A supervisory perspective on 2019 and beyond

Speech by Sabine Lautenschläger, Member of the Executive Board of the ECB and Vice-Chair of the Supervisory Board of the ECB, at Risk Management & Supervisory Conference organised by Banking & Payments Federation Ireland, in Dublin, Ireland, 17 January 2019

Ladies and gentlemen,

It is quite a challenge to give a speech at the beginning of a year like 2019, I must say. So let me play it safe. My first, unsurprising and irrefutable prediction is: 2019 will be a very eventful year for all of us. And of course, I know that for many in Ireland and elsewhere, 2019 will first and foremost be “Brexit year”.

When Brexit happens it will bring considerable changes for banks, markets and supervisors in more ways than one. But we must also bear in mind that Brexit is not happening in an otherwise calm world. It is certainly not the only challenge banks might have to face. There are others: further geopolitical risks, non-performing loans, technological change, cybercrime, repricing in financial markets, the low interest rate environment and climate change, to name just a few.

With so many challenges on the horizon, it is a daunting task to predict how the supervisory landscape might evolve in 2019 and beyond. I cannot foresee how each of these items will play out.

For that reason, I think it’s best to concentrate on the big, structural changes we are facing. Some of these structural changes are triggered by political events, Brexit being a perfect example. Others are triggered by technological progress, for example digitalisation.

So, today, I will focus first on Brexit. I will discuss how it might impact banks, how it might impact markets, and how it might impact supervision. I will then turn to the structural changes triggered by new technologies and discuss what they might entail for banks and supervisors.

Banks, markets and supervisors in the post-Brexit world

Anyone who tries to predict the future has to deal with uncertainty. Prediction is something we humans are just not very good at. Research shows that we tend to overestimate the likelihood of positive events. Likewise, we underestimate the probability that something bad will happen to us.^[1]

And this applies to predictions about the future of banks as well. So, banking supervision can be seen as an exercise in tempering this “optimism bias”. Our most basic task is to be a tad more pessimistic than others and to challenge the banks accordingly.

Though it may seem counter-intuitive, in some cases supervisors are more open to change than banks. Banks sometimes focus on the short term, on the here and now. Their preferred post-Brexit outcome would probably be to stick to business as usual, to leave things – staff, IT, risk management – as they are. But this is not an option, unfortunately. So it is up to the supervisors to push banks to be agile and act before it’s too late.

European banking supervisors have worked hard to ensure that banks are prepared for Brexit. We have been clear about what we expect. We have published information on our website, we have set out our expectations in interviews and speeches, and we have spoken directly with the banks, of course.

From the start, we identified areas of concern for individual banks – particularly those that plan to relocate from the United Kingdom to the EU. We made it clear that we would not accept “empty shells”. And we made it clear that we would not accept comprehensive back-branching practices, where banks would provide services to EU clients only from branches in the United Kingdom.

We outlined the main areas we would be looking at when evaluating banks’ risk management, their staffing and their booking models. We have clearly stated that we expect all banks to have sufficient capabilities in place to manage all material risks locally, that is, here in the euro area. We have also spelled out that the outsourcing of functions or services must not compromise operational independence.

Regarding booking models, there are still a small number of banks that have not fully adjusted in line with our expectations. Again, it looks as if some banks are not as adaptable as supervisors would like them to be. The good news is that even these banks have now started to take action. We are aware, of course, that for some banks Brexit implies big organisational challenges. We will work with these banks to find acceptable solutions. But let me be blunt: many of these banks are big enough to shoulder these changes and to bring staff to the EU, even though they might not see the need.

The impact of Brexit will vary from bank to bank, of course. That’s why we are dealing with it bank by bank. But there are some issues which will affect the entire sector and we have to deal with these as well.

Think of clearing. The clearing of derivatives in UK CCPs is crucial for euro area banks. But a no-deal Brexit could mean that they will lose access to these services. For that eventuality, the European Commission now plans to take temporary measures to preserve access to UK CCPs. This is certainly good news. However, these measures are just a stopgap, and banks must make sure that they are prepared for what happens next. So, there is no time to relax; there is just a little more time to prepare.

