In the stress test methodology, participating banks are required to evaluate the impact of a cyber attack. They must communicate their response and recovery efforts by completing a questionnaire and submitting pertinent documentation. Banks undergoing enhanced assessment are further mandated to conduct and report the results of IT recovery tests specific to the scenario. The reporting of the cyber incident is to be done using the template outlined in the SSM Cyber-incident reporting framework.

Assessing Digital Fortitude: Scope and Objectives

The ECB's decision to conduct a thematic stress test on cyber resilience in 2024 holds profound significance. The primary objective is to assess the digital operational resilience of 109 Significant Institutions, contemplating the impact of a severe but plausible cybersecurity event. This initiative seeks to uncover potential weaknesses within the systems and derive strategic remediation actions. Notably, 28 banks will undergo an enhanced assessment, heightening the scrutiny on their cyber resilience capabilities. The outcomes are poised to reverberate across the financial landscape, influencing the 2024 SREP OpRisk Score and shaping qualitative requirements.

General Overview and Scope​

• Supervisory Board of ECB has decided to conduct a thematic stress test on „cyber resilience“ in 2024.​
• Main objective is to assess the digital operational resilience in case of a severe but plausible cybersecurity event, to identify potential weaknesses and derive remediation actions.​
• Participants will be 109 Significant Institutions (28 banks will be in scope of an enhanced assessment).​
• The outcome will have an impact on the 2024 SREP OpRisk Score and qualitative requirements.​

Navigating the Evaluation: Stress Test Methodology

Participating banks find themselves at the epicenter of this evaluative process. They are tasked with assessing the impact of a simulated cyber attack and meticulously reporting their response and recovery efforts. This involves answering a comprehensive questionnaire and providing relevant documentation as evidence. For those under enhanced assessment, an additional layer of complexity is introduced – the execution and reporting of IT recovery tests tailored to the specific scenario. The cyber incident reporting follows a structured template outlined in the SSM Cyber-incident reporting framework.

Stress Test Methodology​

• Participating banks have to assess the impact of the cyber-attack and report their response and recovery by answering the questionnaire and providing relevant documentation as evidence.​
• Banks under the enhanced assessment are additionally requested to execute and provide results of IT recovery tests tailored to the specific scenario.​
• The cyber incident has to be reported by using the template of the SSM Cyber-incident reporting framework.​

Setting the Stage: Scenario Unveiled

The stress test unfolds with a meticulously crafted hypothetical scenario. Envision a landscape where all preventive measures against a cyber attack have either been bypassed or failed. The core of this simulation involves a cyber-attack causing a loss of integrity in the databases supporting a bank's main core banking system. Validation of the affected core banking system is a crucial step, overseen by the Joint Supervisory Team (JST). The final scenario details will be communicated on January 2, 2024, adding a real-time element to this strategic evaluation.

Scenario

• The stress test will consist of a hypothetical scenario that assumes that all preventive measures have been bypassed or have failed.​
• The cyber-attack will cause a loss of integrity of the database(s) that support the bank’s main core banking system.​
• The banks have to validate the selection of the affected core banking system with the JST.​
• The final scenario will be communicated on 2 January 2024.​

Partnering for Success: Zanders' Service Offering

In the complex terrain of the Cyber Resilience Stress Test, Zanders stands as a reliable partner. Armed with deep knowledge in Non-Financial Risk, we navigate the intricacies of the upcoming stress test seamlessly. Our support spans the entire exercise, from administrative aspects to performing assessments that determine the impact of the cyber attack on key financial ratios as requested by supervisory authorities. This service offering underscores our commitment to fortifying financial institutions against evolving cyber threats.

Zanders Service Offering​

• Our deep knowledge in Non-Financial Risk enables us to navigate smoothly through the complexity of the upcoming Cyber Resilience Stress Test.​
• We support participating banks during the whole exercise of the upcoming Stress Test.​
• Our Services cover the whole bandwidth of required activities starting from administrative aspects and ending up at performing assessments to determine the impact of the cyber-attack in regard of key financial ratios requested by the supervisory authority.​​

In this report, biodiversity loss ranks as the fourth most pressing concern after climate change adaptation, mitigation failure, and natural disasters. For financial institutions (FIs), it is therefore a relevant risk that should be taken into account. So, how should FIs implement biodiversity risk in their risk management framework?

Despite an increasing awareness of the importance of biodiversity, human activities continue to significantly alter the ecosystems we depend on. The present rate of species going extinct is 10 to 100 times higher than the average observed over the past 10 million years, according to Partnership for Biodiversity Accounting Financials[i]. The Intergovernmental Science-Policy Platform on Biodiversity and Ecosystem Services (IPBES) reports that 75% of ecosystems have been modified by human actions, with 20% of terrestrial biomass lost, 25% under threat, and a projection of 1 million species facing extinction unless immediate action is taken. Resilience theory and planetary boundaries state that once a certain critical threshold is surpassed, the rate of change enters an exponential trajectory, leading to irreversible changes, and, as noted in a report by the Nederlandsche Bank (DNB), we are already close to that threshold[ii].

We will now explain biodiversity as a concept, why it is a significant risk for financial institutions (FIs), and how to start thinking about implementing biodiversity risk in a financial institutions’ risk management framework.

What is biodiversity?

The Convention on Biological Diversity (CBD) defines biodiversity as “the variability among living organisms from all sources including, i.a., terrestrial, marine and other aquatic ecosystems and the ecological complexes of which they are part.”[iii] Humans rely on ecosystems directly and indirectly as they provide us with resources, protection and services such as cleaning our air and water.

Biodiversity both affects and is affected by climate change. For example, ecosystems such as tropical forests and peatlands consist of a diverse wildlife and act as carbon sinks that reduce the pace of climate change. At the same time, ecosystems are threatened by the accelerating change caused by human-induced global warming. The IPBES and Intergovernmental Panel on Climate Change (IPCC), in their first-ever collaboration, state that “biodiversity loss and climate change are both driven by human economic activities and mutually reinforce each other. Neither will be successfully resolved unless both are tackled together.”[iv]

Why is it relevant for financial institutions?

