WHITE PAPER. BCBS Title 239: A Path to Good Risk Taking

Transcription

1 WHITE PAPER BCBS Title 239: A Path to Good Risk Taking

2 ii Contents Introduction... 1 The Changing Landscape for Data and Analytics... 2 Lagging Implementation of BCBS 239 and Business Implications... 3 Project Findings... 4 A US-based GSIB Bank...4 A UK-based GSIB Bank...5 A European GSIB Bank...6 Conclusion... 7 Endnotes... 7 Contributor Roger Lang has more than 35 years of financial services experience, including banking, treasury and buy-side trading. His background includes risk solutions development, consulting and sales. He spent 20 years at HP, led working groups for the Financial Services Roundtable, and directed the Wall Street Cornell Theory Center. Lang currently works in product marketing supporting the SAS Risk and Quantitative Solutions group. He is a graduate of New York University with a BS in international business.

3 1 Introduction The financial collapse of 2008 had the greatest impact on the financial services industry since World War II, resulting in consolidation and extensive regulation. The crisis coincided with increased competition from emerging economic powers, nonbanks and fintech organizations. Consumer behavior, from the adoption of mobile banking to P2P payments, forced banks to retool and respond with innovative products and investments in new delivery channels. Technology changed rapidly as well. In the capital markets, trading became fully automated, with pricing, risk decisions and settlement across exchanges made in milliseconds. Against this backdrop of systemic change, the constant drumbeat of new regulations continues to drive up costs while forcing banks to increase reserves and decrease leverage. For example, estimates of the impact of FRTB (fundamental review of the trading book) alone point to a 40 percent increase 1 in capital reserves. IFRS 9, with its new accounting rules and loss-reserving methodology, is another example affecting reserves. These pressures on margins, among others, are driving banks to look for new areas of cost savings and revenue. With these converging business, economic and regulatory factors, enterprise risk management is going through a transformation that is notable for the rapidity of change and the manner in which risk is increasingly integrated within the business. Risk management has traditionally monitored transactions after the fact. To counterbalance pressure on margins with better decisions that optimize the use of capital and address regulatory challenges, risk has rapidly become integrated within the business for example, risk analytics is incorporated within financial products before they are even released to the marketplace. Regulators have signaled that improved risk management practices may act to offset these challenges and improve margins. In a March 2016 Risk Magazine article 2, Paul Fisher, Executive Director of the Bank of England, spoke about good risk-taking practices. He pointed out that regulators are not looking to eliminate risk since it is tied to banks profitability and ultimately beneficial to the overall economy. A well-defined approach that addresses challenges from data to model risk and risk mitigation was required. It is clear that enhanced risk and reporting integrated within the business will enable faster decisions, address regulatory compliance, improve profitability and reduce costs. It is clear that enhanced risk and reporting integrated within the business will enable faster decisions, address regulatory compliance, improve profitability and reduce costs. A common theme that we here at SAS have observed in client projects is that this requires reliable, accurate and timely data.

4 2 The Changing Landscape for Data and Analytics Financial services institutions (FSIs) have traditionally aggregated data from operations within each line of business and geography. They typically submitted summary reports to corporate, while granular transaction data was stored by each business unit within its region. After 2008, regulatory reporting required details underlying all positions across the firm. A new data landscape has emerged along with a new challenge: the requirement to make granular data available for reporting at the enterprise level. 3 For example, one major Canadian bank s mortgage business unit had three geographic databases in the US while mortgage servicing data was kept on a fourth platform. There was no way for corporate compliance to get the detail needed for CCAR reporting and stress testing without normalizing, filtering, cleansing and aggregating mortgage data from these four sources. This was an exercise in collecting granular data that had to be replicated for each geography and every product in every line of business. What we have been witnessing is an explosion in the amount and complexity of data required for risk analytics and reporting. As a result, what we have been witnessing is an explosion in the amount and complexity of data required for risk analytics and reporting. Regulators recognized the need to help FSIs address these sweeping new aspects of managing data not only for compliance, but for managing risk in their day-to-day business. Therefore, BCBS was introduced to provide guiding principles in data management and technology to address the new data landscape. The Basel Committee for Banking Supervision (BCBS) established the principles to ensure banks automated the process of obtaining reliable and timely data for improved risk management, from monitoring positions to maintaining sufficient reserves and managing liquidity in times of crisis. BCBS 239 includes a set of 11 data management and three supervisory guiding principles: Figure 1. BCBS 239 guiding principles.

