JULY – DECEMBER 2016

ISSUE ONE
www.risk-insights.com RISK INSIGHTS
The Latest Risk and Regulation Articles and Opinions

Capital
Stress Testing Operational Risk
IFRS 9 Management & FRTB
& Model Risk Risk Americas
Liquidity Risk

FEATURED ARTICLES

Building a CCAR Economic Consistency of IFRS 9

compliant operational risk liquidity requirements with
stress model stress modeling Basel III
READ THE LATEST ARTICLES FROM
YOUR MOBILE DEVICE

KEEP UP TO DATE ON OUR LATEST

RISK MANAGEMENT CONFERENCES

MANAGE YOUR ONLINE

PROFILE

RECEIVE EXCLUSIVE OFFERS

INTERACT WITH THE ATTENDEES

AND PRESENTERS AT OUR
CONFERENCES

Download today
by searching ‘Risk Insights’
on your relevant App store
 JULY - DECEMBER 2016 | ISSUE ONE

RISK INSIGHTS

Welcome to our Risk Insights magazine

Welcome to the Center for Financial Professionals’ first issue of the
financial Risk Insights magazine. This e-magazine is dedicated to
bringing you the latest opinions and articles in financial risk and
regulation from the senior presenters that attend our collection of
leading risk management conferences.
In our first edition we cover the latest in capital management,
liquidity risk, stress testing, model risk, IFRS 9, operational risk,
third party risk, and the Fundamental Review of the Trading
Book. Readers will enjoy a variety of opinions and insights from
professionals across EMEA and North America from the leading
FIs and solution providers.
We are continuing to grow our Risk Insights website, monthly
e-newsletter, and are very proud to present you with the first edition
of our bi-annual magazine. If you would like to contribute to our
articles, opinions, and our next edition of the magazine, or simply
wish to provide some feedback please do not hesitate contact me.
We hope you enjoy the read and on behalf of the entire Center for
Financial Professionals’ team we wish you a great summer and end
of 2016.
Center for Financial Professionals Team

Contents
Stress Testing & Model Risk Risk Americas Convention
4 Building a CCAR compliant operational risk 18-19 Looking back at our 2016 event
stress model
6 Reviewing evolving stress testing processes:
BAU, data and the practicalities of running a
stress test Capital Management &
7 Understanding the gains and losses for
institutions on the verge of crossover
Liquidity Risk
20 Key components of LCR/2052a implementation
8 How stress testing is compared to economic
capital 21 Reviewing the potential transition from CRD IV
to CRD implementation
8 PPNR modeling and the role of the stress
testing professional 22 Unexpected consequences of the Volcker Rule
23 Economic liquidity stress modeling
25 Reviewing regulatory requirements to better
IFRS 9 understand the liquidity risk landscape for
10 Consistency of IFRS 9 requirements with Basel III better management and compliance
12 Strategic implications of IFRS 9 on systems
12 IFRS 9 impairment
Fundamental Review of
Operational Risk the Trading Book
13 Establishing an effective governance structure to 26 How do you see the role of the market risk
better account for operational risks professional changing over the next 6-12 months?
14 Conference Review: New Generation Operational 26 The potential pitfalls of operating under an
Risk internal models based approach
15 What is defined as ‘good risk culture’ 27 A look towards the CVA finalisation rules
16 Challenges for a new generation of operational
risk 27 The debate between VaR and ES
17 Third party risk management towards a pragmatic
approach
17 Third party risk management landscape SUBSCRIBE FOR THE NEXT ISSUE
17 Alignment of third party and vendor risk The next issue is scheduled to be released in January
management with operational risk agenda 2017. Register your email to receive the next copy

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 3
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Stress Testing and Model Risk
Building a CCAR compliant
operational risk stress model
CHRISTIANE HOPPE-OEHL
HEAD OF OPERATIONAL RISK AND REVERSE STRESS TESTING, UBS
We interviewed Christiane Hoppe-Oehl
at UBS to gain insight on her professional
experience as Head of Operational Risk
and Reverse Stress Testing. Christiane
will be presenting at the Stress Testing
Europe Summit taking place in London, 5-6
October.
Christiane, can you please tell the
Center for Financial Professionals’
readers about yourself and your
professional experience?
I hold a diploma in mathematics. I have
worked 20 years in the financial industry
covering market, credit and operational
risks. I covered market risk at Bayern LB
in Munich and Paris. I was responsible for
market risk modeling, trader supervision,
the development of pricing tools, as well
as trading, pricing, hedging and structuring
of Structured Equity Products. I joined UBS
10 years ago in credit risk modeling where I
put in place a stress governance enhancing
the banks risk frameworks. Since two
years I am responsible for the operational
risk stress model and enhanced it to
comply with CCAR standards. Apart from
operational risk, I am responsible for reverse
stress testing and other consequential risks
under stress.
We are looking forward to you
presenting at our upcoming Stress
Testing Europe Summit where
you will review the building of
CCAR compliant operational risk stress
models, what are the advantages of
using quantitative models over expert
judgment?
4 For
Forthe
thelatest
latestfinancial
financialrisk
riskand
Not long ago, US regulators preferred
quantitative models but the trend is moving
towards more expert involvement to make
up for data issues and enable estimates
of future vulnerabilities which might differ
substantially from historical observed
losses. However, regulators still want banks
to analize their past data and get a good
understanding of relationships to macro-
economic events instead of purely relying
on experts who might be biased or might
have very subjective views on potential
losses. Losses observed in operational risk
were substantial for many banks over the
past 10 years. Increased regulatory scrutiny
has led to ever higher fines amounting
to billions of losses per bank. There is
significant model risk involved and results
might differ substantially depending on
the approach taken. Key is a thorough
sensitivity and benchmarking analysis to
better grasp the correct range of possible
future operational risk losses and the
resulting impact on the banks capital.
How do you make a CCAR
compliant operational risk stress
testing model forward looking?
It starts with a diligent risk
identification process, involvement of
business, senior management and various
internal parties to ensure the current
most material risks can be identified
and measured. This process helps to
raise awareness about key risks and
improvements in risk management.
andregulation
regulationresearch
researchand
andarticles
articlesplease
pleasevisit
visitwww.risk-insights.com
Dwelling deeply into what could go wrong
and assessing the possible loss amount
will lead to the right measures being
taken before the risks will materialise.
Understanding and therewith preventing
events which could hurt the bank most is at
the core of risk managements role.
What are some of the challenges
in estimating legal losses under
stress?
Legal losses have increased substantially
over the past years and the trend for high
fines hasn’t reversed yet. It is hard to predict
possible outcomes. Close collaboration
between Legal, Risk, and Finance is
required to be able to raise awareness
and estimate capital impacts while
confidentiality is key. Large legal fines can
have a significant impact on the companies’
stock price, clients and employees,
reputation and the brand.
How do you see the role of
the Stress Testing Professional
changing over the next 6-12
months?
Modelers must learn to sell their models
and educate the business, to move away
from pure quantitative assessments
to a more process oriented role. The
business must learn to judge on models
and understand their impact on capital.
Collaboration between different entities
(Risk, Treasury, Finance, Legal) must improve
to get a conclusive bank-wide picture.
www.risk-insights.com
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Stress Testing and Model Risk

STRESS TESTING
EUROPE 2016
Reviewing Evolving Stress Testing Processes and Requirements
and Moving Towards the Next Phase of Development
5-6 OCTOBER 2016 | LONDON

KEYNOTE REGULATORS PROCESS & MODEL RISK

CONTROLS
EUROPEAN CENTRAL BANK EMBEDDING STRESS TESTING
DATA & BCBS 239 INTO ‘BUSINESSES AS USUAL’
FEDERAL RESERVE BOARD (TBC)
BUSINESS PLANNING ENTERPRISE
AND OTHERS TO BE & RISK MANAGEMENT STRESS TESTING
ANNOUNCED…
LIQUIDITY OPERATIONAL RISK

CO-SPONSORS:
Register today by contacting
CIMCON jesse.hopkins@cefpro.com
Software
Reduce Spreadsheet Risks or calling the team on
+44 (0) 20 7164 6582 | +1 888 677 7007

