Insurance as a potential capital charge mitigant under the Basel II Capital Adequacy Framework.

Transcription

1 Insurance as a potential capital charge mitigant under the Basel II Capital Adequacy Framework. Introduction 1.1 The Basel Committee The Basel Committee on Banking Supervision (the Committee) is a committee of banking supervisory authorities. It was established by the central bank governors of the G10 countries in It usually meets at the Bank for International Settlements in Basel where its permanent secretariat is located, hence its name. The Committee has worked over recent years seeking to secure international agreement on proposed revisions to supervisory regulations governing the capital adequacy of internationally active banks. Proposals to revise the then existing capital adequacy framework were made in 1999 and followed by a series of consultation rounds, resulting in amendments to the original proposals. 1.2 The Capital Adequacy Framework The Committee published a revised capital adequacy framework in November 2005 (the Framework) which represents the Committee's agreed framework for measuring capital adequacy and the minimum standard to be achieved which national supervisory authorities represented on the committee have proposed for adoption in their respective countries. The Framework is intended to promote convergence of capital measurement and capital adequacy standards among the G10 nations. The fundamental objective is to develop a framework to further strengthen the international banking system. In particular, the Framework is intended to foster and promote risk sensitive capital requirement methodologies, including the greater use of internal assessments by banks to determine capital adequacy calculations. In parallel with this the Framework identifies a detailed set of minimum requirements designed to ensure the integrity of internal risk assessment functions. The Framework provides for a range of options to determine the appropriate capital requirements for credit risk and operational risk and allows a degree of discretion for banks to determine appropriate approaches suited to their particular operations and the relevant applicable local financial market and regulatory infrastructure. In broad terms, the Framework requires banks to hold an appropriate amount of capital having regard to their credit risk and operational risk exposures. This paper examines the potential role for insurance products as capital reduction/risk mitigation tools under the applicable Australian regime. 2. Credit Risk and Operational Risk It is necessary firstly to identify what credit risk and operational risk are for the purposes of the Framework. dycs A v Page 1

2 Credit risk is, broadly the exposure faced by a bank arising from the risk that the counterparty to a transaction could default before the final settlement of the transaction cash flows. An economic loss would occur if the transaction or portfolio of transactions with the counterparty has a positive economic value at the time of the counterparty default. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk (which includes but is not limited to exposure to fines, penalties, or punitive damages resulting from supervisory actions and private settlements) but excludes strategic and reputational risk. 2.1 Operational risk mitigation Capital requirements in relation to operational risk exposures may be calculated using one of two different calculations/measurement approaches. The basic indicator approach, which is the standard approach, or the so called advanced measurement approach (AMA) are available. Under an AMA a bank is permitted to recognise the risk mitigation impact of insurance in the measurement of operational risk used to determine the regulatory minimum capital requirements. The recognition of insurance as a mitigation tool is capped at 20% of the total operational risk capital charge as calculated under the AMA. Recognition of insurance as a risk mitigator is also contingent on the following: The insurer has a minimum claims paying ability rating of A (or equivalent). The policy must have a initial term of no less than one year, otherwise the bank must make appropriate haircuts reflecting the declining residual term of the policy, up to a full 100% haircut for a policy with a residual term of 90 days or less. The policy must have a minimum notice period for cancellation of 90 days. The policy must have no exclusions or limitations triggered by supervisory actions, although the policy may exclude fines, penalties or punitive damages resulting from supervisory actions. The risk mitigation calculations must reflect the bank's insurance coverage in a manner that is transparent and consistent with, the actual impact of loss used in the bank's overall determination of its operational risk capital. The insurance must be provided by a third party entity. However, captive and affiliate entities may be used where the exposure assumed by the affiliate is laid off by the affiliate to an independent third party entity that meets acceptability criteria. This could for example be done by way of a reinsurance arrangement. There are a number of issues and practical problems arising from the above which will be considered in further detail later in this paper. In a footnote to the Framework it is noted that the Committee intends to continue an ongoing review of the use of risk mitigants for operational risks and may consider revisiting the criteria on the basis of experience. dycs A v Page 2

