01 - Ind - L1 - ch1 - July06

Part A
Banking risk and regulation

1 The nature of risk and regulation
in banking
The purpose of this chapter is to provide the student with an overview of

the risks and regulations associated with banking. Many of the concepts
and issues introduced have been intentionally simplified; however in
certain instances concepts will be discussed in more depth in
subsequent sections of this study text.
On completion of this chapter the candidate will have a basic understanding

of:
the risks inherent in banking

why banks need to be regulated
current banking regulations
the different risks as defined in Basel II
the impact of risk events on banks, their stakeholders and the
economy
some key concepts involved in banking and financial risk
management
Indonesian banking regulation.
It is important to remember that candidates beginning their studies for

the Indonesia Certificate in Banking Risk and Regulation qualification
are not expected to have expertise in financial risk management.
However, candidates will be expected to understand the basic concepts
of the underlying risks supervisors require banks to manage.
1.1 Banks, risk and the need for regulation
What is a bank?
This chapter outlines regulation as it relates to banks. A bank is an
institution which holds a banking license, accepts deposits, makes loans,
and accepts and issues checks. In contrast a financial services
company is an institution that offers its customers a financial product
such as a mortgage, pension, insurance or a bond.
The above definitions highlight the differences between a bank and a

financial services company. While a bank is a financial services
company, a financial services company is not necessarily a bank. It is
important to understand that the regulation of banks is different from the
regulation of the financial services industry. Banking regulation is a
subset of the overall regulation of financial services.
© Global Association
Global Association of Risk Professionals,
of Risk Professionals, Inc. &Inc.
Badan Sertifikasi Manajemen Risiko A:3
Part A: Banking risk and regulation
What is risk?
The dictionary definition of risk is the chance of disaster or loss. For
purposes of the Certificate, risk is defined as the chance of a bad
outcome. This implies that risk only relates to situations where a negative
outcome could occur and that the likelihood of such an outcome can be
estimated.
Two other risk-related terms are important for the purposes of the
Certificate:
Risk event is defined as the occurrence of an event that creates the

potential for loss (a bad outcome)
Risk loss refers to the losses incurred as a direct or indirect
consequence of the risk event. Such losses can be either financial or
non-financial.
1.1.1 Financial services industry, banks and regulation

Most people are familiar with the regulation of non-financial products.
Many governments set out guidelines or rules that a company must
follow in order to get its product to market. For example, cars are subject
to product regulation, such as the requirement for seatbelts or airbags.
The regulation is there to protect customers.
The financial services industry is also subject to regulations to protect

customers and increase confidence in its products. Banks, however, are
subject to further regulation. Indeed in the case of banking regulation it is
the institution itself that is strictly regulated, not simply the products and
services it offers. While it is common to have regulation covering the
products or services an industry offers. It is more unusual to have every
institution in the industry regulated.
The reason for this high degree of regulation is that the impact of a
failure of a bank can have a deep and long-term impact across an entire
economy. (These long-term affects are discussed in more detail in
Section 1.1.2.)
While a car manufacturer is subject to product regulation, it is not

governed by a regulatory body that regulates every car producer. The car
manufacturer may be subject to corporate law and the disclosure
requirements of stock exchanges; however it is free to capitalize itself in
whatever way, and to whatever extent its management believes is
necessary. The company’s shareholders provide the only restraint on its
management.
This is not the case for banks as they are not free to choose their capital
structure. Capital structure refers to the way in which a bank finances
itself, usually through a combination of equity issues, bonds and loans.
The capital structure of a bank is determined by local supervisors who
A:4 © Global Association of Risk Professionals, Inc.

Global Association of Risk Professionals, Inc. & Badan Sertifikasi Manajemen Risiko
Chapter 1: The nature of risk and regulation in banking
stipulate the minimum capital requirements, as well as the minimum level

of liquidity the bank is required to hold, and the type and structure of its
lending.
If a bank has sufficient capital it has sufficient financial resources to

meet potential losses. If it has sufficient liquidity it has sufficient financial
resources to fund its assets and to meet its obligations as they fall due.
The capital structure of a bank which is shown below will be explained in

detail as you progresses through the chapter. For now simply note that,
given its asset structure, the supervisor requires the bank to hold
minimum capital of USD 50.4 million. The bank illustrated below is
holding USD 80 million, therefore surpassing the supervisor’s
requirement.
Example Capital structure of a bank
Bank A has the following balance sheet

RWA = Risk-Weighted Assets (see Section 2.2)
Assets Amount Risk RWA

USD weight USD
million % million
Domestic government bonds 100 0 0

Cash 10 0 0
Loans to other banks <1yr 200 20 40
Loans to small and medium 390 100 390
enterprises
Loans to local authorities 200 50 100
Loans to major international 100 100 100
companies
Totals 1000 630
Liabilities Amount
Capital 80
Deposits from customers 820
Loans from other banks 100
Total 1000
Minimum capital required by supervisor = USD 50.4 million

1. Ratio of regulatory capital to RWA = 8% of USD 630m = USD 50.4m
2. Comparison of required capital to capital held = USD 50.4m < USD 80m.
Notes:
1. In this example the ratio for regulatory capital is set at 8%
2. Bank A does not trade in the markets (see Section 1.2) and hence does not
have a trading book.

© Global Association Inc. &Inc.
of Risk Professionals, Badan Sertifikasi Manajemen Risiko A:5
It is important to understand that Basel II, and the Certificate, are both
concerned with the regulation of banks and not the financial services
industry. With regard to the European Union (EU), however, Basel II
regulation will cover a wide range of credit institutions (roughly 8,800) as
well as about 2,200 investment firms.
1.1.2 Why regulate a bank?
The need for banks to be regulated as institutions has its origins in the
risk inherent in the system. Unlike the car industry, banks offer a product
that is used by every single commercial and personal customer –
money. Thus the failure of a bank, either partial or total, can affect the
entire economy and is referred to as ‘systemic risk’.
Systemic risk is the risk that a bank failure could result in damage to the
economy out of all proportion to simply the immediate damage to
employees, customers and shareholders.
While most people may not be familiar with the term systemic risk they
do understand what is meant by a ‘run on a bank’. This occurs when a
bank cannot cover its liabilities, i.e. it does not hold enough cash to pay
the depositors who wish to withdraw their funds. The inability to meet
liabilities and repay depositors does not necessarily have to be real; it
can simply be the result of a perception on the part of its customers.
Example A ‘run on a bank’
Bank A is rumored (correctly or not) to have made an extraordinary number

of bad loans that have led to losses. This rumor causes the bank’s depositors
to withdraw their deposits. If Bank A does not hold enough cash, depositors
will be unable to withdraw their money, adding to the concern over the bank’s
stability. This causes more depositors to attempt to withdraw their deposits.
Whether the original problem is real or not, the level of withdrawals means
Bank A is unable to continue business.
The failure of Bank A causes loans to be foreclosed, as the bank no longer

has the deposits to fund them. If Bank A is sufficiently large its closure (or
failure) could have a ripple effect through the local economy; however if it
operates globally, the impact would be greater.
The solvency of a bank is a concern not only for its shareholders,

customers and employees, but also for those who are in charge of
managing the economy as a whole.
Students should look back at the balance sheet given in the example in
Section 1.1.1. The bank in the example has USD 820 million of deposits
from customers but only USD 10 million of cash with which to repay the
depositors immediately. To raise more cash it could sell its government
bond holdings and potentially raise a further USD 100 million. Any
attempt to raise further funds would result in loans being sold or
foreclosed.
A:6 © Global Association

