Asia’s op risk quantification challenge

Asia’s regional regulators have mixed opinions when it comes to operational risk, finds Ellen Davis

The growth and development of the operational risk discipline in Asia is at best uneven and at worst neglected, according to industry executives, consultants and technology vendors in the region.

While a few financial institutions are taking the bull by the horns – including Singapore’s DBS and South Korea’s Woori Bank – the response from regional regulators is more mixed. The Hong Kong Monetary Authority (HKMA) has set aside the advanced measurement approach (AMA) for now, and Singapore’s regulators are ‘backing off’ their initial ‘gung ho’ approach to the AMA, but Australian regulators are actively pushing their banks onto the AMA.

At the beginning of October, the HKMA published its consultation papers on new capital adequacy standards in Hong Kong, which includes a section on operational risk that permits banks to qualify for either the standardised or the alternative standardised approach. The text also outlines some op risk practices that firms should implement to improve their management, but the regulator confirmed that it is wary of the AMA’s heavy-duty modelling requirements.

From the perspective of "the Basel II definition of operational risk management and the infrastructure for op risk management, the Hong Kong banks are doing almost nothing", says Phillip Straley, partner in the global financial services – risk management practice at Ernst & Young in Hong Kong. "Part of the reason for that is that the HKMA has tried to steer them away from op risk as a priority." Straley says the regulator has two reasons for this approach. The first is "that op risk quantification techniques are still in the early stages of development, and not very proven," he says. "The reality is that in very few banks are confident in their op risk models. So why should a regulator allow you to set regulatory capital based on them?" The other reason, he says, is that the HKMA has "taken a very proactive position" in trying to steer banks towards "what they think is the best use of the bank’s dollars and the bank’s time. They’re saying don’t worry about this stuff for now". Not surprisingly, most of Straley’s assignments currently focus on credit risk modelling and processes, as well as economic capital modelling.

But even with the level of the hurdle lowered, industry executives wonder if the dozen or so publicly listed Hong Kong banks shouldn’t be doing just a bit more. Martin Wardle, the partner in charge of financial services risk management at KPMG in Hong Kong, says: "The Hong Kong banks will be putting in place what they need to for the basic indicator or the standardised approach, although I don’t think they’ve got far enough to start thinking about that yet. From the banks that I deal with, I’ve not heard of anyone looking at the standardised approach. I think they’ll come to the conclusion soon that they have to have another look at it. The regulators are going to start pushing them for information about what they are doing. At that point they will start thinking about the standardised approach, and then the complexities of doing standardised will dawn on them."

Meanwhile, in Singapore, the regulator has stepped back from its initial plan to implement the AMA in its domestic banks on the same timetable as Europe. But it is still actively encouraging its banks to aspire to this level. "We do not wish to see banks adopting the most advanced approaches in a hasty manner," said Ong Chong Tee, assistant managing director at the Monetary Authority of Singapore at a conference in late October by the International Swaps and Derivatives Association on Basel II. "It is more important that local banks ensure that their risk management practices keep pace with the increasing sophistication of their businesses. They should only adopt the most advanced approaches for capital measurement if they can do so meaningfully and when it is consistent with their risk management culture and systems. We have therefore suggested to the local banks that progress towards the more sophisticated approaches for market and operational risk should accompany progress towards adopting the Advanced IRB Approach."

DBS Bank, which won an Operational Risk Achievement Award for its framework earlier this year, is continuing to plough ahead with its AMA framework, although it will initially implement the standardised approach. The problems it is facing are, as a result, a unique blend of those experienced by banks in Europe and the US that are much further along in the AMA process, and the challenges that the Asian environment throws up.

The most substantial challenge at the moment is data. Says Him Chuan Lim, senior vice-president and Basel II programme director at DBS in Singapore, "We have a lot of internal data on the small events, but in terms of big impact events, there is not enough." Lim says his bank is looking at the global databases to draw low-frequency, high-severity events from, but that the percentage of Asian events on those databases is relatively low. On Algorithmics’ First database, Asian events constituted just 16% of the value of all of its events recorded in the third quarter of 2005. SAS declined to say what its Asian event recording statistics were for the purposes of this article, although both database providers have acknowledged that Asia is an area where they are actively seeking to increase their event recording.

Last year, the Association of Banks in Singapore tried to get a database off the ground, but they’ve had to abandon those plans according to industry sources. The problem was that there are only three home-grown banks in Singapore, and there are not enough of the low-frequency, high-impact events among them that would make such a database worthwhile.

Also, because other banks in the Asia-Pacific region are late off the starting blocks for the AMA, it isn’t possible at the moment to form a regional data consortium of domestic banks. "Our understanding is that other firms in the region are just starting to collect data," says Lim. "We get a lot of questions."

Still, Lim says the external database will give his firm the information it needs to help flesh out the tail end of his op risk loss distribution. His firm is also working on a series of research projects to try to help advance its understanding of op risk capital modelling, and has applied for a new grant from the Monetary Authority of Singapore – the programme was recently launched by the regulator to help fund research in risk management.