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 5
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Stress Testing and Model Risk
Reviewing evolving stress testing
processes: BAU, data and the
practicalities of running a stress test
S
ince the financial crisis stress testing
has been increasingly used, most
prominently in the US, but also in the
last few years in the UK and Europe, as a
key tool in examining the vulnerabilities in
banks’ balance sheets and their ability to
withstand adverse economic scenarios or
shocks. The theory around the purpose of
stress tests is simple enough, as they allow
supervisors to assess banks’ resilience to
ensure whether or not they are sufficiently
capitalized to withstand such adverse
scenarios, in the event that one does
actually occur somewhere down the line.
However, in practice running stress tests is
not so simple.
Due to the ever-increasing stress testing
regulatory demands, the Center for
Financial Professionals conducted extensive
research to assess the main stress testing
challenges that financial institutions are
facing. This piece will explore three of the
most prominent areas that came up during
the research; embedding stress testing into
a ‘Business as Usual’ (BAU) framework for
more effective risk management, the ever-
constant stress testing data challenges and
the practicalities of actually running a stress
test.
Many during the research highlighted the
significance of embedding stress testing
into a BAU framework to ensure more
effective risk management across the
organization. The importance of stress
testing is not lost on financial institutions,
with the Bank of England and EBA
conducting regular stress testing exercises
in order to determine how individual banks
can withstand given economic scenarios,
being pushed to the limit of their resources.
However, it is important for banks to use
stress testing for internal risk management
within the organization and not just as a
regulatory tool. Banks spend a lot of money
on infrastructure and labour to support
their relevant stress testing, and it seems a
waste of valuable investment to utilize it by
just ticking a regulatory box. Banks should
be deriving value from their investment
by improving their risk management
capabilities and then using their risk
management capabilities to manage their
6 For
Forthe
thelatest
latestfinancial
financialrisk
riskand
andregulation
business and improve the risk management
of their organization. One of the reasons
that regulators have stress testing exercises
is that they are not confident that banks
are using them internally, and therefore are
not in control of their business. Therefore
if banks can use the tools internally to help
optimize their business, then satisfying
the regulators demands should become
more straightforward. In other words, in an
ideal scenario banks should be constantly
coming up with their own internal economic
scenarios to stress throughout the year, so
that when it does come to regulatory stress
tests it is information that banks already
have.
Another area of focus, one that will
inevitably always come up as a key area
throughout risk management is the data
challenges involved in stress testing
and ensuring that data is used as a tool
for effective stress testing. A prominent
challenge that banks were in unanimous
agreement on was the linkage between
risk and finance, a relatively new concept
where banks are looking across finance
and risk data within stress testing. Within
organizations there is still a lot of separation
between risk and finance data, so the
challenge is bringing the two together and
trying to ensure some form of consistency.
Risk professionals agreed that overall the
interaction between risk and finance is a
pivotal part of stress testing.
Additionally, stress testing has been
receiving increasing interest over the last
few years, both within banks and externally
by the regulators. Inevitably this growth
in interest has resulted in more questions
and therefore an inexorable increase in
the quantity of data involved in the stress
testing process. This poses increasing
challenges as to the way banks approach
stress testing and the challenge of having
something more automated with increased
controls around it, reducing the ability to be
flexible. Therefore, as a whole there is far
more data to grapple within stress testing
in comparison to what there was even two
years ago, and data continues to be an
ever-growing challenge for stress testing
experts.
regulationresearch
researchand
andarticles
articlesplease
pleasevisit
visitwww.risk-insights.com
www.risk-insights.com
A final area of discussion is around the
practicality of actually running a stress test,
particularly running one from its beginning
to end point and the process banks go
through. For example, how do banks turn a
stress testing scenario into a viable scenario
that can be easily understood for example?
Stress testing scenarios that are produced
by supervisors are designed for all banks
taking part in the stress tests, but each
bank has a unique structure to it. It can
therefore be harder for one bank to turn a
stress test scenario into a viable scenario in
comparison to another bank. Furthermore,
it can be challenging to craft a scenario into
something that can actually be modeled. It
is all well regulators’ giving banks a scenario
to test their resilience to, but actually
modeling this to see how the scenario
would play out is more complex. Banks then
have the challenge of actually deciphering
whether there are credible management
actions that can be taken to lessen the
impact of that particular scenario occurring.
Whilst stress testing in theory works really
well, in practice it is almost evolving into an
art as much as a science.
Overall there is more for the industry still
to ponder as it looks towards the results for
this year’s EBA and Bank of England Stress
Tests, which are expected to be published
in early Q3 and Q4 respectively. As stress
testing processes and requirements evolve
there are still many challenges outside
the ones discussed in this piece that need
addressing. Network and discuss these
challenges at the Center for Financial
Professionals’ Stress Testing Europe
Summit, where senior regulators and stress
testing professionals will come together to
review evolving stress testing processes and
requirements and look towards the next
phase of development.
Visit: www.stress-testing-europe.com for
further information and to view the agenda
across the two-day summit.
For further information, please get in
touch with a member of the team on
+44 (0) 207 164 6582.

Understanding the gains and losses for institutions
on the verge of crossover
ROBERT CHAN
HEAD OF STRESS TESTING, CITY NATIONAL BANK
When addressing the gains and losses for institutions on
the verge of crossover from DFAST to CCAR, what are
the main differences FIs should prepare for when moving
over to CCAR?
Staffing is a crucial concern. The difference between DFAST and
CCAR is night and day. FIs will need to staff up, ideally with people
with CCAR experience, in the areas of PPNR, documentation,
project management, risk management, validation, etc.
Segmentation is a crucial difference. CCAR requires much more
granularity. Data granularity is an important part of this. Getting
buy-in from the business line is also another challenge.
Scenarios are different. DFAST only requires 3 Fed scenarios: Base,
Adverse and Severely Adverse. CCAR requires 2 additional BHC
specific scenarios of Base and Stressed.
CCAR requires compliance with regard to the FR Y-14A, FR Y-14Q
and FR Y-14M. The A is the annual CCAR exercise which requires
projections. The Q and M are reporting requirements that require
coordination with the Controller’s office, as they report actuals.
What losses can FIs expect to face when crossing over to
CCAR, and why are these important to consider?
The cost of compliance will skyrocket due to increased headcount,
data and segmentation requirements, and potential systems
upgrades.
CIMCON Software, LLC
Reducing End-User Computing RiskTM
www.cimcon.com
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Stress Testing and Model Risk
When building an effective governance, control and
challenge process, what are the key obstacles faced from
gaining ‘buy-in’ from senior management, and how can
these be overcome?
Senior management must be on board in terms of understanding the
importance of stress testing. It is not just a regulatory exercise but also a
strategic exercise that can affect the way the institution thinks about risk
and governance.
This can be overcome by introducing stress testing in board meetings.
It is important to continue to educate the board and emphasize its
importance in the industry. FIs can point to the scrutiny around peer
banks as the actions taken if not performed well (regulatory restriction of
capital actions).
Should the assessment of controls and functions in place for
testing and monitoring be done internally or externally?
The assessment of controls and functions (validation) should be done
internally. It is fine if there is some portion that is done externally, but
it is important that an internal Enterprise Risk Management team
understands the scope of testing and what was performed, because
once regulators come in and ask questions, the FI will have to be able
to defend methodology, assumptions, etc.
It is also important to bring in an audit team to act as a third line of
defense. First line of defense is model developers, then the validators
(Enterprise Risk Management) serve as the second line, then the
auditors serve as the third line.
Reduce Model Risk
Models used for financial risk
management and reporting need
to be based on high quality data,
properly documented, auditable,
and allow for version tracking and
verification of approvals.
CIMCON Software provides tools
to automate your processes from
discovery and inventory of
models, to link mapping and risk
assessment, error detection &
remediation, and monitoring &
controls.
info@cimcon.com
7
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Stress Testing and Model Risk

How stress testing is compared to economic capital

SONER TUNAY
SVP, RISK ANALYTICS, CITIZENS BANK

At Risk Americas 2016 you
recently led a stress testing
masterclass where you looked into
how stress testing is compared to
economic capital. Why is it important to
draw this comparison?
Economic Capital modeling has been the
leading methodology for measuring the
bank’s capital adequacy for a number of
years since early 2000s with the Basel II
framework. However, the 2008 financial crisis
proved that the methodologies employed in
the economic capital framework were not as
helpful to manage the bank capital through a
turbulent crisis period.
The new emerging standard is around
the Stress Testing methodologies. There
are some commonalities and also some
differences between these two standards.
Therefore, it is quite important to learn from
the shortcomings of the previous models
and methodologies and let this lesson
guide us in the next generation of model
development.
You also looked at PPNR
modeling, what key aspects did
you address?
PPNR is the new frontier in risk modeling. It
is not only a new field but also an area where
integration to bank’s day to day activities
and ultimately to credit loss forecasting is
paramount.
We looked at the big picture of PPNR
modeling, and worked through its various
components. We also prioritized where
the modeling might be most effective as
opposed to some good expert judgment
based approaches.
Lastly we looked through some examples
where integrated credit and PPNR modeling
would inform better origination models and
portfolio management.
What are the key challenges
with scenario design and
development for successful
stress testing?
A comprehensive scenario design starts
with a good understanding of the macro
economic trends and an understanding of
how they relate to the bank’s portfolio. A
common approach for many institutions has
been to repeat the 2008 crisis or stay closer
to the Fed’s severely adverse scenarios from
the previous year.
We as practitioners need to start to be more
active in relating the headline risk and all of
its downstream impacts to our portfolios.

PPNR modeling and the role of the

stress testing professional
DAVID INGRAM
HEAD OF TREASURY RISK STRATEGY, MODELING & POLICY, CITI

In regards to PPNR modeling, are there any areas you
foresee as being more challenging?
For many institutions, sourcing appropriate data is the
strongest impediment to building a strong PPNR modeling
program. Where data is sufficient for robust modeling, building a
well-governed end-to-end process becomes increasingly difficult as
institutions grow in size, scope and complexity. Also, thinking about
PPNR modeling within the context of negative interest rates is a
more recent challenge.
How can these challenges be met?
Over time and in discrete chunks. The mistake that many
institutions make is attempting to remediate everything at once,
and doing everything poorly. It is important to regard the totality
of an institution’s gaps in practices, and logically prioritize a
remediation effort in order of the dependence of one component
on another, the resources required to undertake the remediation,
and while progressing from a comparatively aggregate top-down
process to a more granular bottom-up process.
How do you see the role of a stress testing professional
changing over the next 6-12 months?
The role of a stress testing professional is always evolving.
Externally, regulatory expectations are not static, and evolve over
the years to reflect the shifting landscape of risks that banks face.
Further, the external economic environment presents new or
different risks that should be incorporated in capital planning from
year to year.
Internally, one should never be fully comfortable that their capital
planning fully captures all of the risks that face the bank. A “lessons
learned” session at the end of each CCAR cycle is a good time to
reflect on what aspects of capital planning function well, and which
components are in need of improvement. Further, capital planning
should be increasingly integrated into business planning over time.
The analytics that support capital planning – from balance sheet
costing to risk calibration to capital allocation – are ideal tools to
optimize financial performance relative to the capital required to
support the bank’s different businesses.

