Basel II: Implications for Hong Kong

I'd like to start by thanking the City University and Oracle Systems for organising today's Seminar and for giving me this opportunity to share with you some thoughts on Basel II, and in particular on the implications for Hong Kong.

The process of devising a New Capital Accord has now been going on for more than four years and it is still another three and a half years until countries start implementing it. It's clear from this timescale that what we are talking about here is a very major project indeed, and one which has important implications for the banking industry. It's very welcome, therefore, to have occasions like this to help spread the word on what it's all about.

But why such a big deal? What's so wrong with the existing Capital Accord? The answer is simply that, in the 15 years since it was introduced, things have moved on. The nature of banks' business and the risks they are running have changed dramatically, and the existing Accord no longer comes up to scratch - it no longer functions as a mechanism for ensuring that banks hold an amount of capital that is broadly commensurate with the risks they run. In particular, the current broad-brush treatment of credit risk means that the capital requirement in respect of credits of widely varying quality is the same. And though the existing Accord was modified a number of years ago to incorporate capital requirements in respect of market risk, it doesn't require banks to hold capital against many other risks they run - for example, operational risk, interest rate risk in the banking book, and business cycle risk.

So there are many good reasons why there should be a Basel II to address these weaknesses in the current Capital Accord. But while this objective of better matching capital requirements to the risk taken is certainly very worthwhile, it's really only part of the story. For the aims of Basel II are somewhat broader than this. Basel II is not about creating some wonderful all-singing all-dancing system of capital requirements to keep the banking supervisors happy. It's not a case of supervisors trying to dictate how banks should manage their business.

On the contrary, it's quite the opposite. For Basel II is an attempt to mould supervisory capital requirements to the ways in which banks actually manage their business. Moreover - and this is the crucial point - it aims to relate the capital requirement not only to the amount of risk they undertake, but also to how well they manage that risk. So, in other words, not only will banks get lower capital requirements in respect of lower risk credits; but they'll also get lower capital requirements if they can demonstrate that they manage risk well.

It is for this reason that Basel II might perhaps be better thought of not as the second "Capital Accord" but rather the first "Risk Management Accord". Because it focuses attention not only on the more accurate measurement of risk, but on the management of risk. Banks looking to reduce their capital charge will have two choices: either reduce the risk, for example by substituting better risk credits for lower risk credits, or by reducing positions; or simply manage the risk better. And this will apply not only to credit risk. Again, to take the example of operational risk, banks will have the option of investing in more advanced approaches which will translate into lower capital charges.

You may have noticed that I just mentioned banks having options, having choices. This is another key feature of Basel II. No longer will there be a "one size fits all" approach whereby banks of varying shapes and sizes are shoehorned into one inflexible system of capital charges. Instead, banks will be able to choose what approach they take; for example, whether they adopt the standardised approach or IRB approach for credit risk, and which of the various approaches to operational risk they adopt.

Having said that, the HKMA will of course have its own views on what levels of sophistication of risk management we would expect to see in different types of banks. While we won't mandate particular approaches, we will expect to see levels of risk management that are commensurate with the types and levels of risk being run. So, for example, we won't necessarily expect even a large bank with significant credit risk to implement advanced IRB. But we would expect a bank of such a type to have a fairly advanced internal credit rating system. As another example, we would generally expect banks with a significant level of market risk to implement a models based approach to measuring the risk.

This flexible approach - in contrast to the approach being adopted by some other supervisors, who are mandating that particular approaches be adopted by particular types of banks - is, we feel, the most appropriate approach for Hong Kong. In Hong Kong we have a wide variety of banks, RLBs and DTCs. We have different nationalities. We have different sizes. We have banks that focus on the retail market, and ones that focus on the wholesale market. We have banks that specialise in mortgage lending, ones that specialise in SME lending, and ones that are jacks of all trades. It's perfectly appropriate, therefore, that with such a wide variety of banks there should be a wide variety of credit risk management and other risk management practices. The real point is whether, given the bank's particular circumstances, the risk management practices they adopt are adequate. And that, primarily, is a matter for the bank's management to determine, although we will of course, given our statutory responsibilities, also have an interest in this.

I stress these points for three particular reasons. First, because I don't want anyone to think that we are against banks taking risk. We're not. That's the business they're in. We simply want to make sure they recognise and manage the risk effectively. Second, because I want to make clear that we are not hell bent on driving banks to invest in unnecessarily sophisticated risk management systems. What's appropriate will clearly vary from bank to bank, depending on the nature and scale of their business and the risks they run. Third, because I want to be perfectly clear that Basel II is not some underhand means of making life difficult for smaller banks by raising the hurdle too high in terms of what they need to spend on risk management and on regulatory compliance. Indeed, on the contrary, the whole thing is carefully designed so as to accommodate banks of all shapes and sizes.