Global Association of Risk Professionals, of Risk
Inc. & Badan Professionals,
Sertifikasi Inc.
Manajemen Risiko
Example Continental Illinois Bank crisis
In May 1984 Continental Illinois National Bank in the US suffered a ‘run’ on its
deposits which in turn prompted the largest bank ‘bail out’ in US history. The
‘run’ was started by rumors that the bank was heading for bankruptcy over
poor credit risks, particularly loans taken over from Penn Square Bank which
had collapsed in 1982. Non-performing loans at Continental had risen to USD
2.3 billion by April 1984.
The bank was particularly vulnerable because it relied heavily on short-term

wholesale deposits raised in the market. It suddenly found that these deposits
were not being renewed on maturity and that overseas depositors, concerned
about the rumors, had begun to shift their deposits away from Continental.
Following failed attempts by the bank to arrange a rescue package with a
consortium of 16 other banks, Continental’s domestic depositors also began
to withdraw their funds.
The global nature of the Continental Illinois funding base and the bank’s size
(at the time it was the 7th largest bank in the US) made it imperative for US
regulators to step in to stop the ‘run’ and prevent it from spreading to other
US banks. In 1984 US regulatory agencies assumed USD 3.5 billion in
Continental Illinois debt.
Prior to the 1930s, ‘runs’ on banks and solvency problems occurred

relatively frequently throughout the world. The frequency of such events
led governments to control banks through regulation, ensuring that they
were well capitalized and reasonably liquid. Supervisors (usually central
banks) sought to ensure that banks could:
meet the reasonable level of demand for depositors to be repaid

without the need to foreclose on loans
sustain a reasonable level of losses as a result of poor lending or
cyclical reductions in economic activity, i.e. survive a recession.
Capitalization and liquidity levels were at first fairly arbitrary, with capital
often related to some percentage of loans. In setting the amount of
capital as a percentage of certain types of loans, it became obvious that
there was a ‘missing link’ in calculating the appropriate capital level for a
bank. This missing link is described using the following example.
Example Bank A only lends to its domestic government, and can always assume that
the loans will be repaid.
Bank B only lends to new businesses. It cannot make the same assumption
as Bank A as some, possibly many, new businesses might fail.
Clearly the economics of lending to the two groups in the example above
would be a balance between what could be charged for the loans,
commonly referred to as the ‘margin’, and the losses that would be
incurred. Any potential investor in Bank A or Bank B is making a
risk/reward decision based on how much risk each bank is willing to take
Global Association
© Global of Risk Professionals,
Association Inc. &Inc.
of Risk Professionals, Badan Sertifikasi Manajemen Risiko A:7
verses how much reward does it wish to gain. In the example above
Bank B would seek to earn a higher margin than Bank A as it would
incur higher losses.
In the case of Bank B, bad debts would unlikely occur at a constant rate
as more businesses would default in a recession rather than during
periods of economic growth. A bad debt occurs when a bank is unable to
recover any of the principal lent to a customer or accrued interest owed.
This would cause the bank to suffer variable losses and an erosion of its
capital as it is forced to cover each of these losses.
To maintain the expectation that it can survive bad debts, a bank will
hold a certain level of funds (capital) from which it would deduct such
losses. In our example Bank B would need to hold significantly more
capital than Bank A. This is because Bank A pursues a lending policy
that, although less rewarding in terms of margin, is more conservative
and carries less risk.
From the above example it can be seen that the ‘missing link’ in
calculating the appropriate capital level for a bank is the amount of risk it
is carrying.
Economic shocks and systemic risk
Despite the best efforts of banks to ensure diversification of their lending

portfolios, many still remain heavily exposed to the economic risks of
their home market. The economy of a country can be greatly affected by:
an external shock, be it a natural disaster or a man-made event,

and/or
economic mismanagement.
Banks exposed to such an economy could suffer a significant increase in

the number of customers defaulting. The increase in the default rate can
be attributed to such things as:
the credit standing of companies affected by the rapid deterioration

of the economy
a significant rise in unemployment levels
an increase in interest rates.
Many banks will have difficulty in safeguarding themselves from

economic shocks in a specific country. However there are certain
actions they can take to mitigate the economic effects, including:
complying with regulation (including Basel II) which increasingly

requires banks to create economic shock scenarios and ensure they
hold sufficient capital to protect stakeholders from the effects of such
shocks
A:8 © Global Inc.

Global Association of Risk Professionals, Association
& Badan of Risk Professionals,
Sertifikasi Inc.
Manajemen Risiko
estimating the resulting levels of bad debts and ensuring their

businesses are capitalized accordingly
reducing the level of risk they hold (risk shifting) by securitizing
assets (selling assets in the form of bonds), taking out insurance,
increasing the syndication of existing and new loans to other banks,
and/or buying credit ‘insurance’ through the credit derivatives market.
Risk and capital
The above examples clearly demonstrate the relationship between risk

and capital. The more risks a business runs the more capital it requires.
Banks are required to hold sufficient capital to cover the risks they run.
This is known as capital adequacy.
It has also become increasingly clear to supervisors that the level of a

bank’s capital and its ability to support losses from its lending and other
activities should be related to the risks of the business it undertakes. In
other words the level of capital should be based on the level of risk (risk-
based capital).
The growth of international banking markets in the 1970s and 1980s led
to the first significant move in the direction of risk-based capital. Thanks
in part to the huge increase in oil prices, countries with large US dollar
surpluses needed to recycle those dollars to countries with significant
deficits. The result was a dramatic growth in international banking and
increased competition. It had become clear to supervisors that
international banks needed to ensure they were capitalized against the
risks they were running. At the same, time lending increasingly took the
form of syndicated loan transactions to multinational companies,
developing countries and major development projects, all of which
represented new areas of lending for many of the banks involved.
1.1.3 Bank risk regulation
Basel I
The Basel Committee on Banking Supervision made the first attempt to

establish a standardized methodology for calculating the amount of risk-
based capital a bank would be required to hold when it published the first
Basel Capital Accord in 1988.
The first Accord only covered credit risk and the relationship between
risk and capital was crude by current standards. A simple set of different
multipliers (known as risk weights) for government debt, bank debt and
corporate and personal debt was multiplied by an overall 8% target
capital ratio. While the exact nature of the risk weights is beyond the
scope of this chapter, the Basel I Capital Accord and risk weights are
discussed in detail in Chapter 2. Students should also refer back to the
example of a bank’s capital requirements that was provided in Section

© Global Association of Inc. & Badan Sertifikasi
Risk Professionals, Inc. Manajemen Risiko A:9
1.1.1. This shows how the supervisors calculate minimum capital

requirements under Basel I.
The Market Risk Amendment
Supervisors in several countries extended the 1988 Accord to make it

more risk sensitive. Supervisors then moved quickly to take advantage
of the work being undertaken by many banks to manage the risks in their
own dealing (trading) operations.
For example, to ensure that risks were controlled and priced correctly
banks started setting internal capital requirements for their trading
desks. The capital requirements were directly related to the risks that the
trading desks were running (see Chapter 4). To do this the banks had to
establish a view of the relationship between risk and capital. This view
was based on the growing use of finance theory, specifically the historic
variability of return from different businesses.
The work undertaken by banks to manage their risks had been given a
great deal of impetus as a result of:
the growth of derivatives markets

option pricing models which directly linked the volatility of the returns
of an underlying market instrument to its price, i.e. risk-based pricing.
The Basel Committee published the Market Risk Amendment to the

original Accord in 1996. In addition to creating a simple set of rules for
calculating market risk, the Basel Committee encouraged supervisors to
focus on appraising the models banks used in risk-based pricing. These
are the Value at Risk models (VaR) and are explained in greater depth
in Chapters 2 and 4.
Basel II
Following the publication of the Market Risk Amendment the Basel

Committee began developing a new Capital Accord which was called
Basel II. After much consultation and debate the new Accord was
adopted in 2004 and is due for implementation in 2006-07.
Basel II links the capital of banks directly to the risks they carry.
The coverage of market risk in Basel II is substantially unchanged from

the 1996 Amendment and its subsequent revisions.
At the same time the coverage of credit risk mirrors, to some extent, the
Market Risk Amendment. Banks are encouraged to adopt a model-
based approach to credit risk pricing and supervisors are encouraged to
appraise these models.
A : 10 © Global Association
Global Association of Risk Professionals, of Risk Sertifikasi
Inc. & Badan Professionals, Inc.
Manajemen Risiko
Operational risk is included for the first time and, as with credit risk, a
model approach is encouraged, although recognition is given to the lack
of industry consensus over the structure of these models.
The Basel II Accord also has provisions for other risks to be taken into
account when calculating the risk-based capital of a bank; however
these are not covered by a model approach.
Local supervisors will be responsible for implementing Basel II in

accordance with their own laws and regulations. The consistent
implementation of the new Framework across borders, through
enhanced supervision and cooperation, is crucial. Consistent
implementation will also be important to avoid confusion over dual
reporting to ‘home’ (where the bank is legally established) and ‘host’
(where the bank may have branches or subsidiaries) country
supervisors.
At this stage it is helpful to compare the two Accords.
Basel I Accord Basel II Accord
Focuses on a single risk measure Focuses on internal methodologies

Has a simple approach to risk Has a higher level of risk sensitivity
sensitivity
Uses a one-size-fits-all approach to Is flexible to fit the needs of different
risk and capital. banks.
Before moving on it is important that students understand each of the major

types of risk covered in the new Accord, as well as their consequences for
bank stakeholders and the economy. The major types are:
market risk
credit risk
operational risk
‘other’ risks.
While a brief introduction to each of these risks is provided below, they

will be examined in greater detail later in this Level.
1.2 Market risk
1.2.1 What is market risk?

