New Frontiers in Banking. From corporate governance to risk management: open issues and challenges for the industry, regulators and supervisors.

1. 1 (9)
15 March 2018
Director General, Anneli Tuominen
1
New Frontiers in Banking. From corporate governance to risk
management: open issues and challenges for the industry, regulators
and supervisors.
New Frontiers in Banking, Rome 16 March 2018
Panel address by Anneli Tuominen, Director General, Finnish Financial Supervisory Authority
Introduction
It is a pleasure to be here in Rome and take part in this panel discussion with these highly respected
colleagues. I would also like to thank Professor Jean Tirole for his inspiring key note address as well as
his recent book ‘Economics for the Common Good’ (Tirole 2017), which I really enjoyed reading! I will
start my intervention with the evolution of prudential regulation and the lessons of the financial
crisis, continue with corporate governance issues, and finally debate possible options for completing
the Banking Union, the future of the European supervisory infrastructure and the impact of
digitalization.
John Maynard Keynes once said “If you owe your bank a hundred pounds, you have a problem. But if
you owe a million, it has.” There is still wisdom in this old saying. Against losses, banks (or insurance
companies) need to have their own capital. The riskier the business, the more capital a bank should
have. At the same time banks want to maximize the return on own capital. Own capital is expensive
for them and they want to have less of it than might be optimal from society’s point of view.
Regulating risks in an appropriate manner is a key challenge for the regulator, and assessing them is a
key competence for a bank – and for a supervisor.
The former governor of the Bank of England, Sir Mervyn King summoned up in his recent book (King,
2016) the difference between risk and uncertainty, as defined by Frank Knight in the early 1920s
(Knight, 1921). Risks are known unknowns, while uncertainties are unknown unknowns. When we
know the possible outcomes and can model the probabilities based on past experience, we are
talking about risks. In the case of uncertainty we do not know the possible outcomes and thus cannot
model the probabilities. But we behave like we could. Financial industry builds statistical models and
estimates their parameter values from the (big) data. Before the financial crisis of 2007–2009,
volatility in the financial markets was low. Assessed and estimated risk for, say, a house price
downturn was low. This was to prove again that past performance is no guarantee of future
outcomes.

2. 2 (9)
Risk and uncertainty in microprudential regulation…
I now turn to prudential regulation and discuss how risk and uncertainty have been visible in the
evolution of prudential regulation. During the last 30 years we have witnessed three vintages of
global Basel accords: Basel I, Basel II and Basel III.
Basel I was signed in July 1988. That framework focused on credit risk and the core idea was that
some asset classes are more risky than others. The riskier the asset, the more capital a bank should
have against those risks. The minimum capital ratio was set at 8 % of the sum of the risk-weighted
assets. The risk-weight framework itself was kept as simple as possible with given weights. The Basel I
framework was refined in two ways over the 1990s: an amendment to incorporate market risks and
the decision to allow banks to internally model those market risks. The idea of using internal models
is to have a lower risk weight if historical data proves that the losses are lower for the segment
concerned.
In Basel II, in 2004, the three pillar framework was introduced. The minimum capital requirement
framework, based on Basel I, was extended with a new supervisory review framework, and the use of
disclosures was used to encourage market discipline and internal assessment processes. The latest
version, Basel III, was announced in 2010. In the aftermath of the financial crisis, capital requirements
were tightened. Banks needed to have both more and better quality own capital, and a new leverage
ratio requirement – own capital to unrisk-weighted assets – was introduced. New liquidity
requirements were also introduced.
Last December, an agreement on refining Basel III was reached. The goal of Basel III is still valid:
capital requirements should be based on the best possible measurement of risks, and the capital
requirement framework should include incentives for the banks to develop risk measurement
methodology. Usage of internal models as part of the capital adequacy regulation fulfils these goals.
However there has been far too much unexplained variability in the risk weights among the banks
using internal models in their capital adequacy calculations (see e.g. Turk-Ariss, 2017; Döme and
Kerbi, 2017). This variability has compromised trust in the internal models, and update of Basel III was
needed to improve the comparability and credibility of capital adequacy figures.