While financial institutions’ own operations do not materially impact biodiversity, they do have impact on biodiversity through their financing. ASN Bank, for instance, calculated that the net biodiversity impact of its financed exposure is equivalent to around 516 square kilometres of lost biodiversity – which is roughly equal to the size of the isle of Ibiza in Spain[v]. The FIs’ impact on biodiversity also leads to opportunities. The Institute Financing Nature (IFN) report estimates that the financing gap for biodiversity is close to $700 billion annually[vi]. This emphasizes the importance of directing substantial financial resources towards biodiversity-positive initiatives.

At the same time, biodiversity loss also poses risks to financial institutions.

The global economy highly depends on biodiversity as a result of the increasedglobalization and interconnectedness of the financial system. Due to these factors, the effects of biodiversity losses are magnified and exacerbated through the financial system, which can result in significant financial losses. For example, approximately USD 44 trillion of the global GDP is highly or moderately dependent on nature (World Economic Forum, 2020). Specifically for financial institutions, the DNB estimated that Dutch FIs alone have EUR 510 billionof exposure to companies that are highly or very highly dependent on one or more ecosystems services[vii]. Furthermore, in the 2010 World Economic Forum report worldwide economic damage from biodiversity loss is estimated to be around USD 2 to 4.5 trillion annually. This is remarkably high when compared to the negative global financial damage of USD 1.7 trillion per year from greenhouse gas emissions (based on 2008 data), which demonstrates that institutions should not focus their attention solely on the effects of climate change when assessing climate & environmental risks[viii].

Examples of financial impact

Similarly to climate risk, biodiversity risk is expected to materialize through the traditional risk types a financial institution faces. To illustrate how biodiversity loss can affect individual financial institutions, we provide an example of the potential impact of physical biodiversity risk on, respectively, the credit risk and market risk of an institution:

Credit risk:

Failing ecosystem services can lead to disruptions of production, reducing the profits of counterparties. As a result, there is an increase in credit risk of these counterparties. For example, these disruptions can materialize in the following ways:

• A total of 75% of the global food crop rely on animals for their pollination. For the agricultural sector, deterioration or loss of pollinating species may result in significant crop yield reduction.
• Marine ecosystems are a natural defence against natural hazards. Wetlands prevented USD 650 million worth of damages during the 2012 Superstorm Sandy [OECD, 2019), while the material damage of hurricane Katrina would have been USD 150 billion less if the wetlands had not been lost.

Market risk:

The market value of investments of a financial institution can suffer from the interconnectedness of the global economy and concentration of production when a climate event happens. For example:

• A 2011 flood in Thailand impacted an area where most of the world's hard drives are manufactured. This led to a 20%-40% rise in global prices of the product[ix]. The impact of the local ecosystems for these type of products expose the dependency for investors as well as society as a whole.

Core part of the European Green Deal

The examples above are physical biodiversity risk examples. In addition to physical risk, biodiversity loss can also lead to transition risk – changes in the regulatory environment could imply less viable business models and an increase in costs, which will potentially affect the profitability and risk profile of financial institutions. While physical risk can be argued to materialize in a more distant future, transition risk is a more pressing concern as new measures have been released, for example by the European Commission, to transition to more sustainable and biodiversity friendly practices. These measures are included in the EU biodiversity strategy for 2030 and the EU’s Nature restoration law.

The EU’s biodiversity strategy for 2030 is a core part of European Green Deal. It is a comprehensive, ambitious, and long-term plan that focuses on protecting valuable or vulnerable ecosystems, restoring damaged ecosystems, financing transformation projects, and introducing accountability for nature-damaging activities. The strategy aims to put Europe's biodiversity on a path to recovery by 2030, and contains specific actions and commitments. The EU biodiversity strategy covers various aspects such as:

• Legal protection of an additional 4% of land area (up to a total of 7%) and 19% of sea area (up to a total of 30%)
• Strict protection of 9% of sea and 7% of land area (up to a total of 10% for both)
• Reduction of fertilizer use by at least 20%
• Setting measures for sustainable harvesting of marine resources

A major step forwards towards enforcement of the strategy is the approval of the Nature restoration law by the EU in July 2023, which will become the first continent-wide comprehensive law on biodiversity and ecosystems. The law is likely to impact the agricultural sector, as the bill allows for 30% of all former peatlands that are currently exploited for agriculture to be restored or partially shifted to other uses by 2030. By 2050, this should be at least 70%. These regulatory actions are expected to have a positive impact on biodiversity in the EU. However, a swift implementation may increase transition risk for companies that are affected by the regulation.

The ECB Guide on climate-related and environmental risks explicitly states that biodiversity loss is one of the risk drivers for financial institutions[x]. Furthermore, the ECB Guide requires financial institutions to asses both physical and transition risks stemming from biodiversity loss. In addition, the EBA Report on the Management and Supervision of ESG Risk for Credit Institutions and Investment Firms repeatedly refers to biodiversity when discussing physical and transition risks[xi].

Moreover, the topic ‘biodiversity and ecosystems’ is also covered by the Corporate Sustainability Reporting Directive (CSRD), which requires companies within its scope to disclose on several sustainability related matters using a double materiality perspective.[1] Biodiversity and ecosystems is one of five environmental sustainability matters covered by CSRD. At a minimum, financial institutions in scope of CSRD must perform a materiality assessment of impacts, risks and opportunities stemming from biodiversity and ecosystems. Furthermore, when biodiversity is assessed to be material, either from financial or impact materiality perspective, the institution is subject to granular biodiversity-related disclosure requirements covering, among others, topics such as business strategy, policies, actions, targets, and metrics.

Where to start?

In line with regulatory requirements, financial institutions should already be integrating biodiversity into their risk management practices. Zanders recognizes the challenges associated with biodiversity-related risk management, such as data availability and multidimensionality. Therefore, Zanders suggests to initiate this process by starting with the following two steps. The complexity of the methodologies can increase over time as the institution’s, the regulator’s and the market’s knowledge on biodiversity-related risks becomes more mature.  