Market risk is defined as the risk of losses in on- and off-balance sheet
positions arising from movements in market prices. It is the name given
to a group of risks that stem from changes in interest rates, foreign
exchange rates and other market determined prices such as those for
equities and commodities.
© Global
Global Association ofAssociation of Risk Professionals,
Risk Professionals, Inc.
Inc. & Badan Sertifikasi Manajemen Risiko A : 11
A bank’s exposure to such market-set rates may be a result of either:
traded market risk – where a bank is actively participating in the

trading of market instruments, such as bonds, whose value is
affected by changes in market rates
interest rate risk in the banking book – where a bank is exposed
to the risk of market rates changing because of the underlying
structure of its business, such as its lending and deposit taking
activities.
The best way to understand the above exposure risks is to consider

examples that may occur in a wide variety of banks. However, first
students need to understand an important concept in interest rate risk: the
yield curve.
1.2.2 The yield curve

The yield curve shows the relationship between the effective interest
rate paid and the maturity date of an investment at a given time.
Figure 1.1: A typical yield curve
A typical example of a yield curve is the term structure of interest rates. This
shows the cost of borrowing money against the duration of the debt
instrument (loan, bond etc.). For many currencies there are government
securities, (e.g. bonds) issued for periods of between one day (‘overnight’)
and 20 years. The interest rates for each of these securities are all
nominally different and in general rates for longer periods can be expected
to be higher than those for shorter periods. The yield curve for these bonds
is known as the government yield curve. (Yield curves are discussed in
greater detail in Section 4.4.2.)
Sertifikasi Inc.
Manajemen Risiko
1.2.3 Traded market risk

Traded market risk is the risk of a loss of value of the investments
associated with continually buying and selling financial instruments
(trading) in the market for profit. Traded market risk is incurred
deliberately with a view to profiting from the risk taken.
The following example illustrates how traded market risk occurs.
Example Let us suppose that Bank A wants to engage in trading activities as a

potential profit making activity. It decides to trade government bonds which, in
this example, have interest rates fixed for a period of five years. The value of
the bond will be affected by changes in the interest rate.
If interest rates fall right across the yield curve, the value of the bond itself will
rise because it still pays the five-year bond related interest rate at the time of
purchase.
If in the future the interest rate rises, then the value of the bond will fall
because it pays less than Bank A could get with a new bond purchase.
The change in value of the bond above is one example of traded market
risk. Another is given below.
Example Funding decisions
Bank A can choose to fund the purchase of the bonds described in the above
example by raising the required amount for:
five years at a fixed rate

any number of periods longer than five years
any number of periods shorter than five years.
The bonds are ‘matched’ for interest rate risk if Bank A chooses to fund the
purchase of a newly issued fixed rate five-year bond by raising funds for the
same duration, five years. Any gain on the bonds resulting from falling
interest rates will be offset by a loss on the funds raised, and vice versa.
Bank A in this case has no market risk nor does it have a significant capability
for profit from this particular activity.
If Bank A’s traders believe that interest rates will rise in the future they may
decide that the bank should be funded for a longer term than the duration of
the fixed rate bonds. For example they may raise funds for ten years. If the
traders are correct and interest rates rise, the value of the ten-year fixed rate
debt, which was raised at lower interest rates, would rise more than the value
of the original bonds. Bank A will therefore profit from the overall transaction.
This is known as ‘long funding’. It should be noted that if interest rates fell the
bank would make a loss from the transaction (see the Midland example
below).
of Risk Professionals, Inc. Inc.
& Badan Sertifikasi Manajemen Risiko A : 13
Example If Bank A’s traders believe interest rates will fall in the future they could fund
continued the five-year bonds by raising overnight funds. This is known as ‘short
funding’. The bank will have to renew the funding everyday, but if the traders
are correct, the funding will be at a lower rate each day as interest rates fall
over the period.
Getting the funding decision wrong could be costly. Hence the decision
carries traded market risk.
It should be noted that the above examples are quite simple and ignore
many of the complexities that will be introduced as we consider more
sophisticated instruments and trading strategies. Nonetheless they illustrate
some important fundamental principles of market trading for profit and
students should ensure they fully understand them before continuing.
Example Midland Bank
In 1989 Midland Bank, a major UK bank, lost over GBP 116 million on
interest rate positions held by its investment bank subsidiary, according to
1
Alan Peachey.
1.2.4 Interest rate risk in the banking book
The example above illustrates market risk in the context of trading for
profit, but many banks are faced with the problems of managing similar
risks that occur as a natural consequence of their underlying businesses.
This is called interest rate risk in the banking book, which results from
the business the bank conducts with its customers.
Example Bank A is involved in borrowing from depositors and then lending these funds to
its customers for mortgages. It pays the interest rate set by its central bank for
the deposited funds and lends funds for mortgages at the fixed five-year rate.
In practice the bank has the same ‘short funding’ exposure as the traders wanted
in the previous example on funding decisions. It has this position regardless of
whether the traders think rates are likely to rise or fall. In this example the bank is
not seeking to be a trading bank and is running ‘involuntary’ trading positions.
To avoid running involuntary trading positions Bank A in the example above

will somehow need to match its funding and lending rates (a process known
as hedging), protecting the value of both the deposits and loans. There are
a number of ways a bank can engage in hedging. They include:
changing its underlying business model to offer the same rate on

deposits as is received on loans. In the case of Bank A, it could
change either its lending rate based on the central bank’s discount
rate, or its funding rate to the five-year fixed rate
1
Peachey, Alan. Great Financial Disasters of Our Time. Berlin: BERLIN
VERLAG Arno Spitz GmbH, 2002.
Sertifikasi Inc.
Manajemen Risiko
lending the bank’s deposits to another bank (known as lending