The market for central clearing is highly concentrated. This may be positive in terms of the efficiency of central clearing. But we need to ask at what point these gains in efficiency may be accompanied by risks for individual banks, as well as for financial stability. And we need to start a discussion about how to mitigate these risks. Or to put it more bluntly: as supervisors, do we want big banks to rely on a single CCP for important asset classes?

But Brexit does not just affect the banks, of course. It also affects regulation and supervision, and these will have to adapt too.

European banking supervisors have worked hard to prepare for Brexit. But whatever we do must be rooted in the existing regulatory framework. And that framework is still fragmented. This is certainly not ideal, particularly when it comes to supervising globally active banks.

For one thing, the ECB still lacks the powers to directly supervise the provision of cross-border banking services. National authorities have some powers in this area, but their reach is limited too, and it varies from country to country.

This is a problem. A number of global banks, located outside the EU, currently access EU markets via the United Kingdom. After Brexit they will have to find new ways of entering the EU. They might set up subsidiaries in the EU, but they might also set up branches or provide services directly from non-EU countries, or third countries, as we call them. I’m fine with subsidiaries, because European banking supervision would cover them.

I have concerns when it comes to the rest, though. ECB Banking Supervision does not cover third-country branches or services provided directly from third countries – even if they are material.

It is true, of course, that third-country branches are still subject to national rules and supervision. But this leaves European banking supervision without a full picture of what banks are doing and what risks they pose. Banks, on the other hand, can seize the opportunity and engage in regulatory arbitrage. They could, for instance, circumvent our expectations on empty shells by shifting activities to third-country branches or by providing cross-border services from third countries. Just imagine a large third-country bank, providing cross-border services in part directly, in part through small subsidiaries and mostly via third-country branches across the euro area. No local supervisor would have a full overview of the activities conducted in the euro area, nor the capacity or powers to adequately react to the aggregate risk in the euro area.

I am well aware, of course, that it is not us supervisors who make the rules. The issues I have just mentioned are for legislators. I hope, though, that they will recognise that revised rules would go a long way towards mitigating post-Brexit and other risks.

The supervision of investment firms is another area where legislation urgently needs to adapt. A proposal is currently being discussed in Brussels that would ensure that the largest investment firms in the euro area would be supervised by the ECB. This would help us to make the financial sector a safer place and reduce the scope for regulatory arbitrage.

However, speed is of the essence here. Investment firms will play a greater role in European markets after Brexit. There will be more and bigger players. And this means more and bigger risks, including risks similar to those created by the banking system. Giving the ECB powers to supervise large investment firms will allow us to monitor and mitigate these risks. Progress on the legislative side is crucial as several banks are still finalising their post-Brexit plans. We must be able to send a clear message now: arbitrage of post-Brexit EU rules will not be an option.

Other countries are leading the way here. The UK prudential regulator, for instance, has the powers to supervise the largest investment firms. This, in fact, follows the golden rule of supervision: same business, same risk, same rules. An investment firm which provides almost all the same services as a bank, except for deposit-taking, should be supervised like a bank – by the ECB.

Another issue is the requirement for large non-EU banking groups to consolidate their EU activities above a certain threshold under a single intermediate parent undertaking, IPU for short. We welcome the outcome of recent negotiations on introducing this requirement, which would enable supervisors to have a better overview of activities within the EU. However, this approach is not ideal either, as third-country branches do not have to be consolidated under an IPU.

Banks, markets and supervisors in a digitised world

As I said before, Brexit is not the only challenge that banks face. Technological change, and in particular digitalisation, also has the potential to fundamentally change the banking landscape. But it is not clear exactly how things will change. It is hard to guess how innovations will evolve and easy to get it wrong. That said, we can still look at some scenarios and see how we supervisors would deal with them.

Let’s begin with two extreme scenarios.

