Indeed, one of the largest BNPL providers, Sweden-based Klarna Bank AB, a subsidiary of Klarna Holdings AB, which has been described as ‘Europe’s largest start-up’, raised an additional US$1 billion in financing at the end of February 2021. It boasts 90 million customers worldwide, and its operations in the United States recently exceeded those in Germany, its second-largest market. Two other major BNPL providers, US-based Affirm Holdings, and Australia-based Afterpay Limited, have also shown phenomenal growth. (Klarna is still privately-held, while Affirm and Afterpay are publicly-traded.) All are active outside their home countries, either under their own name or other names. Established payment providers, such as large commercial banks and PayPal, are also entering this space.

In Southeast Asia, several BNPL providers have sprung up just in the last few years, such as Bill Ease, Jungle, and Tendo Pay in the Philippines and Razer, hoolah, Atome, Rely, Split and OctiFi in Singapore. Pine Labs, an Indian company, has recently partnered with Mastercard on a scheme called ‘Pay Later’, envisioned eventually to cover all of ASEAN. Malaysian provider Pace Now Enterprise plans to serve customers in Thailand and Singapore as well as in its home market. The Southeast Asian ‘super-apps’, such as Grab and Shopee, also offer BNPL options in a limited way to their customers.

What is it about BNPL that is so appealing to consumers, investors, and merchants alike? Is it truly a ‘disruptor’, which over time will displace credit and debit cards as means of retail payment, not only online but also in ‘brick and mortar’ stores? And what are the concerns, if any, for financial stability and consumer protection? Is there room for prudential as well as consumer protection regulations? This blog post attempts to answer these questions, as well as describe some interesting features of this booming market that may not be readily apparent from newspaper and magazine articles.

BNPL: A Primer

‘Buy now, pay later’ schemes allow consumers to obtain goods and services now while stretching out payments in installments over a pre-arranged period of time. The period of time can vary considerably, from 30 days to 4 years. Generally, the option to pay in installments is provided ‘free’ to the consumer; that is, without the payment of interest, although interest is charged to the customer in some arrangements.

When a customer makes a purchase, either in-store or online, the BNPL provider makes an immediate payment for the full amount to the merchant. Subsequently, the customer makes the installment payment to the BNPL provider. These installment payments may be automatically drawn from a customer’s bank account, or the amounts could be charged to a customer’s credit or debit card. (It’s not immediately clear why any customer would want to set up this arrangement, if the typical motivation of a BNPL customer is to avoid using credit or debit cards. Moreover, at least one credit card provider, CapitalOne in the United States, prohibits its cardholders from linking to BNPL providers.) These actions create something resembling a loan agreement between the BNPL provider (the creditor) and the customer (the obligor). This loan agreement may be retained by the BNPL provider, or it may be securitised and sold to third-party investors.

For its part, the merchant pays the BNPL provider a fee, generally ranging between 2 and 8 per cent of the purchase amount. These merchant fees typically provide the bulk of BNPL providers’ revenue: 69 per cent in the most recent period for Klarna and 51 per cent in the most recent period for Affirm. (Afterpay’s published data do not permit a similar calculation.)

BNPL programs had already achieved popularity before the COVID-19 pandemic struck, with a steadily rising trend of e-commerce and smartphone payments. The pandemic has accelerated this trend, along with even stronger demand for e-commerce and other forms of cashless and remote payment. Uptake of this payment mechanism has been most pronounced among people aged 40 and younger, especially among those without established credit histories.

As a part of their risk management activities, BNPL providers say they conduct credit checks on both customers and merchants before onboarding them. On consumers, credit checks are conducted using proprietary algorithms and alternative data, rather than accessing public credit registries or private credit bureaus, which are unlikely to possess information on the (mostly young) targeted customers. On merchants, BNPL providers use both external credit registry or credit bureau data, supplemented by internal data.

It may not be immediately obvious why BNPL providers conduct credit checks on their merchants. There is, of course, a reputation risk to the BNPL provider if dishonest merchants selling shoddy or overpriced merchandise are on the platform, alienating customers. More important than that, however, is the underlying mechanism involving customer returns. BNPL providers typically guarantee that the customer’s already-paid installment(s) will be refunded, and the unpaid installment obligations canceled, if a product is returned. If a BNPL provider has a continuous relationship with a merchant, the monies refunded to customers in a particular reconciliation period are simply subtracted in the calculation of the net amount owed by the BNPL provider to the merchant. But this process does not work if the merchant has gone out of business. There is no company to which the customer can return the merchandise, and no company from which the BNPL provider can subtract the monies refunded in the process of reconciliation.

The range of products for which BNPL purchases are popular is vast, but the payment mechanism is most common for consumer electronics and health and beauty products. The product range is widening all the time, however: some BNPL providers cover health care expenses, and experiments are underway for using BNPL to settle utility bills, which can be quite large for certain customers, especially in jurisdictions where utility consumption is heavily taxed.

Keeping the above analysis in mind, we may characterise the essence of a BNPL program as the following:

• Allowing a customer to pay for a good or service over time is another way for a merchant to give some customers a discount on that good or service without actually lowering the price for all customers. The cost of the discount to the merchant, and the value of this discount to the consumer, goes up with increases in the level of market interest rates. At times when interest rates are near zero or negative, merchants may benefit substantially.

• It is administratively costly, and perhaps detrimental to cash flow, for a merchant to operate a BNPL scheme on its own. Therefore, ‘outsourcing’ this task to the BNPL provider is a convenient solution. The merchant receives its money up front, and the BNPL provider handles all of the administration and debt collection tasks, as well as the credit risk of customer nonrepayment.

Risks of BNPL schemes to the consumer

At first glance, customer obligations to BNPL providers do not seem to pose any greater risk than other kinds of household debt, such as credit cards or unsecured personal loans obtained from banks for miscellaneous expenses. On the national level, in jurisdictions where aggregate household debt as a percentage of GDP is still within reasonable levels, the addition of a sliver of additional household debt is probably no cause for concern. On the individual level, however, there are concerns of possible overindebtedness, especially among young and inexperienced users, as well as missed payments resulting in late charges and declining credit scores.

Indeed, as reported in a recent survey, 40 per cent of US customers have missed at least two payments, and 72 per cent of these customers have seen their credit scores decline. (Not all BNPL providers report late payments to credit registries or credit bureaus.) Similar results have been reported in other countries. Another problem for the less financially-literate consumers is overdraft fees charged by banks when BNPL payments are automatically drawn from a consumer’s account without sufficient funds. These overdraft fees have caused significant hardship for some customers. Some consumers even sign up with multiple BNPL providers, evading spending caps, caps on accumulated late fees, and blocks on additional purchases when payments are missed, in order to keep on spending.

What’s more, customers have even reported falling behind in servicing other debt, such as car loans or mortgage loans, in order to keep BNPL obligations current. Customers with spotless BNPL records can obtain benefits, such as discounts on certain products, which sometimes leads to perverse outcomes when these minor benefits can’t completely offset the major drawbacks of going into delinquency on loans that are actually reported to credit registries and bureaus.

Consumers appear to be at least somewhat aware of these risks, and some of them even enjoy features on BNPL apps that track their total spending against budgets, promoting financial responsibility. Avoiding actual or perceived high credit card fees or interest charges is also a motivation to use BNPL services for some customers, evincing another dimension of thriftiness.

It should be apparent from the preceding paragraphs that financial literacy is key, and financial education promoting literacy, whether provided by the BNPL firms themselves or by other entities such as non-profits or regulatory authorities, will be an important component of responsible BNPL usage for young and old for years to come.

On a more esoteric level, some customers (and regulators) may be concerned about how the BNPL providers are using personal data. It’s no secret that BNPL providers accumulate a large amount of data on individual shoppers –- amounts spent, goods purchased, timing of purchases –- that are valuable to merchants in targeting specific customers with advertisements and discounts appealing to them. When the data directly obtained from purchases are combined with data that the BNPL providers are accessing to perform their own credit scoring, a complete profile of a consumer can be developed and sold. To what extent are customers aware that this is happening, and have they provided informed consent?

Risks of BNPL schemes to the providers

Enumerating the risks to BNPL providers is relatively straightforward –- in fact, the three main global providers, all publicly-traded, do this themselves in their required securities filings. Similar to banks, BNPL providers are subject to credit risks, liquidity risks, and operational risks. Their proprietary scoring models may be subject to model risk, and even the risk that they may not now, or no longer in the future, be authorised to use the data that run the models. They may also be subject to reputation risks if the general public perceives them as preying on young or less financially-literate consumers.

Of the three main global providers, Affirm operates with a strikingly different business model and is subject to different risks. Affirm has some characteristics of an investment bank. It has two partner banks, both FDIC-insured deposit-taking institutions in the United States, who actually fund the loans made by Affirm to consumers after Affirm approves the loans. Affirm often on-sells the loans to investment banks for securitisation, retaining the servicing, and sometimes even buys loans to add to their loan packages for sale. All of these activities subject Affirm to liquidity risk, if they are unable to sell the loans they have acquired from their partner banks or purchased in the open market.