An output floor was introduced limiting the benefits of using internal models. One could question
whether it is set at the correct level or if it could have been somewhat lower. This problem is most
evident concerning banks using internal models and having a high share of well-collateralized
mortgage loans in their loan portfolios. The agreed output floor of 72.5% could mean that banks
might have too little incentive to develop risk measurement methodology further.
Even with the caveats described above, most important right now is that we have an agreement and
a clear way forward. Especially important is that the USA, too, has approved the package in the Basel
committee. Now the ball is in the court of legislators. I encourage EU legislators to work for a global
level playing field and to take the Basel proposal to an EU regulatory framework with as few
exceptions as possible.
It is not only regulators that have been concerned about the variability of the results produced by the
internal models. Internal models have been a key supervisory focus area for the ECB for some time
already and, consequently, the ECB last year launched a targeted review of internal models (TRIM).
Through TRIM, the ECB hopes to ascertain that banks using internal models comply with regulatory

3. 3 (9)
standards, that the results of the modelling are driven by actual risks and that a level playing field
between banks is obtained. The review covers credit risk, and also market and counterparty risk.
Having seen part of the results of the in-depth work of the ECB I can only support the proposal in the
ESA review whereby EIOPA is to be given a coordinating role in the internal model approval process.
The challenges of the modelling are in no way a privilege of the banking sector.
….and in macroprudential policy
In addition to the strengthening of the bank-level, or microprudential, requirements, the Basel III
framework also focused on system-wide, or macroprudential requirements. These two are of course
interrelated: greater resilience of an individual bank improves system-wide resilience.
I would like to classify macroprudential tools in three broad categories: those that improve the
structural resilience of the institutions, those that improve the cyclical resilience of institutions and
those that affect the loan demand of households and non-financial corporations, the so-called
borrower-based tools or instruments.
The existing European legislation, CRR/CRDIV, has a broad set of tools for the two first categories. To
improve structural resilience, there is the capital conservation buffer, the buffers for global (G-SII) and
other (O-SII) systemically important institutions. To improve cyclical resilience, there is the
countercyclical capital buffer (CCyB). But as regards the third category, borrower-based tools, the EU-
level legislation is an empty shell. However, many countries have introduced borrower-based tools
like loan-to-value (LTV), loan-to-income (LTI), debt-service-to-income (DSTI) tools to limit maturities
directly or indirectly via minimum amortization requirements.
As macroprudential policy is a relatively new policy area, a learning process is still ongoing. It will take
time – at least one economic cycle – before we can assess with confidence how the tools work and
what their impact is. But already now as a practitioner – the FIN-FSA is the competent
macroprudential authority in Finland – I would like to raise two issues to be improved in the future
framework. Firstly, the set-up to improve the structural resilience of the institutions is complicated.
Partially this is because many of the tools – O-SII, G-SII, and SRB – do not add up, at least in most
cases. Should the logic be “the higher the systemic relevance, the higher the capital requirement”?
This does not make sense. Secondly, as I mentioned, the European toolbox lacks borrower-based
tools. I believe there is a need for a harmonized approach for such tools in the EU even though their
application should remain with the national authorities. Introducing such instruments in national
legislation is always politically challenging; therefore we do need European backing.
Risk, uncertainty and governance
The financial crisis showed us that bank management is not always able to implement and oversee
the governance arrangements that are necessary for sound business decisions. Together with ill-
advised remuneration policies this, in many cases, led to excessive short-term risk-taking by the
executive management. Indeed, while weak and superficial governance practices were perhaps not a
direct trigger for the crisis, they clearly exacerbated the financial situation.
Based on this notion it is easy to understand that governance issues have received increased
attention from many international bodies since the crisis. In general, the importance of safe and
sound governance of a bank is now better understood.

4. 4 (9)
These developments were, for example, analysed by the Basel Committee on Banking Supervision. In
2015 the BCBS concluded (BCBS 2015) that the key developments after the financial crisis were that:
1. Banks now understand better the importance of different elements of governance, such as
effective oversight, individual and collective board skills, and standalone risk committees.