So, how will Basel II change banking in Hong Kong? The answer, I would suggest, is that we won't see any dramatic changes overnight, but we will over time see some re-focusing of how the risks within banks are addressed, both by banks themselves and by the supervisors. This will be more in the nature of a gradual evolution than a "big bang". There are really two main strands. The first will be a more systematic identification of risk, and covering a wider range of risks. The second will be the increased use of quantitative techniques, including modelling and stress-testing.

Let me talk a little bit about each of these in turn.

First is the more systematic identification of risk, covering a wider range of risks. This is something on which I would say that Hong Kong is already in many respects quite well advanced. For several years now the HKMA has adopted what we term a "risk-based supervisory approach". This involves a number of steps. First, the inherent risks being run by an institution in each of its business lines are identified. Eight inherent risks are focused on - credit risk, market risk, interest rate risk, liquidity risk, operational risk, legal risk, reputation risk and strategic risk. These risks are then classified as either "high", "moderate" or "low", taking into account the current position and likely future developments. The risk control practices to manage these inherent risks are then evaluated, and classified as "strong", "acceptable" or "weak". This evaluation takes account of such factors as management oversight, policies and procedures, risk measurement and internal controls. The final step is to combine the assessments so as to determine whether, for each business line, the risk controls are adequate given the level and direction of risk. This helps identify areas where there is an apparent mismatch - for example where a particular business line is assessed as "high" risk but the risk control is assessed as "weak". Appropriate follow-up action would then be conducted.

I've gone into quite a lot of detail on this to make the point that the dialogue between the banks and supervisor in Hong Kong already currently focuses on the full range of risks, even though only a small sub-set of these risks are currently addressed in the capital framework. So, as I said before, Hong Kong is quite well advanced in this area.

As time goes on, however, we would expect to see the banks themselves doing more of this analysis and the supervisors less. Indeed, in time we would expect at least the larger banks to have a fairly well-developed process for assessing all the risks inherent in their business, the quality of the management of these risks, and ultimately how much capital they need to hold in respect of these risks.

The second area I mentioned in which we can expect to see some developments is the increased used of quantitative techniques, including modelling and stress-testing. Again, this is something that is already happening, but is something to which Basel II will give added impetus. The most obvious area for this, of course, is credit risk, where we can expect to see banks making greater use of credit scoring models, and in particular models to estimate probability of default. It seems likely that only a very small number of banks in Hong Kong will decide, on the basis of their assessment of the costs and benefits, to invest immediately in a fully-fledged IRB-compliant system. However, very many more, I am sure, will want to test the water by starting to make greater use in their credit risk management process of models to assess PD, and this is something that we in the HKMA will welcome and, indeed, encourage. Rather than build an elaborate in-house model, many banks may start by purchasing and adapting a system from an external vendor. Or they may join together with other banks to share the cost of building models and databases, or establish a relationship with the academic fraternity. With so many banks, we will probably see a variety of approaches, but I think the direction is clear. Models are here to stay.

The second important area in which the use of quantitative techniques will, I believe, increase, is the area of stress-testing. One lesson we have all learned from the Asian Financial Crisis is that the level of economic activity, asset prices and currency values can fluctuate quite widely, and this can obviously have a big affect on banks' profitability, capital position, and, ultimately, ongoing viability. One way of trying to ensure that banks can stand up to such stresses is to conduct regular stress-testing, in other words to assess how they would be affected in hypothetical stress scenarios. Such testing is becoming an increasingly integral part of the risk management process within banks and, for that matter, the supervisory process. For example, if you have a good understanding of the extent to which your asset quality might be affected by an economic downturn, or how the value of your holdings of securities might be affected by changes in interest rates, this is valuable information in helping you manage your risks. So this is a technique that can be very useful indeed, and which I am sure many banks will want to explore further.

All this talk of greater use of modelling and of quantitative techniques raises, of course, the question of whether there is sufficient availability within Hong Kong of the necessary expertise and skills. This, I would suggest, offers many opportunities - not the least, I would add, for our hosts and sponsors today, as both the academic fraternity and specialist service providers can potentially play an important role here.

I hope that these thoughts on Basel II have been of interest, and possibly have brought out some aspects that may not have been picked up on before. From what I have said it should be clear, at the very least, that Basel II is not some abstract regulatory compliance issue of no real value to the banking industry. On the contrary, it's based very much on emerging best practices in the risk management arena globally, and the objective is to try to encourage the wider spread of these best practices around the banking community worldwide. As regards Hong Kong, embracing the New Accord can only further strengthen our position as one of the world's leading international financial centres.