All three main providers report risks of intensified competition, as the activity of providing BPNL faces few barriers to entry and is easily scalable. One risk mentioned specifically by Affirm is the risk that not enough bespoke sales personnel, data scientists, and engineers will be available at affordable salaries to accommodate its ambitions for growth. Affirm also reports concentration risk in a large percentage of their transactions taking place with a single merchant (a supplier of home fitness equipment, demand for which has soared during the pandemic). Afterpay, for its part, worries about its technology not interoperating with third-party platforms and point-of-sale systems that merchants may prefer in the future.

It is clear that these risks are company-specific and not systemic. No one thinks that BPNL services are a vital component of the payment system in any jurisdiction or that the failure of any one of these firms would cause irreparable harm to customers or merchants.

Regulatory approaches to BNPL

Regulators in different countries are taking notice of the rapid growth in BNPL activity. Over the past year, the Financial Conduct Authority in the United Kingdom, the Australian Securities and Investments Commission (ASIC), and the Monetary Authority of Singapore have all announced their intent to develop what they view as the most appropriate form of regulation for this activity. Regulators have cited concerns over transparency, customer suitability, customer overindebtedness, and treating customers fairly. ASIC is investigating the possibility that merchants are marking up the prices for customers selecting the BNPL option for payment, although BNPL providers prohibit that practice. In the United States, the Consumer Financial Protection Bureau regulates all types of lending from a disclosure and transparency standpoint, but it has not specifically focused on BNPL providers. Finally, no regulatory authority seems to be concerned, at least not yet, about financial stability or money laundering risks.

An intriguing experiment in self-regulation has recently commenced in Australia. In March 2021, the Australian Finance Industry Association. (AFIA) released a ‘Code of Practice for Buy Now Pay Later Providers‘. Compliance with the Code is enforced by means of a detailed Terms of Reference and By-Laws, and only providers in compliance will be allowed to advertise themselves as Code Compliant Members. Adherence is legally enforceable, in the sense that violators who still portray themselves as compliant can be subject to civil action.

The Code is principles-based, and focuses on customer outcomes, which is the emerging philosophy of customer protection in the financial services industry of the 2020s. It is organised around nine pledges to the consumer to:

1. Focus on customers, especially the most vulnerable
2. Be fair, honest, and ethical
3. Keep you properly informed about our product and service
4. Make sure our BNPL product or service is suitable for you
5. Undertake an ongoing review of suitability of our products or services
6. Deal fairly with complaints
7. Offer financial hardship assistance
8. Comply with our legal and industry obligations
9. Support and promote this Code.

Central banks and regulatory authorities in other jurisdictions may elect to work with the industry to develop self-regulatory mechanisms in the same manner as ASIC has worked with AFIA in Australia.

Conclusion

‘Buy now, pay later’ schemes represent a new twist on a very old practice of ‘merchant credit’. They blend technology and payments to satisfy the urges of instant gratification among (mostly) young consumers. But do they represent a ‘disruption’ of the credit and debit card industry, which is already being viewed as a dinosaur and ‘last century’ by the younger generations? The evidence is not in. So far, BNPL is being used mainly for small purchases, paid over short periods of time, and as a means by which merchants can offer ‘discounts’ to some consumers without offering them to all. BNPL carries the stigma of ‘impulse purchases’ and rampant consumerism, at a time when a cultural shift may be occurring as the world emerges from the pandemic’s grip: households may be adjusting to a slower way of life and an emphasis on experiences rather than the accumulation of things. Nevertheless, regulators, the industry, and consumers themselves should be cautious, and should promote responsible use, transparency, and guardrails.

We are in the midst of an unprecedented pandemic. Apart from the tragic loss of life, the economic implications will be felt for years. This will not only be in terms of the businesses that have been closed down, many of which will never re-open, but also through effects on employment and career development, and the massive levels of debt that governments are incurring in order to support their economies.

Scientists have for long sounded alarm about the likely outbreak of a pandemic like COVID-19. But despite such warnings, governments around the world actively cut the budgets of their health services, including those aimed at dealing with pandemics. In the UK, a cross-government pandemic influenza outbreak drill took place in October 2016. Exercise Cygnus, as it was called, identified that the UK’s National Health Service would need thousands more intensive care beds in a pandemic crisis, that doctors would have to start triaging patients and only help those with a better chance of survival, and that there would be a shortage of masks and other protective equipment available to frontline staff. The required investments in equipment and facilities were never made and tragically the predictions of the exercise have now become a reality, as the UK now has the highest number of COVID-19 deaths across Europe. Similarly, in the USA the administration over the last three years cut the funding and workforce of the Centers for Disease Control and Prevention, and the USA now suffers from the highest COVID-19 deaths in the world, numbering more than 85,000 at the time of writing.

A parallel can be drawn to scientists’ warnings of a climate catastrophe. The world is facing the growing threat of abrupt and irreversible climate change. Scientists recently revealed that a large part of the Arctic Ocean has already warmed by more than 4°C above pre-industrial conditions. We have been witnessing an increasing number of climate-related incidents such as hurricanes, earthquakes and bush fires, leading to a loss of life, jobs and habitation. The harrowing scenes of the recent Californian or Australian fires that led to such devastating loss of human and animal life and habitation may be a harbinger of a “new normal”. Are we going to be equally slow to heed such calls for action, until a global climate emergency forces us to act?

One of the major sectors of the economy that needs to act in this regard is the financial sector. It is financial institutions that fund the activities of the companies contributing to global warming and environmental destruction. Going forward, it is crucial that the financial system starts to fully consider the cost of economic activities that cause environmental destruction, pollution and biodiversity loss when making decisions on loans and investments. Furthermore, it is crucial that the financial sector is better prepared to deal with systemic risks, including climate and other environmental risks.

In this regard, it is positive to see that central banks have been showing greater awareness of sustainability risks and acknowledging the need for them to act in helping to align the financial system with sustainable development. Launched at the Paris One Planet Summit in December 2017 by eight institutions, the Network of Central Banks and Supervisors for Greening the Financial System (NGFS) has grown to 65 members and 12 international observers. NGFS members have acknowledged that climate change represents a systemic risk to financial stability and have started to develop approaches to integrate climate-related financial risks into prudential supervision frameworks. A recent survey by the Basel Committee on Banking Supervision revealed that the majority of its membership considers it “appropriate to address climate-related financial risks within their existing regulatory and supervisory frameworks.”

Many countries have been considering to introduce disclosure requirements for climate-related financial risks, as suggested by the Task Force on Climate-Related Financial Disclosures, as well as micro- and macro-prudential instruments to mitigate these risks. A number of central banks – including the Bank of England, the Nederlandsche Bank and the Banque de France – have already started developing climate stress tests for their financial systems.

But calls have emerged from the financial industry to delay prudential measures aimed at addressing climate risks. Without doubt, this is a period of great stress for our economies and the financial sector, and pragmatism and flexibility are needed to manage a difficult crisis situation where so much is at stake. But we need to be clear that the current crisis must not be used as an excuse to undermine efforts by central bankers and financial supervisors to climate-proof financial systems. If anything, the COVID-19 crisis should strengthen the resolve of central banks and supervisors to speed up efforts to integrate environmental and climate risks in financial decision making to prevent the next big crisis to occur.

The central policy challenge facing both pandemics and climate crises is the same – we must make rapid progress in mitigating risks in the face of deep uncertainty and make our societies and economies more resilient. The financial sector will have to play a key role in this.

_____________________________

An abridged version of this article was first published by OMFIF on 14 May 2020 and can be accessed here.

Aziz Durrani is Senior Financial Sector Specialist at the South East Asian Central Banks (SEACEN) Research and Training Centre.

Ulrich Volz is Director of the SOAS Centre for Sustainable Finance and Reader in Economics at SOAS, University of London.

Since the initial publication of this blog post, this article has been further developed into a full fledged SEACEN Policy Analysis Paper, which has been published on the SEACEN Centre Website on 15 May 2020. The paper can be accessed here.

As the world shelters from COVID-19 and attends to those already ill or infected, the primary concern of central banks, stand-alone financial sector regulatory authorities, and deposit insurers (collectively, regulatory authorities or RAs) must be the health and workplace safety of their senior management, staff, and their families.  Beyond that, the RAs have a public policy objective of maintaining confidence in, and the smooth running of, the financial sector, the effects on the real sector of the shutdown of which would be too much for any economy in any jurisdiction to bear.

Maintaining confidence and smooth functioning of the financial sector, in turn, requires attention to the “force multipliers” of a financial crisis:

• Correlation.  The situation where the same negative factor affects most financial institutions (for example, a sharp drop in housing prices or a sharp rise in unemployment).
• Connectedness.  The situation where banks lend to and borrow from one another and/or banks purchase each other’s debt and/or equity securities, causing possible linked failures.
• Contagion.  The situation where events negatively affecting a few banks (usually larger ones) lead to a loss of confidence in other banks, even if these banks are not negatively affected by the same events and there is little or no connectedness.

In any given crisis, any one or all of these force multipliers may be in play. 

In achieving this public policy objective of maintaining confidence and smooth functioning under extremely trying conditions, the RAs must be prepared to address a possible severe financial crisis quickly and effectively.  This goal will require the RAs, together with the Finance Ministry and possibly other government leaders, to prepare and agree upon in advance measures that, if selected, could be put into place without much dissension.  All of the involved organs of government should agree that stopping or at least attenuating a financial crisis, and its concomitant negative effects on the real sector, will necessitate all of the following activities:

• Allocating losses from failed financial institutions according to policies and procedures that, if not already enshrined in laws and regulations, are at least perceived as fair and do not further alarm depositors and other creditors.
• Preventing new losses by reducing connectedness and contagion.
• Bolstering surviving institutions by strengthening capital and liquidity positions, thereby making new lending and refinancing of existing lending possible.

