Evolving Bank and Systemic Risk | Speeches (2024)

It's a pleasure to be back presenting to this banking conference. Today I am going to talk about themain risks that banks face, how those risks have evolved and how banks' and policymakers'response to them has adapted. And then, given the Reserve Bank's mandate for overall financialstability, I will discuss when those bank risks can be systemic financial risks.

It's important to note that risk is not a dirty word for banks. Banks' core business is managingrisk. When they do that well, by offsetting, controlling and appropriately pricing risk they can increaseeconomic activity and improve welfare. In doing this, banks remove risk from the balance sheets ofbusinesses and households, they facilitate businesses investing and hedging, and enable households tosmooth consumption, including by purchasing housing. But when banks don't manage risks well, theconsequences can be devastating.

Four main bank risks

There are four main risks that are central to being a bank: credit risk, market risk, liquidity risk andoperational risk.

Banks core business is lending money to customers and so they face credit risk with theuncertainty about whether customers will repay those debts.

They also, of course, face market risk with the potential for losses as a result of(unexpected) movements in financial asset values, such as commodities, exchange rates or interest rates.

Banks face liquidity risk from the mismatch of long-dated, illiquid assets – mostlyloans – and short-term, liquid liabilities, in particular deposits and money market funding.^[1]

The last of these core risks for banks is operational risk, which is the risk of loss frominadequate or failed internal processes or systems, and human error (see BCBS 2011).

There are many other risks attributed to banks. Many of those are another name for, or part of, the fourcore risks I've just mentioned. For example market risk encompasses price risk and interest raterisk, while compliance risk, transaction risk, the risk of fraud or business disruption are operationalrisks.^[2]

These four core banking risks are the same risks that banks have faced for hundreds of years. But thenature of those risks continues to evolve. These risks have been prominent in the past 15yearsgiven two major shocks: the global financial crisis (GFC) and the COVID-19pandemic.

Core banking risks in recent years

Credit risk is the main risk we think of when it comes to banks and it continues to be the most prominentrisk. Certainly since the GFC, it is the risk that the major Australian banks communicate most about, asjudged by the number of references to credit risk in their annual reports (Graph1).

See Also

The Best Safe Investments For Seniors During Retirement (2023)Understanding high-risk investments13 Toxic Investments You Should AvoidTop 3 factors that determine which investment strategy is...

The significance of credit risk was highlighted with the onset of the COVID-19 pandemic. Forecasts of very large contractions in economic activityand rising unemployment led banks to anticipate large credit losses and so substantially increase theirprovisioning.^[3] As it turns out, losses have been, and are expected toremain, much smaller because of much better than expected economic conditions and direct fiscal paymentsto affected households and businesses. With smaller credit losses now expected, banks have even startedto reduce their stock of provisions as we outlined in our Financial Stability Review.^[4]

Market risk gets almost as much attention in banks' annual reports as credit risk. But Australianbanks don't have large investments in marketable securities. Most of their assets are loans, and inparticular housing loans. Banks hedge most of the interest rate risk from the maturity mismatch on theirassets and liabilities, but they still face market risk on any leftover mismatches in how quickly theirassets and liabilities can be repriced.

Internationally, the GFC increased the focus on the valuation of financial securities, particularly thosewith little price transparency, and so too the attention to market risk for banks that hold significantfinancial assets.

Liquidity risk has always been important for banks. Historically the focus of banks and policy makers hasbeen on the potential for deposit runs. But the GFC demonstrated that there is just as large a risk of arun on wholesale funding, which can be very fast and damaging to a bank's balance sheet.^{[5] [6]}

The GFC was a crisis that started in the financial system – there were exceptionally expansionaryfinancial conditions before the crisis, which tightened rapidly, even in Australia (Graph2). Whilethe early stages of the GFC were a liquidity crisis, fairly prompt provision of additional liquidity bycentral banks greatly reduced that aspect of the crisis.