8 For the latest financial risk and regulation research and articles please visit www.risk-insights.com
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Stress Testing and Model Risk

4TH ANNUAL

STRESS TESTING USA:

CCAR & DFAST
Reviewing The Individual Challenges Across CCAR & DFAST And
The Associated Qualitative And Quantitive Elements
NOVEMBER 3-4 2016 | NEW YORK CITY
Last year the Center for Financial Professionals hosted two of the largest stress testing conferences in
North America. In March we welcomed close to 250 professionals to the 3rd Annual Stress Testing USA 2015, and in October we
hosted the DFAST edition of the series with 150 stress testing professionals.
This year we are looking forward to combining these events as we host the 4th Annual Stress Testing USA: CCAR and DFAST
Congress where we anticipate gathering over 300 stress testing professionals to review the 2016 CCAR and DFAST stress tests
and looking ahead to 2017. The leading Congress will feature four dedicated streams on CCAR, DFAST, Quantitative topics, and
Qualitative topics. While the agenda is still to be announced please view our confirmed speakers and event partners below. You
can also join many others in registering for the Congress at the pre-agenda rate. Find out more at www.stress-testing-usa.com

HEAR FROM MORE THAN 40 SENIOR STRESS

TESTING PROFESSIONALS INCLUDING:
KEYNOTE SPEAKER - Tim Clark (tbc)
Deputy Director, Division of
Banking Supervision & Regulation
Federal Reserve Board
Lourenco Miranda Jorge Sobehart
MD, Head of CCAR MD, Risk Architecture
Société Generale Citi
KEYNOTE SESSIONS
Joseph Donat Overview and differentiations across CCAR & DFAST,
John Fleshed
MD Head of CCAR Office, 2016 Stress Tests, Regulatory Overview and Driving
CRO
BMO Financial Group Efficiencies
Wintrust Financial
CCAR STREAM:
Sabeth Siddique Processes and Controls | Reviewing Results | Data |
Ravi Kodali Deputy CRO, Regulatory SR15-18 | Regulatory Guidance
Lead Data Architect Affairs and Capital Adequacy
Deutsche Bank M&T Bank DFAST STREAM:
Requirements | SR15-18 & 19 | Annual Process |
Robert Chan Julian Philips Prioritizing | Evolution | Governance
SVP, Head of Chief Model QUANTITATIVE STREAM:
Quantitative Analytics Risk Officer Developing Models | Data Requirements | Modeling
City National Bank GE Capital Operational Risk | RWA | Quant Methods | PPNR
Modeling
Tally Ferguson Eva Chan QUALITATIVE STREAM:
SVP, Director of Market Head of Enterprise Stress Evolution of Requirements | Risk Appetite | Capital
Risk Management Testing, Americas Planning | Business As Usual | Aligning Risk & Finance |
Bank of Oklahoma Barclays Governance | Risk Identification

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 9
 JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | IFRS 9
Consistency of IFRS 9
requirements with Basel III
WOLFGANG REITGRUBER
DEPUTY AND FVP IN GROUP CREDIT RISK MODELING, UNICREDIT
FVP, Head of Credit Risk Modeling at
UniCredit, Wolfgang Reitgruber provides
us with his professional insights on the
current IFRS 9 requirements.
Wolfgang, can you please tell the
Center for Financial Professionals’
readers about yourself and your
professional experience?
I am primarily responsible for development
of credit risk methods (rating, scoring,
EAD, LGD, risk mitigation) and model
governance in UniCredit S.p.A. Additionally
I work as independent researcher in the
area of credit risk related methods on
basis of regulatory (Basel II/III A-IRB) and
accounting (IFRS 9 impairment) standards.
Main achievement was the introduction of
the EL backtest. Currently I work on further
extending the Impact of Risk framework
to support development and validation of
life-time expected loss models in an IFRS 9
environment.
We are looking forward to
you presenting at the IFRS 9
Impairment & Implementation
Summit where you will be
reviewing the consistency of IFRS 9
requirements with Basel III. Why do you
feel this is a key talking point?
Let me first clarify: I speak about consistency,
not equivalence. There will definitely be
different expected loss predictions for IFRS 9
compared to IRB frameworks – requirements
differ and they have to support alternative
purposes (capital requirement to cover
volatility versus provisions to cover the
expected value). Nevertheless both are
expected to predict losses and expect the
best feasible modeling approach to be
10 financial risk and regulation
For the latest For the latest financial risk and regulation research and articles please visit www.risk-insights.com
esearch and articles please visit www.risk-
4TH ANNUAL
applied. How could you justify a simplified
approach for IFRS 9 when you have already
proven through IRB that your bank can
afford to develop a high-quality model?
What would you tell a regulator if your IFRS 9
model is based on better quality input data?
What would your business say if you develop
alternative models based on different
datasets of cash-flows, collateral and default
events? At best, you might just confuse
your business. At worst, regulators and
accountants might challenge either model.
At a minimum, you will have to develop both
models on the same underlying “truth” and
to provide a certain reconciliation between
both model predictions.
What challenges should financial
institutions be aware of with
regards to Credit Risk steering?
Currently credit risk steering is
based on 2 pillars: P&L – mostly driven
by cost of risk, provisioning changes and
write-offs, to cope with the expected value
of credit risk. And capital – either economic
capital or regulatory, covering concentration
and correlation effects in the portfolio, to
cope with volatility of credit risk. So far P&L is
largely driven by manual effects. Big tickets
are provisioned manually and only smaller
exposures are typically provisioned based on
models or parameters. With IFRS 9 this P&L
impact will significantly increase – caused by
the pure size of provisions and larger role
of model-based provisions. Potential model
risk will additionally contribute to increase
P&L volatility. In this environment you need
a sound steering concept in place, which
makes judgmental inputs and their P&L
effects as transparent as possible.
In your opinion, would you or
would you not favor to back test
IFRS scenario management?
The use of (multiple) scenarios to
develop expected loss forecasts will
definitely pose significant challenges
regarding governance of this mostly
judgmental input. First you need to
have strict processes in place how you
update scenarios and their respective
weights applied in the loss estimation.
Secondly you need to setup an objective
framework to justify your scenario-
generating process. It should neither be
overly conservative nor overly aggressive.
Whether you can use standard back-tests
or you have to develop new stochastic
frameworks to achieve this target is yet to
be seen.
How do you see the role of the
credit risk professional changing
over the next 6-12 months?
I can speak for the “analytical” part of credit
risk. Modellers have to become as flexible
as possible to work in an environment of
ever changing requirements. Regulators
issue modeling guidance (consultative
documents, technical standards and so
on) at a speed never seen before. IFRS
9 standards are principles-based, which
means they lack specific rules – on purpose.
This does not make life easier for the
model builder. Finally IFRS 9 models need
to be pragmatic and easy to understand –
the managerial attention to P&L impacts
(through IFRS 9 impairment) is still
significantly higher than to capital needs
(e.g. through Pillar I and II).
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | IFRS 9

LONDON | 20-21 SEPTEMBER 2016

IFRS 9
IMPAIRMENT &
IMPLEMENTATION
Reviewing Progress Across the Three
Phases as the Industry Moves Towards
Parallel Runs and Implementation

KEY TOPICS INCLUDE

Interpretation of the Standard
Secondary Impacts of IFRS 9
Data Processes
Provision Models
Disclosure Requirements

15%
Forward Looking Scenarios
IFRS 9 and Basel III
Business Behavior and Running of the Business
Expected Credit Loss Model DISCOUNT
View the full agenda at www.cefpro.com/ifrs9

15% discount for our readers using discount code: RIMAG30

Register today by contacting
jesse.hopkins@cefpro.com or calling us on +44 (0) 20 7164 6582

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 11
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | IFRS 9

4TH ANNUAL

Strategic implications of
IFRS 9 on systems
BRANDON DAVIES
FORMER HEAD OF MARKET RISK, BARCLAYS

T
he implications of IFRS 9 go well
beyond those associated with the
technical implementation of an
accounting standard.
The systems problems of IFRS 9 fall in to
two main implementation categories, Data
and Models. In many instances we are
used to Data being the main issue but in
this instance a great deal of thought needs
to go into understanding how to model
expected loss in respect of individual loans.
Loan losses are pro cyclical, that is they
differ significantly at different points of the
economic cycle. To give a valid estimate of
expected losses on an individual loan basis
either over one year or to loan maturity it is
necessary to estimate from what point in the
economic cycle the estimate is being made.
A number of banks will have risk
departments, trading operations and
treasuries that are capable of using
sophisticated techniques for modeling
the term structure of credit spreads a vital
function of valuing credit trading operations.
Most models, however, have not included
macro economic variables, not least
because of the problems of projecting
measures of output, employment and
inflation into the future.
The accuracy of such models when back
tested against actual data is however greatly
improved by the incorporation of macro
variables, indeed they turn out to be the most
important variables in explaining the relation
between default risks and credit spreads (see
– BIS Working Papers No 203 Macro Factors
in the Term Structure of Credit Spreads by
Jeffery D Amato and Maurizio Luisi, Monetary
and Economic Department March 2006).
The uses of macro models populated by macro
variables are in common use by economists in
central banks and national treasuries.
Central bankers and national treasuries need
to estimate economic cycles to inform policy
choices such as setting the level of central
bank discount rates. The model most widely
used in the UK, and indeed internationally, is
a “Dynamic Stochastic General Equilibrium”
(DSGE) model developed in the UK by the
National Institute of Economic and Social
Research, a version of this model is used by
the Bank of England. There are commercial
versions of the model available through
organizations such as the Adam Smith
Institute; it is a macro economic model.
A DSGE model is not closely related to the
micro economic models as used by bank risk
management departments and much less so
to accounting models as commonly used for
loan provisioning purposes.
The problems associated with any bank
attempting to use a DSGE model are
substantial, banks do not generally store
macro economic data in any detail, so
whilst it is possible to know some aspects
of loan specific data that will be needed to
implement IFRS 9 and for many sophisticated
banks this will track their Basel II risk
parameters as used in their advanced models,
it is not possible to decide on the macro data.
It will also be necessary, if banks use DSGE
models, to decide whether to co-operate
and have one shared view of the economy or
whether each bank should have its own view.
If each bank had its own view identical banks
would have different provisions depending
on the view adopted, thus resulting in banks
accounts not being directly comparable. A
significant issue for the auditing profession.
Moreover if banks co-operated would it make
sense for them to have a different view from
the BoE? A significant issue for the BoE?
Board directors of banks might well see
any difference between their own model
outputs and the BoE outputs (as published
by the BoE quarterly) as a risk to the
“reasonableness” of their own behaviors in
signing off such differences.
Brandon also examines the IFRS 9
standard in detail and the strategic
implications of IFRS 9 for the
Business, Processes, and Personnel.
Read the full article here.

IFRS 9 IMPAIRMENT – BRANDON’S VIEW

IFRS 9 incorporates the concept of ECL to
replace IAS 39’s incurred loss model.
Under the expected credit loss model
impairment would be measured as either:
1. An expected credit loss looking forward
over a 12 month period.
2. An expected credit loss looking forward
over the remaining life of the asset.
3. Incurred loss, which is reserved for non-
performing loans.
The impairment concept is related to the
difference between ex-anti and ex-post
understandings of loan losses. Before the
fact (ex-anti) no one makes a loan expecting
to incur a loss whereas after the fact (ex-post)
we know that on a sizable book of loans
some level of losses are inevitable.
Expected loss provisioning is an attempt to
recognize the reality of running a business
based on making loans.
The concept has a strong basis in
micro-economic theory but in practice
turning it in to practice is likely to bring
many difficulties. In practice the application
of expected loss will require the creation of
a provision on day 1 against any new loan,
which is to be carried at amortized cost, this
provision reflects the expected loss on such
loans over the next 12 months.
Should a loan underperform its expected
loss through say a downgrading of the
borrowers credit standing, then the loan
moves to being provisioned on a remaining
lifetime expected loss basis.
Non-performing loans are moved to being
provisioned on an incurred loss basis.
In practice the application of expected loss
will require the creation of a provision on day
1 against any new loan, which is to be carried
at amortized cost, this provision reflects the
expected loss on such loans over the next 12
months.
Should a loan underperform its expected
loss through say a downgrading of the
borrowers credit standing, then the loan
moves to being provisioned on a remaining
lifetime expected loss basis.
Non-performing loans are moved to being
provisioned on an incurred loss basis.