A 2020 financial crisis, should it materialize, will be different from the 2007-2017 Great Financial Crisis (GFC) and subsequent euro-area sovereign debt crisis, because the origin will be an exogenous, real sector shock and not a buildup of vulnerabilities in the financial sector itself.  Even so, the trajectory of a severe real sector shock leading to a financial crisis that reverberates back again on the real sector may necessitate the use of some of the same tools that were used to react to the GFC, but perhaps to an even stronger degree, and may also necessitate the use of new tools with which RAs may be experimenting, and which may have to be adjusted as events unfold.

The questions of transparency and communication

Two common themes of this brief that should be addressed right from the beginning are transparency and communication, which are different but intimately related.  How much transparency should the RAs practice about the intrinsic condition of the financial sector?  And how should these messages be communicated, giving policymakers and the general public the information they need to know, without alarming them?

The main argument in favor of transparency – which includes not delaying the phase-in of accounting and reporting standards that may worsen the reported (but not intrinsic) condition of banks and other financial institutions – is that in the absence of full disclosure and the realization by policymakers and the general public that “adjustments” have been made, they may assume that the condition of the banks is even worse than it really is intrinsically.  Moreover, the effect of relaxed standards on the accounting for and reporting of problem loans, just to take one example, is not evenly distributed across the banks.  The relative ranking of banks in terms of overall financial strength may well change when broad-based adjustments are made in accounting and reporting standards, even if the intrinsic ranking stays the same.  The effect of these changes in relative rankings may be to distort supervisory decision-making, which would be most unfortunate in a time of crisis.

The main argument against transparency, and allowing banks to appear better capitalized and more profitable than they really are, is that policymakers and the general public could become alarmed if they find out that the majority of banks are unprofitable and heading toward capital deficiency or even insolvency.  This concern, which is not to be minimized, stems partly from a confusion about what “bank capital” and “bank insolvency” really are.  Ordinary people tend to confuse capital with cash, and they may interpret a bank’s declining capital position as a hemorrhaging of cash.  In surveys, households often opine that loan-loss allowances are a “fund” that is “drawn down” by a bank in stressful times.  They may also confuse insolvency with illiquidity.

The media often contribute to this confusion, which is why RAs in crisis preparedness mode should devote time and effort to bringing in the media every step of the way in developing or modifying its crisis management program.  Journalists often confuse terms such as defaulted loans, non-performing loans, rescheduling, restructuring, charge-offs, write-offs, and other concepts which have precise and different meanings in the context of banking regulation and supervision.  They may write headlines alleging that the RAs are allowing deadbeat borrowers to go scot-free.  In some parts of the world, they may have become unused to reporting about bank failures or even display a lack of understanding of what it means if a bank is “failing or likely to fail.”  They may question why insolvent banks are allowed to remain open.  All of this confusion of course, can be amplified on social media and produce a situation of general panic.

The same tools of effective communication will have to be used if and when RAs allow reductions in capital and liquidity buffers, such as the countercyclical capital buffer and the high-quality liquid assets required by the Liquidity Coverage Ratio, as some have already done.  Policymakers and the general public must be convinced that these buffers were created with the expectation that they will be used in a stressed environment, and RAs are not asleep at the wheel by allowing thee buffers to be drawn down. 

Going back to first principles:  how to deal with the technical insolvency of the entire banking system in the aggregate

It’s instructive to look at the worst-case situation and measures to handle it, then work back to the factors that may lead to such a situation.  With economies essentially stopped or frozen, RAs may contemplate a banking system that in the aggregate is insolvent (assets less than liabilities) quite possibly in a market-value sense, and even in a book-value sense.  (As RAs seldom make decisions based on the market value of institutions, this brief will assume insolvency is on a book-value basis.)

Banks, individually and in the aggregate, can continue to operate for months, or even years, in a situation of negative capital, though this condition is hardly desirable.[ii]  Some of the decisions RAs will have to make over the next few weeks and months will be:

• Do we close banks with negative capital, or, even more severely, close banks when capital is still positive but below regulatory minima?
• Do we adjust accounting and/or reporting rules to make insolvent banks appear solvent?
• What kind of disclosures are required?
• Should we recapitalize insolvent banks with public money?

One possibility is for RAs to be completely transparent about the situation of industry insolvency, communicating to policymakers and the general public that this is the condition facing the entire industry, and the health of the banks in the aggregate is a concern that the RAs are monitoring closely.  It is instructive that this was not the approach taken in the early 1980s in the United States, when the entire savings and loan (savings bank) industry was insolvent, and accounting rules and regulatory capital reporting were jiggled to make the industry appear solvent.

The move was not transparent, but it was transparently political to anyone paying attention; few astute industry observers were fooled.  CEOs of these intrinsically-insolvent institutions also responded to these acts of grace by taking on even more risk, so that several years later, when the accounting and reporting rules were changed again in the direction of greater (though not perfect) reality, the “hole to fill” was much bigger than it would have been if the regulators had been transparent from the very beginning.

An argument can also be made for keeping a large number of intrinsically-insolvent banks open to serve community needs during the crisis and obviate additional complex decisions on which of them, and which parts of them, provide “critical services” to the real economy.  To that extent, and with some adjustments (described below), an entire insolvent banking sector can be kept open and functioning almost as a public utility.

Of course, in many jurisdictions there are laws and regulations requiring RAs to intervene when a bank’s capital falls below a certain level.  Situations described by terms such as “failing or likely to fail,” “point of non-viability,” “critically-undercapitalized,” etc., have mandated supervisory action such as beginning resolution procedures, revoking the banking license, placing the bank in conservatorship or receivership, or even liquidating the bank.  As part of crisis preparedness, RAs may elect to approach lawmakers, or may change their own regulations autonomously, for authority to waive these mandated actions in order to keep troubled banks functioning without any kind of disruptive intervention.

Recapitalizations of individual banks with public money may also be an option.  As mentioned above, a financial crisis more often than not spreads to the real economy, causing a decline in the level of economic activity.  Therefore, one goal of financial crisis preparation and management is to keep banks adequately capitalized and thereby able to continue lending to the real economy.  From both an asset-liability management perspective and a liquidity perspective, recapitalizing banks may help replace interest-bearing liabilities (some of which may have run off) with an interest-free (though not necessarily cost-free) source of funds, perhaps boosting bank profitability while keeping the size of the balance sheet constant and avoiding painful deleveraging.[iii]

Meeting the liquidity needs of banks

Much has already been written in the national and international media about various measures adopted by central banks, such as easing requirements for discount window borrowing and long-term refinancing, to sustain the liquidity of commercial banks, which will not be covered in this brief except to remind readers that an insolvent bank can remain open for a long period of time, while an illiquid bank must be closed (or resolved) immediately.  Central banks may also elect to support entire markets for certain classes of securities, such as commercial paper or the activities of broker/dealers, to keep the liquidity of the system flowing, a practice known as “eligibility easing.”

In the broader markets, central banks should be alert to reports of unusual activity by banks to sell these certain classes of securities.  Fire-sales of assets to meet immediate liquidity demands can push a bank or banks from an illiquidity position to an insolvency position, and may cause the markets for these certain classes of securities to freeze up completely.

However, in crisis preparedness steps, RAs and banks must also remember that there are two, not one, main sources of liquidity disturbance that tend to erupt at the onset of a financial crisis:  panic withdrawals of deposits and drawdowns by customers of available credit under lines of credit.  RAs may elect to encourage banks to “know their customers,” that is, review their credit lines and their sources of deposits and try to anticipate the drawdown and withdrawal responses of the most stressed enterprises and households.  Some of these enterprises and households may be calmed by communications from the banks that their needs will be met.  Deposit insurers, in particular, have a special responsibility to calm the public and gently discourage depositors from withdrawing more than the necessary amounts of funds from their accounts.

Deposit insurers, supported by government policymakers, may also elect to raise the covered amount, as was practiced by several deposit insurers at the onset of the GFC.  RAs may also choose to pause any discussions that may have been started over “bailing in” uncovered depositors.  It may also be necessary for deposit insurers to commit (with fiscal backing, if required) to immediate depositor payout from accounts at a closed bank if immediate payout is not yet a long-standing practice in that jurisdiction.  All of these measures may help to avoid a rush to cash out of accounts or stop a rush that is already in progress.

Temporary and tailored modifications to insolvency regimes to obviate closing banks and throwing borrowers into bankruptcy

In many jurisdictions, failed banks are handled by collective insolvency proceedings which entail the partial or total divestment of a debtor (the failed bank) and the appointment of a liquidator or an administrator normally applicable to banks under national law and either specific to those institutions or generally applicable to any natural or legal person.  Some jurisdictions have special provisions for banks, whether they are systemic or not.  Sometimes they are self-contained and bank-specific (like in the United States).  That approach is preferable, in that it keeps failed banks as much as possible out of the court system, where resolution may drag on for months or even years.  Other jurisdictions use the ordinary bankruptcy or company law but with special provisions for banks, which leads to confusion in many instances.

