City University of Hong Kong Professional Seminar 17 March 2006

1. City University of Hong Kong Professional Seminar 17 March 2006 Basel II Compliance in Hong Kong 2006 Part I: Steps for Basel II Compliance Simon Topping Hong Kong Monetary Authority

2. Steps for Basel II Compliance • Timetable • Meeting minimum regulatory requirements • Step 1: Credit risk • Step 2: Operational risk • Step 3: Market risk • Step 4: Financial disclosure • Going beyond minimum regulatory requirements • Step 5: Advanced approaches (e.g. IRB) • Step 6: Capital management (e.g. CAAP) • Step 7: Business implications

3. Overview of Basel II • Introduces a more comprehensive and risk-sensitive capital framework • Captures a wider range of risks: • Pillar 1 – credit, market & operational risks • Pillar 2 – all other risks, e.g. interest rate risk in the banking book, concentration risk, business cycle risk, reputation risk… • Complements existing calculation of minimum CAR with 2 extra components: supervisory review process + market discipline • Allows institutions to use internal models to measure risk (subject to meeting qualifying criteria)

4. HKMA’s Implementation Principles • Pragmatic implementation approach • choice of approaches left to AIs based on scale, nature and complexity of business • on-going home/host cooperation to harmonise differences • focus on cost-effectiveness • Practical legislative approach • detailed Basel II requirements set out in Capital and Disclosure Rules, supplemented by supervisory guidance • Transparent standard setting • prior public consultation on detailed proposals to ensure transparency in Rules setting

5. Implementation Timeline: 2006 • Hong Kong will implement according to the Basel Committee timetable (2007/2008), i.e. Hong Kong will be in the “initial wave” of jurisdictions to introduce the new requirements • Completion of policy-setting (Q1 06) • Release of draft rules (Q4 05 - Q3 06) • IRB approval (Q3 06 onwards) • Establishment of CART (Q3/Q4 06) • Parallel reporting (Q3 & Q4 for basic and standardised approaches, flexible for IRB) • Release of final rules (Q4 06)

6. Implementation Timeline: 2007 onwards • Jan 2007: All 77 locally-incorporated AIs will transition to Basel II. The following will be the options available: • Credit risk: standardised approach basic approach foundation IRB • Operational risk: basic indicator approach standardised approach alternative standardised approach • Market risk: standardised approach internal models approach • Jan 2008: An additional option for credit risk - advanced IRB – will be introduced

7. Basel II - What changes? • Offers capital incentives to improve risk management • Not just a compliance issue - a strategic issue affecting how banks do business • Basel II risk-weighting treatment more closely reflects how banks look at risks • Creates closer link between regulatory capital and risk management • Encourages development of higher risk management standards along a spectrum of approaches of different levels of sophistication

8. Basel II - What changes? (2) • Encourages market discipline • Enhanced disclosure of information on risks, capital and risk management • Published CAR will reflect more accurately change in risk profile • Discipline upon AIs to manage risks and maintain adequate capital • Improvement of shareholder value and public confidence

9. Meeting minimum regulatory requirementsStep 1: Credit risk • The “default” regulatory requirement is the standardised approach. This is an upgrade of the existing Basel I approach, so institutions will already have much of what is required in place, although certain enhancements will be necessary, e.g.: • Incorporate external ratings • Revise treatment of RMLs • Revise treatment of commitments • Revise treatment of past dues • AIs can apply to use the basic (“simplified standardised”) approach if they meet the necessary criteria. This necessitates minimal changes to systems • Changes must be accomplished by Q3 2006

10. Meeting minimum regulatory requirementsStep 2: Operational risk • The “default” regulatory requirement is the basic indicator approach. Systems need to be created to: • calculate annual gross income and multiply by 15% and incorporate in capital calculation • AIs can apply to use the standardized approach. Systems need to be able to: • Calculate annual gross income for 8 business lines and multiply by varying percentages • Or the alternative standardized approach: • Slightly different treatment of 2 business lines • Changes must be accomplished by Q3 2006

11. Meeting minimum regulatory requirementsStep 3: Market risk • The “default” regulatory requirement is the standardized approach. This is an upgrade of the existing approach, so institutions will already have much of what is required in place, although certain enhancements will be necessary, e.g.: • Incorporate external ratings for government paper • Emphasis on prudent valuation of illiquid positions • AIs can apply to use the internal models approach. Again, this is an upgrade of an existing approach, but certain changes are necessitated: • Increased validation requirements • AIS with minimal market risk can apply for “de minimis” exemption • Changes must be accomplished by Q3 2006

12. Meeting minimum regulatory requirementsStep 4: Financial disclosure • The extent of “extra” disclosure required to be made will depend primarily on the approach to credit risk adopted: • Basic approach AIs – minimal change • Standardized approach AIs – additional disclosures required • IRB approach AIs – more substantial additional disclosures required • Changes must be accomplished by mid 2007