12 For the latest financial

For the latest
risk and
financial
regulation
risk and
research
regulation
and articles
researchplease
and articles
visit www.risk-insights.com
please visit www.risk-insights.com

Establishing an effective
governance structure to better
account for operational risks
GUSTAVO ORTEGA
DIRECTOR & GLOBAL HEAD OF ISSUE & RISK EVENT MANAGEMENT, AIG
The Center for Financial Professionals
recently asked Gustavo Ortega for his
thoughts on effective governance and the
latest challenges within operational risk.
Gustavo is an operational risk practitioner
with over 15 years industry experience
joining the Enterprise Risk Management
organization at AIG in 2013, and currently
Director and Global Head of Internal Loss
Data and Issue Management within the
Operational Risk Management function.
Why do you believe establishing an
effective governance structure and
sound operational risk framework is
a key talking point when looking at
operational risk as a whole?
I believe that without a sound governance and
a robust operational risk framework there is
no benefit in having an operational risk unit.
An effective operational risk unit helps bring
together informative risk discussions amongst
the business lines and support functions to
help expedite risk remediation strategies and
promote lessons learned. Operational risk
units provide independent process reviews like
end-to-end business reviews and challenge the
business risk and control activities reassuring
optimal risk management. Operational risk units
drive enterprise change and enable consistent
procedures employing common taxonomies
and tools for businesses to self-identify, assess,
measure, escalate and monitor operational
risks. Accountability models are also part
of the governance and framework for risk
management to be effective. It is important
for operational risk units to clearly define the
business roles and their responsibilities to
ensure appropriate identification, assessment
and treatment of risks across all operating
units. This is typically achieved through lines of
defense models ensuring effective governance
process for managing risks across the enterprise.
How do you describe operational
risk today, and why is it so
important to financial institutions?
Operational risk management is more than
just a numbers game. It is a behavioral
management discipline. Operational risk
has transformed from a simple loss data
collection exercise used for operational
risk capital to a more wide-ranging
function that looks at the quantitative and
qualitative aspects of risk identification,
assessment and measurement. Internal
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
loss data collection has evolved to become
more comprehensive focusing on risk
events, that is not just internal or external
loss data, but includes risk events with
direct economic losses, timing impacts or
better known as accounting losses, non-
financial risk events with defined impacts
affecting customers, business operations,
reputation, and also errors that may result
in positive consequences like gains and
near miss events. All of which help inform
the risk profile of the organization from a
qualitative and quantitative perspective.
Risk and Control Assessments are becoming
more targeted and integrated with other
assurance functions focusing on key business
processes and outsourced activities. KRIs
which have struggled in providing value in
the past are now making a comeback serving
an important element of the framework, in
particular with enhanced risk monitoring.
Scenario analysis have advanced and
continue to be in high demand in particular
with forward looking capital planning
processes like the Federal Reserve Bank
requirements on CCAR (Comprehensive
Capital Analysis & Review). In today’s
financial environment, operational risk has
moved to the top of the CRO agenda and
it’s developed from being considered just
“operations risk” or the risks of processing
transactions to a more inclusive risk discipline.
What continues to be the key
challenges for operational risk
management?
I believe the challenges for operational
risk management continue to focus around
three key areas, that is 1) demonstrating
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Operational Risk
value-add to the business; 2) ensuring
compliance with regulatory expectations
and requirements; and 3) data management
and ability to consume large volumes of
data for effective and timely management
reporting. Operational risk managers
are faced with enhanced regulatory
expectations, defining and clearly
documenting roles and responsibilities like
the 3 Lines of Defense models and creating
a common language that risk assurance and
businesses can speak to.
What would you say are the five
top operational risks you see for
2016?
It’s hard to focus on five top operational
risks in particular when operational risk is so
complex, pervasive and its manifestations of
risks can become systemic. I’d like to think that
technology risk continues to be the highest
risk for large financial organizations, this is
coupled with increased risks around cyber and
security controls. Regulatory continues to be at
the top of the list in terms of fines and highest
priority to risk manage for financial institutions.
Conduct risk is another risk that is increasing,
in particular with new regulatory expectations
as is the case with the FCA (Financial Conduct
Authority) in the UK. We cannot forget that
the number one cause of operational risk
continues to be people, it is human errors that
continue to account for the highest number
and dollars for operational risks and this is the
one area that we, as operational risk managers,
need to continue to focus on, ensuring
strong risk culture is embedded into our daily
routines to be able to not eliminate errors but
potentially mitigate the impact of those errors.
13
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Operational Risk
Conference Review:
New Generation Operational Risk
WRITTEN BY CARRIE COOK, THE RISK UNIVERSE
The Center for Financial Professionals’
2nd annual New Generation Operational
Risk 2016 conference in London came
at a pivotal time for the operational risk
community. Just days before, the Basel
Committee on Banking Supervision
had released its latest consultation on
operational risk capital calculation and
the air was abuzz with differing views on
what the proposed changes could mean
for the discipline.
Model behavior
Naturally, the Basel consultation was the
star of the show, with two speaker slots
dedicated to discussing the proposals.
Peter Mitic, head of operational risk
methodology for the UK at Santander and
Richard Pike, CEO of Governor Software
and independent non-executive director
at Permanent TSB, sat on the panel. Mitic’s
observations were largely related to the
mathematical elements of the proposed
standardized model; mostly that there is
little explanation around how Basel arrived
at the figures used, which is especially
significant as banks are currently required
to justify their own calculations when using
AMA. One delegate asked a valid question:
why should we bother trying to model
operational risk at all if the numbers can’t
be trusted?
Mitic and Pike both felt there is still a place
for modeling, but Pike suggested there is
too heavy a focus on the capital element
at present. “I think we need to have better
thinking around operational risk than just
pure capital” he said, “but unfortunately
I don’t think it’s going to change in the
short term.” Mitic felt a major issue with
modeling operational risk is that firms are
still unable to calculate a maximum capital
requirement – a problem for which he is
working to find a solution.
Board games
A common challenge for many operational
risk professionals is getting the board to
prioritize their concerns. As a non-executive
board member himself, Pike provided a
viewpoint from the other side of the fence
and highlighted the problems caused by
not presenting information to the board in
concise and digestible format. Citing the
700-page reports he is often handed before
meetings, he explained how overloading
board members with information – of
The New Generation Operational Risk series come to NYC later this year - find out more
14 For the latest financial risk and regulation research and articles please visit www.risk-insights.com
which many executives are guilty – does
little to help relations with the C suite. So,
what should operational risk practitioners
be reporting to the board and how do
they find a balance between presenting
aggregate, versus more complex, data?
Pike says the key is to be prepared to
provide more detailed information when
necessary on any assumptions you’ve made
within your reports, rather than providing
it all up front. “I suspect that almost no
board member will want to go through the
mathematical details,” he said. “But they’ll
want to understand the assumptions and
they’ll want to understand the output.” He
added that board members will also need
to know about any sensitivities within the
model so they can understand where risk
management priorities should lie.
Operational intelligence
With an emphasis on data in the new
Basel proposals, Kirsty Rutter’s session on
using big data to enhance operational risk
management proved interesting and timely.
Rutter, formerly of Credit Suisse and now
an independent risk consultant, shared her
experience in gathering and interpreting
data with the application of emergent
semantic technologies to cultivate what
she calls “operational intelligence”. With
a background in physics and accountancy,
Rutter describes herself as “the one
often found raging against the machine”
– evident in her ambition to challenge
management’s tendency to pigeonhole
operational risk under “fluffy stuff”.
To do this, Rutter needed to filter through
the white noise to find the white noise
to find information which would capture
management’s attention. Her primary
hurdle, perhaps unsurprisingly, was gaining
access to the data in the first place. “Data
is usually dispersed across the organization
and is not linked,” she explained. “It’s
owned by different teams and those teams
are typically suspicious of you wanting to
get access to it…The number of imposed
approvals to get access can cause delay.”
Next came assembling this information
in “a sensible, intelligent, speedy way,
which was then repeatable”. Rutter advises
anyone embarking on a similar project not
to be disheartened if it doesn’t work first
time and to be prepared for uncovering
“unknown unknowns”. It could be that the
firm is spending a lot of time and effort
gathering data which turns out to be useless
and provides no insight into the business.
But even this discovery should be seen as a
victory, because it means the problem can
be addressed, perhaps by better educating
those collecting the data, says Rutter. She
also warned of “cultural antibodies” –
people within the organization who will be
resistant to change and will try to kill off
your project. “You are going to ask difficult
questions,” she said.
Regulation trepidation
Meredith Gibson, head of legal risk at
Santander UK, highlighted what she feels
is “the single largest risk” to financial
institutions: regulatory change. “The
reason it is the greatest risk is because so
many of the rules are very uncertain,” she
explained. “For MiFID, for example, we do
not yet have the level two text and we are
supposed to be implementing it by January
2018.” With the backdrop of the Senior
Managers Regime (SMR) adding more
complexity, the pressures around regulatory
change are now even higher, requiring
ever-increasing governance measures.
“For every one guy on the trading floor
in an investment bank making any kind
of money, there are probably four or five
people looking at him and telling him what
he shouldn’t be doing. It’s a very tough
environment,” says Gibson. She added that
MiFID will be a real “game changer” and
is a regulatory risk which is proving very
difficult to prepare for, especially in context
of the SMR. “Now senior management are
going to have to think very carefully about
their role in all of this…If the rules change,
how are they going to make certain that
they know what the rules are in order to
prevent them being breached? You could
spend the entire balance sheet of the bank
just on regulatory change.” In Gibson’s
experience, operational risk and legal
departments have never really interacted in
an official way when it comes to managing
regulation – something she thinks should
change. “Let’s face it, regulatory change
has everything that operational risk seems
to be: people processes and systems –
because that’s what regulatory change
does; it changes the way that people do
things; it changes the processes they use to
do them and the systems they do them on.”