Whichever approach is used – and there may not be time or political appetite for emergency changes to insolvency regimes – RAs may try to speed up the handling of failed banks during the COVID-19 crisis by adopting some of these modifications:

• Suspending the duty by bank directors to file for bankruptcy in those jurisdictions where corporate directors are subject to this duty.  This duty seems irrelevant, and possibly could provoke alarm, if RAs have an explicit policy of allowing insolvent banks to keep operating.
• Suspending the duty, if it exists in a jurisdiction, to recapitalize or liquidate companies.
• Suspension of creditors’ rights to file an involuntary bankruptcy petition against a bank.
• Prohibiting critical third-party vendors of a bank from terminating contracts with the bank due to missed payments, when COVID-19 is the reason.
• Relaxing liability of directors and officers of banks hovering in the zone of insolvency due to COVID-19, to enable them to implement recovery plans (if they have them) without distraction or interruption.

It should be clear that in the wider commercial environment these measures may be applied to bank borrowers, as well as to the banks themselves.  If enterprises that are viable but for COVID-19 interruptions are not automatically thrown into bankruptcy proceedings, the banks that have lent to them can pursue loan workout strategies with the existing management structure and asset mix, possibly speeding their recovery when economic activity begins to resume.

The impact of borrower distress, loan rescheduling and restructuring, repayment moratoria, and accounting and reporting practices on bank profitability and capital adequacy

Many jurisdictions around the world have encouraged or required their banks to reschedule loans for all or certain classes of borrowers who will find it difficult or impossible to make scheduled principal and interest payments, as a result of a generalized economic shutdown due to COVID-19.  (Rescheduling is to be carefully distinguished from restructuring.  The former refers to stretching out the timeline of required payments of principal and/or interest on a loan; the latter refers to actually reducing those payments, through waiving part of the principal and/or reducing the interest rate.  Sometimes a loan modification combines both rescheduling and restructuring.)

In both rescheduling and restructuring, the intent of the bank should be that the borrower will be able to meet the revised schedule of principal and interest payments.  For loan classification and regulatory provisioning purposes, under a pre-IFRS 9 or transition period regime, the loans could be upgraded to “performing” or “standard” status, once the borrower emerges from any “grace period” embedded in the new contract and actually begins to make payments according to the revised schedule.

Things get complicated when the transition to IFRS 9 and COVID-19 reschedulings and restructurings are occurring simultaneously.  Most jurisdictions that have implemented loan repayment moratoria in response to COVID-19 have done so on a blanket basis (or at least targeting certain industries that are likely to be most affected), not individual borrowers.  Moratoria have also been combined with governmental guarantees, particularly for loans to small- and medium-sized enterprises (SMEs).  In general, RAs have taken a lenient attitude toward accounting and reporting for these loans, not requiring them to be considered “non-performing” and not requiring, from an IFRS 9 perspective, to be treated as having experienced “a significant increase in credit risk,” which would otherwise have necessitated a move to “Stage 2” and an increase in required loan-loss allowances.

The philosophy behind this relatively lenient attitude, especially with regard to the blanket moratoria, is that IFRS 9 could envision a “long-long” term approach to firm viability, so that the current dire situation is viewed (from a discounted net cash flow basis) as just a “blip” in a long chain of expected payments.  Especially when combined with government guarantees, loans whose required repayment is stretched out over a 10-year (or longer) period in a near-zero interest-rate environment would hardly even require more loan-loss allowances.

Restructurings, on the other hand, pose a different set of challenges.  When principal and/or interest payments are actually reduced, and not just stretched out over longer time periods, discounted cash flows can decrease substantially even with ultra-low interest rates.  In that situation, RAs may elect to apply existing accounting and reporting rules with less or no leniency.

As time goes on, with COVID-19 looking like a long-lasting, devastating hit to the level of economic activity, some RAs may begin to advocate delaying the implementation of IFRS 9 (or other expected credit loss regimes).  In the United States, for example, the Chair of the Federal Deposit Insurance Corporation (FDIC, which is a banking supervision agency, resolution agency, and deposit insurance fund all at the same time) wrote to the Financial Accounting Standards Board (FASB, the standard-setter for the accounting regime used in the United States) asking for a delay in implementing the Current Expected Credit Loss (CECL) regime, a stricter and simpler variant of IFRS 9, for banks currently subject to the transition.  Her reasoning was so that banks could then “better focus on supporting lending to creditworthy households and businesses.”[iv]

There is no doubt that IFRS 9 and CECL are more complex than earlier rules for determining loan-loss allowances, and there may be some merit in the argument that banks, many of whom may soon be operating with diminished staff numbers, should focus on the provision of basic services and not on implementation of complex accounting rules.  However, RAs should exercise extreme caution in advocating for a delayed transition on the grounds that it would make (reported) capital and (reported) profitability look worse (to be fair, the FDIC Chair was not making that argument), or that a delayed transition would result in more loans being originated than under the current transition.

There is a long-standing dispute in banking and bank supervision and regulation over the idea that a strict regime of loan-loss provisioning leads to less lending, and a more relaxed regime leads to more lending.  The idea has a certain plausibility, but cracks in the wall of certainty appear as soon as one considers that no loan-loss provisioning regime can alter the occurrence or the magnitude of credit losses, only the timing of these losses’ recognition.  Loss recognition can be upfronted, or it can be pushed forward in time; but the magnitude of the loss results only from the ability and willingness of the borrower to repay the loan on time and in full.  Most loan officers will say that the provisioning regime in force has no impact on their decision to approve a loan or not, only the contours of the bank’s overall credit policy and his/her assessment of borrower ability and willingness.

Another argument against delaying the transition to IFRS 9 or CECL is that “temporary” measures to address reported (though not intrinsic) bank capital and profitability have a way of becoming permanent, long after the crisis conditions have abated.  The combined efforts of international standard-setting bodies and RAs throughout the world to introduce tougher requirements to bolster the resiliency of banks and lessen the probability of another financial crisis have already required enormous adjustment, much of it successful, on the part of the banks.  It would be a shame if the banks used the tragedies of the current crisis to successfully advocate for a permanent relaxation of capital, liquidity, accounting, reporting, or disclosure requirements.

Conclusion:  Prepare, be transparent, and seek legislative authorization for extraordinary measures

RAs around the world are in an extremely difficult position.  They are going to be required to make rapid-fire decisions, spurred on by capital and liquidity stress conditions at banks and other financial institutions, in an environment in which senior officers and staff – at both the RAs and their regulated institutions – may be absent or incapacitated.  That frightful situation brings into even sharper view the necessity for RAs to prepare for crises, and get their crisis management tools ready and sharpened, for rapid deployment.

In the long run, the legitimacy of RAs will depend on how, and how well, they used their delegated authorities from their constitutionally-enacted legislative frameworks.  Extraordinary measures, such as allowing banks to remain open with negative capital, should have legislative authorization, so that post-crisis inquiry commissions (What did the RAs know?  When did they know it?  Did they take appropriate and timely action, given their authority?) do not result in constraints on these RAs’ future abilities to respond to crises nimbly and effectively.

And finally, transparency does matter.  Policymakers and the general public have the right to know the true condition of individual banks and the banking sector as a whole.  Perverse as it may sound, one of the benefits of the waves of financial crises that have washed over the world in the last 50 years is that the public may be less sensitive to negative news coming out of the financial sector, and more accepting of the reassurances given by RAs and governments.  But they will not be fooled by accounting and reporting manipulation that has fooled them too often in the past.

References

[i] This brief is intended to lay out issues and options for regulatory authorities.  It is not intended to provide technical advice or advocate for the adoption of laws, regulations, and policies.  The phrase “may” is to be construed in the subjunctive sense and not the permissive sense.  The situations described are hypothetical and should not be construed as predictions. 

[ii] Drawbacks of leaving an insolvent bank open are well-known:  first, the incentive for bank directors and officers to take on much higher credit, market, and liquidity risk in order to “win the bet” and return to solvency; second, the difficulties faced by an insolvent bank in staying profitable with far fewer interest-earning assets than interest-bearing liabilities, perhaps increasing the “size of the hole” to fill; third, the possible loss of confidence of bank depositors and other creditors as the insolvency drags on; and others. 

[iii] An encouraging example of bank recapitalization came from the United States, where at the height of the GFC the Treasury bought shares in 707 banks between March and December 2009, spending $205 billion.  Eventually, as the markets recovered, the vast majority of those shares were repurchased by the banks, returning over $220 billion to the Treasury.  The program, called the “Capital Purchase Program,” was not a complete success:  32 banks that had received capital injections still failed. 

[iv] Letter from Jelena McWilliams, FDIC Chair, to Shayne Kuhaneck, Acting Technical Director, FASB, “Request for Delay in Transitions to and Exclusions from Certain Accounting Rules,” 19 March 2020. 

This blog post is Part B, and is divided into two main sections: (1) the intensification of regulatory, supervisory and resolution activity the authorities can expect, while at the same time running on reduced manpower; and (2) thoughts on a new crisis management framework to put in place when the current crisis has passed and economies start to recover.