1. Perform materiality assessment using the double materiality concept. This means that financial institutions should measure and analyze biodiversity-related financial materiality through the identification of risks and opportunities. Institutions should also assess their impacts on biodiversity, for example, through calculation of their biodiversity footprint. This can start with classifying exposures’ impact and dependency on biodiversity based on a sector-level analysis.
2. Integrate biodiversity-related risks considerations into their business strategy and risk management frameworks. From a business perspective, if material, financial institutions are expected to integrate biodiversity in their business strategy, and set policies and targets to manage the risks. Such actions could be engagement with clients to promote their sustainability practices, allocation of financing to ‘biodiversity-friendly’ projects, and/or development of biodiversity specific products. Moreover, institutions are expected to adjust their risk appetites to account for biodiversity-related risks and opportunities, establish KRIs along with limits and thresholds. Embedding material ESG risks in the risk appetite frameworks should include a description on how risk indicators and limits are allocated within the banking group, business lines and branches.

Considering the potential impact of biodiversity loss on financial institutions, it is crucial for them to extend their focus beyond climate change and also start assessing and managing biodiversity risks. Zanders can support financial institutions in measuring biodiversity-related risks and taking first steps in integrating these risks into risk frameworks. Curious to hear more on this? Please reach out to Marije Wiersma, Iryna Fedenko, or Jaap Gerrits.

[1] CSRD applies to large EU companies, including banks and insurance firms. The first companies subject to CSRD must disclose according to the requirements in the European Sustainability Reporting Standards (ESRS) from 2025 (over financial year 2024), and by the reporting year 2029, the majority of European companies will be subject to publishing the CSRD reports. The sustainability report should be a publicly available statement with information on the sustainability-matters that the company considers material. This statement needs to be audited with limited assurance.

[i] PBAF. (2023). Dependencies - Pertnership for Biodiversity Acccounting Financials (PBAF)

[ii] De Nederlandche Bank. (2020). Indepted to nature - Exploring biodiversity risks for the Dutch Financial Sector.

[iii] CBD. (2005). Handbook of the convention on biological diversity

[iv] IPBES. (2021). Tackling Biodiversity & Climate Crises Together & Their Combined Social Impacts

[v] ASN Bank (2022). ASN Bank Biodiversity Footprint

[vi] Paulson Institute. (2021). Financing nature: Closing the Global Biodiversity

[vii] De Nederlandche Bank. (2020). Indepted to nature - Exploring biodiversity risks for the Dutch Financial Sector

[viii] PwC for World Economic Forum. (2010). Biodiversity and business risk

[ix] All the examples related to credit and market risk are presented in the report by De Nederlandsche Bank. (2020). Biodiversity Opportunities and Risks for the Financial Sector

[x] ECB. (2020). Guide on climate-related and environmental risks.

[xi] EBA. (2021). EBA Report on Management and Supervision of ESG Risk for Credit Institutions and Investment Firms

Carbon offset processes are currently dominated by private actors providing legitimacy for the market. The two largest of these, Verra and Gold Standard, provide auditing services, carbon registries and a marketplace to sell carbon offsets, making them ubiquitous in the whole process. Due to this opacity and centralisation, the business models of the existing companies was criticised regarding its validity and the actual benefit for climate action. By buying an offset in the traditional manner, the buyer must place trust in these players and their business models. Alternative solutions that would enhance the transparency of the process as well as provide decentralised marketplaces are thus called for.

The conventional process

Carbon offsets are certificates or credits that represent a reduction or removal of greenhouse gas emissions from the atmosphere. Offset markets work by having companies and organizations voluntarily pay for carbon offsetting projects. Reasons for partaking in voluntary carbon markets vary from increased awareness of corporate responsibility to a belief that emissions legislation is inevitable, and it is thus better to partake earlier.

Some industries also suffer prohibitively expensive barriers for lowering their emissions, or simply can’t reduce them because of the nature of their business. These industries can instead benefit from carbon offsets, as they manage to lower overall carbon emissions while still staying in business. Environmental organisations run climate-friendly projects and offer certificate-based investments for companies or individuals who therefore can reduce their own carbon footprint. By purchasing such certificates, they invest in these projects and their actual or future reduction of emissions. However, on a global scale, it is not enough to simply lower our carbon footprint to negate the effects of climate change. Emissions would in practice have to be negative, so that even a target of 1,5-degree Celsius warming could be met. This is also remedied by carbon credits, as they offer us a chance of removing carbon from the atmosphere. In the current process, companies looking to take part in the offsetting market will at some point run into the aforementioned behemoths and therefore an opaque form of purchasing carbon offsets.

The blockchain approach

A blockchain is a secure and decentralised database or ledger which is shared among the nodes of a computer network. Therefore, this technology can offer a valid contribution addressing the opacity and centralisation of the traditional procedure. The intention of the first blockchain approaches were the distribution of digital information in a shared ledger that is agreed on jointly and updated in a transparent manner. The information is recorded in blocks and added to the chain irreversibly, thus preventing the alteration, deletion and irregular inclusion of data.

In the recent years, tokenization of (physical) assets and the creation of a digital version that is stored on the blockchain gained more interest. By utilizing blockchain technology, asset ownership can be tokenized, which enables fractional ownership, reduces intermediaries, and provides a secure and transparent ledger. This not only increases liquidity but also expands access to previously illiquid assets (like carbon offsets). The blockchain ledger allows for real-time settlement of transactions, increasing efficiency and reducing the risk of fraud. Additionally, tokens can be programmed to include certain rules and restrictions, such as limiting the number of tokens that can be issued or specifying how they can be traded, which can provide greater transparency and control over the asset.

Blockchain-based carbon offset process

The tokenisation process for carbon credits begins with the identification of a project that either captures or helps to avoid carbon creation. In this example, the focus is on carbon avoidance through solar panels. The generation of solar electricity is considered an offset, as alternative energy use would emit carbon dioxide, whereas solar power does not.

The solar panels provide information regarding their electricity generation, from which a figure is derived that represents the amount of carbon avoided and fed into a smart contract. A smart contract is a self-executing application that exist on the blockchain and performs actions based on its underlying code. In the blockchain-based carbon offset process, smart contracts convert the different tokens and send them to the owner’s wallet. The tokens used within the process are compliant with the ERC-721 Non-Fungible Token (NFT) standard, which represents a unique token that is distinguishable from others and cannot be exchanged for other units of the same asset. A practical example is a work of art that, even if replicated, is always slightly different.