2. Supervisors have taken measures to improve regulatory and supervisory oversight at banks,
for example by strengthening their guidance, raising expectations, and engaging more
frequently with the board.
In my opinion, the most important development in this area has been the reinforcement of the
collective oversight responsibility of the board. It should not be possible for the executive
management to dominate the decision-making in a bank without appropriate checks and balances
and challenge from the board.
The ‘principal-agent dilemma’ describes well the situation where the incentives and actions of
executive managers are not aligned with the preferences of the owners, customers and broader
economy. This dilemma is well known and was already mentioned by Adam Smith in 1776.
Having in mind the challenge of appropriate incentives, regulation on remuneration is clearly needed
from the perspective of society. In this regard, some important steps were taken by the CRDIV,
introducing for example the maximum ratio between the fixed and the variable remuneration and the
identification of risk-takers. In the same vein, one of the main responsibilities of the non-executive
management is to scrutinize the design and implementation of the remuneration policy. Supervisory
experience shows that remuneration policies that encourage excessive risk-taking in the short term
are often linked with weak management of those risks.
Furthermore, the ECB has rightly pointed also to the current economic environment in which banks
are operating: at the same time they face financial, competitive, and regulatory headwinds, and such
an environment drives the focus even more on sound governance (ECB, 2016). Against this backdrop,
I cannot emphasize enough the importance of a holistic view in the current supervisory framework,
combining requirements on capital, liquidity, risk management and governance in a meaningful way.
The topic of this panel called for open issues and challenges. The challenge I would like to point out in
the area of governance is the harmonization of governance expectations in the EU, where differences
in national corporate structures remain significant. Regarding relevant differences in local governance
structures we could mention, for example, the distinction between unitary and dual board structures,
and between shareholder-focused and cooperative ownership models, not to mention the fit &
proper requirements.
To illustrate briefly the supervisory approach in governance, we typically follow a two-layer approach:
compliance with binding national legislation is reviewed together with international guidelines and
best practices. Especially with regard to the international level, it is important to address expectations
without preferring any of the established governance structures. Indeed, the fundamental idea of the
CRDIV and EBA guidelines (EBA, 2017) is to lay down criteria applicable to all existing structures
“without interfering with the allocation of competences in accordance with national company law”.
The relation between Corporate Governance and bank risk-taking was studied by, for example, Brogi
and Lagasio in 2018. Their conclusions support well the supervisory experience. Governance
characteristics have an impact on risk taking in a bank, but as governance structures differ across
countries, these dependencies vary significantly. Therefore we need to acknowledge that Governance
regulations must be tailor made, taking into account local characteristics.

5. 5 (9)
The universal concepts of ‘management body in its management function’ and ‘management body in
its supervisory function’ seem to be well established at the moment. The supervisory function should
be performed by non-executive and preferably independent members, while the management
function effectively refers to the executive management. These functions need to be identified in
each bank regardless of its governance structure. In the cooperative banking sector, in particular, the
impact of these concepts has been significant.
Regardless of these attempts to create some common language, we are still far from a fully
harmonized governance regulation and supervision. Based on academic studies and supervisory
experience, full harmonization in this area may not be the preferred option. What is important is to
apply harmonized supervisory expectations acknowledging local corporate characteristics. With the
clarified universal expectations on different management functions, and the flexibility provided for
national corporate structures, we may finally be able to implement harmonized supervisory
procedures at the EU level. Notwithstanding the mentioned challenges, I trust this will contribute to
the reliability of the financial system through improved governance practices and more conservative
risk management in banks. From the perspective of the main regulatory objectives – protection of
consumers and the economy – I would argue that governance is as important as capital.
Europe at a crossroads
When the 20th
anniversary of EMU is celebrated next year, the period of EMU will be divided in two:
the time before and the time after the financial crisis. The financial crisis (and the continuum of
different crises from 2008 to, say, 2012) showed major weaknesses in the structures of EMU.