5 3 BCBS 239 data principles address challenges from governance to aggregation and reporting. While not intended to be prescriptive, they describe the approach that should be taken to modernize a bank s data infrastructure, enabling the aggregation of granular data across the enterprise to provide a solid foundation for risk management. Lagging Implementation of BCBS 239 and Business Implications Since a solid data foundation is required for better risk taking, it should be viewed as strategically important. However, a number of major institutions are lagging in their implementation of key elements of BCBS 239. The reason may be that they view this regulation as a tactical matter. As a result, many banks were not allocating sufficient resources to accelerate the completion of these projects by January Since a solid data foundation is required for better risk taking, it should be viewed as strategically important. This is apparent in the December 2015 Basel Committee progress report for 30 GSIBs 5 (global systemically important banks). The chart shown in Figure 2 highlights areas where 20 percent or more of the banks lagged in implementation to the point where they were materially noncompliant. 90% 80% 70% 77% 80% 60% 50% 40% 57% 43% 50% 50% 43% 57% 30% 20% 10% 23% 20% 0% Governance Data Architecture and Completeness Materially Noncompliant Accuracy and Integrity Timeliness Largely to Fully Compliant Adaptability Figure 2. GSIBs BCBS 239 progress at December More than half of the 30 GSIBs that self-reported in December 2015 indicated they were materially noncompliant in the critical areas of data architecture and completeness and accuracy and integrity. Twenty percent or more fell short in the equally important areas of governance, timeliness and adaptability. This progress report, combined with our findings from SAS client projects, leads us to conclude banks lagging in their implementation of BCBS 239 are also falling behind in good risk taking, with strategic consequences for business.

6 4 Project Findings The consequences of not having required data, risk analytics and reporting are felt across products and lines of business. Problems also reach the board level, where strategic initiatives are delayed, revenue targets are missed, goals for expansion put on hold, and lingering inefficiencies drive up cost. Following are three examples taken from our client projects that began with data aggregation, risk analytics and reporting challenges. Each example highlights the challenges faced, how SAS helped and the benefits realized. A US-based GSIB Bank Challenges Modeling portfolio credit risk was a major challenge in an environment that included 59 million consumer and small business relationships, as well as a range of products from lines of credit to mortgages and cards. The bank needed to: Understand its credit risk position at any given time with the ability to mitigate exposure. Improve its capability to scale the division s credit risk modeling to include credit cards. Perform ad hoc reporting on terabytes of data to be analyzed. How SAS helped SAS provided an enterprise risk management platform and data server based on grid technology, enabling the aggregation and analysis of terabytes of data. The platform pulls 30 terabytes of data, including hundreds of millions of records, from eight source systems. SAS Analytics provides accurate credit scoring and loss forecasting capability. Benefits The bank was able to reduce the probability of default calculation by speeding up the process of data aggregation and analysis, reducing the time required from 96 hours to four hours. It gained the ability to run credit scores on 400,000 loans over the 360-month life of each loan using a suite of models. This process of viewing results quickly from multiple models enabled the bank to achieve better risk taking in its credit portfolio. The time required to obtain analytic results was reduced from three hours to 10 minutes. Automation of the data aggregation process and reduction in time for analytic reports freed up analysts for ad hoc analysis, improving the bank s ability to manage credit risk more profitably.