First, banks could adapt in order to survive and even thrive in a digitised market. In this scenario, they would swiftly embrace the digital trend, team up with fintechs, and no major disruptions would occur. On the contrary, banks would be more profitable and agile than before. From the viewpoint of banks, this is certainly the most benign scenario. However, we should not forget that adapting to new trends and adopting new technologies always comes with new risks, such as legal or operational risks.

In the second extreme scenario, banks could find themselves powerless in the face of fast-paced innovation. Fintechs, or big techs providing financial services, could disrupt the market and take it over. The result could be either a highly competitive market, or a market that is highly concentrated. For the banks, this scenario is far less benign than the first one. And it would challenge supervisors as well. After all, many fintechs operate outside the regulatory perimeter. The regulator would need to keep in mind the golden rule I mentioned before: same business, same risk, same rules.

We cannot predict how things will play out in detail. These are two extreme scenarios, of course. In reality we are likely to land somewhere in between. Some banks will adapt, and even thrive; others will not be able to keep up. So, banks should focus on what they do best. And they should look at how technological innovations might help them to do what they do best more efficiently in the future.

What’s more, all banks need to keep an eye on cyber risks and work on cyber resilience. We know that banks are already exposed to cyber risk. But they will become more vulnerable as digitalisation progresses. They will need to invest in staff who have the appropriate skills to handle such risks. And they will have to comply with rules and regulations on this front.

ECB Banking Supervision will do its part. We will launch a number of on-site inspections on cyber risk in 2019, and we will continue to monitor the situation under our SSM cyber incident reporting process. We will also bring our expertise and knowledge to bear when contributing to guidelines being developed by the European Banking Authority on such issues.

But the impact of technological change goes beyond banks. Technology can also change the way in which we supervisors do our jobs, and it can change the way in which we think about risks. Applying new technologies to banking supervision could not only make it more effective and efficient. It could also reshape our priorities.

The greatest gains from what is known as suptech – supervisory technology – would be made in the collection and analysis of data. And there are many examples. Automated reporting could ease the burden on banks and make data collection more efficient. Machine learning could enhance the validation of data. Virtual assistants could be programmed to address user complaints during data collection, for instance. In addition, suptech could help to improve the analysis of credit and liquidity risks.

Some experts even argue that suptech could become a third approach to supervising banks. In addition to the rules-based and principles-based approaches, there would be a data-driven approach. Now, there is still a lot of uncertainty about the exact role suptech will play in the end. But it is already being applied here and there. Let me give you a few examples from across Europe. ^[2]

The Austrian central bank has developed a reporting platform that bridges the gap between the IT systems of supervised entities and supervisors. The Italian central bank is exploring ways of using machine-learning algorithms to forecast loan defaults. And the Dutch central bank is working on the use of neural networks to detect liquidity risk.^[3]

But as a good supervisor, I must add a note of caution, of course – countering the optimism bias again. Innovation is not risk-free in supervision either. Suptech comes with a number of risks. Think of the legal risks that arise when you start to handle ever larger amounts of sensitive commercial data. So as we supervisors start to apply new technologies, we must be just as cautious as we would expect banks to be. And we must remember that these technological advances are no substitute for supervisory judgement, which will still play an important role in the supervisory approach, supporting the outcome of supervisory assessments and underpinning the use of discretion in supervisory actions.

Conclusion

Ladies and gentlemen, I have touched on two major structural changes. Now it is time to come to a conclusion.

As I said at the beginning, the job of a supervisor is to be slightly less optimistic than the average person. We have to make sure that banks are ready for anything, even for a bad outcome. So we will continue to push banks to prepare for Brexit and any other challenges we see coming their way.

And although we might be less optimistic and more cautious than others, we do not shy away from innovation. Against the backdrop of Brexit, we have put forward many ideas on how to improve the European supervisory framework. And we see technology as an opportunity to make supervision more efficient and effective. The world is changing constantly, and we all have to adapt – banks as well as supervisors.