Basel II: How Ready is your Bank for Pillar II Compliance?

During 2006, banks around the world concerned with meeting upcoming compliance deadlines for the new Basel II regulations began to switch some of their attention from Pillar I of the regulations to Pillar II.

While Pillar I of the new regulations sets out specific rules for how banks calculate their minimum regulatory capital requirements, Pillar II sets out broader principles for how banks should conduct their internal assessments of capital adequacy, and how supervisors should review this and other supervisory issues.

Figure 1 – When do you Expect to be Compliant with Pillar II?

The less prescriptive nature of Pillar II has led to uncertainty about the way in which individual banks should interpret Pillar II requirements – and to doubts about how quickly bank implementation projects are proceeding.

During the third quarter of 2006, SunGard surveyed 61 bank respondents from banking markets all around the world to gauge their Pillar II aims and progress – especially with regard to the risk-and-capital systems that lie at the heart of Pillar II compliance.

About half the respondent banks were from Europe, Middle East, Africa (EMEA), with a quarter each from the Americas and from Asia-Pacific-Japan (APJ). The institutions included global banking players, second-tier banks in developed banking markets, and many leading banks in developing banking markets such as South Africa, Mexico and Thailand.

What Progress are Banks Making on Pillar II?

The survey confirmed that banks around the world are now taking Pillar II seriously, with about 77% of banks saying they have a formal Pillar II project and team in place. However, because regulators around the world have set different timetables for compliance, there are marked differences in the timeframes the banks are working to.

EMEA banks, dominated by European institutions, have the tightest regulatory deadline and are working to the tightest deadlines for project completion (Figure 1). Over half of the EMEA banks who responded expect projects to be finished within the next few months, including those finished already. Not surprisingly, banks in APJ are lagging as compared to the other regions: some 65% of the Pillar II projects in APJ are set to take 12 months or more.

Whatever the local timeframes, it’s clear that banks worldwide have some way to go to complete Pillar II projects (Figure 2). Most banks say their Pillar II projects are in the early planning stages (31%) or underway (40%). Barely 16% of respondents have reached a point where they would claim their project is ‘partially complete’, and 8% are still defining their projects.

Figure 2 – At Which Stage of the Pillar II Project are you?

Again, the EMEA banks show a strong lead in terms of projects underway or partially complete. Out of 61 respondents, only three banks claimed that their Pillar II systems were built and fully integrated – all of them EMEA institutions.

Risk management is an evolving science, and Basel II has been no different. A lack of clarity in Pillar 2 has forced the focus of implementation projects on Pillar I. In some cases this has been a good thing. Banks and regulators have had to deal with hitherto unconsidered issues, some of which may have been industry-wide. This has fostered an environment of collaboration that has helped expand the understanding of everyone involved. It is therefore not surprising that banks are only just beginning to think of Pillar II, or still have a project underway.

Do Banks Think Their Pillar I Tools will Support Pillar II?

Most banks recognize that the processes and systems they have put in place for Pillar I of Basel II will not be adequate to measure the full range of risks covered under Pillar II internal capital adequacy calculations.

Optimistically, almost 70% of banks say they will extend their Pillar I systems to help calculate capital for some of the risks included in Pillar II calculations, while another 13% of banks do not intend to use their Pillar I tools at all for Pillar II – and are presumably building new systems or adapting their existing internal capital adequacy systems. Only 18% of banks continue to hope that they can extend Pillar I capital tools to assess all the risks required for Pillar II.

While operational event risk is covered under Pillar I, many banks are likely to want to refine their approach to measuring operational risk for the Pillar II purpose of assessing internal capital adequacy. Our survey showed an even split between banks that will use their Pillar I operational risk tool for Pillar II (52%), and banks that will be using a different tool (48%).

Have Banks Selected their Pillar II Tools?

While 40% of banks globally say they have selected the tools they will need to meet Pillar II requirements, a striking 60% of banks say they have not. This relatively slow rate of selection may be because Pillar II is open to the detailed interpretation of local regulators around the world. This interpretation began to become clearer in some regions – notably Europe – during 2006, but globally banks still have many questions about Pillar II compliance. Some 72% of institutions say they have considered using expert external consulting to address particular Basel II issues.

Again, there are regional differences (Figure 3). The percentage of banks that have selected Pillar II tools is 60% in Europe but falls to around 30% and 20% in the Americas and in APJ respectively.

Figure 3 – Have you Chosen Pillar II Tools?

Which Risks are Banks Focusing on?

Pillar II will require most banks to assess internal capital for a much wider range of risks than the credit, market and operational risks covered under Pillar I, depending on the risk profile of each bank. So which risk types are banks focusing their attention on?