Intensified regulatory, supervisory and resolution activity: challenges of “scaling down”

During the period when COVID-19 is spreading rapidly, regulatory authorities will have to perform a kind of heroic double-duty: the authorities themselves may need to implement BCM while, at the same time, keeping an eye on the regulated FIs’ implementation of their own BCM programs (if they have them at all). Beyond that, the authorities have to keep an eye on the spillover effects from the real economy on their regulated FIs and consider running screens to determine which of them are the most exposed to the most affected sectors, such as autos, logistics, energy, transport, tourism and retail. Keeping an eye on the financial industry while the authorities’ own functions are constrained, due to a lack of manpower, will be a big challenge – intensifying the need for risk-based supervision. There has never been a greater need, and a more important role, for off-site supervision than there is today.

One of the first pillars of most BCM programs is “scaling down” activities. But in the event that the economic fallout from COVID-19 spills over into generalised weaknesses in the financial sector, then central banks and other regulatory authorities will have to make many quick decisions on many fronts. This is the opposite of “scaling down.” The regulators may have to meet for long hours, some working from remote locations, to put into effect contingency plans to shore up banks’ capital, cash supply and liquidity. Some key staff may not even be available remotely, while undergoing treatment.

Some of the urgent measures that either could or are already being taken to shore up financial stability, apart from monetary policy decisions which are not the subject of this blog post, could be: (1) for central banks, the creation of additional lines of credit or reducing collateral requirements and/or expanding the range of acceptable collateral on existing lines of credit to support specific markets (such as the broker-dealer market), certain industries or certain classes of firms such as SMEs (these measures are often collectively referred to as “eligibility easing); (2) also for central banks, the outright purchase from FIs of securities, the liquidity of whose markets has dried up; and (3) for finance ministries (but in consultation with the regulatory authorities), the purchase of shares newly issued by FIs to bolster their capital bases.

That last intervention, it should be noted, was practiced on a very wide scale in the United States at the height of the Great Financial Crisis. Policymakers realised that it was necessary to keep banks lending, which would be practically impossible in an environment where capital positions were very thin or non-existent. Over 700 banks issued shares that were bought by the US Treasury, which gradually sold the shares back to the banks when the markets and the overall economy recovered. A decade later, this intervention is still recognised as the single most effective measure taken anywhere in the world to prevent a generalized financial sector collapse.

Implementing all of these measures is very labour-intensive, at a time when senior management and staff of the regulatory authorities may be working remotely or not working at all. Regulators may also have to meet with directors and officers of FIs to discuss and agree on urgent measures. These meetings may also have to be held remotely, which is difficult in the best of times.

One subject that is attracting increasing attention is regulatory relief. Pressures on the authorities for regulatory relief, which are present even in more normal times, will intensify the longer the virus looms as a threat, requiring long and possibly contentious meetings with elected officials in many countries. Regulatory relief could take the form of allowing FIs to allow their Pillar 2 or systemic capital buffers to be drawn down, relaxing provisioning requirements on assets exposed to heightened credit risk or delaying by months or years the full implementation of Expected Credit Loss (ECL) methods of determining loan-loss allowances, encouraging or even requiring FIs to reschedule or restructure loans without immediately recognizing losses, delaying the implementation of the Net Stable Funding Ratio (NSFR, a key mandate of Basel III), and other measures that in normal times would be criticised as “forbearance.”

In fact, regulatory and borrower relief have already been implemented in Italy, Europe’s hardest-hit country. For example, Italy has declared a moratorium on mortgage payments, with the state ultimately guaranteeing these payments. How are these programs going to be implemented by understaffed regulators, and how are their impacts on financial institutions going to be assessed? What happens if shortages of staff at banks result in reduction in the supply of critical data? Many banks are now in the process of preparing their annual financial statements for 2019. Although these statements won’t reflect the effect of COVID-19 on their operations, the reports and the auditors’ opinion on these reports may be delayed for weeks, or even months, along with delays in the transmission of more current data.

Conclusion: A look into the future

If a serious global financial crisis is precipitated by the COVID-19 pandemic, and large-scale measures are taken to reduce the intensity and impact of the crisis, there will inevitably be second-guessing and cries that the regulatory authorities favoured this or that group, didn’t act quickly enough, exceeded their legislative authority or made other crucial errors. As difficult as it may be during a crisis in which many senior officials may be absent, it is essential to document the discussions and rationale for the decisions taken. Without this documentation, regulatory authorities will face crises of legitimacy long after the actual financial crisis has been abated.

In the new post-crisis world, stress testing and contingency planning will rise even further on the list of essential activities by both regulatory authorities and FIs to maintain financial stability. Pandemics will have to be added to the list of risk factors that today are mostly macrofinancial in nature. Stress tests that envision the widespread unavailability of electricity or telecommunications may have to be added to the analytical mix, as well as the failure of a major financial market infrastructure or major FI whose connectedness to the entire financial system poses a risk to every other FI.

The coronavirus (COVID-19) outbreak could cause global foreign direct investment (FDI) to shrink by 5%-15%, according to an UNCTAD report published on 8 March. The UN trade body had earlier projected a stable level of global FDI inflows in 2020-2021 with a potential increase of 5%. Now it warns that flows may hit their lowest levels since the 2008-2009 financial crisis, should the epidemic continue throughout the year. COVID-19’s negative impact on investment will be felt the strongest in the automotive, airlines and energy industries, the report says.

According to the Center for Strategic and International Studies (CSIS), at the sectoral level, tourism and travel-related industries will be among the hardest hit as authorities encourage “social distancing” and consumers stay indoors. The International Air Transport Association warns that COVID-19 could cost global air carriers between $63 billion and $113 billion in revenue in 2020, and the international film market could lose over $5 billion in lower box office sales. Similarly, shares of major hotel companies have plummeted in the last few weeks, and entertainment giants like Disney expect a significant blow to revenues. Restaurants, sporting events and other services will also face significant disruption. Industries less reliant on high social interaction, such as agriculture, will be comparatively less vulnerable but will still face challenges as demand wavers.

Since our blog post on 5 March 2020, we noted that central banks, governments and international agencies such as the International Monetary Fund (IMF) have taken a much more decisive and coordinated approach in their efforts to mitigate the impact of COVID-19 on the global economy. In response to this crisis, governments and central banks all over the world have enacted fiscal and monetary stimulus measures to counteract the disruption caused by the coronavirus. The IMF announced $50 billion of support for countries hit by the coronavirus. Since this announcement, Iran said it has asked the IMF for $5 billion of emergency funding to help it fight the social and economic impact of coronavirus.

The US announced another significant rate cut and are discussing an economic stimulus package. A number of other central banks such as the Bank of England and the Reserve Bank of Australia also cut interest rates. In addition, the Bank of Canada, the Bank of England, the Bank of Japan, the European Central Bank (ECB), the Federal Reserve and the Swiss National Bank are today announcing a coordinated action to enhance the provision of liquidity via the standing US dollar liquidity swap line arrangements. The ECB also announced a range of operational measures that it is taking as a precaution to protect its staff from risks associated with the spread of COVID-19.

Despite central bank and government actions, there has been a dislocation in financial markets and a crash in oil prices. Stock markets suffered significant declines as the threat of a coronavirus-fuelled oil war and ongoing panic about the spreading disease grew and triggered a rare automatic halt to trading early in the session. Russia’s refusal to meet OPEC’s push for production cuts unleashed a 10% fall in the price of crude oil and threatens to revive an energy war as the coronavirus’ global spread inflicts mounting damage on commodity and equity markets. Italian government bonds suffered their biggest one-day fall inalmost a decade after the ECB’s president, Ms. Christine Lagarde, said it was not the role of the ECB to “close the spread” in sovereign debt markets — referring to the spread between Italian and German bond yields that is a key risk indicator for Italy.

A question being asked is whether the IMF should inject liquidity through special drawing rights (SDRs) to alleviate the impact in most emerging and low-income countries, given that they are in a much weaker position compared with the global financial crisis of 2008-09. The fiscal space has all but disappeared. In 2007, 40 emerging market and middle-income countries had a combined central government fiscal surplus equal to 0.3% of gross domestic product (GDP), according to the IMF. Last year, they posted a fiscal deficit of 4.9% of GDP. The deterioration is not new — they have been posting deficits of this magnitude since 2015. The deficit of EMs in Asia went from 0.7% of GDP in 2007 to 5.8% in 2019; in Latin America, it rose from 1.2% of GDP to 4.9%; and European EMs went from a surplus of 1.9% of GDP to a deficit of 1%. Only in the Middle East has the situation barely changed, but countries there had large deficits in both periods, hardly a source of relief.

Consequently, the ability of EMs to implement countercyclical fiscal policies will be limited this time around. Their capacity for expansionary monetary policies is also significantly more constrained. For once, policy interest rates are already quite low in many EMs and their currencies are weakening fast against the US dollar. On top of this, the level of EM corporate hard currency debt is significantly higher now than in 2008. According to the IMF’s October 2019 Financial Stability Report, the median external debt of emerging market and middle-income countries increased from 100% of GDP in 2008 to 160% of GDP in 2019.

COVID-19 has already taken lives and caused suffering in many countries around the world. The human tragedy should always be first in our minds as financial sector regulators, as we discuss ways to maintain financial stability, of which business continuity management (BCM) of central banks, stand-alone financial sector regulatory authorities, deposit insurance agencies (collectively, regulatory authorities), and financial institutions (FIs) themselves plays a central role.

The threat of the virus has put everyone on alert as governments, regulatory agencies and health professionals provide guidance and possible restrictions on movement and gatherings to prevent the spread of the virus. Central banks and policymakers have also taken sizable and coordinated monetary policy and economic measures to mitigate the impact of COVID-19 on the global economy.

