01 December 2007 Features

 

Basel II and the post-implementation landscape

Nicholas Pratt

Looming over the industry for the past seven years, Basel II becomes reality on 1 January. What will change?

MiFID may well have stolen the Christmas headlines in terms of regulatory deadlines, but come the New Year, there will be another regulatory deadline passed that has been considerably longer in its lead-up and has implications for almost every financial institution or lending entity.

For 1 January 2008 is the first “live” date for the implementation of the Basel II Accord, explains the Bank of International Settlements updated guidelines on risk management processes. It has been seven years in the making – designed to prevent the collapse of the global banking system following any major market, credit or operational event.

The Accord began its life in January 2001 when the first draft was released for public consultation. In the subsequent seven years it has gone through several amendments and postponements before finally establishing some immovable deadlines – 1 January 2008 is the date by which all European banks must have their basic systems Basel compliant and the US banks are to follow a year later.

In technology terms Basel II has precipitated some massive spending and has been a long-running and successful source of revenue for vendors and consultants alike. But come the January date will the gravy train grind to a halt? Will there be anything left to do? Or has attention already turned to Basel III? And what effect will the sub-prime crisis and resulting credit crunch have on Basel II-related activity?

Certainly the bulk of the spending has already been made after all, it is a bit late to be starting now. But, as David Rowe, executive vice president for risk management at vendor SunGard, says: “I don’t think there will be many banks charging across that January 2008 finish line with arms raised and fists pumping. But once they stagger across the line, exhausted, there will be various holes that they will be spending the next 12 months filling in.”

Roger Martini-Facio, head of risk and compliance at LogicaCMG says: “They have the majority of both the business and technology systems in place, but there is still an element of manual intervention involved and the automation of those aspects is what they will be doing in the first half of 2008, along with a focus on integrating these systems across the bank and rolling out any remaining technology.”

After the spending bonanza of the last seven years, the technology focus in 2008 will be very much on reducing expenditure, says Martini-Facio. “A lot of projects were able to be implemented under the Basel II banner, but now that banner has gone there will be less risk-based technology spending because it should have been done over the last few years and it will be harder to get any business justification. There would have to be a very good reason or a demand from the regulator.”

One of the regulatory demands may be in the approach to the Accord adopted by certain banks. The central tenet of Basel II and its treatment of credit risk, and its difference to the one-size-fits-all structure of Basel I, was that it contained three different implementation approaches – the foundation, the standardised and the advanced – of varying sophistication with a lower capital charge standing as the reward for those who adopted the advanced approach, where there is a greater reliance on internal models.

Thus far it is only really a handful of banks in the major European markets that have gone for the advanced approach, motivated in part by peer pressure and the possible effect on their reputations of not being seen as “advanced”. For the other banks it has been a standard approach. For example, consultant Ci3 has been helping Irish banks to implement their Basel II-complaint credit risk systems. “The Irish banks are not going for the advanced approach. We have only helped with one that was. That was Ulster Bank which is part of Royal Bank of Scotland,” says Richard Pike, a director at Ci3.

This may well change during 2008 and beyond. “For some banks they will face the decision of whether to upgrade and, assuming that the reduction in capital charge justifies the expenditure, there will be work to do in moving the portfolios from a standard approach to an advanced approach employing internal modelling,” says Martini-Facio.

For Rowe, the cost/benefit assessment and size of the capital charge reduction is the wrong way to look at the issue – instead it should be a purely risk-based decision. “If the risk is of a certain size then you ought to have a sophisticated approach to measurement so you can manage that risk appropriately,” he says.

As one of the larger banks in Europe, Credit Suisse unsurprisingly adopted the advanced approach for Basel II and is working towards the January 2008 date for going live. “We are on track for that and will go into January with a fully operational and compliant infrastructure,” says Andrew Cross, managing director of Credit Suisse Shared Services and the bank’s Basel II programme director.

This is not to say that there will not be work to do next year. While Cross says that roughly 90% of the work the bank wanted to complete will be done by year-end, there is 10% or so that will go into a book of work to be completed during 2008. “We will be fully compliant but we will not have implemented all of the processes into all of our systems.”