13. Implementation Timeline: 2007 onwards • Jan 2007 • Credit risk: standardised approach: 20 basic approach: 50 foundation IRB: 1 or 2 • Operational risk: basic indicator approach: 50 standardised approach: 20 alternative standardised approach: 2 • Market risk: standardised approach 35 internal models approach 4 or 5 • Jan 2008 (onwards) • 7 or 8 AIs may transition from basic or standardised approach to foundation or advanced IRB

14. Meeting minimum regulatory requirementsSummary • Basic approach AIs – minimal change to achieve compliance (some changes on credit risk, introduction of operational risk) • Standardized approach AIs – more changes required (e.g. o/a external ratings & enhanced disclosure), but building on existing approaches, so much of what is required will already be in place • IRB approach AIs – more substantial changes required if the AI opts for IRB (but note that this is not mandatory)

15. Going beyond minimum regulatory requirementsStep 5: Advanced approaches • Going beyond minimum regulatory requirements is optional • However, market expectations are that AIs will migrate to more advanced approaches over time • HKMA expects all AIs to have risk management capabilities commensurate to their scale and nature of activities • AIs need to assess the costs and benefits of the various approaches. Much of the “cost” attributed to “Basel II compliance” is in fact necessary expenditure to upgrade risk management, which would have been undertaken even if there had been no Basel II

16. Going beyond minimum regulatory requirementsStep 5: Advanced approaches: credit risk • Use of advanced credit risk management techniques (e.g. models / IRB) should enable AIs to reduce credit losses over the cycle, by means of earlier identification of problem loans & initiation of corrective action • Will also facilitate risk-adjusted pricing • AIs which do not plan to adopt IRB should also look to enhance their credit risk management, e.g. by use of credit scoring and loan classification systems (and reduction of reliance on collateral) • Those who lack the skills to properly assess the creditworthiness of borrowers risk being left with the loans no-one else wants – and higher NPLs

17. Going beyond minimum regulatory requirementsStep 5: Advanced approaches: operational risk • One of the key objectives of Basel II is to heighten management awareness of operational risk (the risk of loss arising from inadequate or failed internal processes, people and systems or from external events), e.g. internal fraud, IT malfunctions, money laundering scandal • not just about setting aside capital: the qualitative aspects on risk management are equally – if not more - important • HKMA has issued SPM to set out standards and best practices – but is not requiring advanced measurement approaches (AMA)

18. Going beyond minimum regulatory requirementsStep 6: Capital management • migrate to using risk-based “economic capital” methodologies for measurement of risks and capital adequacy as well as pricing • AIs will need to demonstrate that they have a forward-looking process for assessing and managing their capital needs • HKMA will continue to set minimum capital ratios for individual AIs, but the process will become more rigorous and transparent (to the AI); over time, the AI will play more of a role in determining the appropriate minimum ratio

19. Going beyond minimum regulatory requirementsStep 6: Capital management (cont.) • It is likely that the HKMA will set lower minimum ratios for top-rated institutions (i.e. the 10% minimum will no longer apply) • Provided AIs can demonstrate that their risk measurement and management is of a high standard, including that proper use is made of stress-testing and sufficient attention is paid to “Pillar 2” risks, there may be less need for them to maintain a big “buffer” above the minimum set by the HKMA (in other words, they may, over time, be able to reduce their capital)

20. Going beyond minimum regulatory requirementsStep 7: Business implications: strategic planning • Basel II should be seen as a tool for improving strategic planning, defining the institution’s risk appetite, setting risk limits, etc. • It can also facilitate risk-adjusted performance measurement • And it also provides a framework for assessing the risks inherent in new products/initiatives and pricing them

21. Going beyond minimum regulatory requirementsStep 7: Business implications: Competitive dynamics • Potential cost/capital advantage for users of more advanced approaches • risk-adjusted pricing • lower bad debt charge over the cycle • lower capital requirement (therefore better return on capital) • lower cost of funding (market perception) • improved external ratings?

22. Board/Senior Management responsibilities • Assess strategic implications of Basel II • Integrate Basel II risk measurement concepts into risk management system • Develop systems and procedures to ensure compliance • Oversee implementation with project management • Assess impact and keep aiming at higher risk management standards

23. Final thoughts • All AIs must be in compliance with the minimum regulatory requirements of Basel II by Jan 2007 • What is required to achieve compliance depends very much on which approaches an AI adopts – there is obviously more involved in achieving compliance with the more advanced approaches than with the basic and standardized approaches • AIs may choose to migrate to more advanced approaches in later years – this “incremental” approach is encouraged • But Basel II should not be looked at as purely a regulatory compliance issue – there are important business implications • AIs would have needed to make these sorts of improvements to risk management even if there had been no Basel II