Regulatory authorities globally continue to monitor and assess the impact COVID-19 will have on FIs. Recently, it was reported that US financial regulators were preparing contingency arrangements, including travel restrictions and home-working, to ensure they can effectively oversee the financial markets as the virus closes in on the US capital. Many have instituted rules and regulations as well as relevant guidance to assist FIs in implementing or augmenting their BCM programs to minimise the potential adverse effects of a pandemic, including COVID-19.

This blog post consists of three (3) main sections and is published in two (2) parts: Part A and Part B. Part A is the first section, and presents a discussion of the steps regulatory authorities can take to implement their own BCM programs, and what they can expect from their regulated FIs, during the current pandemic. Part B consist of two (2) main sections: (1) the intensification of regulatory, supervisory and resolution activity the authorities can expect, while at the same time running on reduced manpower; and (2) thoughts on a new crisis management framework to put in place when the current crisis has passed and economies start to recover.

Business continuity management during a pandemic: a new twist on a very old practice

If there is one important, critical function of the regulatory authorities in the face of widespread possible disruption in financial services, it must be to maintain the confidence of individuals, households, businesses and investors in the financial system. If suppliers of funds to FIs lose confidence, massive asset sales and deposit withdrawals could result, a kind of forced deleveraging that would require extremely large injections of liquidity by central banks to revive moribund financial markets and preserve the smooth functioning of payment systems, without which declines in the level of economic activity will be exacerbated.

Maintaining confidence, of course, requires also that deposit insurance agencies set up programs to immediately pay out depositors of failed FIs. In an acute, long-lasting crisis, the desired currency-to-deposit ratio might rise sharply as households and firms hoard cash, necessitating a rapid upscaling of banknote printing and distribution.

It’s a good thing that many of the critical banking functions have been automated over the last few decades, requiring less human involvement. But human involvement is still necessary to screen and flag reports, turn equipment on and off, maintain equipment, control access to key infrastructure and so forth. FI staff or third-party vendor staff will still be necessary to keep ATMs functioning, for example.

As a possible downside of increased automation, requiring intensified vigilance by FI senior management and staff (and not only in the server room), cyber criminals and fraudsters may take advantage of a chaotic situation at one or more FIs to strike, believing that management is distracted by issues related to the virus. The current stressful period is no time to scrimp on resources devoted to ITC risk management, of which cyber risk management is an integral part. Beyond pure cyber risk, FIs may face power outages and interruptions to telephone and internet service if unavailability of manpower begins to affect key utility providers.

Post-2008 financial regulatory reforms emphasised the importance of FIs and identified critical business functions and operations in their crisis management, resolution and recovery planning. A strategic analysis of the firm’s essential and systemically important functions is necessary for resolution planning and for assessing resolvability. It should help ensure that the resolution strategy and operational plan include appropriate actions that help maintain continuity of these functions while avoiding unnecessary destruction of value and minimising, where possible, the costs of resolution to home and host authorities and losses to creditors.

Given the particular features of a pandemic, however, including a potentially longer duration than envisioned in many traditional crisis management scenarios, the critical business functions identified in the traditional BCM program may not always provide sufficient guidance for conducting operations in a pandemic scenario. Explicit identification of the highest priority critical business functions and operations will help to ensure they receive appropriate resources. These functions and operations could be defined as activities which, if not performed or maintained for more than a very short period, would cause the FI to be in default on its obligations or otherwise threaten its financial soundness.

For example, FIs may consider it appropriate to focus on servicing existing customers and completing transactions already in progress, and closing or minimising risk positions. They may choose to defer or suspend activities such as new business development, opening new accounts, undertaking special or new projects or any internal non-essential systems changes within the organisation. These activities may be progressively scaled back based on the phase of the pandemic or available resources.

The most commonly cited critical business functions of regulated FIs, which would also be consistent with governmental priorities for public confidence, generally include (but are not limited to):
• Core risk management functions — particularly market, operational, credit and liquidity risk monitoring;
• General ledger/finance capabilities to allow monitoring of the overall financial (including capital) position of the FI;
• Call centres handling customer transactions and enquiries (excluding, for example, outbound or sales calls); and
• Data centres, recovery sites and critical third-party suppliers supporting critical functions.
• Cash supply and currency distribution, including operation of automated teller machines (ATMs);
• Retail payments and banking systems that provide existing customers with access to funds, including EFTPOS, bill payments, credit cards, telephone banking and Internet banking;
• Automated direct entry payment processing for existing customers, including government payments and payroll processing for corporate customers, as well as payments to suppliers and staff;
• Credit functions, in particular those processing functions necessary for managing retail, corporate and institutional access to credit, particularly for pandemic-affected borrowers;
• For larger FIs, wholesale payments clearing and settlement activities, including interbank settlements, securities settlements and custody, particularly where these functions are provided to other FIs; and
• Limited trading functions for FIs active in markets operated by exchanges as well as over-the-counter — in particular, those functions necessary for completing transactions for existing customers and managing liquidity of the FI.

It should be noted that FIs are already taking action. In light of these acute challenges, FIs in the United Kingdom and United States are sending hundreds of staff to their UK and US disaster recovery sites, installing big screens in traders’ homes and pushing regulators for a reprieve on trading rules so they can keep their businesses running through a COVID-19 outbreak.

The efforts by big global banks including Goldman Sachs, JPMorgan Chase, Morgan Stanley and Barclays are an escalation of BCM program implementation that has already prompted them to segregate staff in Asian cities at the initial epicentre of the COVID-19 outbreak.

Of course, the real difficulty with the current situation is that even working from remote sites will not be possible as they too are open to becoming contaminated. So, the clearest way forward will be to allow all critical staff to be able to work from home remotely. In fact, these moves are being forced upon many banks, including central banks, given the lockdowns being implemented in various countries across Asia (such as the Philippines and Malaysia). The recent moves to cloud technology can help, as we note that even whilst in the office, many staff are logging onto remote servers containing all their files and data. The move to work from home for extended periods should therefore be something that is quite easily achievable.

Even once this is all in place, the real challenge will come when some of the more senior members of staff contract COVID-19. The virus does not discriminate, and we have already seen a number of celebrities and politicians contract it. So how will the market cope if/when a central bank governor, a bank CEO or the Prime Minister or President of a country, or their senior staff, start to contract the virus? Central banks, regulators, governments, and private organisations should also have a clear back-up plan for their chain of command so that they can reassure the markets that there are other experienced staff available to continue running the show and prevent further panic and instability, should the worst occur to their leadership teams.

In the past week or so, Covid-19 has become more threatening outside China as the virus is now rapidly spreading in countries such as Italy, South Korea, the US and Iran, just to name a few. Concurrently, in recent days, attention has turned to the likely damage to global output and to the possible reaction of macroeconomic policymakers.

Covid-19 is hitting the global economy when growth is soft, and inflation is relatively subdued, but many countries are grossly overleveraged. In case of the euro-area, for example, Covid-19 is hitting at a time when interest rates are already at a record low level of minus 0.5 per cent. Below we provide a chronicle of central banks and policymakers’ responses to Covid-19.

It appears the heightened attention that is being given to the likely impact of the virus on the global economy was kickstarted by a blog post by the International Monetary Fund’s (IMF’s) Managing Director, Kristalina Georgieva, on 19 February 2020 that was published on the IMF’s website. She noted that the new coronavirus, or COVID-19, outbreak was the “most pressing uncertainty” facing the world economy right now. She also highlighted that the international health emergency that “we did not anticipate in January” now threatened to derail global economic growth that was already under pressure from a global trade war and Brexit.

a few days later, speaking at the G20 summit in Saudi Arabia, the International Monetary Fund’s managing director also warned that the coronavirus had disrupted economic activity across the globe and called on countries to prepare for a weaker global growth outlook in the face of the virus. She noted her concerns that a quick recovery from the incident was not guaranteed. Even in the case of rapid containment of the virus, growth in China and the rest of the world would be impacted. She highlighted that we all hoped for a V-shaped rapid recovery but given the uncertainty, it would be prudent to prepare for more adverse scenarios.

In our chronicling of central banks and policymakers’ responses to Covid-19 we noted that in the very early days (late January/early February) of the spread of the virus, Bank Indonesia, the People’s Bank of China and the Bank of Thailand were amongst the first central banks to verbalise policies and intervention actions to mitigate risks to their economies. At that time the spread of the virus was largely concentrated in China, the epicentre of the virus.

We also noted that since Friday, 28 February 2020, the official responses of macro policymakers in the advanced economies (AEs) have shifted from a seemingly nonchalant approach to a more aggressive and coordinated one. Since then, a number of central banks have cut interest rates including the US Federal Reserve, the Reserve Bank of Australia, the Bank of Canada and Bank Negara Malaysia.

We note the that while central banks around the world are easing monetary policy and governments are offering fiscal stimulus to limit the impact on economic activities, Covid-19 is not a conventional economic threat. As noted by Kenneth Rogoff, unlike the two previous global recessions this century, the new coronavirus, Covid-19, implies a supply shock as well as a demand shock. Supply shocks are slightly more challenging to manage by central bankers and policymakers than anxiety-induced frugality among consumers, firms and investors. On the one hand, when people stop spending, growth slows and inflation falls. On the other hand, when supply is constrained, as in the case of Covid-19, shutting down factories and disrupting global supply chains, prices can accelerate concurrently with rising unemployment.