The COVID-19 pandemic was very different because it was an exogenous shock tothe financial system. But central banks quickly saw the potential for tighter liquidity conditions and,to an even greater extent, ramped up the provision of liquidity to forestall any potential for asignificant liquidity shock. As a result, financial conditions quickly returned to being expansionary.One consequence of these two events is that, globally, banks have seen that central banks will increasethe provision of liquidity in response to large systemic liquidity shocks and so expectthere is less need to self-insure against these shocks. Indeed, this can make sense from a societalperspective, as there's a good argument that liquidity can be considered a public good (for example,see Kearns and Lowe (2008)).

However, banks clearly still need to insure against moderate systemic and idiosyncratic liquidity shocks.The global banking reforms that followed the GFC – including the Liquidity Coverage Ratio and NetStable Funding Ratio in Basel III – mean that banks are much better placed to deal with liquidityshocks. Perhaps because of their confidence in their own liquidity, and the potential for central bankliquidity, Australian banks give less prominence to liquidity risk in their annual reports.

Operational risks have evolved and in general intensified over time, particularly for banks that havebecome larger and more complex. There is also some evidence that operational risk correlates withmacroeconomic conditions and so potentially with the other core banking risks (Aldasoro etal 2020). Internationally there was a spike in operational losses following the GFC related toimproper operating practices in the boom prior to the GFC. These included fiduciary breaches, aggressivesales, privacy breaches, account churning and misuse of confidential information. These issues have alsohad some prominence in Australia with the recent Royal Commission into Misconduct in the Banking,Superannuation and Financial Services Industry.^[7]

‘Emerging risks’

Two bank risks that are getting increasing attention are those stemming from climate change andcyber-attacks. In fact these are not distinct risks – both are representations of the four corebanking risks I've just described.

Climate risk

Climate change is part of a broader category of ESG – Environmental, Social and Governance –risks that are getting greater attention, driven by investors.

Two separate risks are typically identified as resulting from climate change:^[8]

• Physical risk is the potential for reduction in a bank's income or the damage to its assets (mostnotably banks' loans) as a result of the physical effects of climate change, for example fromsevere storms, bushfires or more extreme temperatures or rainfall, which could reduce crop yields ortourism revenues.
• Transition risk is the potential for losses that could result from changes in policy, technology andbehaviours, either in Australia or overseas, that occur as we move to a less emissions-intensiveeconomy.

Physical and transition risks are sometimes referred to as horizontal risks in that they are across thefour core bank risks. When it comes to climate change:

• There is credit risk because climate change can result in falls in borrowers'incomes and declines in the value of assets securing loans, either because of physical risk (forexample, drought or storms result in smaller crops) or transition risk (for example, a coal minercould experience a sharp fall in the value of their mine if demand for coal falls with policychanges). This is the most significant part of climate risk.
• There is market risk because the risks from climate change could result in falls –or unexpected volatility – in the value of financial assets to the extent that these risks arecurrently not incorporated into prices.^[9]
• There can be liquidity risk, for example because a bank may not be able to roll over itsshort-term wholesale funding because investors are concerned about its climate exposure, probablyfrom an increase in its credit or market risk.^[10]
• Banks can also face operational risk from extreme weather. For example, Hurricane Sandyforced banks in New York to close offices.

Just as in other countries, banks in Australia are now paying substantial attention to climate change.Climate change risks now get more mentions in our major banks' annual reports than even liquidityrisk, in contrast to not being mentioned at all only a few years ago. While five or 10years ago,climate risk was not in the job description of a bank chief risk officer (CRO), now the CRO is intimatelyinvolved in a bank's response to climate change reflecting the risks (and opportunities) that climatechange poses to banks.

But quantifying and pricing the impact of climate change on their risks is challenging for banks. Mostbanks do not yet have sufficiently detailed data to estimate their exposure, such as disaggregated dataon their emissions exposure via their counterparties, or detailed location information for assets thatare used as collateral for loans. They also face uncertainty about the impact of climate changemitigation policies and the effects of climate change.