Head of Enterprise Risk Management at
Martin Currie, Neil Hutchison, talks to
the Center for Financial Professionals on
how to measure and understand what is
defined as good risk culture.
Neil, can you tell the Center
for Financial Professionals’
readers about yourself and your
professional experience?
I am the Head of Enterprise Risk at Martin
Currie, an Edinburgh-based affiliate of
the Legg Mason investment management
group. Prior to joining Martin Currie in 2008,
I worked at Deloitte in the Enterprise Risk
Services practice, advising clients in a broad
range of industry sectors.
The nature and scale of Martin Currie’s
business requires the Enterprise Risk team
to cover all aspects of the risk framework,
from the development and maintenance
of risk policies and processes, to the
provision of assurance to management
and the Board, via the operation of a
range of risk management activities,
including BCP, error management and risk
identification and assessment. The team
is also responsible for the promotion of a
positive and constructive risk culture across
the enterprise.
What internal and external factors
must an organization have to
reflect a good risk culture?
For genuine cultural change to take effect,
there needs to be more than just the ‘push’
factor of greater interest in the subject from
regulators. Of course, if regulators make a
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
What is defined as
‘good risk culture’
NEIL HUTCHISON,
HEAD OF ENTERPRISE RISK MANAGEMENT, MARTIN CURRIE
point of calling out ‘poor risk culture’ as a
contributing factor in enforcement cases,
then firms will eventually grind into action
and put in place the policies and the public
pronouncements that support a ‘good risk
culture’. But this will do very little to effect
real change in the organization if this ‘tone
at the top’ does not filter down through
the layers of management to the risk takers
themselves.
So there needs to be a ‘pull’ factor from the
other stakeholders in the business, not least
the Board. The case for the benefit of a good
risk culture needs to be made, and won, with
the management of the firm at a level below
the Executive. Otherwise, the carefully drafted
words from the C-suite will burn up on entry
to the business.
What difficulties are faced when
distinguishing and changing a
company’s risk culture?
The main challenge in changing a company’s
risk culture is that it is inherently intangible in
nature. We all have a feeling of what a ‘good’
risk culture might look like (and certainly what
a ‘bad’ culture is), but we might not be able
to put our finger on what the root causes
are or how to measure it. Operational risk
professionals are drawn to the tangible, to
the measurable and to the visible. Arguably
culture is none of these and so analysis is
difficult for an industry brought up on a diet of
internal controls and processes.
Change is difficult, full stop. Ask anyone who
has been through a significant corporate
restructure or system implementation. But
this is doubly true when you are talking about
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Operational Risk
changing behaviors and views, sometimes
deeply held. This requires a subtlety of
approach not necessarily inside of the
comfort zone of the typical operational risk
professional, who may be required to apply
techniques beyond their familiar toolkit.
Do you believe the assessment
of risk culture is possible, can this
really be measured?
There is no doubt that the measurement
of risk culture is challenging. Operational
risk professionals may be required to move
their thinking on from absolute risk indicator
thresholds and the traditional ‘death by RAG-
rating’ method of presentation.
But, at the risk of sounding evangelical, I
have to believe that it is possible. My view
is that before culture can be measured, one
has to identify the key drivers of risk culture
(both good and bad) and then continue to
drill down until something emerges that can
be assessed and, hopefully, measured in an
empirical way. We have made a start with
data that already exists in the business, such
as error / breach rates, complaint volumes,
mandatory CBT completion, etc.
This then needs to be overlaid with the
ethereal question of ‘how do we feel about
the risk culture in the organization?’ We
have found that people are very happy to
offer an opinion in response to this question,
even if they don’t necessarily understand the
question they are answering!
So, in short, yes, I do believe this but, no, I
have not cracked it yet.
15
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Operational Risk
Challenges for a new generation
of operational risk
RICHARD PIKE,
NON-EXECUTIVE DIRECTOR, PERMANENT TSB
O
perational risk has been around as a discipline in Financial
Services since early the 2000s. Over those years it has grown
to be an important part of any risk department in most
financial institutions. Operational risk has also brought new tools and
techniques to risk including RCSA, loss recording, and op risk capital
calculation.
While there have been many successes for the op risk community over
the years, the discipline is still fighting to prove its strategic value to
senior executives and board members. Due to recent events it is now
clear to all financial firm executives that operational risks can have
very serious consequences in terms of direct losses (including fines),
regulatory & client relationships and reputation. So if operational risk
managers can show that they can in fact assist in limiting these effects
they will have earned that treasured seat at the top table.
As op risk is a second line of defense function in most firms, its focus
has to be on providing clear and concise information to the business in
order for them to make decisions about managing the risks. When the
business considers op risk to have most of the relevant information to
help them make a decision they will ensure that op risk is at the table
when those decisions are being made.
Op risk has made great strides in terms of capturing and processing
data. Loss event recording programs, RCSA workshops, KRI
maintenance projects, etc. have all been implemented successfully
across the industry. Unfortunately, not enough time and effort has gone
into the analysis and clear reporting of this data in the correct context.
There are a number of challenges that the discipline is facing with
current tools and techniques that I suggest have to be overcome
before op risk can claim to be proactively analysing and reporting
operational risk.
Goldilocks challenge
We have all struggled with the problem of too much or too little
information in reports. The nature of op risk means that there will never
be a one size fits all report, however we need to set the bar a lot higher
in terms of making reports that show the right information to the right
people and that are presented in the context of the business decisions
being made.
Materiality challenge
There are too many units of measure in op rsk and within individual
firms. Op risk teams will provide results in terms of RAG status, OpVaR,
Loss amounts, KRI limit breaches, issue numbers etc. It is also often not
clearly defined how material these values are in respect of the business
objectives of the firm. All of this makes it very difficult for the business
to answer the ‘So What’ question.
Capital calculation challenge
The issue of op risk capital is a very thorny one, but in general the
capital calculation has to be more relevant to the business as too many
business executives feel that the process has no relevance to any
16 For the latest financial risk and regulation research and articles please visit www.risk-insights.com
business decisions they make and is simply a regulatory exercise. The
current debate needs to be focused on coming up with models that
can be closely related to and be effected by the business.
“ IT IS NOW CLEAR TO ALL
FINANCIAL FIRM EXECUTIVES THAT
OPERATIONAL RISKS CAN HAVE
VERY SERIOUS CONSEQUENCES”
Interdependencies challenge
Op risk is replete with situations where individual risks have multiple
causes and effects that manifest themselves across multiple reporting
dimensions (legal entities, processes, regulations, etc.). Often risk
people and/or business people will identify these interdependencies
but as they cannot be recorded in the risk systems they are noted in
an informal manner or at worst forgotten. This sort of information is of
huge value to the business as it is normally not clear to them from their
individual silos and so it needs to be identified and captured correctly.
Line of sight challenge
Op risk has, in general, failed to give a ‘line of sight’ to senior
executives into the risks that they are taking and how they might
affect the attainment of their objectives. This is mainly due to the
fact that there is no clear manner in which to aggregate data across
the various reporting dimensions. This challenge is partly created
by the ‘materiality challenge’ set out above. The result is that when
the business asks to look behind a particular report or result they
are told that it is a mixture of different metrics (often subjective
and from different systems) and therefore there is no clear way to
‘drill down’. This leaves business people with a feeling that there
is ‘hocus pocus’ going on somewhere and that the reports cannot
necessarily be trusted.
As the recent financial crisis starts to fade into the past (hopefully)
and focus turns to capital levels and ROE there is a great
opportunity for operational risk to show the business that it has
the information and the analytical capabilities to add real value to
business decisions at the most senior levels. In order to achieve
this, operational risk practitioners have to focus on upgrading the
tools and techniques they use to analize and present the data they
have. If the new generation op risk can surmount the challenges
set out above it can earn an important role in the strategic future of
financial institutions.
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Operational Risk

Third party risk management

towards a pragmatic approach
SIMON LLOYD-HORTON
HEAD OF THIRD PARTY RISK MANAGEMENT
STRATEGY & FRAMEWORK, HSBC

Simon participated at our Vendor & Third
Party Risk Europe Summit and delivered
a presentation on the management of
affiliates/intragroup entities and moving
towards a pragmatic approach
What are the considerations
institutions should look into when
deciding to outsource via a third
party or an intra-group entity?
Institutions should consider the specific
underlying risks of the service. The service,
and the manner in which it will be delivered,
varies from engagement to engagement.
If a ‘one size fits all’ approach is taken the
result can be unidentified risk exposures
and inefficiency. Conversely there will be
opportunities to realise efficiencies if risk
management activities are tailored.
What are the key differences in
managing intra-group entities/
affiliates in comparison to other
third parties?
Although regulators clearly expect the
risks posed by services delivered both by
third parties outside the group and those
provided by entities within the group to be
identified and managed, institutions should
consider whether exactly the same risk
management processes and treatment are
required. This remains a developing area
for the industry and one that would benefit
from consideration by practitioners.

Third party management Alignment of third

landscape
TOM GARRUBBA
SENIOR DIRECTOR
THE SANTA FE GROUP/SHARED ASSESSMENTS
Third party vendor risk is now front and
center with many C-Suites and Boards of
Directors. As today’s digitized business
landscape continues to expand, so too does
the role third party vendors are playing in the
day-to-day operations in an organization.
Meanwhile, both industry and regulators
have made it clear that – for organizations
and the service providers they do business
with – data protection and privacy must
continue to be top priorities. One must
always remember; you can outsource the
work, but not the risk!
Organizations in various industries continue
to struggle with the delicate balance of
moving key initiatives forward by utilising
vendors, while ensuring compliance with
regulatory guidance and standards, as well
as their own internal compliance policies.
Organizations are being increasingly
pressured by regulators, their customers
and their own management, to ensure the
organization is aware of its responsibilities
in performing effective due diligence on
the overall security and privacy posture of
third party vendors. Because of this, third
party vendor risk has grown to paramount
importance in the C-Suites and board
rooms, not just in the UK, Europe and North
America, but also to other parts of the world
where key and critical process are being
performed by organizations that tend to
presently struggle with these challenges.
A great start for organizations is to:
• Inventory and understand all your third
party vendors and the various scopes of
work being performed.
• Perform this process for any third party
vendor coming into possession of,
access to, or exposure to your corporate
data.
Once that exercise has been completed
then:
• Develop a strategy to assess and monitor
your vendors to gauge their security and
privacy posture to ensure third-party
operations adequately secure your key
customer and/or confidential data.
Now comes the big question. What
“measuring stick” should you use to
get an understanding as to third party
data handling controls, and whether
those controls are in line with your own
organization’s controls and compliance?
Many organizations have crafted or borrowed
questionnaires or checklists to help them
answer this question. However, oftentimes,
those instruments don’t go to the level
of granularity needed for assurance, and
additionally, the proprietary instruments may
not be “adopted” by the third party or the
industry in which they serve.
party and vendor
risk management
with the operational
risk agenda
CHRIS RACHLIN
FORMER GLOBAL HEAD OF
OPERATIONAL RISK MANAGEMENT
SERVICES (INCL. 3RD PARTY RISK
MANAGEMENT), HSBC
It’s important to have alignment
across the risks types. Many
organizations have gone off
and implemented different risk
methodologies for vendor or third
party risk compared to operational
risk. This makes it difficult for senior
management and the board to get
a holistic or comparative risk picture.
The use of third parties by banks
can be very beneficial for them
and their customers, but it is very
difficult to make good risk based
decisions if the organization
is continuously over or under
estimating the level of risk in their
third parties when trying to compare
it to, say, their overall cyber risk.

