution mechanism, however its full implementation is almost two years away.
In fact, to see that in some respects we are slipping backwards towards fragmentation and a myriad of domestic markets rather than financial markets becoming more globalised one only needs to look at the Fed’s ‘guidance’ on leveraged loans discussed above, as well as at the new bank leverage ratios. The new ‘guidance’ on leveraged lending applies only to US banks, not European banks. Likewise differences exist with leverage ratios where banks in Europe will be required to hold 3 per cent of capital against total unweighted assets while their largest US counterparts will be required to hold twice as much. Thus while progress has been made in some areas we need to continue to work together — governments, regulators and the industry — to harmonise rules so as to reduce the risks inherent in the financial sector but doing so entails travelling a long road ahead.
Finally, there is no ‘rule’ to implement for what is probably the most important lesson learned and that is the lesson o f the consequences of complacency that I raised in 2006. In my view, as I look around at financial markets today, that lesson may have already been lost on some. Whenever a ‘new paradigm’
supposedly exists, we need to collectively recognise and accept that the reality is there is no reward without risk.
A u th o r 's n o te The views and opinions expressed in this paper are those of the author, nourished by a 25-year experience in Wall Street financial institutions. They do not necessarily reflect the official policy or position of the World Bank.
R efe ren ces 1 ‘Cinderella’s moment’, The Economist, 11th
February, 2010. 2 A CDO is a type of structured financial product
that pools together cash flow-generating assets — such as mortgages, bonds and loans — and repackages the pooled assets into discrete tranches bearing various credit ratings that can be sold to investors. In order to enhance the credit worthiness of senior tranches in the capital structure some CDOs are ‘wrapped’, ie credit enhanced by guarantee providers.
3 For a chronology of municipal bond guarantor credit ratings actions since October 2007, see www.munibondadvisor.com/BondInsurance- ratingactions.htm
4 EBITDA, an abbreviation for earnings before interest, tax, depreciation and amortisation, is an indicator o f a company’s financial performance used as a proxy for a company’s operating profitability.
5 United States Bankruptcy Court Southern District of New York, in re: Lehman Brothers Holdings Inc. et al., Debtors, Chapter 11 Case No. 08-13555 (JMP), Report of Anton R . Valukas, Examiner, 11th March, 2010.
6 Federal Reserve System (2014), Joint Press Release, ‘Federal Reserve Board and FDIC Welcome ISDA Announcement’, available at: h ttp ://www.federalreserve.gov/newsevents/press/ bcreg/20141011a.htm (accessed 20th October, 2014).
7 Federal Reserve System (2014), Press Release, available at: http://www.federalreserve.gov/ newsevents/press/bcreg/20140218a.htm (accessed 20th October, 2014).
318 Journal of Risk Management in Financial Institutions Vol. 7, 4 314-318 © Henry Stewart Publications 1752-8887 (2014)
Copyright of Journal of Risk Management in Financial Institutions is the property of Henry Stewart Publications LLP and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.