The Reserve Bank has recently published some initial work quantifying the impact of climate change onAustralian banks through physical and transition risks (Bellrose, Norman and Royters 2021). That workfinds that in regions most exposed to extreme weather, a small share of housing could experience pricefalls which increases the chance of lenders experiencing credit losses. But for the scenario used andbased on available information on the banks' assets, the overall losses for the financial systemappear to be manageable. Banks are also exposed to transition risks from their lending toemissions-intensive industries which again exposes them to credit risk, although overall, Australianbanks' portfolios appear to be less emissions-intensive than the economy as a whole.

Another important step in Australia in developing banks' and regulators' understanding of climaterisks is the Climate Vulnerability Assessment (CVA) being undertaken by the Australian PrudentialRegulation Authority (APRA) on behalf of the Council of Financial Regulators (CFR), which includes APRA,along with the Australian Securities and Investments Commission (ASIC), Australian Treasury and the RBA.The CVA is currently being run with the five largest banks and the results are planned to be publishednext year (see APRA (2021)). The Reserve Bank is assisting in the CVA, including with the macroeconomicenvironment. Similar exercises are being undertaken in many countries.^[11] APRA has also recentlyreleased its Prudential Practice Guide for climate change financial risks.^[12]

Cyber risk

The other (so called) ‘emerging risk’ that is getting increasing attention is cyber risk.Cyber risk is a type of operational risk, which has actually existed for some time. It is the risk offinancial loss, operational disturbance or damage resulting from disruption, failure or misuse of ITsystems.^[13] Realised cyber risk can take many forms, from theftof funds or other valuable commercial or personal information, to disruption of services, or corruptionof data, possibly for ransom.

It is difficult to assess the extent of cyber risk as firms don't tend to publicly disclose attacksand there isn't uniform or comprehensive reporting of cyber-attacks. But everything points tocyber-attacks growing in frequency. The Australian Cyber Security Centre received 13percentmore reports of cybercrime in 2020/21than the previous financial year,with a larger share being classified as severe. Various sources also suggest that the financial sector isone of the most targeted sectors.^[14] The Australian banks are also increasinglydiscussing the cyber risks they face. While the number of mentions of cyber risk in banks' annualreports is still fewer than the four core banking risks, it has much greater prominence today than only afew years ago. The pandemic has increased this risk further with more employees working from home andmore digital banking, increasing the possible entry points for attackers.

Cyber risk is in many ways different to other risks banks face as there is an adversary, someone who istrying to profit at the bank's expense. In that sense it is closest to theft, another operationalrisk. But while bank robbers have traditionally been restricted to being able to steal the amount of cashin a bank branch or armoured car, cybercrimes have a potentially much larger loss for banks. One aspectof cyber risk that is truly different to other risks banks face is that an adversary may actually not beseeking a financial profit, but may just want to disrupt the operations of the bank or the broaderfinancial system. Such motives make it harder to anticipate and defend against cyber-attacks.

The large Australian banks have substantial resources to deploy in their cyber defences, and so aregenerally regarded to be as well protected as other large firms in Australia. It can be difficult forsmaller banks to maintain equivalent cyber defences because of their smaller resources – relativeto some other expenses banks face, cyber defences have relatively large fixed costs compared to thevariable costs that scale with the size of the bank.

Like all firms, banks have to pay attention not only to their own cyber defences but also those of anythird-party suppliers they use. APRA directly supervises around 680financial entities, but thefinancial system consists of around 17,000interconnected entities including third-party serviceproviders, which are all possible avenues for cyber risk. Entities regulated under CPS 234arerequired to apply appropriate cybersecurity controls, develop active governance around cybersecurity, andreport material cyber incidents to APRA. Regulated entities are also responsible for ensuring complianceby their third-party suppliers (see Summerhayes 2020).