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 17
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Risk Americas

Risk Americas 2016

AN OVERVIEW OF THE LEADING RISK AND REGULATION CONVENTION

CLOSE TO 400 SENIOR FINANCIAL RISK PROFESSIONALS ATTENDED

25 CO-SPONSORS AND EXHIBITORS SHARED THEIR
KNOWLEDGE AND EXPERTISE
70+ SENIOR PRESENTERS PARTICIPATED IN SESSIONS
AND PANEL DISCUSSIONS
BREAKFAST BRIEFING, LUNCHEON ROUNDTABLES,
AND END-OF-DAY COCKTAIL RECEPTION
CRO KEYNOTE SESSIONS ACROSS BOTH DAYS
AND MULTIPLE STREAMS COVERING…

STRESS TESTING & MODEL RISK LIQUIDITY RISK & CAPITAL OPERATIONAL RISK
MANAGEMENT
Analyzing results: CCAR & DFAST Governance, Risk & Compliance
Scenario Analysis Regulatory Changes;
Risk Culture
Model Risk LCR, NSFR, TLAC
RCSA Vendor Management
Data Risk Interest Rate Risk Market Risk
Cyber/ IT Security
PPNR Modeling Basel III Capital Rules
Capital Planning & Modeling

ATTENDED THE CONVENTION? MISSED THE CONVENTION? REGISTER FOR 2017 AT THE
View the photos on Facebook here Purchase the presentations here PRE-AGENDA RATE
www.risk-americas.com

18 For the latest financial risk and regulation research and articles please visit www.risk-insights.com
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Risk Americas

“THE
CONCENTRATION
OF SPECIALISTS
HAS BEEN
EXTRAORDINARY”
CRO, TCF BANK

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 19
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Liquidity & Capital Management

Key components of LCR/2052a implementation

DON MUMMA
MANAGING DIRECTOR, AXIOMSL

LCR requirements will vary significantly
by institution. A smaller bank with a very
simple business model and simple data will
often lack the requisite LCR subject matter
expertise. This is a very different challenge
than problems a larger institution will face
with sprawling data sources, and therefore
it’s not a one-size-fits-all approach.
Key components involve early self-
assessment and assembling an optimal
plan and governance process to tackle
LCR. Once you figure out what you have
and need, you assemble the team — some
inside with others including consultants
and technology providers — looking
at those resources, plan around that
team, and then design the governance
process that will guide a firm through LCR
milestones and benchmarks, unit testing,
user acceptance testing and other aspects
of the implementation process.
For larger banks in the United States,
a fundamental part of this process is
2052a. Currently, there isn’t an LCR report
requirement in the U.S. per se; rather
there is this compliance requirement.
The Federal Reserve has produced some
element mapping that illustrates how
2052a is used in LCR, but there is no real
template here yet, and currently 2052a is
actually filed under a separate name, 5-g.
Putting those two together is an important
component: they’re closely interrelated,
and firms currently implementing LCR
and 2052a separately will risk significant
disconnects.
Therefore, the greatest technology
challenge treasury teams face is to source
relevant granular information across the
bank, as with 2052a compliance, so as to
now proactively monitor the LCR in an
effective and operationally coherent way.

‘Basel IV’: Stay ahead of the game…

‘Basel IV’: Keep ahead of the game…
‘Basel IV’: Stay ahead of the game…
The smarter way for you to tackle SA-CCR, the FRTB and other Basel capital rules
is by using a single platform to run all of your calculations.

AxiomSL uses a flexible platform which updates regulatory and core functionality
independently (just like a smartphone), to help you stay ahead of regulatory
change.

Visit www.axiomsl.com for more information.

Contact us Connect with us

Email: emea@axiomsl.com
London head office: 125 London Wall, London EC2Y 5AJ
Tel.: +44 (0)20 3823 4600

20 For the latest financial risk and regulation research and articles please visit www.risk-insights.com
 JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Liquidity & Capital Management

Reviewing the potential transition

from CRD IV to CRD V

ROBERT WAGNER
HEAD OF GROUP CAPITAL MANAGEMENT,
DANSKE BANK
My primary concern is the new capital floor under “Basel IV”. It seems
to become the binding requirement for many banks and in particular
for Nordic banks and not the backstop it is intended to be. With a
binding capital floor, the capital requirement for many low risk banks
will de facto be set according to the standardized approaches, and
thus to a wide extent based on one size fits all risk weights set by
regulators. This is not the right way to go. I strongly support keeping
the capital requirements risk based. It is vital that banks are incentivized
to assess and price risk correctly. That would also allow banks to adjust
for jurisdictional differences, which is difficult to do in the one-size fits
all standardized framework. Binding capital floors will skew the price of
low risk assets, which for instance will give banks incentive to replace
low-risk assets with high-risk assets. In conclusion, we hope to see that
the final BCBS proposals and the political process in EU will lead to
implementation of a capital floor, that is calibrated to be a genuine
backstop for banks in all of EU – including the Nordic Region.
That being said, I generally support the “Basel IV” review of internal
models. The design of the risk-weighted framework has been largely
unchanged since Basel II and could rightly be due for a check-up.
I agree with the Basel Committee in that it is important to ensure
that the risk based framework is not 1) unnecessarily complex,
2) incomparable across banks and jurisdictions and 3) leading to
systematically underestimation of risk. However, it is important to take
the interplay with other recent regulatory changes into account and in
particularly the overlap between different regulatory initiatives.

DAVID MCCLEARY
DIRECTOR - REGULATORY REPORTING
POLICY & CONTROL,
MIZUHO INTERNATIONAL
The biggest problem
for most institutions is
uncertainty and there
is still a significant
amount of regulatory
change coming
down the pipeline.
Institutions need to
understand the impacts of these requirements,
which include; The Fundamental Review of the
Trading Book (FRTB); The new Standardized
Approach for Counterparty Credit Risk
(SA-CCR); Revisions to the Operational Risk
framework; The Leverage Ratio; The Revised
Standardized Approach to Credit Risk; The
Net Stable Funding Requirement (NSFR);
The Revised Framework for Large Exposures;
Shadow banking rules; Requirements for SFTs;
MREL/ TLAC; The Future of “internal ratings-
based” (IRB) models; and the list goes on.
It goes without saying that there are significant
costs to institutions needing to roll out
these changes, which are timetabled for
implementation from 2017 onwards.
As we approach these final years for Basel III
implementation, some of these requirements,
a number of which began as CRD IV reforms
still need to be finalized. These are being
widely referred to as Basel IV or CRD V reforms.
Here is a little on two of these requirements.
FRTB kicked off in May 2012 following Basel
2.5 updates to the market risk framework in
2011. Since then we have been through three
public consultations and four Quantitative
Impact Studies and the Basel Committee
is expected to publish the Final Policy in
January 2016. Early reports which suggest
a longer implementation timeline (end of
2019) will be welcomed by the industry.
Some cynical pundits have suggested that
the only other good news to come out of this
will be for those that missed out on Basel
2.5. For market risk, it is now a level playing
field for all.
The Final Policy will herald the Sensitivity
Based Approach (new standardized approach)
for market risk and replace Value-at-Risk (VaR)
with Expected Shortfall (ES) as a basic
risk measure for internal models. Clear
boundaries will be established between the
banking book and trading book. There will
be significant impacts on risk governance
including risk appetite, risk management
framework, systems and data management,
policies & procedures, trading processes
& controls and retraining. In addition,
BSBC interim impact analysis published in
November 2015, suggests a 4.7% increase
in overall minimum capital requirements
and an average increase of 74% in
aggregate market risk capital
SA-CCR was finalized by the Basel Committee
in March 2014. It is the new standardized
approach for counterparty credit risk (SA-
CCR) and replaces both the Current Exposure
Method (CEM or MTM) and the Standardized
Method (SM) which are used to measure
Exposure at Default (EAD) in the capital
adequacy framework. In addition, the IMM
shortcut method will be eliminated from the
framework once the SA-CCR takes effect, which
is scheduled for 1 January 2017.
The SA-CCR compliance date of 1 January
2017 is not achievable in the EU because the
European Commission is not empowered under
Part 9/Article 457 of the Capital Requirements
Regulation (CRR) to introduce SA-CCR. It is only
empowered to ‘make technical adjustment and
corrections of non-essential elements’ (Articles
274 and 276 of the CRR). SA-CCR needs to be
introduced via revised CRR legislation (CRR v2).
The impact of the SA-CCR hinges on the
netting set. SA-CCR will produce lower capital
requirements than under CEM, but the savings
will be more evident for balanced derivatives
portfolios, and more punitive for highly
directional netting sets. SA-CCR will have
significant operational and implementation
impacts on institutions. SA-CCR employs
a more risk-sensitive approach to CCR.
The calculation algorithm is more complex
and sophisticated. SA-CCR requires more
data; additional data elements are required
to meet these risk calculations. The new
methodology is expected to close out the
differences between Pillar 1 and Pillar 2a capital
calculations. Institutions will need to bear in
mind the potential detrimental impacts on the
Leverage Ratio (scheduled to implement in
2018) given SA-CCR impacts on the exposure
measures.