Jean Tirole writes in his book that “the 2008 crisis had its origin in the failure of regulatory
institutions: failure in prudential supervisions in the case of the financial crisis, and failures of state
supervision in the case of the euro crisis (Tirole 2017, pp. 350).” We have now learned how important
banking and capital markets are for the stability of the economy. And we have also learned the value
of high-quality supervision. The first reflections of this were the birth of the European System of
Financial Supervision (EFSF) and the first steps towards Banking Union.
Before the financial crisis, cross-border supervisory co-operation was conducted in the Level 3
committees (CESR, CEBS and CEIOPS). These committees lacked binding tools for ensuring supervisory
convergence. In the single market, risks easily cross national borders, but supervision did not follow.
European Supervisory Authorities (ESAs: ESMA, EBA and EIOPA) were established in 2011 to address
these deficiencies with much stronger regulatory powers. Although their supervisory powers were
also strengthened, they still remained fairly negligible.
Around the same time, the first steps towards the creation of Banking Union were taken, as the
lessons of the crisis had eroded trust in purely national supervision. Currently, Banking Union consists
of two pillars; the Single Supervisory Mechanism and the Single Resolution Mechanism; the European
Deposit Insurance Scheme is still missing.
While the European System of Financial Supervision (EFFS) is currently under review, it is important
to discuss what we want to achieve with the ESAs. Do we want to achieve integrated financial and
capital markets? Do we want to deter cross-border consumer detriment? Do we want to minimize
contagion of stability risks between countries? Do we encourage competition or national
sovereignty? Do we want to have a pan-European supervisory structure for the capital markets? Do
we want to have stronger supervision at the EU level?

6. 6 (9)
In the Capital Markets Union mid-term review it was debated that in the longer term the Capital
Markets Union would also require a pan-European capital markets supervisor. The Commission's
proposal for the ESFS review did, however, include neither a vision on the long-term supervisory
architecture for the Capital Markets Union nor a road map towards that.
In my view, there are certainly areas where supervision of the European capital markets could be
more centralized. Obvious candidates for centralized supervision are areas where the number of
market participants is relatively low and the activities are inherently cross-border, such as supervision
of market data providers, as proposed in the ESFS review.
On the other hand, in areas with close links to financial consumer protection, the supervisory tasks
should remain close to the consumers, i.e. at the National Competent Authority (NCA) level.
However, protection of financial consumers has to be improved and consistency in supervision
ensured. The increase of digital services flowing across borders highlights the importance of cross-
border consumer protection. We have unfortunate examples of cases where the home country
supervisor has not done enough to supervise its entities’ behaviour abroad, i.e. to protect consumers
in host countries. The ESAs should have much stronger tools to ensure that the NCAs are up to their
tasks. I therefore welcome the proposals by the Commission in the ESA review in this regard.
The ultimate goal of Banking Union, as stated by the heads of state and governments in June 2012,
was to “break the vicious circle between banks and governments”. On the path towards the
completion of the third pillar of Banking Union there are at least two legacy issues that need further
deliberation: non-performing loans (NPLs) and treatment of sovereign exposures.
Dealing with non-performing loans has been one of the top supervisory priorities of the ECB. The
amount of NPLs in the euro area stood at EUR 760 billion in autumn 2017, a decrease of about EUR
200 billion compared with a few years ago. This is a highly problematical issue in some countries, as
NPLs restrain banks from lending to the economy and drag down their profitability.
The ECB last year published guidance on how to reduce the amount of NPLs on a bank’s balance
sheet. Yesterday, the ECB published an addendum to this guidance that sets out the ECB’s
expectations on how to provision for new NPLs. Unsecured loans that become non-performing need
to be fully provisioned after two years, and secured loans after seven years. If a bank does not follow
the ECB’s expectations, the ECB will take this into account in its Supervisory Review and Evaluation
Process (SREP). The approach to be taken vis-à-vis the NPL stock is still under consideration.
Earlier this week the European Commission presented measures to reduce non-performing loans in
the banking sector. The package contains four key-areas: to set incentives for banks to set aside funds
to cover the risks against future NPLs, to encourage the development for secondary markets for the
NPLs, to facilitate debt recovery and by providing a blueprint for national AMCs.