In contrast to some of the other “advanced” investment banks, most of the technology work for the last two years, and the next year has been focused on the finance side rather than risk – getting the transaction and exposure information and performing the capital calculations.

“What Basel II meant from an implementation and technology perspective was some moderate enhancement to our risk process because we had already done a lot of work internally on building global risk processes, but some significant enhancement to our finance infrastructure,” says Cross. “There is some work left to do but this is generally tactical, converting manual process into more systematic ones, which is generally the 10% you get left with in any large scale technology projects.”

While the focus for January 2008 has been on data collection and having an initial model to put before the regulators, come January attention will turn to Pillar 2 stages, where the emphasis is on the analysis of the data and the possible use of internal models. Ben De Prisco, senior vice president, research & financial engineering and capital management solutions at risk vendor Algorithmics, describes Pillar 2 as “a laboratory environment for banks to experiment with different approaches”.

Several big elements of Pillar 2 work, says De Prisco, will involve the reconciliation of economic and regulatory capital models, stress-testing, and assessing concentration risk. Other non-Pillar 2 efforts will revolve around refining existing Pillar 1 calculations to adopt more sophisticated approaches for modeling double default and using expected positive exposure calculations for the trading book, ultimately leading to the full integration of credit and market risk.

Whether the cost in technology for this post-Basel II will equal what has come before is hard to gauge, says De Prisco. “It is a trade-off between what was spent on data collection, where the focus of Pillar 1 lay, and what will need to be spent on data analysis, where the focus of Pillar 2 lies.”

According to SunGard’s Rowe, another way in which technology will play a role in post-Basel activity is in enterprise risk management – a term that has, admittedly, been thrown around for almost 10 years now without showing any sure sign of sticking. “There is still a lot of work to be done on gathering all the information needed to be able to ask convincing risk questions at an enterprise level, for example, what would be our total enterprise-level exposure to a downturn in the US housing market?” says Rowe.

“I have to think that had one of the major banks been able to ask this question, they would have pulled back from the sub-prime market but I don’t think enough organisations, certainly ones as large and diverse as Merrill and Citi, have reached that point where they can make those high-level ‘what if’ calculations on an enterprise scale.”

The sub-prime crisis happened too late to affect banks’ Basel II projects in terms of the January 2008 deadline. As Logica’s Martini-Facio points out, Basel II has developed in a very benign market. “If these events had happened a couple of years earlier, I think they would have had a large impact on the implementation of Basel II because they would have been trying to fight the credit crunch. As it is, Basel II implementations will go ahead as they are and most banks will be in that business-as-usual stage.”

Of course there is always the possibility of a Basel III or a Basel IIa being hurriedly released but this is unlikely given the considered progress of the current Accord. “I think there will be a lot of commentary from the regulators but there is no big drive to jump to a Basel III,” says Cross at Credit Suisse. “I think it is more likely that there will be initiatives on specific issues, such as liquidity and definition of owned funds. The Basel process is a complex task that involves gaining consensus from a wide range of national regulators.”

If the sub-prime crisis has indicated anything it is that technology and risk modelling and methodology can only achieve so much. “What I think it says is that sophisticated risk analytics are vital to effective risk management but they are necessary, not sufficient,” says SunGard’s Rowe. “What is also needed is the right way of thinking.”

On the one hand this means retraining credit teams to ensure that all credit-related data is updated and treated within the same framework on a constant basis. This may be seen as the softer side of Basel II preparations now that the heavy lifting that comprise systems implementation is over. But from a business perspective, this training is the heavy lifting. As Ci3’s Pike says: “You can design the mother of all IT systems but if no-one is using it, then you are stuffed.”

The other responsibility lies with senior management. Over the last 12 months many risk managers had noticed the drop of the credit spreads in the market and many felt that there was a crisis in the making in the sub-prime and fixed income market.

However, if the business is under pressure from the senior management to beat last year’s numbers, it is very hard for someone to suggest pulling back from a market where everyone still seems to be making a lot of money – and in which everyone knows that the returns cannot go on forever but no-one knows when it will end, so it becomes a case of who is going to blink first.

“Balancing the return with the risk at an enterprise level has to be a priority of the senior management,” says Rowe. “They are the ones that have to make the call.”