interbank) and raising five-year funding from another bank
if the derivatives markets are available, entering into a swap
agreement with another bank, where it pays the bank the one-month
interbank rate and receives the five-year rate in exchange.
(The central bank discount rate is the interest rate a central bank
charges on a loan to a bank. The one-month interbank rate is used here
as a proxy for the central bank discount rate because the discount rate is
not a market rate.)
Example American savings and loan associations
The American savings and loan associations (S&Ls) are essentially mortgage
lenders, with the ability in some states to make direct investments to own
other businesses and carry out property development.
Until the 1980s they were mainly mutual associations owned by their
members, but as a result of financial disasters (described below) they are
now primarily owned by the federal government or by stockholders.
While estimating the total cost of the bailout of the S&Ls is difficult, some
reports put the figure as high as USD 500 billion. Although there were many
instances of fraud, the root cause of the disaster was twofold.
First, mortgages were issued on properties with greatly inflated prices. When
the property market collapsed the security on many mortgages was wiped
out. Second, although interest rates on a large number of mortgages were
fixed, many customers could repay their mortgages early without penalty
enabling them to refinance their mortgages at a lower cost when interest
rates started to fall. However lenders were still locked into paying higher
interest rates on the borrowings they raised to fund the original mortgages.
This mismatched position of being locked into paying a higher rate for funds,
and the only source of income being new mortgages issued at lower rates,
caused many S&Ls to collapse with losses of billions of dollars.
Market risk is described in greater detail in Chapter 4.
1.3 Credit risk
1.3.1 What is credit risk?
Credit risk is defined as the risk of losses associated with the possibility
that a counterparty will fail to meet its obligations; in other words it is the
risk that a borrower won’t repay what is owed.
Example Bank A lends mortgages to its personal customers. In doing so it runs the risk
that some – or all – of its customers will fail to pay either the interest on the
mortgage or the original sum borrowed.
Credit risk arises from the possibility that loans provided by a bank, or bonds
purchased by a bank, are not repaid. Credit risk also extends to the non-
performance of any other obligations a bank incurs through another party,
such as the failure to make payments under a derivatives contract.
For many banks credit risk is by far the largest risk they run. Typically the
margin charged for accepting the credit risk is only a small proportion of the
total sum lent, and therefore credit losses can rapidly destroy a bank’s capital.
Example Barclays Bank
In its 1992 Annual Report British bank Barclays recorded a pre-tax loss of
GBP 244 million for the year ended 1992, having made provisions of GBP 2.5
billion for bad and doubtful debts during that year. These included a provision
of GBP 240 million against a single loan of GBP 422 million to IMRY, a
property developer. The bulk of the losses stemmed from the UK property
crash in the early 1990s.
1.3.2 Methods of managing credit risk
Banks employ a number of different techniques and policies to manage

credit risk in order to minimize the probability or consequences of credit
loss (known as credit risk mitigation). These include:
grading models for individual loans

loan portfolio management
securitization
collateral
cash flow monitoring
recovery management.
To increase students’ understanding of credit risk the various methods

are described below.
1.3.3 Grading models
Regular bad lending is possible, but unlikely, if banks pursue sound lending
policies. The first step is to create detailed credit grading models which are a
way of establishing the odds of default. They therefore calibrate the risk,
allowing banks to assign a probability to a bad outcome (known as the
probability of default – PD). This should allow banks to ensure that they do
not concentrate their lending books (their portfolio) in poor quality loans with a
high probability of default (failure to honor the debt).
Credit rating agencies such as Moody’s Investors Service and Standard

& Poor’s use grading models to produce a wide range of risk sensitive
grades (credit grades) to cover the credit risk of bonds.
Sertifikasi Inc.
Manajemen Risiko
Example A single factor grading model
Bank A lends mortgages to its customers. In order to ensure it minimizes the

credit risk it produces a simple grading model. In this case Bank A groups the
loans by the percentage of the current property value it lends to the borrower.
It then calculates the probability of each group of loans resulting in a loss to
the bank and adjusts its pricing policy to ensure the portfolio is balanced
between loan types.
The bank would expect the potential losses on loans advanced at 50% of the
current property value to be far less than those advanced at 100%. It can
then adjust the pricing of loans to optimize its return on risk.
It should be noted that in practice grading models consider several

additional factors. For example percentage of borrower’s income
devoted to paying the interest on the loan, the borrowers employment
history, and the number of years of loan repayment compared with the
borrower’s age.
Basel II specifically addresses grading models as part of its credit risk

framework.
1.3.4 Loan portfolio management

Banks similarly measure their loan portfolios to ensure that their lending
is not overly concentrated in a single industry, or in a single geographic
area. This allows a bank to ensure that its portfolio is well diversified. A
loan portfolio that is well diversified means that the risk of systematic
default is also low. This form of analysis is known as cohort analysis
and can be applied to both corporate and personal loans.
1.3.5 Securitization
To safeguard against the impact of economic shocks banks are required

by Basel II to estimate the effects of such events and ensure that their
businesses are capitalized accordingly. In addition to allocating capital,
banks take other action to safeguard themselves. One technique banks
use to insulate themselves from such shocks is to ‘package’ and then
sell, as securities, parts of their lending portfolio to investors. This is
known as securitization.
Securitization allows banks to reduce potentially high levels of exposure

to specific forms of lending which their scenarios show to be most at
risk, or where they have high concentration of risk. It then allows banks
to take the funds generated from the asset sales and invest them in
other assets which are assumed to carry a lower risk.
1.3.6 The role of collateral

Collateral is defined as assets pledged by a borrower to secure a loan
or other credit, and which are subject to seizure in the event of default.
Collateral plays a major role in the lending policies banks adopt. It can
take many forms, the most obvious and most secure being cash, and the
most common being residential property.
Example Bank A advances money for a customer to buy a house and takes, as
security, the right to take possession of the house if the scheduled loan
repayments are not made. In this example the house forms the collateral on
the mortgage loan.
It is important that banks ensure that the collateral taken really does
mitigate the risks in circumstances where the borrower defaults. Many
forms of collateral may be very specific to the business being
undertaken. If the business itself proves unprofitable the assets of the
borrower may also prove to be of little value. A bank must ensure that
the collateral will retain value in the event of default.
Example Bank A lends to an automaker and takes as security the right to take
possession of the plant and equipment in the event of default. Due to a lack
of sales the automaker collapses and defaults on the loan. Bank A takes
possession of the plant and equipment but finds that, due to the general state
of the car industry, the equipment has little resale value. The collateral value
falls far short of the outstanding loan and Bank A makes a considerable loss.
Basel I was very limited in the type of collateral it recognized. However

Basel II recognizes a wider range of collateral, especially in its more
advanced Internal Ratings-Based (IRB) approaches to credit risk.
(Internal Ratings-Based approaches to credit risk are discussed in
greater detail in Level 3.)
1.3.7 Cash flow monitoring

Many banks that have suffered from high levels of default have found
that rapid reaction to a deteriorating credit situation can significantly
reduce the problem. Banks have lowered their credit risk by:
limiting their level of exposure (known as exposure at default – EAD),

and
ensuring that customers react quickly to changed circumstances.
Many credit models pay special attention to the cash flow of companies
and individuals, as reflected in their bank accounts.
1.3.8 Recovery management
Many banks have found that the efficient management of defaulted

loans can lead to a significant recovery of the original loss. They have
Sertifikasi Inc.
Manajemen Risiko
thus developed departments dedicated to handling recovery situations

as an important part of high-quality credit risk management processes.
Loss given default (LGD) is the estimated loss that a bank will sustain as
a result of a default occurring. The establishment of LGD and its
management both play a role in the Internal Rating-Based approaches
to calculating credit risk capital. The value of LGD in the Advanced IRB
Approach is directly influenced by the bank’s estimate of how much it
could recover on a loan default.
1.4 Operational risk
1.4.1 What is operational risk?
Operational risk is the risk of loss resulting from inadequate or failed

internal processes, people and systems, or from external events.
The above definition is set forth in the Basel II Framework. Operational

risk can be further divided into sub-categories, such as the risk
associated with:
internal processes
people
systems
external events
legal and regulatory requirements (legal risk).
(These will be covered in greater depth in Chapter 6.)
Over the last 15 years there have been many examples of operational
risk incidents which generated significant losses for the companies
involved. The following two examples highlight different categories of
operational risk failures.
Example Barings
In 1995 Baring Brothers and Co. Ltd. (Barings), London, collapsed after
incurring losses of GBP 827 million following the failure of its internal control
processes and procedures.
A Singapore-based trader working on the Singapore Futures Exchange was

able to hide losses from his ever-increasing trading positions for more than
two years until they became unsustainable. Due to the lack of local control
measures, the trader had been acting as both the back and front office
settlement manager, authorizing his own deals. Although perceived as a
‘rogue trader’ incident the failure of internal controls was identified as one of
2
the key causes.
2
Report of the Board of Banking Supervision Inquiry into the Circumstances of
the Collapse of Barings, Bank of England Official Report, HMSO, 1995.
Example Technology/globalization
This operational risk example affects virtually every industry not just banking.
It is also not a single event but, unfortunately, an on-going series of events.
This is the impact of computer viruses that cause billions of dollars of damage
to businesses worldwide. The Melissa virus, one of the most infamous,
appeared in March 1999 and is estimated to have affected 45 million
personal computers in just a few days. It ultimately cost business an
estimated USD 500 million. In 1990 there were 200 reported viruses; by the
end of 2004 the number had risen to more than 70,000.
Although the Basel II definition of operational risk excludes business,

