Regulatory stability and the role of supervision and governance

Keynote address by Mr Jaime Caruana, General Manager of the BIS, at the Tenth High-level Meeting on Global Banking Standards and Supervisory Priorities in the Americas, jointly organised by the Association of Supervisors of Banks of the Americas (ASBA), the Basel Committee on Banking Supervision (BCBS) and the Financial Stability Institute (FSI), Montevideo, 28 October 2015.

Abstract

Supervision has a number of important functions. In addition to the consistent implementation of regulation, supervision can complement regulation in dealing with the financial sector's continuous innovation and adaptation, thereby reducing the need for frequent rule changes and promoting regulatory stability. Moreover, supervision can go beyond the quantitative requirements to address qualitative matters such as corporate governance, influencing banks to change their risk culture for the better. In short, there is a lot that supervisors can and should do to help make banks not only more resilient but also more reliable - and thus more able to perform their intended economic and social function.

---

It is my pleasure to be here with you today to discuss global banking standards and supervisory priorities. These high-level meetings always provide an opportunity for a fruitful exchange of views and experience on matters that are at the heart of our work.

In response to the global financial crisis, the Basel Committee and other standard setters developed a comprehensive set of reforms. These reforms have increased the resilience of banks and the banking system, which will also promote our ultimate objective of sustainable economic growth.

Many of the sessions in this meeting will discuss the regulatory agenda and its implementation. You may be glad to hear that I will not be talking about the regulatory reform agenda. While it is critical, regulation is only part of the story. Instead, I would like to step back, take a broader view and look at some aspects of supervision which in my opinion are critical not only to achieving financial and economic stability but also to restoring public trust in the financial system.

Why is supervision so important? There are three main reasons or functions to be highlighted:

First, the success of any regulatory standard depends on the supervision of that standard. As the regulatory reform programme approaches finalisation, it is natural that the Basel Committee's focus is now shifting towards supervision and the assessment of impacts, whether intended or unintended. Consistent implementation of the rules is one of the important roles of supervision, possibly the most important. It is a way to ensure sound balance sheets and a resilient financial system.

A second important role is dealing with complexity, innovation and continuous change. In a highly dynamic, changing and complex world, regulations are permanently playing catch-up with the continuously adapting financial sector. Supervision can complement regulation in dealing with this challenge. For example, some of the problems associated with the excessive variance of risk-weighted assets across banks can be addressed not only by putting some constraints on banks' internal models (ie regulation), but also by being stricter in model approval (ie supervision).

Third, merely complying with regulations is not enough. For the banking system to fulfil the role that society wants it to play, it needs to do more. In particular, trust in the system must be restored. This requires not only the strengthening of balance sheets or compliance with regulations, but also changes in behaviour and in the culture of financial institutions. Quoting a recent Group of Thirty (G30) document: "most banks should aim for a fundamental shift in the overall mindset on culture".¹

Culture is a difficult concept to grasp: it deals with values and behaviour. That being said, if culture is what people do when no one is watching, then can supervisors - by watching, monitoring and asking questions - influence culture for the better? The answer is yes. It is important for supervision to contribute to enhancing culture because culture influences decisions and behaviour. Making sure that behaviour aligns with good policies is essential.

Supervisors have been paying increasing attention to this issue. And yet, the response is arguably still uneven across countries. This suggests the need for more discussion in the supervisory community. I will come back to this point later and draw your attention to a number of good analyses of this topic that have been published recently.

In the rest of my remarks, I will focus on the last two issues: the role of supervision in dealing with complexity and innovation; and the role of supervision in encouraging good culture and governance in financial institutions.

Dealing with complexity and innovation

The financial system undergoes constant evolution. Any given regulatory framework - be it simple or complex - would thus inevitably face limitations in constraining the risks in this system. I would argue that we need to recognise the intrinsic nature of these limitations. Some of them come from our incomplete understanding of systemic risks and the dynamics of complex systems, where interlinkages and non-linearities allow seemingly small shocks to result in dramatic changes in economic behaviour. Other limitations stem from financial market innovations that adapt to but also generate new types of risks. Importantly, financial markets often innovate in response to regulation itself, reducing the intended impact of regulatory changes.

In order to remain effective, a regulatory system needs to address these limitations and challenges. However, regulatory attempts to catch up with a continuously adapting financial system are an uphill battle. Rules and indicators, whether simple or not, may look appealing in theory but turn out to be less effective as soon as they become a binding regulatory constraint and trigger responses from individuals and institutions.

What is the appropriate approach? I would propose that, instead of constantly tweaking regulatory frameworks to deal with the financial sector's responses, we deploy complementary and flexible tools from supervision. To be sure, major revisions to our understanding of the financial system - such as those triggered by the global financial crisis - do call for regulatory reforms every now and then. But we need to accept that any reform would not be perfect. It would face intrinsic limitations and fall short in anticipating how the financial system will evolve. The reform is thus best seen as laying solid foundations for the implementation of supervisory tools that can be adapted to the specificities of a particular jurisdiction or market. Since such tools are well placed for dealing with continuous changes in the financial system, giving them more prominence would help alleviate regulatory challenges.

