Regulators urged to enhance op risk oversight post September 11

NEW YORK -- Financial regulators must enhance their monitoring of individual firms and the linkages between them after the September 11 attacks in New York showed the vulnerability of the financial system to op risks.

That was the verdict of management consultants McKinsey & Company in a November report on the impact on New York’s financial services of the attacks.

McKinsey, acknowledging regulators re- examining their policies, said agencies must ensure firms’ business recovery plans take account of the problems of access and telecommunications connections. Regulators should also ensure mandatory industry-wide stress testing of linkages between firms and markets.

As an example of the stress testing McKinsey had in mind, the firm cited the possibility that in the equity markets, regulators and industry groups -- the US Federal Reserve, the Securities and Exchange Commission (SEC) and the Securities Industry Association, for instance -- could sponsor joint connectivity tests of selected firms, key clearing houses and major customers. Other organisations, including perhaps the US Treasury and the Bond Market Association, could sponsor tests for the bond markets with particular focus on clearing and settlement processes.

The attacks exposed deficiencies in the financial system and its vulnerability to key ‘choke points’ -- telephone switches and other hubs through which key information flows, McKinsey said (see box).

The underlying ‘connectivity’ of the telecoms and power infrastructure was surprisingly fragile, with single points of failure such as at the New York telephone carrier Verizon’s central office at 140 West Street. Both the energy and telecoms infrastructures lacked alternative networks that could be activated swiftly, the report said.

Industry analysts noted that Bank of New York (BoNY) officials blamed much of the disruption to the bank’s crucial securities processing services after the attacks on the loss of telephone connections to its customers, rather than on BoNY’s systems.

BoNY, one of the world’s biggest processors of securities trades, had major problems paying out funds due to failed communications lines. Some market sources estimated its payments backlog reached $130 billion on September 13, leaving a number of big European institutions with large overdrafts with other banks.

The McKinsey report said there was a lack of geographic diversity in back-up plans, insufficient access to back-up sites, a lack of alternative networks and systems for telecoms and power. "These weaknesses could pose a significant threat in the event of future system-wide disruptions," it said.

Forty percent, or 1,700 of the civilians killed in the attacks on the twin towers of the World Trade Center, worked in the financial services industry, McKinsey noted.

But the report said the immediate impact was modest relative to the overall size of the financial services sector. The industry was shocked by the suspension of most trading for several days, but financial systems performed well overall.

Only about $4.4 billion of the $30 billion in total property damage was attributable to financial services firms, since most firms rented office space. And as most of the property damage was covered by insurance, the net loss to the sector will be even lower, the report said.

The cost of business disruption, a combination of lost revenues due to market closure and dislocation expenses, was about $1.8 billion and was partly covered by insurance.

Impact of Attack on New York Financial Services

, a report by McKinsey & Company (www.mckinsey.com).

Curing the choke points New York’s financial markets were exposed to a few critical and highly concentrated ‘choke points’ on September 11 -- key hubs such as exchanges, clearing firms and inter-dealer brokers. This triggered significant effects for the rest of the financial services system, management consultants McKinsey & Company said in its report (see main story). McKinsey recommends a secure alternative system for key choke points with the following suggestions: • Develop a ‘wiring diagram’ for the financial services industry that would identify choke points. One option would be to form a private-sector task force led by a respected industry member and consisting of representatives from the Treasury, Federal Reserve and SEC, as well as payments utilities and key wholesale and retail firms. • The industry should explore a higher level of contingency standards for choke points. In developing new guidelines for business recovery plans of firms, regulators should look at establishing higher benchmarks for critical elements of the system. Greater oversight of the commercial paper and repo (government securities repurchase) markets in particular should be considered to reduce uncertainty. • Create contingency procedures ensuring local authorities and key financial service leaders can co-ordinate with each other in emergencies. Measures could include providing local authorities with a list of critical employees and employers at choke points to ensure access to offices in another area-wide shutdown and creating a hotline to aid co-ordination. • The industry should think about creating a secure network for use in emergencies that does not rely on the main telecommunications network, or on the speed with which participants can get to back-up sites. It should also build on existing technology to maintain a real-time contact list and establish agreed contingency rules. • Industry influence should be used to upgrade infrastructure. Financial services firms in Lower Manhattan could form an industry consortium to work with key energy and telecoms companies to develop alternative power and telecoms systems companies and upgrade critical infrastructure.