In the first stage of the process, the owner claims a carbon receipt, based on the amount of carbon avoided by the solar panel. Thereby the aggregated amount of carbon avoided (also stored in a database just for replication purposes) is sent to the smart contract, which issues a carbon receipt of the corresponding figure to the owner. Carbon receipts can further be exchanged for a uniform amount of carbon credits (e.g. 5 kg, 10 kg, 15 kg) by interacting with the second smart contract. Carbon credits are designed to be traded on the decentralised marketplace, where the price is determined by the supply and demand of its participants. Ultimately, carbon credits can be exchanged for carbon certificates indicating the certificate owner and the amount of carbon offset. Comparable with a university diploma, carbon certificates are tied to the address of the owner that initiated the exchange and are therefore non-tradable. Figure 1 illustrates the process of the described blockchain-based carbon offset solution:

Figure 1: Process flow of a blockchain-based carbon offset solution

Conclusion

The outlined blockchain-based carbon offset process was developed by Zanders’ blockchain team in a proof of concept. It was designed as an approach to reduce dependence on central players and a transparent method of issuing carbon credits. The smart contracts that the platform interacts with are implemented on the Mumbai test network of the public Polygon blockchain, which allows for fast transaction processing and minimal fees. The PoC is up and running, tokenizing the carbon savings generated by one of our colleagues photovoltaic system, and can be showcased in a demo. However, there are some clear optimisations to the process that should be considered for a larger scale (commercial) setup.

If you're interested in exploring the concept and benefits of a blockchain-based carbon offset process involving decentralised issuance and exchange of digital assets, or if you would like to see a demo, you can contact Robert Richter or Justus Schleicher.

Early October, the Basel Committee on Banking Supervision (BCBS) published a report[1] on the 2023 banking turmoil that involved the failure of several US banks as well as Credit Suisse. The report draws lessons for banking regulation and supervision which may ultimately lead to changes in banking regulation as well as supervisory practices. In this article we summarize the main findings of the report[2]. Based on the report’s assessment, the most material consequences for banks, in our view, could be in the following areas:

• Reparameterization of the LCR calculation and/or introduction of additional liquidity metrics
• Inclusion of assets accounted for at amortized cost at their fair value in the determination of regulatory capital
• Implementation of extended disclosure requirements for a bank's interest rate exposure and liquidity position
• More intensive supervision of smaller banks, especially those experiencing fast growth and concentration in specific client segments
• Application of the full Basel III Accord and the Basel IRRBB framework to a larger group of banks

Bank failures and underlying causes

The BCBS report first describes in some detail the events that led to the failure of each of the following banks in the spring of 2023:

• Silicon Valley Bank (SVB)
• Signature Bank of New York (SBNY)
• First Republic Bank (FRB)
• Credit Suisse (CS)

While each failure involved various bank-specific factors, the BCBS report highlights common features (with the relevant banks indicated in brackets).

• Long-term unsustainable business models (all), in part due to remuneration incentives for short-term profits
• Governance and risk management did not keep up with fast growth in recent years (SVB, SBNY, FRC)
• Ineffective oversight of risks by the board and management (all)
• Overreliance on uninsured customer deposits, which are more likely to be withdrawn in a stress situation (SVB, SBNY, FRC)
• Unprecedented speed of deposit withdrawals through online banking (all)
• Investment of short-term deposits in long-term assets without adequate interest-rate hedges (SVB, FRC)
• Failure to assess whether designated assets qualified as eligible collateral for borrowing at the central bank (SVB, SBNY)
• Client concentration risk in specific sectors and on both asset and liability side of the balance sheet (SVB, SBNY, FRC)
• Too much leniency by supervisors to address supervisory findings (SVB, SBNY, CS)
• Incomplete implementation of the Basel Framework: SVB, SBNY and FRB were not subject to the liquidity coverage ratio (LCR) of the Basel III Accord and the BCBS standard on interest rate risk in the banking book (IRRBB)

Of the four failed banks, only Credit Suisse was subject to the LCR requirements of the Basel III Accord, in relation to which the BCBS report includes the following observations:

• A substantial part of the available high quality liquid assets (HQLA) at CS was needed for purposes other than covering deposit outflows under stress, in contrast to the assumptions made in the LCR calculation
• The bank hesitated to make use of the LCR buffer and to access emergency liquidity so as to avoid negative signalling to the market

Although not part of the BCBS report, these observations could lead to modifications to the LCR regulation in the future.

Lessons for supervision

With respect to supervisory practices, the BCBS report identifies various lessons learned and raises a few questions, divided into four main areas:

1. Bank’s business models

• Importance of forward-looking assessment of a bank’s capital and liquidity adequacy because accounting measures (on which regulatory capital and liquidity measures are based) mostly are not forward-looking in nature
• A focus on a bank’s risk-adjusted profitability
• Proactive engagement with ‘outlier banks’, e.g., banks that experienced fast growth and have concentrated funding sources or exposures
• Consideration of the impact of changes in the external environment, such as market conditions (including interest rates) and regulatory changes (including implementation of Basel III)

2. Bank’s governance and risk management

• Board composition, relevant experience and independent challenge of management
• Independence and empowerment of risk management and internal audit functions
• Establishment of an enterprise-wide risk culture and its embedding in corporate and business processes.
• Senior management remuneration incentives

3.Liquidity supervision

• Do the existing metrics (LCR, NSFR) and supervisory review suffice to identify start of material liquidity outflows?
• Should the monitoring frequency of metrics be increased (e.g., weekly for business as usual and daily or even intra-day in times of stress)?
• Monitoring of concentration risks (clients as well as funding sources)
• Are sources of liquidity transferable within the legal entity structure and freely available in times of stress?
• Testing of contingency funding plans

4. Supervisory judgment

• Supplement rules-based regulation with supervisory judgment in order to intervene pro-actively when identifying risks that could threaten the bank’s safety and soundness. However, the report acknowledges that a supervisor may not be able to enforce (pre-emptive) action as long as an institution satisfies all minimum requirements. This will also depend on local legislative and regulatory frameworks

Lessons for regulation

In addition, the BCBS report identifies various potential enhancement to the design and implementation of bank regulation in four main areas:

1. Liquidity standards

• Consideration of daily operational and intra-day liquidity requirements in the LCR, based on the observation that a material part of the HQLA of CS was used for this purpose but this is not taken into account in the determination of the LCR
• Recalibration of deposit outflows in the calculation of LCR and NSFR, based on the observation that actual outflow rates at the failed banks significantly exceeded assumed outflows in the LCR and NSFR calculations
• Introduction of additional liquidity metrics such as a 5-day forward liquidity position, survival period and/or non-risk based liquidity metrics that do not rely on run-off assumptions (similar to the role of the leverage ratio in the capital framework)

2. IRRBB

• Implementation of the Basel standard on IRRBB, which did not apply to the US banks, could have made the interest rate risk exposures transparent and initiated timely action by management or regulatory intervention.
• More granular disclosure, covering for example positions with and without hedging, contractual maturities of banking book positions and modelling assumptions 

3. Definition of regulatory capital

• Reflect unrealised gains and losses on assets that are accounted for at amortised cost (AC) in regulatory capital, analogous to the treatment of assets that are classified as available-for-sale (AFS). This is supported by the observation that unrealised losses on fixed-income assets held at amortised cost, resulting from to the sharp rise in interest rates, was an important driver of the failure of several US banks when these assets were sold to create liquidity and unrealised losses turned into realised losses. The BCBS report includes the following considerations in this respect:
  • If AC assets can be repo-ed to create liquidity instead of being sold, then there is no negative impact on the financial statement
  • Treating unrealised gains and losses on AC assets in the same way as AFS assets will create additional volatility in earnings and capital
  • The determination of HQLA in the LCR regulation requires that assets are measured at no more than market value. However, this does not prevent the negative capital impact described above
• Reconsideration of the role, definition and transparency of additional Tier-1 (AT1) instruments, considering the discussion following the write-off of AT1 instruments as part of the take-over of CS by UBS

4. Application of the Basel framework

• Broadening the application of the full Basel III framework beyond internationally active banks and/or developing complementary approaches to identify risks at domestic banks that could pose a threat to cross-border financial stability. The events in the spring of this year have demonstrated that distress at relatively small banks that are not subject to the (full) Basel III regulation can trigger broader and cross-border systemic concerns and contagion effects.
• Prudent application of the ‘proportionality’ principle to domestic banks, based on the observation that financial distress at such banks can have cross-border financial stability effects
• Harmonization of approaches that aim to ensure that sufficient capital and liquidity is available at individual legal entity level within banking groups

Conclusion

The BCBS report identifies common shortcomings in bank risk management practices and governance at the four banks that failed during the 2023 banking turmoil and summarizes key take-aways for bank supervision and regulation.

The identified shortcomings in bank risk management include gaps in the management of traditional banking risks (interest rate, liquidity and concentration risks), failure to appreciate the interrelation between individual risks, unsustainable business models driven by short-term incentives at the expense of appropriate risk management, poor risk culture, ineffective senior management and board oversight as well as a failure to adequately respond to supervisory feedback and recommendations.

Key take-aways for effective supervision include enforcing prompt action by banks in response to supervisory findings, actively monitoring and assessing potential implications of structural changes to the banking system, and maintaining effective cross-border supervisory cooperation.

Key lessons for regulatory standards include the importance of full and consistent implementation of Basel standards as well as potential enhancements of the Basel III liquidity standards, the regulatory treatment of interest rate risk in the banking book, the treatment of assets that are accounted for at amortised cost within regulatory capital and the role of additional Tier-1 capital instruments.

The BCBS report is intended as a starting point for discussion among banking regulators and supervisors about possible changes to banking regulation and supervisory practices. For those interested in engaging in discussions related to the insights and recommendations in the BCBS report, please feel free to contact Pieter Klaassen.

[1] Report on the 2023 banking turmoil (bis.org) (accessed on October 19, 2023)

[2] Although recognized as relevant in relation to the banking turmoil, the BCBS report explicitly excludes from its consideration the role and design of deposit guarantee schemes, the effectiveness of resolution arrangements, the use and design of central bank lending facilities and FX swap lines, and public support measures in banking crises.

First and foremost, the long period of low and even negative swap rates was followed by strongly rising rates and a volatile market, which impacted the behavior of both customers and banks themselves. At the same time, regulatory developments, initiated by EBA’s new IRRBB guidelines, have shifted the banks’ focus to managing their earnings and earnings risk, rather than economic value risks.  

Non-maturing deposits (NMDs) are of particular interest in this respect, given the uncertainty regarding the future pricing strategy and volume developments involved in these products. Moreover, as NMDs are generally modeled with a rather short maturity, the portfolio plays a significant role in the stability of the NII, making this portfolio even more relevant to evaluate in light of the newly introduced Supervisory Outlier Test (SOT) limits on earnings risk (more specific NII), or the local equivalent. 

How does this affect IRRBB management at banks?

The exact impact of these developments is also heavily dependent on the bank’s local market, and corresponding laws and regulation, as well as the balance sheet composition of the bank. In Nordics countries, banks are affected more heavily, given that loans and mortgages generally have shorter maturities, as compared to other Western European countries like Germany and the Netherlands. This yields a smaller maturity mismatch with on-demand deposits at the liability side, such that a natural hedge exists to some extent within the balance sheet. Earlier on, this effect, combined with the rather stable markets, made active ALM, including IRRBB management, less urgent. The incentive to accurately model NMDs was therefore limited, so most banks simply replicate this funding overnight, while banks in other European countries tend to use a longer maturity, as illustrated by figure 1.

{Figure 1: Difference in average repricing maturity of NMDs between Nordic banks and other European banks, based on Pillar 3 IRRBBA and IRRBB1 disclosures from 2022 annual reports}

While the natural hedge already (partially) mitigates the risks from a value perspective to a large extent, investing the full NMDs portfolio overnight leads to relatively high NII volatility, thereby potentially violating regulatory limitations. The return on overnight investments will directly reflect any changes in the market rates, while deposit rates in reality are usually somewhat slower to include such developments. Although the resulting asymmetry between the investment return and deposit rate to be paid to customers yields a positive result under rising interest rates, it can reduce profits when interest rates start to fall.  