strategic and reputational risk, it has the provision for other risks to be
taken into account when calculating the risk-based capital of a bank.
These risks need to be continuously monitored and are discussed later in
this chapter (see Section 1.5).
Operational risk is primarily related to the myriad of problems that can result
from the failure of processes within a bank. However operational risk affects all
businesses not just banks. For example automakers can suffer an operational
loss by not adopting strict quality control measures on new models.
Operational risk is the most important risk affecting customers on a day-to-

day basis. This is why banks are increasingly focusing on the processes,
procedures and controls associated with operational risk. Over the last 20
years the mismanagement of operational risk has been at least as
damaging to the value of individual banks as credit and market risk.
All banks are familiar with operational failures and will already have
plans and processes in place for the management of these risks. The
most obvious day-to-day problems that affect every bank include:
failure to reconcile payments made and received from other banks

transactions incorrectly entered by traders or back office staff
resulting in incorrect market positions and problems in reconciling
the positions held
failure to balance the credits and debits received by the bank
a key transaction system failure following the upgrade of a computer
system
external events such as a power failure or flood.
Over the last 15 years there has been a general increase in the number
of high profile operational risk events that have had a severe impact on
banks’ profitability and capital. As a result supervisors have been
encouraging banks to look at their processes as broadly as possible and
to consider low frequency/high impact events outside the areas of credit
and market risk. The Basel II regulations have moved operational risk
management forward. They require, for the first time, that a bank quantify
this risk, measure it and allocate capital towards operational risk in the
same way as for credit risk and market risk.
Sertifikasi Inc.
Manajemen Risiko
1.4.2 The changing face of operational risk
Operational risk is not a new risk class; indeed it is a very old one.
Operational risk failures are commonplace and have been occurring
since the first bank was set up.
Both supervisors and banks are concerned that changes in the banking
industry are also causing the nature of operational risk to change. Events
that have historically resulted in relatively low-cost errors are being
supplemented or even replaced by events that occur less frequently, but
which have a much larger impact.
There are several reasons why the nature of operational risk is

changing. They include:
automation
reliance on technology
outsourcing
terrorism
increased globalization
incentives and trading – the ‘rogue trader’
increasing transaction volumes and values, and increased litigation.
(These and other causes will be discussed in more detail in Chapter 6.)
1.5 Other risks
The Basel II Framework is very specific regarding what is included under the
heading ‘Other risks’. Although not directly covered by the regulation they are
important because banks need to take into account many risks when
computing their risk-based capital. Three risks, considered other risks, are:
business risk
strategic risk
reputational risk.
Students should note that while these are not included in the Basel II
definition of operational risk many banks do include them in their own
definitions and manage them accordingly.
1.5.1 Business risk
Business risk is the risk associated with the competitive position of the
bank, and the prospect of the bank prospering in changing markets.
While business risk is not included in the Basel definition of operational

risk it is clearly a major concern for a bank’s senior management and
board of directors. Business risk encompasses, for example, the short-

and long-term prospects for existing products and services.
Example Bank A provides mortgages to its customers. Its senior management decides
to increase its market share by aggressively discounting its mortgage rates,
while offering 100% (loan-to-value) mortgages. This business decision carries
a high degree of risk as it over-exposes Bank A to the property market and
any subsequent rise in underlying interest rates. This may cause borrowers’
mortgage costs to rise and could result in additional defaults. Furthermore, a
reduction in property prices will cause the security value to fall below the
value of the loans.
Given that rising interest rates and falling property prices can happen at the
same time, this business decision clearly has risk.
Although Bank A rapidly expands its market share, the quality of the new
mortgages is low. When interest rates rise Bank A finds that many of its
customers have over-borrowed and can no longer afford the repayments.
Example BestBank
In July 1998 BestBank of Boulder, Colorado, US was closed by the Colorado

State Bank Commissioner as a result of unsustainable losses of
approximately USD 232 million. These losses resulted from its policy of
pursuing rapid growth by providing credit card finance to low quality
3
borrowers.
BestBank’s credit card policy is a classic example of a bank lending money to

high-risk customers at a high rate of interest to grow its business. Although
the bank was apparently generating high rates of return, BestBank failed to
make sufficient provisions for the inevitable bad debts.
1.5.2 Strategic risk
Strategic risk is the risk associated with the long-term business

decisions made by a bank’s senior management. It can also be
associated with the implementation of those strategies.
Strategic and business risks are similar; however they differ in the
duration and importance of the decision. Strategic risk deals with
decisions such as:
which businesses to invest in

which businesses to acquire, and/or
where and to what extent businesses will be run down or sold.
3
See Managing the Crisis: The FDIC and RTC Experience. Federal Deposit
Insurance Corporation, Washington, D.C., May 2005.
Sertifikasi Inc.
Manajemen Risiko
Example Bank B accepts deposits from its customers and extends personal loans to
them. Bank C is a mortgage business that only provides mortgages to its
customers.
The senior management of Bank B decides to extend the bank’s business,

entering the mortgage business by acquiring Bank C. This decision carries
strategic risk because Bank B is taking a long-term strategic decision and
moving into a business in which it has no experience.
Example Merrill Lynch
In 1998 Merrill Lynch, a major US bank, acquired Yamaichi Securities and

attempted to introduce US-style retail banking services into the Japanese
market. Merrill Lynch’s strategic decision to expand its Japanese operations
proved unsuccessful. In 2001 the bank was forced to reduce the size of its
Japanese branch network, and lay off the majority of employees. Over just
three years Merrill Lynch’s Japanese business had lost USD 928 million. Merrill
Lynch had misjudged the market by attempting to change the way financial
products were sold in Japan. It had also encountered cultural difficulties and a
4
depressed market.
1.5.3 Reputational risk
Reputational risk is the risk of potential damage to a firm resulting from

negative public opinion.
Reputational risk is similar to business risk in that it is excluded from the

Basel II definition of operational risk. The example in Section 1.1
illustrates reputational risk as it shows that a ‘perceived lack of funds’
could cause ‘a run on a bank’. The bank’s reputation was damaged
because of a risk event. Its customers became concerned; this in turn
led to a crisis in confidence.
Today the risk to a bank’s reputation has increased both in terms of its
severity as well as the speed with which losses can occur. This is because
financial markets are global and are trading 24 hours a day. Thus damage
to many international banks’ reputations can happen at any time, in any part
of the world and be reported in real time across the globe.
Reputational risk is not just limited to the reputation of an individual

bank. It can encompass whole sectors of the banking industry, for
example mortgage banking or internet banking. Even though the risk
event might occur in only one bank where there were inadequate risk
controls, the reputation of the individual product or sector could be
affected throughout the banking industry as a whole. What started as an
isolated incident could, based on how it is reported, end up damaging
the reputation of the entire industry.
4
See Financial Times, January 10, 2002.
Example Industry-wide reputational risk
Bank C is an internet-only bank. Following the upgrade of its online security

software, a glitch in the software allowed some customers to read the bank
statements of other customers. Although they weren’t able to authorize any
transactions on other customers’ accounts, the incident is reported as an
internet security breach for online banks. This leads to media reports
speculating on “how safe is your money online”? The potential for online
fraud gives the perception that internet banks are inherently insecure. Despite
no actual loss to any customers, the public’s confidence in online banking
collapses and the reputation of internet banks plummets. As a result the
number of customers at internet-only banks drops dramatically leading to a
catastrophic loss of earnings which forces some online banks to collapse.
As highlighted in the example above, an event that initially has a minor

impact could end up producing long-term loss if the impact on the bank’s
reputation is not effectively managed. Quantifying the loss resulting from
reputational risk can be difficult given the long-term and widespread
nature of the effects.
Example NatWest Bank
In February 1997, after announcing its 1996 results, National Westminster