The question we are faced with is whether a bank has enough available capital to resort to in order to
provision for its NPLs. If the capital adequacy of the bank does not allow for full provisioning, we
could – in my opinion – apply a step by step approach in the reduction of the legacy NPLs originating
from the financial crisis. I also feel that there still is a need for the precautionary recapitalization
regime.
The second unresolved issue is that many banks still hold a large amount of their home country’s
sovereign debt. The public debate on sovereign exposures has focused on three (non-mutually
exclusive) options. One is to issue risk weights to (euro area) government bonds, another to issue

7. 7 (9)
quotas or concentration charges on banks’ sovereign exposures (Véron, 2017). The third option is the
creation of a European Safe Asset. The high-level task force of the ESRB (2018), chaired by Philip Lane,
published in January its report on sovereign bond-backed assets (SBBS). All these options require a
change in the current risk-weight model.
Common supervision – the Single Supervisory Mechanism – has been operative from November
2014. We are currently supervising directly 118 significant institutions, which account almost for 82%
of bank assets of the participating countries. During the first three years of common supervision, the
supervisory processes have become more harmonized, which is reflected in the pillar II capital
requirements. Integrated banking supervision has contributed to making euro area banks more
resilient. The CET 1 capital ratio of banks has increased by over 270 bps and the quality of the capital
has improved.
Supervisory expectations are also tougher, and gaps in the regulatory framework have been
narrowed. Importantly, we also see that following the lead of the ECB, national authorities are
improving their own supervisory practices for the benefit of everyone. In addition to improving the
quality of supervision, the SSM has reinforced discipline, both amongst national supervisors and the
banking community.
The common resolution system started in 2015 and the BRRD came fully into force in 2016. The
resolution fund is still work in progress, as it should reach its planned size of 55 billion euros or 1% of
covered deposits by December 2023. As regards the common backstop of the resolution fund, the
Commission has proposed, and the Eurogroup has started to study how to use the current ESM or the
possible forthcoming European Monetary Fund as the common back stop.
We have moved into an environment where significant institutions can actually fail in an orderly
fashion. However, these resolution decisions provided useful lessons for both ongoing supervision
and the functioning of the crisis management framework, e.g. the framework for early intervention
needs to be revisited. We have also learned that the supervisory discretion embedded in the current
framework is important and should be preserved. Decisions should not be made too early nor too
late.
Finally, I would like to mention the dilemma stemming from retail investors. Indeed, from a financial
stability perspective, the resolvability of a bank may be significantly hampered if applicable bail-in
instruments are held by retail investors. The ESAs did already in 2014 highlight the risks relating to
self-placements, placing of instruments issued by a bank with its own clients (JC 2014 62). Although
the new MiFID 2 framework also in many cases prevents banks from returning to unhealthy self-
placement practices, it may be necessary to consider additional safeguards, such as high minimum
subscription amounts to limit the retail exposure to bail-in-able instruments.
The European deposit insurance system (EDIS) can be regarded as any other insurance. Normally, an
insurance contract is considered to be fair if insuring equal risks results in an equal insurance
premium. This would mean that the NPL problem would have to be solved (to some acceptable
steady-state level) more or less completely before the start of the common insurance system.
Another fair option, which is familiar to everyone who has taken out insurance, is that the higher the
risk, the higher the premium. This would mean that the banks that have more risks (NPLs) on their
balance sheets would have to pay higher premia to EDIS. In a forthcoming paper, ECB researchers
have studied how such a set-up would behave in different (simulated) situations.

8. 8 (9)
How is digitalization changing everything?
It seems sometimes that supervisors focus on solving the problems of the past rather than focusing
on the challenges of the future. In my opinion more supervisory action should be taken in analysing
how digitalization is changing the environment where European banks and other financial firms like
insurance companies are operating. What does it require to keep up with the changing environment?
Will all European banks eventually be able to rise to the possibilities and challenges that accompany
digitalization?
Financial services are shifting more and more online and to mobile devices. In the future, they will be
increasingly used wherever and whenever business is done, 24/7. Customers are demanding
developed cutting-edge digital services, which puts pressure on the banks. They have to be able to
offer the services either by themselves or in cooperation with partners, such as fintech companies.