7 5 A UK-based GSIB Bank Challenges A major international bank headquartered in the UK was required to comply with the new accounting standard for credit impairment, IFRS 9. The new rule affected reserves for potential credit losses in the bank s retail and wholesale banking divisions. The new regulation required over 5,000 variables to be calculated against over 15 million positions in more than 70 countries, creating an enormous data and analytics challenge. Data and workflow for models to do stress testing wasn t automated. Over 400 modelers were deployed to address these challenges while costs mounted. How SAS helped SAS implemented a data management solution that enabled the bank to aggregate accurate and timely data from all of its loan portfolios. An end-to-end process for model governance, model implementation and orchestration was deployed. Stress testing scenarios were implemented using in-memory computing to optimize performance. A results database was implemented and mapped to SAS Visual Analytics for what-if analysis and reporting. Benefits Board-level challenges of financial reporting, audit and compliance were addressed on time through better data management, analytics and reporting to meet the new accounting rules deadline. The process to implement new credit risk models was reduced from approximately 18 months for each model to several weeks. The automation of model orchestration, analytics workflow, management attestation and reporting resulted in millions of dollars in cost savings. The bank gained enhanced control over its credit risk modeling capability. Improved risk taking and risk mitigation provided direct business benefits for the retail and wholesale business units.

8 6 A European GSIB Bank Challenges The global CFO wanted to move forward with plans for an enterprisewide data delivery and reporting infrastructure. The goal was to improve financial reporting by aggregating data from more than 1,000 systems into a single view. Challenges were experienced in reconciling the general ledger with groupwide consolidation of credit risk values. This resulted in an excessive and costly manual effort to produce stress testing reports. Regulatory reporting challenges to complete timely and accurate stress testing had negative implications on reserve requirements. How SAS helped SAS provided the required aggregation to enable a consolidated view of data, including auditable data governance. The SAS Stress Testing solution was deployed on an in-memory platform to ensure required scalability and performance levels. SAS Analytics provided the calculations, reporting and visualization required for centralized management information and reporting. Benefits Consistent, reconcilable capital calculation results through better data management, analytics and reporting enabled the bank to meet regulatory requirements as well as its own financial reporting goals. The bank was able to drive multiple stress testing runs in parallel, significantly reduce manual effort, reduce the time required to obtain validated results, and meet regulatory requirements in a timely manner. Stress testing was adopted for a strategic business advantage and better risk taking. The number of stress tests were doubled, providing key risk and accounting data. On-demand enterprise risk data was adopted as a cornerstone of the bank s risk management program in support of its global business strategy.

9 7 Conclusion Risk management, based on reliable and timely enterprise data, is rapidly evolving to become an integral part of the financial services business. Better risk taking will ultimately differentiate financial institutions from competitors, ensure survival and fuel growth in today s global economy. In the face of these existential challenges and potential opportunity, BCBS 239 principles provide a solid foundation for data and analytics. Therefore, implementing them should be seen as a strategic investment. As Kathryn Kerle, Head of Enterprise Risk Reporting at RBS, stated in a Risk.net forum 6 : We are in an age of digitalisation, and there is a competitive imperative to be better at this. If we can embrace this set of principles and think about it strategically, it also can help us to be competitive in this digital environment. Consensus is building. From product managers to risk managers and the board, we are seeing automated processes to manage data and analyze risk as a means to improve margins and compete effectively in our global economy. BCBS 239 principles must be embraced as a path to good risk taking. Endnotes 1 Basel Committee on Banking Supervision, Fundamental review of the trading book interim impact analysis, November 2015, 2 Paul Fisher, Regulation, risk-taking, and responsibility, Risk Magazine, March 2016, regulation-risk-taking-and-responsibility. 3 Tom Kimner, SAS, Risk data aggregation: Transparency, controls and governance needed for data quality and reporting, risk-fraud/risk-data-aggregation.html. 4 Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting, January 2013, 5 Basel Committee for Banking Supervision, Progress in adopting the Principles for effective risk data aggregation and risk reporting, January 2015, bcbs/publ/d308.htm. 6 Risk.net forum: BCBS 239 Principles for effective risk data aggregation and reporting, Risk data aggregation and risk reporting, December Acknowledgement to Kathryn Kerle, Head of Enterprise Risk Reporting, Risk Infrastructure at RBS for permission.

10 To contact your local SAS office, please visit: sas.com/offices SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. indicates USA registration. Other brand and product names are trademarks of their respective companies. Copyright 2016, SAS Institute Inc. All rights reserved _G