Based on our chronicling of central banks and policymakers’ responses, we believe that the fiscal and economic stimulus that we have seen to buttress health systems and affected economic sectors such as travel, tourism and manufacturing are warranted. With global inflation relatively subdued, fiscal and economic stimulus can be pursued without exacerbating an ongoing inflation problem. Massive public sector spending, however, might be challenging for governments that have not saved for a rainy day or those that are already running massive deficits. On the monetary policy side, some central bank may be constrained by the fact that they lack room for monetary policy. This is particularly concerning for countries that are already at very low or even negative interest rates. In those cases, there may be concerns about the side-effects of negative interest rates and a fear that cutting them further may do little to address the impact of Covid-19 on the economy.

Why is this important? Well, it has now been over 10 years since the Great Financial Crisis, the direct cost of which ran into the hundreds of billions. In the US alone it is estimated that it cost US$498 billion on a fair value basis, which was 3.5% of the US’s GDP in 2009. In the UK, a package amounting to £500 billion (which at that time was equivalent to c.US$850 billion) had to be put into place to rescue the banks. The indirect costs resulting from the ensuing lost output and lower investment run significantly higher, with the San Francisco Federal Reserve estimating this cost to be US$22.9 trillion in just the US alone!

It is not surprising therefore that a lot of regulatory focus has gone into ensuring that such widespread contagion is avoided and the taxpayer is not left on the hook again the next time a crisis occurs. One of the key issues the financial crisis highlighted was the ability for banks to arbitrage the internal risk models they developed under the Basel II framework to play down the riskiness of assets they held, and in turn reduce the amount of capital they were required to hold to guard against those assets souring. The reforms following the crisis included the new Basel III regulations. These set out to overcome the weaknesses of Basel II by enhancing the robustness and risk sensitivity of standardised approaches, constrain the use of the internal rating based (IRB)-based methods in some cases, and require floors for probability of default (PD) and loss given default (LGD) calculations where they continue to be used. In addition to this, a new expected loss-based accounting provisioning standard, IFRS 9, has been introduced. This requires banks to take more timely provisions against weakening loans, at the initial sign of any significant increase in credit risk rather than waiting until a risk event crystalises, and to make forward looking estimates on the performance of their loan portfolio.

The idea of these reforms was to strengthen reserves of capital banks hold against unforeseen events, as well as to increase the amount of provisions held against poorly performing assets, in order to reduce pro-cyclicality in the financial system. There is no doubt that these aims are being achieved to a degree.

Lee, Wang and Zhong, however, point to the fact that academic evidence to date (and I would add, real-life evidence following the financial crisis) suggests that the Risk Weighted Assets (RWA) metrics derived under the Basel guidelines do not in fact capture the true riskiness of banks. They propose another method of measuring bank risk, starting from the fact that the majority of a risk a bank is exposed to comes from its loan portfolio. The authors posit that there are a couple of fundamental flaws in the current RWA framework. Firstly, RWA calculations fail to properly account for the volatility of default losses over time (or second moment) in a bank’s loan portfolio. Whilst the current regulations focus on the average default rates in each loan category, the authors highlight that portfolio theory states that the variation in these default rates also gives rise to a need for higher levels of capital. So, it is the variance of default rates for each asset class from quarter to quarter that is important rather than merely the average default rate. The second weakness concerns the fact that the RWA framework does not directly account for concentrations of holdings or default correlations across asset classes, and particularly property holdings, the default of which were the cause of recent, and historical, bank failures. So, unsurprisingly, even if a bank has a well-diversified portfolio of loans on its book, if they are correlated then they will all tend to default when there is a recession or banking crisis.

What they are pointing out will not be a total surprise to regulators, particularly the latter point. It is an accepted fact that the Basel Pillar 1 framework does not capture concentration or correlation risks. This is precisely why under Pillar 2, for risks not captured under Pillar 1, supervisors are asked to estimate the concentration and correlation risks in a bank’s portfolio under the Supervisory Review and Evaluation Process (SREP). Depending on how severe these are, a related capital add-on is required. Each central bank/regulatory authority will therefore have their own methodology for carrying out such an assessment, which will dictate the level of any capital add-on required. The problem is that if this system was working as it should be, then they would have been able to pick out the heavy concentrations and correlations banks had built up to the real estate market prior to the financial crisis.  Moreover, if the Pillar 2 concentration risk adjustment was adding on sufficient capital to those banks with the most concentrated/correlated portfolios, then the methodology used by the authors would not have been able to show itself to be a better predictor of bank failures than the Tier 1 Capital Ratio (T1CR) measure that is currently in practice. Part of the problem is that the concentration risk assessment is a manual process, dependent on having regulatory staff with the right expertise who can look across all portfolios across all banks. This is usually a difficult ask, and invariably it means differences in approaches between the largest and smallest banks, and across jurisdictions with different regulators. Moreover, once concentration risks are identified, it is a judgement call as to how much more capital is required, which is again problematic.

This is where the approach proposed by the authors could be really useful. They put forward a Loan Portfolio Risk (LPR) variable that measures the time-varying volatility in default risk for a portfolio of bank loans. They split each bank’s loan portfolio into 14 asset classes. The riskiness of the bank portfolio as a whole is then a function of its exposure to each asset category, as well as the variance and cross-correlation structure in the delinquency rates across the 14 asset classes. LPR can therefore be thought of as the expected dollar losses for the loan portfolio as a whole, from a one standard deviation move in historical default rates, taking into account all default cross-correlations. Banks whose loan portfolios are concentrated in asset categories with highly volatile delinquency rates will have higher LPR scores, and banks whose holdings are in asset classes with low delinquency rate volatility will have lower LPR scores. They then propose a new capital adequacy measure that compares a bank’s adjusted book equity to its loan portfolio risk (LPR), which they term the Equity-to Loan-Portfolio-Risk ratio, or ELPR. They find this measure to be incrementally important in predicting bank failure up to five years in advance, even after controlling for all the CAMELS variables that regulators may have examined.

So, does this work in practice? They gathered data from more than 500 bank failures that took place during 2003 to 2017, and saw that the T1CR was able to anticipate only about 17 per cent of the variation in bank failures that occurred from one year to the next. Their measure of loan portfolio risk predicted almost 25 per cent of the variation. Their measure outperformed the T1CR even more in predicting the likelihood of bank failures two, three, or five years in the future.

Lee, Wang and Zhong conclude that some banks may actually need two or three times as much capital as the T1CR suggests. A couple of the specific examples of the approach are useful to examine. Silver State Bank (SSB) was a Nevada commercial bank with 17 branches in Las Vegas and Phoenix. It was deemed insolvent on September 5, 2008. SSB’s T1CR was 9.67 per cent and it was marked as Well Capitalised. SSB’s CAMELS score also looked strong, partly as SSB was very profitable in both 2006 Q4 and 2007 Q4. But from December 2006 the ELPR indicator would have flagged SSB as severely undercapitalised (with a probability of failing by Dec 2008 of 14.47 per cent; much higher than the base measure of 2 per cent). Another example concerns Oklahoma-based FNBL, a small national bank that started in 1902. The bank survived the crisis and is operational today. FNBL’s T1CR at the end of 2006 was 5.32 per cent, placing it in the riskiest one percent, with a 22 per cent implied probability of failure by the end of 2008. In contrast, FNBL’s ELPR measure at the end of 2006 was 2.21, around the 50th percentile, implying only a slim probability of failure by 2008 of around 0.07 per cent.

There is clearly still more work to do on this, but using publicly available data, they have managed to demonstrate quite a promising metric that captures a low frequency form of failure risk. Unlike static risk weights, their ELPR measure captures intertemporal variations in default risk over business cycles, and as it is based on the long-run variance of delinquency rates rather than recent quarterly estimates, it should reduce procyclicality concerns associated with IRB model-based estimates. Their approach is also more transparent and objective than the current IRB models approach. Whilst the authors have gone as far as to nominate their LPR approach as a new prototype Capital Adequacy Ratio measure for the Basel Committee to consider, I think that at the very least regulators may consider using it as part of their Pillar 2 concentration risk review. The methodology could be uniformly applied to all banks in the system, and then provide an additional triangulation point for particular banks that may be at risk and whose current T1CR may therefore not capture the full extent of risk they are exposed to.

So what has Carney actually said? Speaking at the annual gathering of central bankers in Jackson Hole, Wyoming, last week, Carney pointed out that the dollar remains dominant in the global financial system, even though the emerging markets now play a much larger role. He points out that during the Latin American debt crisis, emerging markets only made up a third of global GDP. That has now grown to 60% and by 2030 is predicted to account for 75% of global GDP. Despite this, most international trade and lending is carried out in dollars. This leaves emerging economies vulnerable to volatile capital flows, foreign shocks and financial crises, caused by fluctuations in the exchange rate, changing dollar interest rates and consequently the availability of dollar liquidity. It also compromises their monetary sovereignty. In order to mitigate such risks, emerging market economies are forced to hold billions in dollar reserves, rather than being able to spend such funds on their own domestic priorities. This also further adds to the global savings glut the world is suffering from.