The CFR is piloting a framework for adversarial testing of financial market participants' cyberdefences and their resilience. This exercise is mimicking the tactics, techniques and procedures that areused in real cyber-attacks. In doing so, it will test how well banks, and financial marketinfrastructures more broadly, can detect, respond and recover when faced with an unknowncyber-attack.^[15]

Given the large number of cyber-attacks on Australian banks, it's not really a matter of if there is amajor cyber breach but when – a point that APRA has made repeatedly (see for example Byres (2021)).So, as important as banks' cyber defences are, perhaps even more important is their resilience, howthey would recover from an attack. This detection and response is an important part of this cyber testingbeing undertaken by the CFR agencies.

From bank risk to systemic risk

I'd now like to turn to how those core risks to banks can result in systemic risks for the financialsystem. A stable financial system facilitates the flow of funds between savers and investors and in doingso facilitates economic growth. If the smooth functioning of the overall financial system is disrupted,it can cause substantial harm to economic activity and our daily lives. We only have to think back to theGFC to be reminded of the significant cost globally to employment, incomes and welfare from a financialcrisis. The Reserve Bank has a mandate for overall financial stability, and so we carefully monitor thesesystemic risks.

There are a number of factors that increase the likelihood that bank risk becomes systemic risk including:

• if the affected bank is large
• if the nature of the risk means it is correlated across banks so would be realised simultaneously inmultiple banks (this could even be through perception, for example that a deposit run on a small bankprecipitates runs on other small banks that look ‘similar’)
• if there is a high degree of interconnection or it affects a critical node of the financial system
• if the realisation of that risk is likely to be persistent and so it would have a long lasting effect
• if it is realised when uncertainty or risk aversion is particularly high (e.g. during a globalpandemic).

These factors have elements of credit, market, liquidity and even operational risk. For example,Australian banks have similar portfolios – in particular substantial housing lending – and sohave similar credit and market risk. A significant increase in credit risk would affect a large share ofbanking assets and so could become systemic. The large Australian banks have similar funding structuresincluding which international capital markets they borrow in. So significant realisations of liquidityrisk would have the potential to become systemic, although as I noted the Reserve Bank has substantialability to address a systemic liquidity crisis.^[16] Even operational risk can be systemic if it were tobe realised in, say, a central counter party, or spilled over from one bank to others because theaffected bank could not meet its payment obligations.

Indeed, even those so-called ‘emerging risks’ – climate risk and cyber risk – areon our radar as systemic risks. Just as banks have paid increasing attention to those risks, so have weat the Reserve Bank. And we too have been communicating more about them, as highlighted by the number ofmentions in our Financial Stability Review (Graph4). The financial risks from climatechange are clearly systemic as climate change will affect the portfolios of all banks. Cyber risk neednot be systemic. It could affect only one bank, but if that bank is large and interconnected, or thecyber-attack affects a critical node in the financial system, it could very well become systemic.

Conclusions

To sum up, banks today face the same four core risks that they have faced for decades or even hundreds ofyears: credit, market, liquidity and operational risk. But those risks have evolved, as highlighted bythe growing prominence of risks that cross these core risks: climate change risk and cyber risk. Howrisks are managed has also changed substantially, for example the domestic implementation of the BaselIII reforms after the GFC has resulted in banks holding more capital and liquid assets, while the latestcapital reforms from APRA make risk weights more sensitive to the risks of different loans.^[17] Theupcoming capital reforms will better allocate capital to risk by adjusting risk weights, improveflexibility by increasing the capital in buffers, boost loss-absorbing capacity, and improve the qualityand transparency of reporting on regulatory requirements.^{[18] [19]} It is crucial that banks continue to adapt their riskmanagement for these evolving risks, as those bank risks can morph into systemic risks that have thepotential for dire consequences for the economy and people's livelihoods.