WASHINGTON A top Federal Reserve official said the central bank is still grappling with how to quantify certain types of operational risk at the largest banks and identify reliable controls to manage them.
David Lynch, assistant director for quantitative risk management at the Fed, told a conference Wednesday that when it comes to some kinds of risk particularly those for which incidents are unpredictable or rare the agency lacks agreed-upon methods for counting and assigning costs to incidents. Without those basic metrics, developing useful models for banks and supervisors to rely on to identify and hedge those risks is very difficult.
"If you have a series of litigation losses is that one event, five events, 100 events? It's difficult to promote a consistent answer to that," Lynch said during a panel at The Clearing House's operational risk conference. "The lifeblood of an operational risk unit is the data they collect. The heart of being able to provide an objective assessment starts with the data."
Operational risk is a catchall term to refer to costs associated from human error, legal liabilities, natural or manmade disasters, and can include anything from cybersecurity threats to regulatory fines. The Fed has been requiring banks to hold capital to mitigate operational risks for decades, but most recently updated its rules in December 2013 to accommodate standards made as part of the Basel III accords. (The changes in Basel III were identical to the operational risk rules in Basel II, but the Fed never got around to implementing the Basel II accords.)
The financial crisis sparked a new focus on having banks hold capital to mitigate their credit and market risks, and those capital regimes are largely in place. However, JP Morgan's 2012 London Whale derivatives loss where a single trader cost the firm more than $7 billion in losses and related fines drew renewed attention to how substantial operational risks can be.
While banks have been holding capital to address operational risks, some complain that there are no controls the firms can put in place to reduce that capital cost.
Joseph Rice, vice president of operational risk at Wells Fargo, told the conference that since there are no such controls recognized by the Fed that actually reduce capital requirements, there is little incentive for banks to try to contain operational risk from a regulatory capital perspective.
"In the environment we've been in, where capital adequacy is obviously an important focus of supervisors, I think intellectually they recognize that if [a bank] can demonstrate a certain control environment and those controls are effective, it should mean less margin," Rice said. "But getting a clear demonstration of that [capability] that anyone can really buy into is difficult."
Lynch agreed that no such controls exist, and that considering the state of the Fed's modeling processes for operational risk, it is unlikely that such controls will be available in the near future.
"Until that data is there and there is an ability to demonstrate that controls do control the risk, it's very, very hard to say these sets of controls are adequately addressing the risk and you can reduce your capital because of it," Lynch said. "I think given the state of operational risk modeling today, it's kind of very difficult to come to that statement."
Lynch's comments come as the Basel Committee on Banking Supervision is poised to finalize new measures for risk-weighted capital ratios, which includes a minimum capital holding to offset operational risk.
Karen Shaw Petrou, managing partner at Federal Financial Analytics, said that "floor" will give the Fed and other global regulators even less wiggle room to allow banks to identify and install controls to reduce that capital burden. That may be problematic for two reasons: first, it will eliminate banks' incentive to look for ways to control its operational risk, and second, it will limit regulators' ability to manage operational risks in more creative and effective ways.
"Capitalizing operational risk does very little to ensure operational resilience, in contrast to backup systems and all the other resources," Petrou said. "There really actually is an incentive to take more risk since you're going to have to hold the same amount of capital regardless."