- Growth: Any bank looking to grow domestically and internationally will need robust and scalable risk management systems and processes. As it grows, it'll notice different types risks e.g. market risk (fx and interest rate exposures) for international banks; for a domestic bank that is growing, its branch mangers will no longer have time to relation manage every creditor thus credit risk grows. A bank acquiring a broker for example opens itself to huge operational and market risks (proprietary equity positions).
- Capital sourcing: For banks that look to source funding from either NSE or abroad; risk management is a consideration for the investors. Having class "A" risk management may reduce the premium that investors require
- Reputational: the risk of not having risk management in place is that the bank will find its reputation in tatters or worse when one type of risk trips it up.
- Contigency planning: Part of Basel 2 risk management is stress testing which is about capitalising for one-off capital destroyers.
- Shareprice: Could be impacted by the feeling that a certain bank is at risk from its reckless risk management. As an investor in Equity, one question I always ask myself is this, if say Equity was to be hit by one of the above risks; was discovered to have insuffcient capital as a result and had to de-scale its operations, would CBK's Ndungu have tell Equity to reduce its operations? And I think we all know the answer to that.
-The standard approach won’t be applicable unless
---Bank has significant banking book-applies to most Kenyan banks
---Significant corporate or sovereign (including municipalities, parastatals and county council) exposure
---Significant credit rating coverage-very few corporates are credit rated in Kenya and even those that are, very few keep these ratings updated.
This leaves the two internal rating methodologies. In theory, this should mean a quicker uptake by the banks because many should already have these in place, right? Wrong-many are reliant on credit appraisals some which require subjective judgements. The initial credit approval process lacks the scalability that the use of credit scoring system would bring about. Then regulators have to approve these models. Which is where the next comes especially if different banks use different models as opposed to ones within set industry standards. It places a lot of pressure on the supervisor knowledge wise. How do they know which internal model is delivering adequate credit risk coverage? How do you compare an internal model that Equity uses to credit rate its mass customers with that of Standard Chartered which has middle/upper class customers?
Under the Advanced IRB, the bank can use it own model to estimate pd, as well as loss given default, expected loss, maturity, but in most countries this is only allowed if the bank has been producing these estimates for 3 or more years. Most Kenyan banks don't have these internal credit rating models now let alone for 3 years.
Under Foundation internal rating based approach, the bank is allowed to estimate the probability of default. To estimate PD, most banks would need to have the ability to stratify their customers using various criteria but the main ones might be maturity profile, collateral type and repayment track record. Once, the bank is able to break this down into say 10-15 categories, it can attach risk weightings to each category which will in effect denote the capital that needs to be held against each. Being able to get this model signed off by regulators will thus reduce capital required in most cases if the classification is sufficiently granular.
Most Kenyan banks will have fx and interest rate risks under this risk category and exceptionally, equity. Daily VaR approach requires the bank to be able to calculate the daily P&L impact of a 1 basis point movement in interest rates on its banking book. Similarly for those parts of its banking and trading book that have exposure to non-domicile currencies. The fx risk will thus apply to KCB, DTB, Equity and others that have foreign businesses.
Operational Risk:This is in effect the easiest to implement because with the exception of the advanced approach, most banks should be able to get data by business lines for several years and this just then need to apply a factor.
Holistic Scenario Testing:
Once the bank is able to calculate the required regulatory capital from the above and other risks, Basel 2 requires that a bank using the internal models in of the approaches to do stress test its capital against various one-off scenarios. For most Western banks these are events such as; credit crunch; LTCM, the tech bubble burst; oil prices crisis; black Monday et al. In Kenya, banks should consider the likely impact on their regulatory of the following scenarios and then provide the necessary capital buffer:
- A coup overthrowing current government
- Civil war lasting 6 months
- Drought lasting 1 year
- A run on the bank
- IMF/WB sactions against Kenya
- Withdrawal of a shareholder
- Arresting of CEO for murder
- Security breach on internet facility
- NSE fall by 50% in 7 days
- Global depression