Carney therefore advocates a new international financial system to reflect the multi-polar global economy. He states that the most likely new reserve currency would be the renminbi, given that China is the world’s largest trading nation, having overtaken the US in 2010. The renminbi is also now more common than sterling in oil futures, despite having a zero share of the market before 2018. There is also greater use of it in international trade, which will no doubt be further helped by China’s Belt and Road initiative. However, a reserve system based on the renminbi would eventually lead to the same issues that we are currently experiencing with the dollar. Hence, Carney calls for multiple reserve currencies to take on the function, benefiting the global system through diversification and reduced spill over effects, and hence less need for countries to build up huge reserves. We should perhaps take a moment to warn of what happened to others who called for the end of the dollar hegemony (Muammar Gaddafi, Saddam Hussein and currently the wrath being faced by Iran, for instance). Carney, however, is not cowed and goes on to state that given the current state of technological developments, such a new reserve currency could be based on a virtual rather than a physical platform.

Most of us by now are already familiar with Libra, and regular readers may also recall my thoughts on it when it was announced a couple of months back. Carney again points to Libra as potentially offering the mechanism for such a virtual reserve currency system. Nevertheless, given the many ongoing questions around how Libra would operate, he concedes that it may be better for such a new “Synthetic Hegemonic Currency” to be provided by the public sector, notably through a network of central bank digital currencies. And who would be responsible for managing such a currency? I would think it would most likely be the IMF, given that it already has such a prototype currency in the form of the special drawing rights reserves it manages.

But wait a minute! Surely, we already have such a digital currency? And more to the point, this one is not vulnerable to the easily imposed controls that a digital currency could otherwise be subjected to from either governments or private corporations. Something that is decentralised and backed by a clear and unchanging set of rules – Bitcoin! In fact, given the increasing infringements on what were thought to be independent institutions globally, combined with what Carney is pointing to, Bitcoin may well start to enjoy a new wave of resurgence. One only needs to look at the current example in the U.K., where the unelected Prime Minister, Boris de Pfeffel Johnson, has now decided to suspend parliament (the so-called “prorogation of parliament”) to force through a no-deal Brexit. In any other country, this would have been called out for what it is – an attempted coup d’etat! I for one would certainly prefer a decentralised global currency to ones that are backed by increasingly undemocratic governments that fall victim to the whims and fancies of egotists, who have little concern for the well-being of the populace they govern. Let’s see what the rest of the world thinks.

Before we all rush out and buy Bitcoin though, perhaps we are missing the obvious? In times of such stress, when potentially the whole current monetary framework is due for a correction, whilst money is being freely printed and we are debating its very nature, historically there is one item people have always turned to – gold! Gold is already at a 6-year high, up almost 30% on where it was towards the end of last year. No doubt a large factor in this is the on-going US-China trade war, but the talk of de-dollarisation and the potential widening of the net of global reserve currencies is only going to push its value up further. And on this it seems the world is already reaching a consensus. So, whilst we calmly await the collapse of the dollar, my advice is to go out and add some gold to your portfolio!

The 19 speakers and panellists represented a wide range of prestigious institutions in the public, private and non-profit sector, including Columbia University (New York), the European Central Bank, the Financial Services Information Sharing and Analysis Center (FS-ISAC), the Bank for International Settlements, the Committee on Payments and Market Infrastructure, several SEACEN members, the United States Department of Justice, a bank active in Southeast Asia, three private companies using technology to improve financial services and an insurer active in cyber risk insurance. 

The sessions covered matters of pressing importance such as the link between cyber risk and financial stability; cybersecurity information-sharing among central banks, between regulators and their regulated banks and among banks; central bank oversight of cybersecurity preparedness at regulated banks and payment systems; how technology can be used to assess cultural patterns at a bank that may lead to misconduct, including insider threats; central bank leadership in addressing the qualifications and integrity of staff throughout the financial services industry; emerging cyber threats to the financial sector and cybercrime; FinTech and non-traditional financial services providers and their approach to cyber vulnerability; and the emerging world of cyber risk insurance. 

There were many key takeaways from the Summit, grouped around several key themes:

The two-way link between cyber risk and financial stability.  Cyber risk can threaten financial stability through several channels, particularly a lack of financial substitutability (the loss of a key provider or key service), a lack of IT substitutability (IT providers and infrastructure tend to be concentrated), a loss of customer confidence, a corruption of data integrity and through the interconnectedness of financial institutions.  But the direction can also go in reverse.  Financial fragility can increase the risk of a devastating cyber-attack.  Boards and senior management of weak or unstable financial institutions can take their attention off cybersecurity, leading to exploitation by malicious actors, who tend to lurk in the systems of banks and other financial institutions for a long time before striking.  And financial stability supervisors should require banks to conduct “reverse stress tests” – assume that a major credit risk, market risk, operational risk, liquidity risk, or reputation risk event has occurred, and then brainstorm to envision the types of cyber risk events that could have these effects. 

The bad and worsening shortage of information security experts to support financial institutions and their regulators.  The world as a whole faces a skills gap and a shortage of experts to cope with looming cyber threats, a shortage that is expected to worsen over time.  (One estimate is two million unfilled vacancies in cybersecurity.)  Talented young people earn higher salaries and seem to have more satisfying work environments in technology firms (especially FinTechs) than in financial institutions and their regulators.  Small banks, in particular, are especially hard-hit, because the necessary level of prevention and detection supplied by skilled staff is spread over a smaller revenue base.

Cyber threats originating largely from inside the bank.  Like firms in most industries, banks grapple with poor cyber hygiene – laziness and taking shortcuts – increasing vulnerability to attacks by malicious actors, whether inside or outside the bank.  A cultural shift is important, because employees take their behavioural cues more from their peers than their senior management, who may be setting the right tone – even sounding the alarm – but are being ignored.  Cybersecurity training of staff, especially those in the business units, is necessary but not sufficient, as new techniques, such as social engineering (on-line grooming a bank officer or staff member to ultimately reveal login credentials) and whaling (sending bogus, but plausible, emails to a high-ranking bank officer or director) , are emerging constantly that catch staff off-guard.  It may even be necessary to force staff to install necessary software updates or other forms of protection by cutting off their access if they do not comply.  Above all, the bank must identify and secure its core digital assets – data and documents – against corruption.  Even a system of backing up data can be corrupted if it is automatically backing up corrupted data. 

The double-edged sword of outsourcing and partnering.  As banks increasingly outsource key services, they need to step up their outsourcing risk management and ensure that third-party vendors have cyber risk management programs as good as, or better than, the banks themselves.  Financial technology (FinTech) companies will increasingly be partnering with banks, but some FinTechs, in spite of having access to the latest and most efficient cybersecurity technology, unburdened by legacy systems, may be concentrated first on survival and expansion, with cyber resilience a secondary objective.

The critical role of information sharing and cooperation in joint exercises.  Without a doubt, information sharing – of both threat intelligence and actual cyber events – is more important than ever.  Information sharing must be happening among financial sector regulatory authorities, between regulators and their regulated institutions and among financial institutions themselves.  There are many more channels than before; including some noteworthy ones such as the Operational Security Situational Awareness (OSSA) network of 33 central banks, mostly inside but some outside the European Union, managed by the European Central Bank; FS-ISAC for information sharing among financial institutions; and FS-ISAC’s Asia Office’s CERES Forum for information sharing among financial sector regulators.  Work is proceeding on joint cyber-attack simulation tests and common responses by banks to ransomware attacks.  One recommended exercise for banks and their regulators within a jurisdiction is to assume that the most important bank or financial market infrastructure in the economy is hit with a cyber-attack that corrupts its data or disables its key services, and determine how all the other players in the system should protect and react. 

Cyber risk insurance as a mode of transferring risk.  Participants and presenters alike in the Summit stressed that prevention of a cyber-attack is all but impossible, as banks and their regulators can only lower the risks, not eliminate them.  Detection is key, because most major cyber-attacks are “slow burn” – the intruder is lurking in the system for a long time, determining the right time to strike.  With all of these uncertainties present, and the difficulties of specifying metrics and setting a tolerance for risk, many banks are turning to the emerging market for cyber-risk insurance as a mode of transferring the risk.  This market is rapidly developing but is itself grappling with issues arising from a lack of information about the frequency and financial magnitude of cyber-risk events and the usual “moral hazard” problem of insured firms investing less in their own protection.  Here, financial sector regulatory authorities or self-regulatory bodies such as bankers’ associations can assist the insurance industry in pricing coverage and determining appropriate levels of coverage and deductibles, by mandating the collection of key metrics for the insurers to use in their own calculations. 

Concluding Thoughts

An overarching message emerging from the SEACEN Policy Summit on “Central Bank Leadership in Combating Cyber Risk” is that all sectors of the financial services industry – banking, payments, securities, insurance, wealth management, and their regulators and supervisors – must cooperate to the fullest extent possible in increasing their cyber resilience, improving information sharing, and realizing that the entrance of new financial services providers and new access channels for their customers act as a force multiplier for cyber risks in the industry.  Central counterparties (CCPs), which have been so helpful in reducing systemic risks in key markets, are especially vital to secure, because a corrupted CCP can serve as a choke point, causing inability to receive and process transactions cascading throughout the system. 

Indeed, cybersecurity has never been, and certainly is not now, a problem only for “the guys in the server room” to solve. 

Glenn Tasky is the Director of the Financial Stability and Supervision & Payment and Settlement Systems pillar at the SEACEN Centre.