Historically, banks in the Nordics experienced less flexibility in the modeling of NMDs, due to regulatory guidelines being somewhat stricter than EBA guidelines. For instance, Sweden’s Finansinspektionen (FI) required banks to replicate these positions overnight. However, relatively recently, the FI updated its regulations (FI dnr 19-4434), allowing banks to somewhat extend the duration of the investment profile, for a limited portion of the portfolio, and up to a maturity of one year. This results in flexibility to update the investment profile to better reflect the expected repricing speed of deposit rates, which could lead to improved NII stability. Additionally, besides applying these revised NMD models for managing banking book risks, they can, when approved, also be used for effective and consistent capital charge calculations under Pillar 2. 

How can these developments be properly managed? 

Even though the recent market developments create additional challenges in IRRBB management for banks, they also provide opportunities. The margin on deposit products for banks is currently improving, since only part of the interest rate rises is passed through to customers. The increased interest rates also mean that more advanced NMD models, with longer maturity profiles, can have a positive impact on the P&L, while simultaneously improving the interest rate risk management. 

In such a rare win-win situation, it is more advantageous than ever to prioritize NMD modeling. In reassessing the interest rate risk management approach towards NMDs, banks should explicitly balance the tradeoff between value and earnings stability when making conceptual choices. These conceptual choices should align with the overall IRBBB strategy, as well as the intended use of the model, to ensure the risk in the portfolio is properly managed. 

In weighing these conceptual alternatives, it is essential to take portfolio-specific characteristics into account. This requires an analysis of historical behavior, and an interpretation of how representative this information is. If behavior is expected to change, a common approach is to supplement historical data with expert expectations of forward-looking scenarios to develop a model that reflects both. Periodically reassessing the conceptual choices ensures a proper model lifecycle of NMD portfolios. This is crucial for accurate measurement of interest rate risk as well as for staying competitive in the current market environment. 

Would you like to hear more? Contact Bas van Oers for questions on developing a non-maturing deposit model.

On Thursday 15 June 2023, Zanders hosted a roundtable on ‘Climate Scenario Design & Stress Testing’. In our head office in Utrecht, we welcomed risk managers from several Dutch banks. This article discusses our view on the topic and highlights key insights from the roundtable. 

In recent years, many banks took their first steps in the integration of climate and environmental (C&E) risks into their risk management frameworks. The initial work on climate-related risk modeling often took the form of scenario analysis and stress testing. For example, as part of the Internal Capital Adequacy Assessment Process (ICAAP) or by participating in the 2022 Climate Stress Test by the European Central Bank (ECB). To comply with the ECB’s expectations on C&E risks, banks are actively exploring methodologies and data sources for adequate climate scenario design and stress testing. The ECB requires that banks will meet their expectations on this topic by 31 December 2024. 

Our view

We believe that banks should start early with climate stress testing, but in a manageable and pragmatic way. Banks can then improve their methodologies and extend their scope over time. This allows for a gradual development of knowledge, data and methodologies within all relevant Risk teams. Zanders has identified the following steps in the process of climate scenario design and stress testing: 

• Step 1: Scenario selection 
  A bank has to select appropriate (climate) scenarios based on the bank’s climate risk materiality assessment. Important to consider in this phase is the purpose for which the scenarios will be used, whether the scenarios are in line with scientific pathways, and whether they account for different policy outcomes (like an early or late transition to a sustainable economy). 

• Step 2: Scope and variable definition 
  An appropriate scope must then be selected and appropriate variables defined. For example, banks need to determine which portfolios to take in scope, which time horizons to include, select the granularity of the output, the right level of stress, and which climate- and macro-economic variables to consider. 

• Step 3: Methodology 
  Then, the bank needs to develop methodologies to calculate the impact of the scenarios. There are no one-size-fits-all approaches and often a combination of different qualitative and quantitative methodologies is needed. We recommend that the climate stress test approach be initially simple and to focus on material exposures. 

• Step 4: Results 
  It is important to use the results of the scenario analysis in the relevant risk and business processes. The results can be used for the bank’s risk appetite and strategy. The results can also help to create awareness and understanding among internal stakeholders, and support external disclosures and compliance. 

• Step 5: Stress testing framework 
  Finally, banks should establish minimum standards for climate scenario design and stress testing. This framework should include, amongst others, policies and processes for data collection from different sources, how adequate knowledge and resources are ensured, and how the scenarios are kept up-to-date with the latest market developments. 

Key insights 

Prior to the roundtable, participants filled in a survey related to the progress, scope and challenges on climate risk stress testing. The key insights presented below are based on the results of this survey, together with the outcomes of the discussion thereafter. 

The financial sector has advanced with several aspects around integrating climate risks in risk management over the past year. This was recognized by all participants, as they had all performed some form of climate risk stress testing. The scope of the stress testing, however, was relatively limited in some cases. For example, all participants considered credit risk in their climate risk scenario with many also including market risk. Only a limited number of participants took other risk types into account. 

Furthermore, all participants assessed the short-term impact (up to 3 years) of the climate scenarios, whereas only around 40% and 10% assessed the impact on the medium term (3 to 10 years) and long term (>10 years), respectively. This is probably related to the fact that all participants used climate scenarios in their ICAAP, which typically covers a three-year horizon. The second most mentioned use for the climate scenarios, after the ICAAP, was the risk identification & materiality analysis. A smaller percentage of participants also used the climate scenarios for business strategy setting, ILAAP and portfolio management. 

The two topics that were unanimously mentioned as the main challenges in climate risk stress testing are data selection and gathering, and the quantification of climate risks into financial impacts, as shown in the graph below: 

• Insight 1: Assessing impact of climate risk beyond the short-term very much increases the complexity and uncertainty of the exercise 
  The participants indicated that climate stress testing beyond the short-term horizon (beyond 3 to 5 years) is very difficult. Beyond that horizon, the complexity of the (climate) scenarios increases materially due to uncertainties of clients’ transition plans, the bank’s own transition plan and climate strategy (e.g., related to pricing and client acceptance policies), and climate policies and actions from governments and regulators. Taking the transition plans of clients into account on a granular level is especially difficult when there is a large number of counterparties. There are no clear solutions to this. Some ideas that take longer-term effects into account were floated, such as adjusting the current valuation of various assets by translating future climate impact on assets into a net present value of impact or by taking climate impacts into account in the long-term macro-economic scenarios of IFRS9 models. 