Lim says his firm is particularly interested in the blending of external and internal data, as well as challenges around scaling data.

The other problems Lim’s team face are more down-to-earth, but just as vital to the overall challenge of complying with Basel II’s AMA framework. "How do we sustain what we have been doing over the past few years, so that our business continues to understand why they need to do it, and so that we retain the confidence of management," asks Lim. "It is quite easy for us to do all this work – we have achievement awards – but when it comes to dollars and cents, revenue and costs, those will take priority over other agendas." This is a familiar set of questions that op risk managers are asking themselves, now that the first blush of excitement is off the subject, and firms globally are struggling with a substantially increased regulatory burden in related areas, such as money laundering, corporate governance, business continuity and fraud. Lim says: "We need to be creative about how we continue to get the attention of the board and management, so that they continue to commit to this agenda."

As part of this process, Lim and his team put together a risk governance target framework for operational risk, as a road map to help them improve the flow of information about op risk through the company. As part of this, the op risk group function now produces a regular report for the board of directors that is composed of information gathered from throughout the organisation, including loss events, key risk indicator trends, compliance breaches and any other data that might indicate a "deficient process". Lim says that when he first developed the report, it was tucked into the "Any other business" section of the board’s agenda. With a chuckle, he notes that "these days it has been moved up the agenda to before the market and credit risk reporting".

Another bank in the process of implementing a robust op risk framework is Woori Bank. Mi Kyung Yoo, speaking at a conference in Singapore in mid-September, outlined her firm’s extensive efforts, although she echoed DBS’s concerns about data availability and quality in the region. Her firm is going to be attempting to qualify for the AMA, she said, but will be relying on a scenario-based approach to help model areas where her firm does not have sufficient loss data. But, she added, her ultimate goal is to use loss data for the entire modelling process and to that end Woori Bank has signed up to both the SAS external database product and the Operational Riskdata eXchange loss event data consortium based in Switzerland. The firm is also rolling out a risk self-assessment programme across its 700 branches.

In Australia, the regulator has taken a very proactive approach to its banking sector. All the major banks in the country are said to be applying to the regulator for AMA framework approval. The Australian Prudential Regulatory Authority released its approach to the AMA at the beginning of October, but most banks have already gone most of the way to assembling their applications with the help of consulting firms, according to industry sources. Ross Moulton, director of op risk at Bank West, based in Perth, Australia, said at the Singapore conference that the implementation of the firm’s AMA framework "is an ongoing process and certainly far from finished".

But these pockets of progress are more the exception than the rule in Asia, say op risk executives. The lack of regulatory drivers in key markets such as Hong Kong has been a blow to the development of the discipline, they add. But those who defend the regulators who have not jumped behind Basel II’s op risk proposals say the lack of action on the AMA by Hong Kong’s regulators, and the foot-dragging of other countries, reflects concerns about the validity of the AMA approach. Indeed, outside the US, where there is a strong anti-AMA contingent, Asia is perhaps the second largest concentration of those who don’t believe that capital modelling for op risk is a viable discipline. One Hong Kong-based consultant says the Hong Kong regulators "fundamentally don’t believe, I think, that the modelling of operational risk is worthwhile. I think they fundamentally think the cost outweighs the benefits, and they are sceptical as to whether you can model it anyway." He also points out that Japan and South Korea – where regulators have begun to encourage banks to make moves towards the AMA – have not been paragons of regulatory virtue in the past, with substantial banking crises and op risk events on their books, and suggests that their agreement to implement the AMA is driven more by politics than practicality. He adds: "One has to question the ability of some of the more aggressive regulators to get operational risk right."

A lot of this "lack of faith" in op risk modelling and measurement stems from the paucity of data in the region. "Even for the IRB approaches for credit risk, there is a lot of scepticism as to whether there is enough data in Asia to do this properly," says KPMG’s Wardle. "The Asian financial crisis – how do you treat that? All the default data effectively comes from that period. So if it is a problem for credit, it is even more of a problem for operational risk." Others counter that the data problem is temporary – that it will be overcome with a bit of time and improved data collection by banks.

Also, many executives say there are sections within many financial institution ‘communities’ that are actually keen to be getting on with implementing an op risk framework. "I think that in the middle levels of an organisation, people are quite motivated by op risk," says Shane Knowler, director of financial services advisory at PricewaterhouseCoopers in Hong Kong. "[But] it doesn’t motivate or grab the very senior management. I don’t know whether they don’t understand the issues or they don’t think it is an issue, or they think it is more of a regulatory issue than a business advantage issue."