By reducing the need for frequent refinements of regulatory rules, the greater prominence of supervisory tools will contribute to greater regulatory certainty. This is particularly important at the current juncture, as the post-crisis regulatory reform has entered its final phase. A lot has already been achieved, and the regulatory framework is stronger than in the past. It thus makes sense to conclude any open issues as soon as possible and let banks concentrate their efforts on financing the real economy within a stable regulatory environment.

The global nature of financial markets adds another dimension to this discussion. Cross-border consistency of the regulatory framework is necessary for a level playing field and, ultimately, for the proper functioning of the financial system. At the same time, we need to recognise domestic specificities, which tend to get more attention in the wake of crises. It is thus key to strike the right balance to prevent financial fragmentation. We already know that the solution is to go through internationally agreed standards and supervisory cooperation. We also know that this is a difficult balance, particularly after financial crises, which tend to increase the risk of each jurisdiction adopting national regulatory strategies. To work as intended, such standards need to build on international supervisory cooperation, the exchange of experience and frameworks for mutual recognition.

The limitations of the regulatory framework have been highlighted by the debate about banks' internal risk models. In particular, post-crisis regulatory reviews show that, even for exposures of similar riskiness, model-based risk weights can differ materially across banks. This risk-weight variability is partly of banks' own making, as they have much flexibility in using complex internal models - a flexibility that has opened the door to the possibility of strategic model "optimisation". In turn, models' complexity has conspired with data limitations to complicate supervisory validation. As a result, confidence in banks' internal models has weakened, thus delaying the regulatory agenda.

The response to risk-weight variability should combine regulatory and supervisory measures. On the regulatory front, measures can address some of the shortcomings of banks' internal models. For instance, constraints on certain model inputs or on model outputs (risk-weight floors) would directly reduce the variability of risk weights.

For its part, supervision can quickly adapt to financial innovation and thus play a complementary role in strengthening the robustness of model outputs. Concretely, supervisors can impose strict criteria for model approval, in line with new financial market realities. They are also in a suitable position to decide which banks have the modelling capacity to develop, maintain and use properly calibrated models.

Even under constraints, banks' internal models enhance risk sensitivity. This is an important feature of a framework that recognises the complexity of the financial system and thus the limitations of any fixed set of rules. By employing internal models, the framework maintains its flexibility, thus offering supervision scope for deploying tools that match ongoing financial innovation and new risks.

Banks' internal models present many additional advantages. When models differ genuinely across banks, they introduce a healthy diversity of opinion, which can be a stabilising force. In addition, they maintain banks' incentives to improve their financial risk expertise - not least through a continuous dialogue with supervisors - and build data sets that are useful for risk measurement. All this while the responsibility for risk management and model design remains with the banks.

In sum, proactive supervision can usefully complement regulation. Endowed with enough discretion to flexibly adapt to changing practices and to identify and counter potentially destabilising behaviour, supervisors could contribute to banks' sound risk measurement and management. In addition, flexible supervision could reduce the need to constantly adapt the regulatory framework to the changing financial landscape. At the current juncture, this would help expedite the finalisation of work on the ambitious regulatory agenda, thus reducing regulatory uncertainty.

Both regulation and supervision can give banks incentives to strengthen their risk management. But we know that good risk management is not just about creating complex models that try to explain complex realities. It is also about using models in a way that takes proper account of their limitations. And it is about creating the right risk culture and putting appropriate governance and oversight structures into place.

This leads me to my next point.

Promoting better risk culture and governance

Cases of large losses at banks and other firms due to weaknesses in governance and culture are all too common. At the heart of these cases, there is an inevitable link between poor risk culture, on the one hand, and failures in controls and governance, on the other. Such weaknesses therefore have safety and soundness implications and represent a major risk factor with tangible consequences for banks' profitability, reputation and competitiveness.

If banks have to recover public trust, they need to look to values and behaviour - they need to effect a fundamental shift in culture. Short-termism, weak risk culture and weak oversight are some of the cultural failings that banks should work to avoid.

The issue of culture and governance is certainly not new, but, as I mentioned earlier, a couple of good analyses of this topic have been published recently. I believe that these provide an opportunity to further advance this important discussion.

One is the July 2015 report "Banking conduct and culture: A call for sustained and comprehensive reform" by the G30. It concludes that, among other things, "addressing culture and repairing trust go hand in hand and are a prerequisite for sustainable economic returns".

The same month also saw the release of the Basel Committee's "Guidelines: Corporate governance principles for banks". This revised guidance raises supervisory expectations related to corporate governance. The principles in this guidance are closely aligned with those recently issued by the OECD and the recommendations published in reports prepared by the G30.²

Furthermore, the Financial Stability Board (FSB), in a guidance paper issued in 2014, presents good governance along with appropriately defined risk appetite and properly aligned compensation as the three foundations of a sound culture.³ It also proposes a useful set of indicators of good culture: the tone from the top, accountability, effective communication channels open to different and challenging views, and proper incentives, particularly on remuneration.

So, what do these analyses mean in practice?