Bank (NatWest), a large British bank, disclosed a ‘black hole’ in its options
portfolio amounting to GBP 90 million as a result of mispricing of the bank’s
options portfolio since late 1994. It was thought the mispricing was due to
staff errors rather than fraud. NatWest’s own inquiry, undertaken by the
accountants Coopers & Lybrand and law firm Linklater & Paine, concluded
that the computer models and systems were incapable of correctly revaluing
5
positions.
The episode was a public relations disaster for NatWest because it

highlighted the bank’s inability to manage its trading operations. NatWest was
fined by the Securities and Futures Authority for a breakdown in its internal
controls because inadequate valuation of trading positions had been
previously highlighted by both internal and external auditors.
It is worth noting that this incident contributed to NatWest being subsequently

6
taken over by the then much smaller Royal Bank of Scotland (RBS). It is
very unusual for a large bank to be taken over by a smaller bank and the
success of the RBS bid was largely attributed to the excellent reputation of its
management.
5
See Financial Times, May 19, 2000.
6
See FT.com, Financial Times Group, May 18, 2000.
Sertifikasi Inc.
Manajemen Risiko
1.6 The potential consequences of failing to manage

risks in banking
1.6.1 The impact of risk

In addition to the direct financial loss a risk event can have on a bank, it
can also have an impact on the bank’s different stakeholders –
shareholders, employees and customers – as well as the economy.
Generally the effect on shareholders and employees is direct; however
the consequences for customers can be indirect and therefore less
obvious. These indirect risk losses are often the consequence of the risk
event having an economic impact. The potential impact on both
stakeholders and the economy is explained below.
1.6.2 Effects on shareholders
When an event occurs shareholders can be affected by the:
total loss of their investment – the collapse of the company

reduction in the value of their investment – the share price might fall
either due to reputational damage or reduced profits
loss of dividends resulting from reduced company profits
liability for the loss – shareholders may be liable for the loss incurred.
Example BCCI
In July 1991 the Bank of Credit and Commerce International (BCCI)

collapsed as a result of approximately USD 4 billion in internal fraud and USD
14 billion of liabilities.
Following the collapse of BCCI it was found that the bank was essentially
worthless, which affected investors around the world. Liquidators were
subsequently appointed to ‘wind up’ BCCI and recover the maximum amount
of assets for its depositors and creditors. In the seven years following BCCI’s
collapse it was estimated that liquidators had successfully recovered more
than USD 5.5 billion.
1.6.3 Effects on employees
The employees of a company can be affected by a risk event,

irrespective of their involvement. Possible effects include:
internal disciplinary proceedings due to negligence or deliberate

action by the employee
loss of earnings, for example a reduction in bonuses or pay rises due
to the impact on company earnings
loss of employment.
Example Orange County
In December 1994 the government of Orange County, in the US state of

California, stunned the markets by announcing that its investment pool had
suffered a USD 1.6 billion loss. This was the largest loss ever recorded by a
local government authority in the US. The loss was the result of investments
by the county treasurer who was responsible for managing a portfolio of USD
7
7.5 billion belonging to county schools, cities and the county itself.
The treasurer’s investments in derivatives assumed that interest rates would

either fall or remain low. This investment strategy worked well until 1994
when the Federal Reserve Board instigated a series of interest rate increases
causing severe losses in Orange County’s investments. The investment pool
was liquidated in December 1994 realizing losses of USD 1.6 billion.
As a direct consequence of this loss Orange County declared bankruptcy and

laid off many employees.
1.6.4 Effects on customers
The effects of a risk event on customers can be either direct or indirect

and may not be immediately identifiable. The effects could also continue
over an extended period and have an additional impact on the bank.
Therefore it is very difficult to quantify the total loss associated with a
risk event where customers are concerned.
It is important that students understand the consequences of risk for a

bank’s customers because they highlight the need to regulate banks
specifically, rather than regulating the financial services industry as a
whole.
The consequences for a bank’s customers include:
a reduction in the level of customer service

a reduction in product availability
a liquidity crisis
changes in regulation.
1.6.5 Operational risk and customer service

It has already been stated that the risk which most affects customers on
a day-to-day basis is operational risk. When an operational event occurs
customers can be directly affected through:
the wrong or poor quality service

a partial interruption of service
a real or perceived lack of security
a total lack of service.
7
Orange County Case: Using Value at Risk to Control Financial Risk.
Professor Philippe Jorion, www.gsm.uci.edu/~jorion/oc/case.html, April 2005.
Sertifikasi Inc.
Manajemen Risiko
The interruption of normal customer service can have an impact on the

bank’s reputation which will, in turn, impact the bank’s profitability as
customers take their business elsewhere. This is particularly important if
the operational risk event has been caused by a technical problem which
has affected thousands of customers.
The impact of an operational risk event on customers can subsequently

result in other types of financial loss for a bank. These include:
payments to individuals as compensation for indirect losses

litigation costs
regulatory penalties.
Example Cahoot
Cahoot, the online bank set up by Abbey National Bank of the UK, ran into
technical problems shortly after it was launched in June 2000, as reported in
8
the Financial Times. Early on the system collapsed and was unavailable for
almost two days; it was then plagued by additional problems for a further
three days. Cahoot's strategy was to offer the first 25,000 customers interest-
free overdrafts and credit cards. A rival of the online bank questioned whether
Cahoot had invested enough in the system’s capacity to cope with the level
of demand it subsequently received.
It was taking between 10 to14 days to approve customers because the bank
was conducting money laundering checks on potential clients. In addition to
rejecting applicants with a history of excessive credit, anyone living in an
apartment was also likely to have been turned down as the website could not
cope with addresses such as 35a, ‘garden flat’ or ‘top flat’ (all common
address designations in the UK).
1.6.6 Economic impact of a risk event
Over lending – a cyclical phenomenon
There have been several banking crises that can be attributed to classic
problems such as ‘over lending’ during booming economic conditions. A
problem that was unseen at the time could in the future prove to be
disastrous for individual banks, and produce damaging side effects for
their customers and for the economy as a whole.
Banks that have ‘over lent’ in a boom will inevitably ‘under lend’ in any
subsequent recession. This is because the impact of a recession
reduces a bank’s capital as it is forced to write-off bad loans. This in turn
reduces the ability of a bank to lend in the future without recourse to new
capital.
8
See Financial Times, June 17, 2000.
This so-called ‘procyclicality’ effect can be clearly seen in the prevalence

of lending into ‘asset bubbles’. Excessive lending during a booming
market leads to unrealistic expectations of returns and unrealistic
valuations of assets, as has occurred in commercial and residential real
estate and equities markets, at various times, throughout the world.
Example The ‘dotcom’ bubble
In the late 1990s investors were desperate to invest in internet companies as

this was seen as the ‘get rich quick’ sector of the market. This led to vastly
over valued companies with artificially high equity prices. The market proved
unsustainable as companies failed to make the predicted returns with many
sliding deeper and deeper into debt. Eventually in 2000 and through 2001 the
market collapsed with investors losing billions. In November 2000 it was
estimated that in the previous eight months more than GBP 40 billion had
been wiped off the value of dotcom companies in the FTSE TechMark index
in London.
For the next few years it was virtually impossible for internet companies to
raise investment irrespective of the quality of their business plans.
The area of ‘procyclicality’ is one where future research on credit risk

modeling and management is likely to be concentrated. Basel II has
been criticized for potentially increasing the ‘procyclicality’ of bank
lending as it links the results of credit grading models (see Section 1.3.3)
to a bank’s regulatory capital requirements. Thus any general
deterioration in the credit grading of loans will lead to an increase in
regulatory capital requirements regardless of whether loan defaults have
increased.
Market risk and liquidity
The consequences of a market risk event are growing as markets

continue to trade more and more assets. This asset growth in traded-
markets has not been trouble-free. Mathematical models which are used
to assist in identifying and understanding risk and pricing have come a
long way, but there is still a distance to go before they can be
considered completely reliable indicators of market risk trends.
The problems that Long-Term Capital Management (LTCM)

encountered illustrate this.
Sertifikasi Inc.
Manajemen Risiko
Example Long-Term Capital Management
In September 1998 Long-Term Capital Management (LTCM) was rescued

