RiskTech Forum

Wolters Kluwer: The Risk Worries That Keep Hong Kong’s Top Bankers and Regulators Up at Night

Posted: 1 November 2016  |  Source: Wolters Kluwer

Cybercrime and hiring the wrong sort of people are two of the most worrying bogeys that make Hong Kong’s top bank executives lose sleep at night.

Meanwhile, on the regulators’ side of the fence, cybersecurity is also very much on the radar screen, along with money laundering and terrorist financing, credit and liquidity risk, and risks from changes to international financial standards.

Cybersecurity and Conduct Risk

When asked about their chief concerns at a panel discussion held during the recent Hong Kong Institute of Bankers' (HKIB) Banking Conference, banking heads put cybersecurity and conduct risk at the top of their dreaded list.

Weber Lo, Citi country officer and chief executive officer for Hong Kong and Macau, said he isn’t as anxious about the threat posed by credit risk compared with cyber risk. While Hong Kong’s mature banking industry already has the expertise to grapple with credit risk, cybersecurity is a different beast altogether, according to Mr Lo.

“Cybersecurity is quite new to us. What keeps me awake at night is cybercrime,” Mr Lo said, citing the recent spate of financial industry hackings such as the Bangladesh Bank heist in February, in which hackers stole US$81 million from Bank Bangladesh using the SWIFT bank messaging network; and the cyber robbery in Taiwan in July, in which an international crime ring used malware to withdraw more than NT$81 million (S$3.4 million) from First Commercial Bank’s network of automated teller machines.

Paul Yang, head of Greater China of BNP Paribas and chief executive officer of BNP Paribas Hong Kong, points out that in the earlier days of Hong Kong’s banking industry, the risk scenario was much easier to deal with.

“When I started in the industry, it was very easy...you had market risk, counterparty risk. The worst case scenario was that the guy doesn’t come to pay you back.

“Cyber risk is definitely very scary and this is a major area that we're trying to invest a lot of money in.”

May Tan, chief executive officer of Standard Chartered Bank (Hong Kong) Ltd, says conduct risk is what keeps her more on edge.

“We talk about recruiting people, but actually embedding the right culture and conduct is really tough because at the end of the day... the individuals themselves should know what the right thing to do is. It’s very difficult for senior management to know exactly what every individual is doing.”

Both these hazards eventually translate into tarnished reputation for the banks, Mr Yang points out.

“If you're not careful…at the end of the day, the damage to the reputation of the bank and the brand will be huge,” he says.

HKMA Worries over De-Risking

Hong Kong’s chief financial regulator, the Hong Kong Monetary Authority (HKMA), acknowledges that cyber security risk is among its chief concerns, but also counts three other major risk hotspots, namely anti-money laundering and counter-terrorist financing (AML/CFT); credit risk and liquidity risk; and risk relating to the implementation of changes to international standards.

Arthur Yuen, deputy chief executive at the HKMA, says that a particularly thorny issue for the HKMA right now is ‘de-risking,’ which has been the inadvertent side effect of tighter global standards to combat money laundering and terrorist financing. This is the recent trend of banks weeding out potentially high-risk customers, and as a result denying bona fide businesses from having access to much-needed funds.

Mr Yuen said in his regulatory keynote at the same HKIB annual conference:

“Well-established companies have ended long-term banking relationships because they were assessed and found to be a money-laundering risk all simply because some part of the business interacted with a certain high-risk jurisdiction for business… as a result they have to (come up with alternatives) to cover their basic banking needs.”

He added that “it is quite apparent by now that some banks don't always get the balance right,” although “getting this balance right is not easy sometimes.”

HKMA chief executive, Norman Chan, also berated global banks over their blanket de-risking tactics in his opening keynote speech at the same conference.

“In a nut-shell, to seek to de-risk using a ‘one size fits all’ approach across all jurisdictions for an international bank may be easier or tidier from the compliance angle, it does not take into account the very diverse risk profiles of customers in different countries and in different business segments,” said Mr. Chan.

Mr Yuen pointed out to conference participants that banks should instead adopt the ‘risk-based’ approach espoused by the HKMA, under which they “first of all identify and assess the money laundering risk which various customers in various business lines present to the bank ... and then apply appropriate measures to mitigate the risk identified.” 

Brexit Effect on Credit, Liquidity Risk

The HKMA is also keeping a tight watch on credit risk and liquidity risk amid the many uncertainties on the global front, such as Britain's vote to exit from the European Union, Mr Yuen said.

He noted that with the Hong Kong banking system “perhaps being the most open and internationally exposed banking system in the world,” local regulators always have to be aware of what’s going on in the outside world.

“In this regard, there are indeed a number of factors that are contributing to uncertainties facing our banking sector such as Britain's decision to leave the EU.”

He said the risk challenge arises mainly from the “potential impact of Brexit on financial market sentiment, entangled together with a number of (other) risk factors, such as generally high valuation of assets, uncertainty over U.S. interest rate normalisation and disparity of monetary policies in different jurisdictions”.

Some Banks Not Ready for IFRS 9

Another item on the HKMA’s watchlist is the risk from changes in international financial standards, the most significant and most immediate being the implementation of the new international financial reporting standard (IFRS), IFRS 9.

The new standard replaces the earlier IAS 39 by 2018, and requires early recognition of credit losses that banks can incur.

The HKMA said that based on a survey conducted in June, readiness in adopting IFRS 9 varied very substantially among banks, with some banks regarded as less prepared than others.

“It’s a bit worrying for us given that the deadline for implementing for IFRS 9 is already 2018… and we do see that a number of banks have to play catch-up.

“So if your bank is among the less prepared group, I strongly urge you to go back and make sure that you step up the preparation work as soon as you possibly can,” said Mr. Yuen.

Hiring the Right People for the Job

With all these safety concerns swamping the industry, both bank executives and financial regulators agree that it is crucial to have a sizable pool of suitable talent to deal with the myriad assortment of risks.

The process shouldn’t just be finding the right sort of people and providing them with the right sort of training, but also making sure they have the right attitude towards conduct, as well as the right attitude towards markets and consumers, bank executives said.

“All these new standards are highly complicated and require special training and expertise to come to grips with them. So banks have to hire, train and retrain people in order to fully understand and implement the rapidly changing regulatory standards and requirements,” HKMA’s Mr Chan stressed.

“Apart from the badly needed capability amongst banks in capital, liquidity and credit risk management, the demand for enhancement and upgrading in banking conduct has also increased phenomenally in the last few years,” he added.

“It's how you attract the right talent,” Ms Tan from Standard Chartered noted, pointing out that Hong Kong’s talent pool for AML/CFT was very small with banks “all poaching from each other.”

Mr Yang from BNP Paribas said it is important to train staff to “adopt the right culture, the right approach, the right conduct.”

“We always push guys to say that when you have to make a decision, it is in the best interest of the client and once it is in the best interest of the client, it is in the best interest of the bank. Not your silo, not your business plan but the bank as a whole.”

Mr Chan, however, assured the industry that the HKMA has no plans to introduce a mandatory qualification or licensing regime for banking practitioners.

“Such (a) regime may not be flexible enough to cater for a fast expanding and changing banking business environment,” he said.