For the latest financial risk and regulation research and articles please visit www.risk-insights.com 21
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Liquidity & Capital Management

Unexpected consequences
of the Volcker Rule
TALLY FERGUSON
SVP, DIRECTOR OF MARKET RISK MANAGEMENT,
BANK OF OKLAHOMA

Let me discuss three unexpected consequences of the Rule. First,
Risk Mitigating hedging became harder to support. In the May
3-4 Risk Americas convention, I shared mortgage servicing rights
example to illustrate how high the analytical and documentation
bar is. I also offered a low-tech but effective solution to avoid
these requirements. For this article, I offer several broad examples
for banks to consider. The inset describes what the Volcker rule
considers risk mitigating hedging. Note the risks hedged must be
specific and identifiable. “Hedging interest rate risk” is not specific.
The risk protected by an anticipatory hedge may be hard to identify.
The second bullet of the inset requires hedges to be specific to
a position. This requirement makes Macro-hedging difficult to
defend. As an example, fine tuning net interest income at risk with
interest rate swaps can involve opening and closing derivative
positions within 60 days. That becomes trading. To show that
activity is permissible under Volcker, the ALM desk must document
the hedge activity as follows:
• Identify the risk(s) of the hedged positions, contracts, or other
holdings of the banking entity that the purchase or sale is
designed to reduce;
• Describe the specific risk-mitigating strategy that the purchase
or sale is designed to fulfill;
• Distinguish the trading desk or other business unit that is
establishing and responsible for the hedge; and
• Create and retain records that show the hedge complies with
the risk mitigating hedge requirements. Regulators can ask for
this analysis for up to five years, and banks must promptly
produce such records.
As illustrated at the May 3-4 Risk Americas Convention, records
showing hedge compliance are extensive. They must demonstrate
correlation analysis, and independent testing designed to ensure that
the positions, techniques and strategies that may be used for hedging.
They must be specific to the risks identified at the outset of the hedge.
These requirements will change the way you document balance sheet
hedges and may change your balance sheet hedging strategies.
A second unexpected consequence pertains to transactions entered
into for the benefit of customers. I use mirrored customer trades as
an example. Many mid-size banks offer corporate clients help with
managing their interest rate risk. The classic fixed for floating interest
rate swap lets borrowers make fixed-rate credit facilities out of floating
rate loans. With this swap, the borrower pays the bank a fixed rate and
receives floating. Banks seeking to keep the floating rate structure
immediately offsets (“mirrors”) the client swap with a derivatives
dealer, paying fixed and receiving floating. As Robespierre would
be quick to point out, “immediately” is less than 60 days, making
these transactions trading transactions. How can banks continue
this business? Is it excluded as brokerage activity? Exempted as
for the benefit of customer? Exempted as market making? Should
banks rebut the presumption that such activity is trading? Likely,
precedence will be set over time.
“AS ROBESPIERRE WOULD
BE QUICK TO POINT OUT,
“IMMEDIATELY” IS LESS THAN
60 DAYS, MAKING THESE
TRANSACTIONS TRADING
TRANSACTIONS”
Finally, consider one last unexpected consequence. Many of the
mid-size banks that reported few or no trading account assets,
reported trust accounts under management. With custody of
securities accounts come potential for trade errors. Consider a
customer that asks the custodian to sell $100,000 in bonds. In error,
the bank purchases the $100,000 in bonds. The bank now owns
$200,000 in bonds. Upon identifying the error, it will sell the position
and lock in the loss or gain from the error. Assuming the banks
internal controls are reasonably effective, they will find and correct
the error within 60 days. If not, the bank has considerably bigger
problems than Volcker Rule documentation. Because the bank in
this example purchased and sold $100,000 of bonds within 60 days,
the transaction is presumed trading. This could be an intriguing
opportunity to rebut the presumption of trading. Minimally, the
bank should document the error to leave a clear audit trail that a
customer trade, not a speculative whim, set this set of transactions
in motion.

22 For the latest financial risk and regulation research and articles please visit www.risk-insights.com

2052A/LCR
FUNDS TRANSFER
PRICING
CCAR
NSFR
REPORTING
RECOVERY &
RESOLUTION
ENHANCED PRUDENTIAL
STANDARDS
FUNDING RISK USA
TLAC
INTRADAY LIQUIDITY
SEPTEMBER 27-28, 2016 | MILLENNIUM BROADWAY, NYC
Economic liquidity stress modeling
OTTO HUBER
GLOBAL HEAD OF LIQUIDITY RISK, CREDIT SUISSE
Otto, can you please tell the
Center for Financial Professional
readers about yourself and your
professional experience?
I have been with Credit Suisse for over 11
years. I am currently Global Head of Liquidity
Risk Management, a role in which I have
global functional responsibility for the second
line of defence for liquidity risk management.
Before joining the Risk Division in October
2015, I was in Credit Suisse’s Global Treasury
in Zurich and New York, where I was
responsible for Treasury Risk & Modeling.
In this role I was in charge for the modeling
View the full
of non-maturing products and non-interest
bearing assets and liabilities, the valuation
quidityusa
and risk assessment of Treasury-issued debt
and capital instruments, as well as for the
Treasury funds transfer pricing methodology.
Before joining Credit Suisse, I studied at the
University ofReaders can
St.Gallen from save
which 15%
I hold a on metrics.
PhD in finance.
by contacting jesse.hopkins@cefpro.com
At the Risk EMEA 2016 Summit
you focused on modeling. Why do
you believe that economic liquidity
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | Liquidity & Capital Management
15% DISCOUNT
Using code RIMAG33
LIQUIDITY &
Reviewing Regulatory Expectations Across Liquidity &
Funding Risk for Better Management and
Understanding of Impact on Balance Sheet
KEY HIGHLIGHTS
stress modeling in particular is a key talking while addressing the weaknesses of the latter.
point? In case the internal metric is more restrictive,
it can be used as universal risk metric for
Unlike classical market risk management
liquidity management purposes and will
and modeling, which is quite mature and
standardized across the industry, liquidity risk thereby automatically ensure regulatory
modeling is still developing. I believe there compliance.
is a tremendous mutual benefit by sharing
How do you see the role of
experience across different firms on their
approaches to liquidity risk modeling. Our liquidity risk professional changing
bank just underwent a significant effort to over the next 6-12 months?
overhaul our internal liquidity risk model and I I reckon most firms have realised that a
am looking forward to sharing my experience
much stronger second line of defence for
with peers and to learn from their approaches
liquidity risk management is needed than
to this topic.
they used to have in the past. Many firms,
agenda at www.cefpro.com/li-
Why is it important to compare including Credit Suisse, have significantly
internal economic liquidity stress
models and regulatory metrics?
increased the second line of defence for
liquidity risk management in terms of size,
There has to be a link between the seniority, and business proximity. Our team
internal liquidity risk model and regulatory has quadrupled over the last 2 years and
registration using
If the internal modeldiscount code RIMAG7.
is less restrictive Register
I anticipate it will continue today
to grow – at
than the regulatory metrics, then a firm cannot a much slower pace though. Therefore,
or calling
focus on managing to the internal metric. I
the team on +1 888 677 7007 /
we now have to deliver on our promises
think the internal model shall generally be
+44 (0) 20 7164 6582
more restrictive than the regulatory metrics,
to management and the regulators and
continue the journey we’ve just started.
23
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | Liquidity & Capital Management

RUN THE RISK

ONE SYSTEM
COUNTLESS SOLUTIONS
• Securities Analytics and Por tfolio
Management

• ALM and Risk Management

• Advanced Default Modeling

• Liquidity Management

• Fully integrated DFAST and LCR Solutions

www.zmfs.com

Put DCG’s experienced

model validation team to
work and gain quantitative
and governance insights

24 For the latest financial risk and regulation research and articles please visit www.risk-insights.com

REGULATORY
LANDSCAPE
ILAAP
LCR
NSFR
INTRADAY LIQUIDITY
DATA
ASSET MANAGEMENT
QUO VADIS
LIQUIDITY MANAGEMENT
LIQUIDITY RISK
CONTROLS
LIQUIDITY RISK MANAGEMENT
Reviewing regulatory requirements to better understand the
liquidity risk landscape for management and compliance
L
iquidity Risk Management is an area
of focus for financial institutions and
regulators globally, with the potential
systemic impact of being unable to obtain
the necessary liquidity to cover financial
obligations, regulators are cracking down
to safeguard the industry and reduce the
systemic risk of large organizations failing to
meet obligations.
Liquidity and the associated risks remain a
top priority for all financial institutions across
the industry, with a range of regulatory
changes and uncertainty around the future
of the liquidity landscape, is there a light
at the end of the tunnel for liquidity risk
managers, and an idea of the broader
liquidity landscape? Many of the regulatory
changes within liquidity risk have been
released by the regulators and interpreted
by the financial institutions and implemented
or infrastructure changes have commenced.
The focus is now shifting to the bigger
picture and reviewing how these regulations
work alongside each other, with a phase
in period for each regulation, it remains
unclear the overlaps that will occur and how
institutions can alleviate this duplication of
effort for a more seamless approach. As the
industry moves closer to implementation
and finalization of standards, it remains to be
seen whether there is a bigger picture to be
seen, whether regulators are taking a case
by case stance or working towards a bigger
goal for the liquidity landscape. Financial
institutions must look to improve or develop
their current infrastructure to support the
regulatory demands, adaptability being
key to accommodating the changes and
ensuring not just regulatory compliance,
but a good risk management practice that
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
RISK INSIGHTS | Liquidity & Capital Management
15 NOVEMBER, 2016 | LONDON
incorporates adequate risk controls, robust
frameworks, regulatory scrutiny and supports
strategic planning and management.
As is the case across many regulatory
changes, there is an element of
interpretation across the industry and
individual organizations when implementing
regulations. Many changes look to bring
uniformity across the industry to create a
level playing field and ensure comparability
across institutions. However the level of
interpretation across institutions and various
departments does not always create the
desired comparability and uniformity.
With the language used in consultative
papers often very ambiguous and final
standards often also similar, it is down to
institutions to be subjective around their
interpretation, which has its benefits and its
pitfalls. Allowing for individual, subjectivity
in interpretation of a standard, allows an
institution to tailor the changes to their
organization, with smaller institutions often
dubious that the rules are created with large
banks in mind, it gives the opportunity to
customize to a certain degree.
However ambiguity can also result in
infrastructure overhauls and extensive
draining of resources towards regulatory
compliance, only to fall at the final hurdle,
forcing companies to take a better safe
than sorry stance and interpret the rules
as they are stated. Over the last few years,
institutions have seen many large overhauls
in the liquidity space with areas like LCR,
NSFR, ILAAP, Intraday all coming into play
over the last few and upcoming few years,
interpreting these to ensure they are aligned
internally and all work adequately together
JULY - DECEMBER 2016 ISSUE ONE
SUMMER SPECIAL
20% DISCOUNT
on first 20 registrations
is a challenge faced by all institutions during
our research. The question remains how
organizations can build out systems to
support these regulations, whilst ensuring
the flexibility to make unexpected changes
and incorporate new regulation into a firm
wide risk management programme.
An area falling under the regulatory changes
bracket is that of intraday liquidity and the
necessary reporting requirements. Many
internal systems and infrastructures were
not originally set up to cope with and
facilitate the level or reporting required
for intraday liquidity, therefore the efforts
for most financial institutions have been a
huge undertaking, resulting in huge drains
on resources. A second area under the
systems for intraday liquidity reporting is
the data available in the current systems,
the granularity of data required for intraday
reporting is far more intricate and a vast
amount to report current positions at any
given point. Institutions are now moving
towards understanding the requirements
better and therefore beginning to
operationalize the process and build it into
a permanent system within the reporting
infrastructure, managing this on a daily basis
continues to be a challenge, with limited
resources, limited data sets for analysis and
subject matter experts to constantly collect,
collate and report the necessary data. To
accommodate new and evolving regulations,
beyond intraday, there has been a clear
focus on gaining a better understanding
and requirement for flexibility in systems and
frameworks to be put in place. The levels of
granularity, accuracy and the requirement of
maintaining data ahead of time is a crucial
challenge.
25
JULY - DECEMBER 2016 ISSUE ONE

