In many conference speeches, training presentations and papers since the end of the Great Financial Crisis, we often heard or read that “we don’t know when or from where the next crisis will come, but it will surely come.” It is too early to say that COVID-19 is or will precipitate another large scale global financial crisis, but the potential in the current environment for an intensified period of financial instability is surely present.
COVID-19 has already taken lives and caused suffering in many countries around the world. The human tragedy should always be first in our minds as financial sector regulators, as we discuss ways to maintain financial stability, of which business continuity management (BCM) of central banks, stand-alone financial sector regulatory authorities, deposit insurance agencies (collectively, regulatory authorities), and financial institutions (FIs) themselves plays a central role.
The threat of the virus has put everyone on alert as governments, regulatory agencies and health professionals provide guidance and possible restrictions on movement and gatherings to prevent the spread of the virus. Central banks and policymakers have also taken sizable and coordinated monetary policy and economic measures to mitigate the impact of COVID-19 on the global economy.
Regulatory authorities globally continue to monitor and assess the impact COVID-19 will have on FIs. Recently, it was reported that US financial regulators were preparing contingency arrangements, including travel restrictions and home-working, to ensure they can effectively oversee the financial markets as the virus closes in on the US capital. Many have instituted rules and regulations as well as relevant guidance to assist FIs in implementing or augmenting their BCM programs to minimise the potential adverse effects of a pandemic, including COVID-19.
This blog post consists of three (3) main sections and is published in two (2) parts: Part A and Part B. Part A is the first section, and presents a discussion of the steps regulatory authorities can take to implement their own BCM programs, and what they can expect from their regulated FIs, during the current pandemic. Part B consist of two (2) main sections: (1) the intensification of regulatory, supervisory and resolution activity the authorities can expect, while at the same time running on reduced manpower; and (2) thoughts on a new crisis management framework to put in place when the current crisis has passed and economies start to recover.
Business continuity management during a pandemic: a new twist on a very old practice
If there is one important, critical function of the regulatory authorities in the face of widespread possible disruption in financial services, it must be to maintain the confidence of individuals, households, businesses and investors in the financial system. If suppliers of funds to FIs lose confidence, massive asset sales and deposit withdrawals could result, a kind of forced deleveraging that would require extremely large injections of liquidity by central banks to revive moribund financial markets and preserve the smooth functioning of payment systems, without which declines in the level of economic activity will be exacerbated.
Maintaining confidence, of course, requires also that deposit insurance agencies set up programs to immediately pay out depositors of failed FIs. In an acute, long-lasting crisis, the desired currency-to-deposit ratio might rise sharply as households and firms hoard cash, necessitating a rapid upscaling of banknote printing and distribution.
It’s a good thing that many of the critical banking functions have been automated over the last few decades, requiring less human involvement. But human involvement is still necessary to screen and flag reports, turn equipment on and off, maintain equipment, control access to key infrastructure and so forth. FI staff or third-party vendor staff will still be necessary to keep ATMs functioning, for example.
As a possible downside of increased automation, requiring intensified vigilance by FI senior management and staff (and not only in the server room), cyber criminals and fraudsters may take advantage of a chaotic situation at one or more FIs to strike, believing that management is distracted by issues related to the virus. The current stressful period is no time to scrimp on resources devoted to ITC risk management, of which cyber risk management is an integral part. Beyond pure cyber risk, FIs may face power outages and interruptions to telephone and internet service if unavailability of manpower begins to affect key utility providers.
Post-2008 financial regulatory reforms emphasised the importance of FIs and identified critical business functions and operations in their crisis management, resolution and recovery planning. A strategic analysis of the firm’s essential and systemically important functions is necessary for resolution planning and for assessing resolvability. It should help ensure that the resolution strategy and operational plan include appropriate actions that help maintain continuity of these functions while avoiding unnecessary destruction of value and minimising, where possible, the costs of resolution to home and host authorities and losses to creditors.
Given the particular features of a pandemic, however, including a potentially longer duration than envisioned in many traditional crisis management scenarios, the critical business functions identified in the traditional BCM program may not always provide sufficient guidance for conducting operations in a pandemic scenario. Explicit identification of the highest priority critical business functions and operations will help to ensure they receive appropriate resources. These functions and operations could be defined as activities which, if not performed or maintained for more than a very short period, would cause the FI to be in default on its obligations or otherwise threaten its financial soundness.
For example, FIs may consider it appropriate to focus on servicing existing customers and completing transactions already in progress, and closing or minimising risk positions. They may choose to defer or suspend activities such as new business development, opening new accounts, undertaking special or new projects or any internal non-essential systems changes within the organisation. These activities may be progressively scaled back based on the phase of the pandemic or available resources.
The most commonly cited critical business functions of regulated FIs, which would also be consistent with governmental priorities for public confidence, generally include (but are not limited to):
• Core risk management functions — particularly market, operational, credit and liquidity risk monitoring;
• General ledger/finance capabilities to allow monitoring of the overall financial (including capital) position of the FI;
• Call centres handling customer transactions and enquiries (excluding, for example, outbound or sales calls); and
• Data centres, recovery sites and critical third-party suppliers supporting critical functions.
• Cash supply and currency distribution, including operation of automated teller machines (ATMs);
• Retail payments and banking systems that provide existing customers with access to funds, including EFTPOS, bill payments, credit cards, telephone banking and Internet banking;
• Automated direct entry payment processing for existing customers, including government payments and payroll processing for corporate customers, as well as payments to suppliers and staff;
• Credit functions, in particular those processing functions necessary for managing retail, corporate and institutional access to credit, particularly for pandemic-affected borrowers;
• For larger FIs, wholesale payments clearing and settlement activities, including interbank settlements, securities settlements and custody, particularly where these functions are provided to other FIs; and
• Limited trading functions for FIs active in markets operated by exchanges as well as over-the-counter — in particular, those functions necessary for completing transactions for existing customers and managing liquidity of the FI.
It should be noted that FIs are already taking action. In light of these acute challenges, FIs in the United Kingdom and United States are sending hundreds of staff to their UK and US disaster recovery sites, installing big screens in traders’ homes and pushing regulators for a reprieve on trading rules so they can keep their businesses running through a COVID-19 outbreak.
The efforts by big global banks including Goldman Sachs, JPMorgan Chase, Morgan Stanley and Barclays are an escalation of BCM program implementation that has already prompted them to segregate staff in Asian cities at the initial epicentre of the COVID-19 outbreak.
Of course, the real difficulty with the current situation is that even working from remote sites will not be possible as they too are open to becoming contaminated. So, the clearest way forward will be to allow all critical staff to be able to work from home remotely. In fact, these moves are being forced upon many banks, including central banks, given the lockdowns being implemented in various countries across Asia (such as the Philippines and Malaysia). The recent moves to cloud technology can help, as we note that even whilst in the office, many staff are logging onto remote servers containing all their files and data. The move to work from home for extended periods should therefore be something that is quite easily achievable.
Even once this is all in place, the real challenge will come when some of the more senior members of staff contract COVID-19. The virus does not discriminate, and we have already seen a number of celebrities and politicians contract it. So how will the market cope if/when a central bank governor, a bank CEO or the Prime Minister or President of a country, or their senior staff, start to contract the virus? Central banks, regulators, governments, and private organisations should also have a clear back-up plan for their chain of command so that they can reassure the markets that there are other experienced staff available to continue running the show and prevent further panic and instability, should the worst occur to their leadership teams.