• Insight 2: Whether to use a top-down or bottom-up approach depends on the circumstances 
  It was discussed whether a bottom-up stress test for climate scenarios is preferable to a top-down stress test. The consensus was that this depends on the circumstances, for example: 
  • Physical risks are asset- and location-specific; one street may flood but not the next. So, in that case a bottom-up assessment may be necessary for a more granular approach. On the other hand, for transition risks, less granularity might be sufficient as transition policies are defined on national or even supranational level, and trends and developments often materialize on sector-level. In those cases, a top-down type of analysis could be sufficient. 
  • If the climate stress test is used to get a general overview of where risks are concentrated, a top-down analysis may be appropriate. However, if it is used to steer clients, a more granular, bottom-up approach may be needed. 
  • A bottom-up approach could also be more suitable for longer-term scenarios as it allows to include counterparty-specific transition plans. For more short-term scenarios, a sector average may be sufficient, considering that there will be less transition during this period.

• Insight 3: Translating the results of climate risk stress testing into concrete actions is challenging 
  The results of the stress test can be used to further integrate climate risk into risk management processes such as materiality assessment, risk appetite, pricing, and client acceptance. Most participants, however, were still hesitant to link any binding actions to the results, such as setting risk limits (e.g., limiting exposures to a certain sector), adjusting client acceptance, or amending pricing policies. However, the ECB does require banks to consider climate impacts in these processes. The most mentioned uses of the climate risk stress testing results were risk identification & materiality assessments and risk monitoring.  

Conclusion 

Most banks have taken first steps in relation to climate scenario design and stress testing. However, many challenges still remain, for example around data selection and quantification methodologies. Efforts by banks, regulators and the market in general are required to overcome these challenges. 

Zanders has already supported several banks with climate scenario design and stress testing. This includes the creation of a climate scenario design framework, the definition of climate scenarios, and by quantifying climate risk impacts for the ICAAP. Next to that, we have performed research on modeling approaches that can be used to quantify the impact of transition and physical risks. If you are interested to know how we can help your organization with this, please reach out to Marije Wiersma.

Seventy banks have been considered, which is an increase of twenty banks compared to the previous exercise.  The portfolios of the participating banks contain around three quarters of all EU banking assets (Euro and non-Euro).  

Interested in how the four Dutch banks participating in this EBA stress test exercise performed? In this short note we  compare them with the EU average as represented in the results published [1].   

General comments

The general conclusion from the EU wide stress test results is that EU banks seem sufficiently capitalized. We quote the main 5 points as highlighted in the EBA press release [1]: 

• The results of the 2023 EU-wide stress test show that European banks remain resilient under an adverse scenario which combines a severe EU and global recession, increasing interest rates and higher credit spreads. 
   
• This resilience of EU banks partly reflects a solid capital position at the start of the exercise, with an average fully-loaded CET1 ratio of 15% which allows banks to withstand the capital depletion under the adverse scenario. 
   

• The capital depletion under the adverse stress test scenario is 459 bps, resulting in a fully loaded CET1 ratio at the end of the scenario of 10.4%. Higher earnings and better asset quality at the beginning of the 2023 both help moderate capital depletion under the adverse scenario. 
   
• Despite combined losses of EUR 496bn, EU banks remain sufficiently apitalized to continue to support the economy also in times of severe stress. 
   
• The high current level of macroeconomic uncertainty shows however the importance of remaining vigilant and that both supervisors and banks should be prepared for a possible worsening of economic conditions. 

For further details we refer to the full EBA report [1]. 

Dutch banks

Making the case for transparency across the banking sector, the EBA has released a detailed breakdown of relevant figures for each individual bank. We use some of this data to gain further insight into the performance of the main Dutch banks versus the EU average.

CET1 ratios

Using the data presented by EBA [2], we display the evolution of the fully loaded CET1 ratio for the four banks versus the average over all EU banks in the figure below. The four Dutch banks are: ING, Rabobank, ABN AMRO and de Volksbank, ordered by size.

From the figure, we observe the following: 

• Compared to the average EU-wide CET1 ratio (indicated by the horizontal lines in the graph above), it can be observed that three out of four of the banks are very close to the EU average. 
• For the average EU wide CET1 ratio we observe a significant drop from year 1 to year 2, while for the Dutch banks the impact of the stress is more spread out over the full scenario horizon.  
• The impact after year 4 of the stress horizon is more severe than the EU average for three out of four of the Dutch banks.  

Evolution of retail mortgages during adverse scenario

The most important product the four Dutch banks have in common are the retail mortgages. We look at the evolution of the retail mortgage portfolios of the Dutch banks compared to the EU average. Using EBA data provided [2], we summarize this in the following chart:

Based on the analysis above , we observe: 

• There is a noticeable variation between the banks regarding the migrations between the IFRS stages. 
• Compared to the EU average there are much less mortgages with a significant increase in credit risk (migrations to IFRS stage 2) for the Dutch banks. For some banks the percentage of loans in stage 2 is stable or even decreases. 

Conclusion

This short note gives some indication of specifics of the 2023 EBA stress applied to the four main Dutch banks.

Should you wish to go deeper into this subject, Zanders has both the expertise and track record to assist financial organisations with all aspects of stress testing. Please get in touch.

References

1. EU-wide stress testing | European Banking Authority (europa.eu) 

2. https://www.eba.europa.eu/assets/st23/full_database/TRA_CRE_IRB.csv  
    

The Zanders purpose

Our purpose is to deliver financial performance when it counts, to propel organizations, economies, and the world forward.

In the below overview, we present an overview of the main ESG-related publications from the European Commission (EC), the European Central Bank (ECB), and the European Banking Authority (EBA).

This is complemented by the most important timelines that are stipulated in these regulations and guidelines. Additional regulations and guidelines that are expected for the next couple of years are also highlighted.

If you want to discuss any of them, don’t hesitate to reach out to our subject matter experts.

But to seize the opportunities ESG must become an integrated part of a bank’s strategy, risk management and disclosure regimes. High-quality data is instrumental to identify and measure ESG risks, but it can be lacking. FIs need to improve their internal data and use of external private and public vendors like Moody’s or the IMF, while developing a framework that plugs any data gaps.

The lack of appropriate ESG data is considered one of the main challenges for many FIs, but proxies, such as using a building’s energy rating to work out its carbon emissions, can be used.