Banks, of course, should assume the prime responsibility for their own behaviour. As the G30's July 2015 report puts it:

Banks should specify their cultural aspirations through a robust set of principles, and fashion mechanisms that deliver high standards of values and associated conduct consistent with the firm's purpose and broader role in society. A key challenge is to identify and manage behaviors in "grey zones" in which adherence to conduct and values principles and standards is a matter of judgment, not a matter of clear-cut legal requirements. Just because it is legal does not mean it is right.

In front of this audience, let me focus more on the role of supervisors.

Effective prudential supervision requires assessing not only banks' implementation and adherence to the technical and quantitative aspects of regulatory standards, but also whether there is an appropriate culture within a sound corporate governance framework.

There are a number of measures supervisors should take to address weakness. At a minimum, supervisors should set clear expectations for banks. They should engage in active dialogue with banks on issues of culture and governance. And they should assess the effectiveness of banks' frameworks and processes and require remedial action as necessary.

Let me elaborate on these points.

Setting supervisory expectations

Supervisors cannot regulate culture, nor should they. But they can set expectations about some values, processes and incentives through a monitoring function. They also can and should issue guidance for banks to establish robust corporate governance policies and practices, in order to ensure that behaviours will be aligned with established values and policies

Regulatory guidance should address, among other things, expectations for board responsibilities, board structure, the composition and qualification of board members, checks and balances, committees, and a clear allocation of responsibilities within the bank. The reports I mentioned earlier provide much more detailed proposals in this regard.

Two-way dialogue

Supervisors need to be willing and prepared to have a high-level dialogue on these issues of governance and behaviour - a dialogue that is different from the one on compliance.

It is essential that banks and supervisors dedicate sufficient time to issues of governance and that their interactions are conducted at the appropriate level. Such dialogue provides an opportunity to clarify expectations on both sides and address issues of priority, such as supervisory findings and topics recently discussed in a board's risk committee.

Evaluating effectiveness

Evaluating culture is complex. In this task, supervisors may find it helpful to refer to the indicators of good culture highlighted by the FSB in its guidance paper and the recommendations in the other two reports mentioned. Rather than going through the whole list, I would like to elaborate on two points.

First, the tone from the top. It should be abundantly clear that the board has ultimate responsibility for the bank's overall governance. It is responsible for the bank's business strategy and financial soundness, key personnel decisions, internal organisation and governance structure and practices, risk management and compliance obligations.

But setting the tone from the top is not enough. The board and senior management need to lead by example and speak loudly and clearly, but the risk is that the message will get lost in the middle. The board and senior management need to make sure that, as the G30 report very nicely puts it, the voices of middle management and the echo from the bottom can be heard.

Supervisors should have processes in place to fully evaluate a bank's corporate governance. To make the link with the previous points, regular communication with a bank's board of directors and senior management should provide valuable input to these evaluations. This should be supplemented with regular reviews of written materials and reports to assess, among other things, how compliance incidents, customer complaints and audit recommendations are being managed. This work could include interviews with those responsible for risk management, compliance and internal audit functions and with external auditors, as well as other types of on- and off-site monitoring.

Second, let me underscore a point pertaining to effective risk governance - what is often referred to as the "three lines of defence" approach. Both the G30 and the BCBS emphasise its significance and recommend it as a structure for clearly defining the responsibilities of the different parts of the organisation for risk management, and thus for ensuring that the culture of effective risk management - in terms of both values and accountability - permeates all levels of the organisation.

Each of the three lines has an important role to play, and provide supervisors with abundant checkpoints to monitor.

• The business line is the first line of defence. It has to have "ownership" of risk, whereby it acknowledges and manages the risk that it incurs in conducting its activities. The ownership of risk means that the analysis of risk also starts with the business units themselves - the message should be made clear to all.

• The risk management function is responsible for further identifying, measuring, monitoring and reporting risk on an enterprise-wide basis as part of the second line of defence, independently from the first line of defence. The compliance function is also part of the second line of defence. The responsibilities of these functions need to be clear to everyone in the organisation. Moreover, risk managers and compliance officers need to be empowered to act. This would require support from top management.

• The internal audit function is the third line of defence, conducting risk-based and general audits and reviews to provide assurance to the board that the overall governance framework, including the risk governance framework, is effective and that policies and processes are in place and consistently applied.

Conclusion

To conclude, even though regulation is critical, it is only part of the story. Supervision also has a role to play, not only in achieving financial stability but also in fostering culture and governance changes, which would help restore public trust in the financial system.

Supervision can complement regulation in dealing with the financial sector's continuous innovation and adaptation. More proactive use of supervisory tools can help take some of the burden off regulation, reducing the need for too frequent rule changes, thereby promoting regulatory stability. Moreover, supervision can go beyond the quantitative requirements of regulation to address qualitative matters such as banks' corporate governance. By monitoring the right indicators and asking the right questions, supervisors can influence banks to change their risk culture for the better.

In short, there is a lot that supervisors can and should do to help make banks not only more resilient but also more reliable - and thus more able to perform their intended economic and social function.