from collapse by 16 major counterparties that had agreed to invest USD 4
billion to enable it to ‘wind down’ its USD 200 billion market exposure in an
9
orderly fashion.
LTCM’s investments were not long term and its capital was mainly provided
by banks, permitting the investors to ‘gear up’ and make massive profits from
comparatively small price movements. Unlike investment trusts which can
borrow money only to a limited extent, LTCM was able to borrow many times
the amount of its own capital which ultimately led to its near-collapse.
By August 1998, three quarters of LTCM’s total notional derivatives exposure

of more then USD 1 trillion was in the form of interest rate swaps with some
50 counterparties worldwide, none of whom knew the extent of LTCM’s
overall exposure. Bear Sterns, the Wall Street firm handling LTCM’s
settlements, ‘pulled the plug’ on the company initially by calling in a USD 500
million payment that LTCM was unable to meet because of its inability to sell
supposedly highly liquid assets in such large volumes.
Liquidity crises may be rare today in retail banking (see Section 2.1.1);
however they are more common in wholesale markets. Wholesale
banks, which don’t have deposits from retail customers, depend on
assets to collateralize their market borrowing. These include assets such
as government bonds and corporate bonds. If these assets become
illiquid, (i.e. investors are either not prepared to purchase them or would
only do so at greatly reduced valuations), a liquidity crisis could ensue.
Liquidity crises can and do appear in wholesale markets. To lessen the
impact of a liquidity crisis there needs to be:
increasing vigilance on the part of supervisors

rapid reaction from central banks, and
close monitoring by bank management.
It is partly because of these changing market conditions that the Basel II

Accord, with its greater risk sensitivity, has been created. It is important
that Certificate candidates understand the significance of issues discussed in
this section.
Sarbanes-Oxley (SOX)
Regulating bodies often introduce new rules in response to a particular

problem to minimize the chance of it recurring. The introduction of such
regulations can have an indirect effect on a bank’s customers, either
through the cost of implementation or through a change in perceived
values. An example of increased regulation following a risk event was
the passage in the US of the Sarbanes-Oxley Act of 2002 which set out
statutory requirements for corporate accountability. The legislation was
9
See Financial Times, September 25, 1998.
introduced following accounting scandals associated with the collapse of

companies such as Enron and WorldCom.
International Accounting Standards (IAS)
In 2005-06 international accounting standards will be widely introduced,

particularly across the EU. These are likely to affect the way in which a
number of banks account for, amongst other things, the hedging of their
underlying interest rate risk in the banking book. There is the possibility
that some hedges may be disallowed for accounting purposes,
subsequently affecting the level and volatility of a bank’s profitability.
Some in the banking industry feel that there is a potential for conflict
between the best practices of risk management under Basel II and the
hedging rules under IAS.
The introduction of IAS is also likely to affect banks’ disclosures in their

Reports and Accounts, which take on greater importance under Basel II
Pillar 3 disclosure requirements. It is unusual to consider a new set of
accounting regulations as a risk event. However, if the introduction of
international accounting standards alters the perception of the future
profitability of some banks it is clearly a risk event. Therefore, it will need to
be carefully managed and any adverse effects explained to stakeholders.
1.7 The Indonesian banking system and regulation
1.7.1 The Indonesian banking system
Banking legislation enacted in 1992 and 1998 created two types of banks
within Indonesia. Commercial banks offer a full range of financial
services including foreign exchange services. They have access to the
payment system and provide general banking services.
People’s Credit Banks, known as BPRs, are much smaller than

commercial banks and are usually operate locally. They can accept
deposits but do not have access to the payment system.
In addition to banks there are small non-bank institutions such as village

credit institutions (BKD) and rural credit unions (LDKP).
1.7.2 Banking regulation
The regulation of the banking system has developed rapidly since 1998
in response to the many challenges presented by the domestic financial
marketplace. Many areas of the financial markets have been covered by
new regulations thus creating a comprehensive regulatory framework.
Table 1.1 below gives an outline of the structural acts and regulations
that have come into force since 1998.
Sertifikasi Inc.
Manajemen Risiko
Table 1.1
Act/Regulation Purpose
Banking Act 1998 amending the This amendment to the 1992 Act defines
Banking Act 1992 each type of bank together with the
requirements and restrictions applicable to
each
Bank Indonesia Act 1999 Established Bank Indonesia as the

independent central bank for Indonesia. It
also set out the objective and tasks of the
bank
Audit and Compliance 1999 Defines the requirements for audit and
compliance functions within banks
Commercial Banks 2000 Sets out the licensing and operating

requirements of a commercial bank
Know Your Customer Principles Defines the procedures and practices

2001 banks must use to identify customers and
monitor the activity on their accounts
Fit and Proper Test 2003 Sets out the fit and proper tests carried out
by Bank Indonesia on controlling
shareholders and senior management of
banks
Market Risk 2003 Defines the minimum capital requirements

for commercial banks with respect to their
market risk positions
Risk Management 2003 Defines the risk management infrastructure

required of banks
Commercial Bank Business Plan Sets out the requirement for commercial
2004 banks to develop and submit a short- and
medium-term business plan
Legal Lending Limit 2005 Sets the concentration of risk within a

bank’s lending portfolio
Debtor Information System 2005 Requires banks to submit information on all

debtors to a central credit bureau
Asset Securitization 2005 Defines the principles to be followed by

banks in the use and execution of asset
securitization
Good Corporate Governance Defines the corporate governance

2006 principles to be followed by community
banks.
In addition Bank Indonesia has published the Indonesian Banking

Architecture which sets outs the direction, outline and working structures
for the banking industry over the next five to ten years. The changes will
be implemented in stages covering the following objectives:
to reinforce the structure of the national banking system

to improve the quality of banking regulation
to improve the supervisory function
to improve the quality of bank management and operations
to develop banking infrastructure
to improve customer protection.
Sertifikasi Inc.
Manajemen Risiko
Sample questions
1. Banks are constrained in their capital structure by regulation aimed

at protecting:
a) Shareholders c) Customers
b) The economy d) Management
2. Banks usually suffer from economic shocks because:
a) They are heavily exposed c) They are heavily exposed to

to their domestic economy corporate customers
b) They are heavily exposed d) They are heavily exposed to
to personal customers the international economy
3. Basel II requires banks to measure their capital requirements

because:
a) The less liquidity a bank c) The more deposits a bank

has the more capital it has the more capital it needs
needs to hold to hold
b) The more loans a bank has d) The more risk a bank has the
the more capital it needs to more capital it needs to hold
hold
4. Securitization allows a bank to manage directly:
a) The size of its capital base c) The size of its deposit base
b) The size of its lending book d) The size of its liability base
5. Interest rate risk in the banking book results from:
a) The value of a bank’s c) The structure of a bank’s

derivatives book business
b) The value of a bank’s bond d) The value of a bank’s lending
book portfolio
6. Which one of the following is an example of traded market risk?
a) The US savings and loans c) The Continental Illinois crisis

crisis in the 1980s of 1984
b) The Midland Bank crisis of d) The Barings crisis of 1995
1989
7. In which years did banking legislation create two types of banks in

Indonesia: Commercial banks and People’s Credit Banks?
a) 1992 and 1996 c) 1992 and 1998

b) 1996 and 1998 d) 1994 and 1996
Answers can be found in the Appendix.
Sertifikasi Inc.
Manajemen Risiko
Summary
This chapter has introduced a number of key concepts and issues

involved in risk and regulation in banking. Students should review this
summary before proceeding.
Banks, risk and the need for regulation
Risk is defined as the chance of a bad outcome.