We have also seen the rise of entirely new types of banks that operate 100% online.
In addition, regulation is affecting the roles of the European banks. PSD2 is introducing a new type of
competition by forcing banks to open their interfaces to third parties: payment initiation service
providers and account information service providers.
Also, the increasing competition applies pressure for the shortening of product development cycles. It
seems that banks want to launch products and services as fast as possible. However, this cannot be
done at the cost of security. Cybersecurity can only be as strong as its weakest link. Both banks and
supervisors should allocate more resources against operational and cyber risks. Cybersecurity also has
an important role in the fintech action plan of the European Commission. Needless to say, the ECB is
also active in the area of cyber resilience.
What does it take from banks to keep up with the changing environment? The financial industry is
already characterized by large IT investments and the need will not be vanishing in the future. Banks
need new types of resources. If you take a look at what kind of job openings the banks have today,
they are quite different from what they were, for example, 10 years ago. Banks are hiring data
scientists, software developers and cyber security professionals, to name a few.
We now have more than 5,000 banks in Europe. Are all of them able to build their IT systems up to
the level where they can rise to the challenge? The answer is probably “no”, and European banks
need to think of ways to cooperate. Some banks have already joined forces in developing IT systems. I
also think that it is inevitable that we will see more consolidation in the European banking sector due
to the high costs of IT-related investments and the increasing competition from new entrants.
Conclusion
To conclude my panel address, prudential supervision and governance have taken big steps since the
financial crisis. I want to remind you that my observations are based on my experience in supervision
– both at the national and the common European level – and in the European Supervisory Authorities.
I have learned to appreciate the importance of good governance alongside the traditional prudential
and conduct requirements. As we are finally leaving the crisis behind us, it is time to look forward. As
regards our single market area, it is important that we can finalize Banking Union as smoothly as
possible and make the most of the recent ESA review.

9. 9 (9)
Finally, I would like to emphasize that if the values and ethical foundations of the financial sector are
not healthy, even the most comprehensive regulation and effective supervision could become
irrelevant.
References
Basel Committee on Banking Supervision (2015): Corporate governance principles for banks, July
2015.
Basel Committee on Banking Supervision (2018): Sound Practices. Implications of fintech
developments for banks and bank supervisors, February 2018.
Brogi Marina and Valentina Lagasio (2018): Better safe than sorry. Will new rules on bank Corporate
Governance prevent excessive risk taking?
Döme, Stephan and Stefan Kerbi: Comparability of Basel risk weights in the EU banking sector. pp 68-
89, Financial Stability Report 34, Österreichische Nationalbank, December 2017.
EBA (2017): Guidelines on internal governance under Directive 2013/36/EU, 26 September 2017
(EBA/GL/2017/11).
ECB (2016): SSM supervisory statement on governance and risk appetite, June 2016.
European Commission (2017b): Completing Europe’s Economic and Monetary Union – policy package.
ESRB High-Level Task Force on Safe Assets (2018): Sovereign bond-backed securities: a feasibility
study. Volume I: Main findings. January 2018.
Joint Committee of the European Supervisory Authorities: Placement of financial instruments with
depositors, retail investors and policy holders ('Self-placement'): Reminder to credit institutions and
insurance undertakings about applicable regulatory requirements, 31 July 2014 (JC 2014 62).
King, Mervyn (2016): The End of Alchemy: Money, Banking and the Future of the Global Economy.
WW Norton & Company, 2016.
Knight, Frank (1921): Risk, uncertainty and profit. Reprint of Economic Classics, 1964.
Turk-Ariss, Rima: Heterogeneity of Bank Risk Weights in the EU: Evidence by Asset Class and Country
of Counterparty Exposure. IMF Working Paper 17/137. June 2017.
Smith, Adam (1776): The Wealth of Nations. Wilder Publications, 2008.
Tirole, Jean (2017): Economics for the Common Good. Princeton University Press. 2017.
Véron, Nicholas (2017): Sovereign Concentration Charges: A New Regime for Bank’s Sovereign
Exposures. Provided at the request of the Economic and Monetary Affairs Committee, European
Parliament. November 2017.