RISK INSIGHTS | FRTB

How do you see the role of the market risk

professional changing over the next 6-12 months?
DIONISIS GONOS
DIRECTOR, CO-HEAD QUANTITATIVE
ANALYTICS FOR MARKET RISK,
BARCLAYS
It’s a big period of change. While the theoretical
requirements of the FRTB framework are not too
challenging, the implementation details, system
and architecture requirements are. The market risk
professional will need to get involved in almost
every detail of the implementation and architecture
(from time series, to proxies, sensitivities calculation,
scenario generation, valuation, P&L, reporting
allocation and explain) to ensure that all the
components can work together optimally to get the
needed accuracy and provide the business and Risk
Management the tools to navigate this complex
framework.
ANUSHMAN PRASAD
MANAGING DIRECTOR
MOODY’S COPAL AMBA
The role of the market risk professional has been evolving fast post the financial
crisis in accordance with Basel 2.5 regulations. We see this evolution pick up
more steam as the framework takes a concrete shape. While we believe that
banks and financial institutions will eventually come to grips with understanding
the framework itself, the real challenge seems to be in implementing this
framework. The demand for high quality data and increased processing power
may arise from calculation of multiple market risk measures at various liquidity
horizons and asset classes, default risk charge, and non modellable risk factors.
Hence a market risk professional will need to adapt and update their skills to
not only meet the modeling challenges but also the software implementation
challenges related to storage and complex processing of such large scale data.
This may even demand use of cloud computing and non-relational data bases
frameworks to process unstructured data.

The potential pitfalls of

operating under an internal
models based approach
THOMAS HOUGAARD
SENIOR PROJECT MANAGEMENT OFFICER, FRTB PROGRAMME, NORDEA

At the Risk EMEA 2016 Summit you
looked into the potential pitfalls of
operating under an internal models
based approach. Why is this such a
key talking point?
At this stage we can honestly say that it
looks like it will be much more difficult
to receive and maintain internal model
approval than has previously been the case.
And further that in the current form, several
of the components of the IMA framework
will require a lot of work both within
individual banks and across the industry to
translate into workable processes as well as
economically efficient business models.
What would you say are the
ramifications of certain desks
being bumped to standardized?
Clearly this is a capital issue. Interestingly
though even for the small subset of
desks for which the capital impact of
this would be manageable there will be
consequences. That is because the logic
and economics of how to hedge market
risks in a capital efficient way will be
restrained by the netting opportunities of
the standardized framework.
How can professionals prepare if
internal models fail?
With the current design of the framework
it is not unlikely that the model assessment
triggers for IMA (especially the P&L attribution
test) periodically can force individual desks
onto the standardized approach. In practice
that means that one needs to prepare
mitigating actions for managing capital
consumption for both IMA and SMA even
if one aims for Internal Model Approval.
I would therefore encourage all banks to
develop comprehensive capabilities and
understanding of the future standardized
approach for market risks.
What key challenges do you
believe lie ahead for the market
risk with the finalisation and move
towards implementation of FRTB
standards?
One of the most important challenges that
I see is that we have limited or no visibility
of how the set of principles in the final FRTB
rules in practise will be translated into law –
which will have implications for what must be
built in terms of market risk infrastructure. At
the same time it is my general understanding
that most market participants agree that one
must proceed with high urgency if one wishes
to be able to have an Internal Model ready
and approved by the indicated timeline in the
final version of the FRTB rules as published by
the Basel Committee for Banking Supervision.
In practise this means that one must decide
on a series of large investments before there
is a clear picture of what exactly needs to
be built. This is one of the main reasons why
Nordea has chosen to follow an agile project
management approach to implementing our
project.
On the methodological side I think that the
largest challenge will be that we must move
from risk models that are appropriately
conservative to capture all material risks to
risk models that with a fairly high degree of
certainty can replicate actual P&L. This is not a
trivial exercise.

26 For the latest financial risk and regulation research and articles please visit www.risk-insights.com

A look towards the
CVA finalisation rules
MARTIN DELLOYE
REGULATORY WATCH
& POLICIES
BNP PARIBAS
Are there any areas within the CVA
financial rules you anticipate as being
more challenging?
CVA risk is an area where striking the right
balance between simplicity, comparability and
risk sensitivity is particularly challenging.
On the one hand, some regulators consider the
proposed advanced approach – IMA-CVA – is
overly complex. On the other hand, the industry
claims that the standardized approaches – SA-
CVA and BA-CVA – are not risk-sensitive enough.
A constructive dialogue between the Basel
Committee and the industry is essential to
reach a good consensus. Unfortunately, the
Committee’s timeline is very tight (finalisation of
the rules expected by September 2016) and a
second consultation is out of time.
Back on IMA-CVA, it is well acknowledged that
it is challenging to implement. Under IMA-CVA,
banks would have:
• To produce a wide range of CVA sensitivities
on a daily basis which require an upgrade
of calculation capacity.
• To comply with eligibility tests (P&L attribution
& backtesting).
Nonetheless, it seems reasonably achievable with
some fine-tuning and sufficient time to adapt.
Could you give us a brief outline on
the shortcomings of the current CVA
framework?
The current framework has a number of
shortcomings among which:
• The Advanced Approach introduces a
hypothetical regulatory CVA distinct from
the true accounting CVA. What is
ultimately capitalized is the hypothetical
regulatory CVA which distorts the essential
link between economic risk truly incurred
and capital.
• Only the credit spread risk of CVA is
captured.
• Proxy credit spread hedges are not eligible.
• Both market risk hedges and non-eligible
credit hedges are capitalized as
open positions under the market risk
framework.
• The standardized approach is not a
credible fallback to the advanced
approach as it is not risk-sensitive at all.
For the latest financial risk and regulation research and articles please visit www.risk-insights.com
The debate
between VaR
and ES
BRANDON DAVIES
FORMER HEAD OF MARKET RISK,
BARCLAYS
Value-at-Risk (VaR) is a measure
of losses due to “normal” market
movements which means it ignores
extreme outcomes. By ignoring the
tail risks, VaR creates an incentive
to take excessive but remote risks.
Consider an investment in a coin-
flip. A £100 bet on tails at even
money creates a VaR to a 99 per
cent threshold of £100 as you will
lose that amount 50 per cent of the
time, which obviously is within the
threshold. In this case the VaR will
equal the maximum loss.
Compare that to a bet where you
offer 127 to 1 odds on £100 that
heads won’t come up seven times
in a row. You will win more than
99.2 per cent of the time, which
exceeds the 99 per cent threshold.
As a result, your 99 per cent VaR is
zero even though you are exposed
to a possible £12,700 loss. In
other words, an investment bank
wouldn’t have to put up any capital
to make this bet.
In contrast, Expected Shortfall is
a measure that takes into account
the fact that tail risks and extreme
events happen frequently in
JULY - DECEMBER 2016 ISSUE ONE
RISK INSIGHTS | FRTB
the real world. It also accepts
that extreme events initiated
by exogenous shock feed upon
themselves. And it takes into
account the incentives to “game”
the risk measurement system
and that extreme contingent risk
(e.g. out of the money options)
may create reward and no VaR
measured risk.
Regulators are being persuaded to
move towards an ES-based system
by what happens in markets, where
prices are not normally distributed
and empirical studies show that
asset price distributions exhibit “fat
tails” (leptokurtosis).
The mathematics of such
distributions imply far higher
capital requirements than normal
distributions and that analysis of
the tails is more important than
that of the variance from the mean
– this means an ES measure is more
relevant than VaR.
ES also invariably produces a far
higher capital requirement than VaR
which suggests the latter provides
a gross under estimate of risk and
capital.
However ES also ignores the
probability, that the rare tail risk
data observations are far less stable
observations than the common
data observations around the
mean average of a distribution.
Projections of risk based on an
assumed distribution will be stable
but if the tail observations are the
result of dynamic and conditional
processes such projections may
prove to be very accurate wrong
numbers.
27
 Sometimes you have
something really good
to show for yourself

RiskTech ®
RiskTech ®
RiskTech ®

2016 Category Winner 2016 Category Winner 2016 Top Ten

IFRS 9 Regulatory Reporting

www.wolterskluwerfs.com

ADVERTISE ON RISK INSIGHTS, E-NEWSLETTER AND RISK INSIGHTS MAGAZINE

Feature your company and thought-leadership in our next Risk Insights magazine, the online website,
and our monthly newsletter. We send out our Risk Insights to over 350,000 professionals every month.
Visit www.risk-insights.com for our media pack or contact us on +44 (0) 20 7164 6582 | +1 888 677 7007

CONNECT WITH US