Our survey showed that business risk – e.g. the risk to revenues arising from competition in the banking markets – is at the top of the pile, with about 51% of banks intending to allocate capital to this risk. Market risk in the banking book (48%), and liquidity risk (41%), are close behind (Figure 4).

With technology shrinking the world into a global village and financial instruments getting innovative to keep up with expanding needs, competition amongst banks is on the increase. The philosophy of Basel II has been to enable banks to maintain their competitive advantage while implementing a prescriptive regulatory capital model. It is interesting to see that banks are actually setting aside capital to cover business risk.

Figure 4 – Which Risks are you Focusing on?

Interestingly, reputation and legal risk also showed strongly: around 30% of the banks intend to allocate internal capital to them. They were level-pegging as the fourth and fifth key risks that banks intend to allocate capital to, despite the difficulty of putting numbers against these risks.

Allocating capital to these risks was a particularly strong concern for respondents from the Americas, perhaps because of the wave of litigation following the millennial ‘boom and bust’ in the US stock market. Some banks also commented that they will allocate capital to concentration risk (a particular dimension of credit risk) and interest rate risk (a dimension of market risk).

Which Business Applications are Banks Focusing on?

One of the novel aspects of Pillar II is that regulators have said banks must use the numbers they produce on risk and capital to run their businesses – the so-called ‘use test’. Banks are also aware that potentially onerous investments in Basel II risk and capital measurement have a silver lining – if they can be leveraged to strengthen bank risk management and to risk-adjust business decisions in a way that impacts profitability.

Figure 5 – Which Business Applications are you Focusing on?

So how are banks planning to integrate their internal capital adequacy assessment processes into their business (Figure 5)?

Most of our participant banks say they will use the numbers for their capital planning (85%), i.e., making sure the bank has enough capital to support the risks it plans to assume. Almost as many (79%) will apply the numbers to their forward-looking business planning and forecasting. Many will also use it for risk mitigation (69%), and governance and control (61%).

Almost 60% of banks have set themselves the ambitious aim of applying the new numbers to both pricing and performance measurement – perhaps a key example of how banks are leveraging Pillar II investments into business applications.

Providing a bank has invested in the right kind of systems for calculating overall capital adequacy, it is relatively straightforward for the bank to allocate a portion of this number back to business lines, portfolios and transactions so that the cost of risk capital can be factored into business line performance measurement and transaction pricing.

A significant, but much smaller, number of banks (21%) plan to apply their capital adequacy numbers to risk-adjust their remuneration and incentives for business leaders. While encouraging in terms of establishing a trend, this number also suggests that only a minority of banks accept the critical role of risk-adjusted compensation in changing the culture and behaviour of a banking institution.

How are Banks Approaching the Issue of Pillar II Stress Testing?

The regulators are keen that banks incorporate stress testing in their Pillar II systems. But the type of stress tests and the degree of sophistication demanded by regulators will vary in line with the size and risk profile of each institution. We asked the banks what kind of stress testing their Pillar II tool would provide. As Figure 6 shows, around 70% of banks will be able to use their tool to stress test key credit concentration risks.

Figure 6 – What Kind of Stress Testing will your Pillar II Tool Provide?

About half of the institutions would like to see how changing the confidence level attached to their capital calculation affects the amount of the capital that the bank requires. And around a third of banks would like to stress test how changing the degree of correlation between risk types, and within risk types, affects the outcome.

Note: Modelling correlations between different risk types is perhaps one of the most intriguing problems facing the financial engineering world today. For instance, an interest risk swap would have market risk as well as credit risk associated with it. Inter-risk correlations in this case would be in terms of modelling extreme conditions, where there could be a massive interest risk shift (market risk scenario) that could, in turn, trigger default. Modelling for inter-risk correlations involves modelling the likelihood of scenarios affecting combined risk. On the other hand, intra-risk correlations involve modelling relationships such as those between industry sectors. Relationships in this case could be modelled in terms of scenarios such as simultaneous increase in defaults in related sectors such as airlines and hospitality.

About half of the banks said they would be able to perform ‘bottom up’ stress testing for individual business units and legal entities, as opposed to stress tests at group level. This will help reveal how underlying units contribute to the overall capital requirements of the bank and is likely to be important for banks hoping to use their Pillar II systems to make practical business decisions.

Conclusion

It’s clear from our survey that banks are taking Pillar II compliance seriously – though many Pillar II projects are far from complete and banks have some distance to go in terms of selecting the tools they will need. As the regulators intended, banks are including many new kinds of risk in their internal capital adequacy calculations, and many banks plan to apply the new risk numbers to key business decisions.

Interestingly, banks do not necessarily see Pillar II compliance as the end of the road for improving their internal risk and capital adequacy systems – half our sample (49%) plan to upgrade their Pillar II capabilities within three years after their initial compliance.