FIs need climate change-related data that isn’t always available if you don’t know where to look. This article will give you an overview of the most relevant data vendors and provide suggestions on how to treat missing data gaps in order to get a comprehensive ESG framework for the green future where carbon measurement, assessment, reporting and trading will be vital

The data challenge

In May 2021, the Network for Greening the Financial System (NGFS) published a ‘Progress report on bridging data gaps’. In this report, the NGFS writes that meeting climate-related data needs is a challenge that can be described along the following three dimensions:

• data availability,
• reliability,
• & comparability.

A further breakdown of the challenges related to these dimensions can be found in Figure 1.

Figure 1: The dimensions of the climate-related data challenge.
Source: Graphic adapted by Zanders from a NGFS report entitled: ‘Progress report on bridging data gaps’ (2021).

Key financial metrics

The NGFS writes that a mix of policy interventions is necessary to ensure climate-related data is based on three building blocks:

1. Common and consistent global disclosure standards.
2. A minimally accepted global taxonomy.
3. Consistent metrics, labels, and methodological standards.

EU Taxonomy, CSRD & EBA’s 3 ESG risk disclosure standards

Several initiatives have started to ignite these needed policy interventions. For example, the EU Taxonomy, introduced by the European Commission (EC), is a classification system for environmentally sustainable activities. In addition, the recently approved Corporate Sustainability Reporting Directive (CSRD) provides ESG reporting rules for large listed and non-listed companies in the EU, including several FIs. The aim of the CSRD is to prevent greenwashing and to provide the basis for global sustainability reporting standards. Another example of a disclosure standard is the binding standards on Pillar 3 disclosures on ESG risks developed by the European Banking Authority (EBA).

Even though policy, law and regulation makers have a big part to play in the data challenge, there are also steps that individual institutions could and should take to improve their own ESG data gaps. Regulatory bodies such as the EBA and the European Central Bank (ECB) have shared their expectations and recommendations on the management of ESG data with FIs.

To illustrate, the EBA recommends FIs “[identify] the gaps they are facing in terms of data and methodologies and take remedial action” and the ECB expects institutions to “assess their data needs in order to inform their strategy-setting and risk management, to identify the gaps compared with current data and to devise a plan to overcome these gaps and tackle any insufficiencies”

Collecting data

Collecting ESG data is a challenging exercise. A distinction can be made between collecting data for large market cap companies, and small cap companies and retail clients. Although large cap companies tend to be more transparent, the data often is dispersed over multiple reports – for example, corporate sustainability reports, annual reports, emissions disclosures, company websites, and so on.

For small cap companies and retail clients, the data is more difficult to acquire. Data that is not publicly available could be gathered bilaterally from clients. For example, one European bank has developed an annual client questionnaire to collect data from its clients.

Gathering data from various reports or bilaterally from clients might not always be the best option, however, because it is time consuming or because the data is not available, reliable, or comparable. Two alternatives are:

1. Use tools to collect the data. For example, using open-source tooling from the Two Degrees Investing Initiative (2DII) to calculate Paris Agreement Capital Transition Assessment (PACTA) portfolio alignment.
2. Collect data from other external data sources, such as S&P Global.

This could be forward-looking external data on macro-economic expectations, international climate scenarios, financial market data or sectoral climate developments. Below we discuss some sources for external ESG and climate change-related data.

External data

Some of Zanders’ clients resort to vendor solutions for acquiring their ESG data. The most commonly observed solutions, in random order, are:

All the solutions above provide an aid to determine if climate related performance data is lacking, or can assist in reporting comparable and reliable data. They all apply a similar process of collecting the data and determining ESG scores, which is illustrated in Figure 2.

Figure 2: Data collection process for ESG data solutions (Source: Zanders).

Additionally, public and non-commercial data and solution providers are available, such as:

Missing data

Given the data challenges, it is nearly impossible to create a complete data set. Until that is possible, there are several (temporary) methods to deal with missing data:

• Find a comparable loan, asset, or company for which the required data is available.
• Distribute sector data based on market share of individual companies. For example, assign 10% of the estimated emission of sector X to company Y based on its market share of 10%.
• Find a proxy, comparable or second-best metric. For example, by taking the energy label as a proxy for CO2 emission related to properties, or by excluding scope 3 emissions and focusing on scope 1 and 2 emissions.
• Change the granularity level. For example, by gathering data on sector level rather than on individual positions.
• Fill in the gaps with statistical or machine learning techniques.

Conclusion

The increased attention to integrating ESG risks into existing risk frameworks has led to a need for FIs to collect and disclose meaningful data on ESG factors. However, there is still a lack of data availability, reliability, and comparability.

Several regulatory and political efforts are ongoing to tackle this data challenge, such as the EU taxonomy. More policy interventions, however, are required. Examples are additional mandatory disclosure requirements, an audit and validation framework for ESG data, and social and governance taxonomies that classify economic activities that contribute to social and governance goals.

In the meantime, FIs have to find ways to produce meaningful insights and comply with regulatory requirements related to ESG risks. Zanders has experienced that there is no one-size-fits-all solution for defining, selecting, implementing, and disclosing relevant data and metrics. It is dependent on the composition of the asset and loan portfolio, the use of the data, and the data that is (already) available. Regardless of how the lack of data is solved, it is important that FIs are transparent about their choices and methodologies, and that the related metrics and scorings are explainable and intuitive.

Sources:
https://www.ngfs.net/sites/default/files/medias/documents/progress_report_on_bridging_data_gaps.pdf
https://ec.europa.eu/info/business-economy-euro/banking-and-finance/sustainable-finance/eu-taxonomy-sustainable-activities_en
https://www.europarl.europa.eu/news/en/press-room/20220620IPR33413/new-social-and-environmental-reporting-rules-for-large-companies
https://zanders-migration.appealstaging.co.uk/en/latest-insights/ebas-binding-standards-on-pillar-3-disclosures-on-esg-risks/
https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Reports/2021/1015656/EBA%20Report%20on%20ESG%20risks%20management%20and%20supervision.pdf
https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.202011finalguideonclimate-relatedandenvironmentalrisks~58213f6564.en.pdf
https://2degrees-investing.org/resource/pacta/