Shane, like several others, believes it will take another large-scale "event" in the region for both regulators and financial services firms to get behind op risk measurement and modelling wholeheartedly and in concert. Certainly, Asia has had its share of losses since Barings (see chart), but while these seem to have motivated certain regulators to improve certain aspects of their supervisory approach, none has had the galvanising effect needed. Knowler says: "I think that if there is another high-profile Barings-type incident, then I think that might reignite interest in op risk and provide a bit more motivation." OpRisk

Top 10 Asian events by loss amount from the First database Organisation Firm Loss amount Settlement /end date Event geography SK Global Company SK Group $5 billion Mar 31, 2003 South Korea In an accounting fraud case that emerged in March 2003 with a unique Korean chaebol flavour, trading company SK Global came under scrutiny for an alleged accounting fraud that involved its incestuous relationship with a sister entity. The company’s owner and CEO Chey Tae-won, and several other senior executives, were arrested on fraud charges.Chey was later convicted of fraud, sentenced to a probationary sentence, and returned to his position as chairman of SK Corp UFJ Holdings Toyo Shinkin Bank $2,507,331,490 Aug 13, 1991 Japan In what has become known as one of the largest losses ever to be attributed to loan fraud, at least half a dozen Japanese banks were exposed to losses in excess of $2 billion due to the Nui Onoue affair that surfaced in August 2001. The banks had lent billions to the Japanese restaurant owner, mystic and stock market speculator on the strength of forged certificates of deposit issued by an employee of Toyo Shinkin bank. The credit union, which had ¥360 billion in deposits, was faced with ¥342 billion in claims when the affair surfaced, causing the Bank of Japan to intervene in order to prevent a run on the bank Showa Shell Sekiyu Showa Shell Sekiyu - No firm available $1.5 billion Jan 1, 1993 Japan Showa Shell Sekiyu, a major oil refiner in Japan, faced losses of ¥165 billion from forward currency transactions. The company’s treasury department, expecting the dollar to rise against the yen, began buying forward dollars on futures markets at around ¥145. Unfortunately, the dollar decreased to ¥120 in 1993 causing huge exchange losses for the firm. ING Groep Barings $1.3 billion Feb 27, 1995 Singapore Barings suffered a $1.3 billion unauthorised trading loss that was precipitated by a Singapore-based trader with a ‘hotshot’ reputation who eventually pleaded guilty to two counts of fraud and was sentenced to an six-year jail term. Carrian Group Carrian Group - No firm available $1 billion Jan 1, 1983 China/ Hong Kong Carrian Group, one of Hong Kong’s largest corporate failures, crashed in 1983 with debts to creditors and shareholders of more than $1 billion in an example of people risk. Carrian was allegedly bribing banking officials to continue lending it money without following any of the proper channels or procedures and using ‘$2 firms’ (a type of dummy company) linked with George Tan, Carrian's founder, as a cover through which funds would actually be funnelled into Carrian. Bank Bumiputra Malaysia Bank Bumiputra Malaysia - No fund available $900 million Oct 31, 1983 Malaysia Between August 1980 and October 1983, a subsidiary of Bank Bumiputra Malaysia, Bumiputra Malaysia Finance (BFML), extended loans to the Carrian real estate group. In this people risk situation, these loans were not properly secured and banking regulations were evaded to give Mr Tan, the head of Carrian, quick access to the money. The true destination of the funds was masked through several seemingly unrelated corporations that were actually funnelling the funds to Mr Tan. These firms were ‘$2 firm’, meaning that they were recently incorporated and had no real assets. Industrial and Commercial Bank of China Industrial and Commercial Bank of China - No firm available $894 million Aug 31, 2004 China/ Guangdong Province The Industrial and Bank of China was defrauded out of 7.4 billion renminbi Commercial ($894 million) over a four-year period between 2000 and August 2004. A year-long investigation by Chinese authorities has implicated 233 bank employees and government officials in a scheme involving forged letters of credit. Cosmo Securities Company Cosmo Securities Company - No firm available $658,899,904 Aug 13, 1993 Japan On August 13, 1993, Cosmo Securities declared bankruptcy, after announcing that it had lost ¥70 billion due to tobashi trades, in a case of people risk. Tobashi deals involve shifting unprofitable securities among customers’ accounts, and are arranged to help corporate clients avoid losses. In the aftermath of the announcement, Daiwa Bank agreed to bail out Cosmo Securities through a ¥78 billion buyout. Mitsubishi Corporation Nippon Leisure. Card - System Co $584 million May 22, 1996 Japan In 1996, a case of external risk surfaced when two suppliers of prepaid pachinko cards discovered that their supposedly counterfeit-proof ¥5,000 and ¥10,000 cards were being used fraudulently. Nippon Leisure Card-System of Tokyo lost ¥55 billion in this incident, while Osaka-based Nippon Game Card lost ¥8 billion. China Aviation Oil Holdings China Aviation Oil $550 million Nov 30, 2004 Singapore China Aviation Oil (Singapore), which is 60% owned by China Aviation Oil Holdings of Beijing, sought court protection from creditors on November 29, 2004 after losing $550 million as a result of speculative derivatives contracts. The firm had placed bets on options contracts that the price of jet fuel would fall. Instead, the price rose steadily, as did CAO’s losses.

Operational Risk