Risk event is defined as the occurrence of an event that creates the
potential for a bad outcome.
Risk loss refers to the losses incurred as a direct or indirect consequence
of the risk event. Such losses can be either financial or non-financial.
Banks are regulated to protect the customer and the economy from
process and procedure failure.
Bank regulation differs from industry regulation in that it is the bank
itself, and not just its products, that is regulated.
The solvency of a bank is a concern not only for its shareholders,
customers and employees, but also for those who are in charge of
managing the economy as a whole.
Capital structure refers to the way a bank finances itself, usually
through a combination of equity, issues, options, bonds and loans.
Basel II is concerned with the regulation of banks and not the
financial services industry as a whole.
To maintain the expectation that a bank can survive its bad debts, it
will hold a certain amount of capital.
There is an important relationship between risk and capital: the more
risks a business runs the more capital it requires.
Banks are required to hold sufficient capital to cover the risks they
run. This is known as capital adequacy.
The Basel Committee on Banking Supervision made the first attempt
to establish a standardized methodology for calculating the amount
of risk-based capital a bank would be required to hold when it
published the original Basel Capital Accord in 1988.
The effect of economic shocks on banks can be minimized through
regulation.
The impact of risk events can be minimized through regulation.
The first Capital Accord (Basel I) only covered credit risk.
Market risk was added through the Market Risk Amendment of 1996.
Basel II is about regulating banks and how they manage the risks in
their portfolios.
Basel II links the capital of banks directly to the risks they are running.
Local supervisors will be responsible for implementing the Basel II
Capital Accord in accordance with their own laws and regulations.
Basel II contains a risk category for operational risk in addition to
credit and market risk. It also has provision for ‘other risks’ to be
Basel II is to be available for implementation in 2006-07.
Market risk
Market risk is defined as the risk of losses in on- and off-balance

sheet positions arising from movements in market prices. Market risk
is the name given to the group of risks that stem from changes in
interest rates and foreign exchange rates.
The yield curve shows the relationship between the effective interest
rate paid and the maturity date of an investment at a given time.
Changes in market rates can significantly affect the value of a market
instrument, such as a bond.
Traded market risk is the risk of a loss of value of the investments
associated with continually buying and selling financial instruments
(trading) in the market for profit.
Interest rate risk in the banking book is the risk of a loss of value of
the limited investments that occur as a natural consequence of the
bank’s underlying business.
Credit risk
Credit risk is defined as the risk of losses associated with the

possibility that a counterparty will fail to meet its obligations, in other
words it is the risk that a borrower won’t repay what is owed.
Collateral is defined as the assets pledged by a borrower to secure a
loan or other credit, and which is subject to seizure in the event of
default.
Basel I was very limited in the type of collateral it recognized.
Basel II recognizes a wider range of collateral, especially in its
Internal Ratings-Based approaches to credit risk.
Consistently bad lending is possible but unlikely if banks pursue
sound lending policies.
Models to achieve the grading of loans are specifically required as
part of the Basel II credit risk framework.
Operational risk
Operational risk is the risk of loss resulting from inadequate or failed

internal processes, people and systems, or from external events.
Although the Basel II definition excludes business, strategic and
reputational risk, it has the provision for these ‘other risks’ to be
Over the last 20 years the mismanagement of operational risk has
been at least as damaging to the value of individual banks as credit
risk and market risk.
Basel II has moved the management of operational risk forward in
that for the first time banks are required to quantify this risk, measure
it, and allocate capital in the same way as required for credit and
market risk.
Events that have historically been relatively low-cost are being
supplemented or even replaced by events that occur less frequently,
but which have a much larger impact.
Sertifikasi Inc.
Manajemen Risiko
Other risks
Basel II is very specific regarding what is included in ‘other risks’. It

encompasses strategic risk, business risk and reputational risk.
Business risk relates to the competitive position of a bank and to the
likelihood of it prospering in changing markets.
Strategic risk is the risk associated with the long-term business
decisions made by a bank’s senior management.
Reputational risk is the risk of potential damage to a firm resulting
from negative public opinion.
Reputational risk is not just limited to the reputation of an individual
bank; it can encompass whole sectors of the banking industry.
Quantifying the loss resulting from reputational risk can be difficult
given the long-term and widespread nature of the effects.
The potential consequences of failing to manage risks in banking
In addition to the direct financial loss a risk event can have on a bank, it
can also have an impact on the bank’s different stakeholders –
shareholders, employees and customers – and the economy as well.
Generally the effect on shareholders and employees is direct;
however the consequences for customers can be indirect and
therefore less obvious.
Understanding the consequences of risk for a bank’s customers is
important as it highlights the need for specifically regulating banks
rather than the financial services industry as a whole.
The risk which most affects customers on a day-to-day basis is
operational risk.
Banks that have ‘over lent’ in a boom will inevitably ‘under lend’ in
any subsequent recession.
Liquidity crises may be rare today in retail banking; however they are
more common in wholesale markets.
One direct consequence of risk incidents is that regulating bodies may
introduce new rules to prevent or minimize the chance of a recurrence.
The Indonesian banking system and regulation
Commercial banks offer a full range of financial services including

foreign exchange services. They have access to the payment system
and provide general banking services.
People’s Credit Banks, known as BPRs, are much smaller than
commercial banks and are usually operate locally.
In addition to Commercial and People’s Credit Banks there are small
non-bank institutions such as village credit institutions (BKD) and
rural credit unions (LDKP).
The regulation of the banking system has developed rapidly since
1998 in response to the many challenges presented by the domestic
financial marketplace.
Bank Indonesia has published the Indonesian Banking Architecture

which sets outs the direction, outline and working structures for the
banking industry over the next five to ten years.
Sertifikasi Inc.
Manajemen Risiko

01 - Ind - L1 - ch1 - July06

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

01 - Ind - L1 - ch1 - July06

Uploaded by

Copyright:

Available Formats

Part A

Banking risk and regulation

The purpose of this chapter is to provide the student with an overview of

On completion of this chapter the candidate will have a basic understanding

the risks inherent in banking

It is important to remember that candidates beginning their studies for

1.1 Banks, risk and the need for regulation

The above definitions highlight the differences between a bank and a

Risk event is defined as the occurrence of an event that creates the

1.1.1 Financial services industry, banks and regulation

The financial services industry is also subject to regulations to protect

While a car manufacturer is subject to product regulation, it is not

A:4 © Global Association of Risk Professionals, Inc.

stipulate the minimum capital requirements, as well as the minimum level

If a bank has sufficient capital it has sufficient financial resources to

The capital structure of a bank which is shown below will be explained in

Example Capital structure of a bank

Bank A has the following balance sheet

Assets Amount Risk RWA

Domestic government bonds 100 0 0

Totals 1000 630

Minimum capital required by supervisor = USD 50.4 million

Global Association of Risk Professionals,

1.1.2 Why regulate a bank?

Example A ‘run on a bank’

Bank A is rumored (correctly or not) to have made an extraordinary number

The failure of Bank A causes loans to be foreclosed, as the bank no longer

The solvency of a bank is a concern not only for its shareholders,

A:6 © Global Association

Example Continental Illinois Bank crisis

The bank was particularly vulnerable because it relied heavily on short-term

Prior to the 1930s, ‘runs’ on banks and solvency problems occurred

meet the reasonable level of demand for depositors to be repaid

Economic shocks and systemic risk

Despite the best efforts of banks to ensure diversification of their lending

an external shock, be it a natural disaster or a man-made event,

Banks exposed to such an economy could suffer a significant increase in

the credit standing of companies affected by the rapid deterioration

Many banks will have difficulty in safeguarding themselves from

complying with regulation (including Basel II) which increasingly

A:8 © Global Inc.

estimating the resulting levels of bad debts and ensuring their

Risk and capital

The above examples clearly demonstrate the relationship between risk

It has also become increasingly clear to supervisors that the level of a

1.1.3 Bank risk regulation

The Basel Committee on Banking Supervision made the first attempt to

Global Association of Risk Professionals,

1.1.1. This shows how the supervisors calculate minimum capital

The Market Risk Amendment

Supervisors in several countries extended the 1988 Accord to make it

the growth of derivatives markets

The Basel Committee published the Market Risk Amendment to the

Following the publication of the Market Risk Amendment the Basel

The coverage of market risk in Basel II is substantially unchanged from

Local supervisors will be responsible for implementing Basel II in

At this stage it is helpful to compare the two Accords.

Basel I Accord Basel II Accord

Focuses on a single risk measure Focuses on internal methodologies

Before moving on it is important that students understand each of the major

While a brief introduction to each of these risks is provided below, they

1.2 Market risk

1.2.1 What is market risk?