3 2.2 Credit risk mitigation The potential benefits of using insurance products for credit exposure mitigation and capital reduction purposes are clear. In the Australian context, lenders mortgage insurance (LMI) which protects a lender against the loss arising from a borrower's default is perhaps the best known example. However, the Framework does not specifically identify insurance as an acceptable technique for credit risk mitigation, although it does identify certain guarantees and credit derivatives as acceptable credit risk management tools. Only certain types of guarantees and credit derivatives with particular characteristics will be recognised as providing acceptable credit risk mitigation for capital adequacy purposes. These requirements include the following: the guarantee/credit derivative must represent a direct claim on the protection provider. it must be explicitly referenced to specific exposures so that the extent of the cover is clearly defined and incontrovertible. it must be irrevocable (other than in respect of the non payment by the bank of money due in respect of the credit protection contract). the contract must not permit the protection provider unilaterally to cancel the cover or to increase the effective cost of cover as a result of deteriorating credit quality in the underlying credit exposure covered by the contract. it must be unconditional. there should be no clause in the contract that could prevent the protection provider from being obliged to pay out in a timely manner. Eligible guarantees/eligible credit derivatives will only be recognised when issued by a narrowly defined class of counterparties including banks and securities firms with a lower risk weighting then the counterparty, and other entities rated A minus or better. For guarantees, operational requirements including the following must be satisfied: the guarantor must cover all payments the underlying obligor is expected to make, for example the notional amount, margin payments etc. the guarantee must be an explicitly documented obligation assumed by the guarantor. the bank must be permitted to pursue the guarantor for monies outstanding under the transaction rather than having to continue to pursue the counterparty and by making a payment under the guarantee the guarantor must acquire the right to pursue the obligor for monies outstanding under the transaction documentation. all documentation must be binding on all parties and legally enforceable in all relevant jurisdictions - banks must have appropriate legal opinions to verify this, and update them as necessary to ensure continuing enforceability. dycs A v Page 3

4 In order for a credit derivative contract to be recognised, a number of conditions including the following must be satisfied: the credit event specified by the contracting parties must, cover at a minimum: failure to pay the amounts due under the terms of the underlying obligation that are in effect at the time of failure; bankruptcy, insolvency or inability of the obligor to pay its debts; and the structuring of the underlying obligation involving the forgiveness or postponement of principal interest or fees that results in a credit loss event. The credit derivative must not terminate prior to expiration of any grace period available on the underlying obligation as a result of the debtor's failure to pay. The identity of the parties responsible for determining whether a credit event has occurred must be clearly defined. The determination must not be the sole responsibility of the protection seller. Although it appears from the above that insurance products would not be recognised as acceptable credit risk mitigants, the Committee has confirmed 1 that insurance which effectively functions like a guarantee and meets the operational requirements laid down for eligible guarantees as discussed above is a permissible credit risk mitigant. Having regard to the very heavily regulated environment in which Australian insurers' operate and the significant legal protection afforded to insureds under Australian law as it relates to insurance contracts including the legislative regime provided for in the Commonwealth Insurance Contracts Act 1984, it is submitted that contacts of insurance issued by Australian insurers provide protection to ADI's of an equivalent and in some cases superior nature to the protection provided by eligible guarantees and credit derivatives. 3. Implementation of the Framework in Australia Although Australia is not a member of the G10 group Australia will implement the Framework. The currently proposed commencement date is 1 January However in a number of material respects implementation in Australia of the Framework will be different to the regime proposed by the Committee. For any bank proposing to seek to use insurance products as a credit or operational risk mitigant, a number of factors discussed below should be noted. 1 BIS QIS FAQ: E Credit Risk Mitigation item 6. dycs A v Page 4

5 3.1 APRA Requirements Although the proposed implementation of the Framework in Australia is broadly consistent with the Committee's recommendations in most respects, there are differences in the proposed treatment and recognition of credit and operational risk mitigants under current Australian proposals. The Australian Prudential Regulation Authority (APRA) has released for public consultation and comment a number of discussion papers and draft prudential standards regarding the implementation in Australia of the Framework. The consultation process is intended to result in final draft prudential standards regarding regulatory capital charges under the Framework which APRA expects to be released in the first half of The standards are proposed to finalised in late 2007 ready for implementation of the Framework in Australia on 1 January (a) Credit Risk Mitigation In draft Guidance Note AGN112.3 APRA confirms that certain credit risk mitigation techniques and/or eligible guarantees may be recognised by APRA as credit risk capital mitigants. As a base requirement, all documentation must be binding on all parties and legally enforceable. An APRA regulated authorised deposit taking institution (ADI) must undertake sufficient legal review and due diligence to be satisfied with the legal enforceability of the documentation and must undertake periodic reviews to confirm ongoing enforceability. In the case of guarantees, the guarantee instrument must represent a direct claim on the guarantor with the extent of the cover being clearly defined and incontrovertible. The guarantee must be irrevocable and unconditional. Guarantees will be eligible and recognised by APRA as a credit risk mitigant only if issued by eligible guarantors including governments, public sector entities, central banks, Australian ADI's overseas banks and other entities with an external rating grade of A minus or better. However the Guidance Note expressly states that claims which are secured or collaterised in other ways including by insurance contracts, are not considered to be covered by eligible collateral. That is, the present draft of the guidance note makes it clear that insurance will not be recognised by APRA as an eligible credit risk mitigant. This is at odds with the position of the Committee as discussed above that insurance when used as a credit risk mitigant that effectively functions as a guarantee and meets the operational requirements for guarantees will be permitted to be treated as a credit risk mitigant. It is also inconsistent with the current treatment by APRA of certain qualifying types of LMI insurance as a credit risk mitigant for prudential regulatory capital requirement purposes. In light of this, it is submitted that in circumstances where insurance cover operates in the same functional manner as a guarantee and meets the requirements of an eligible guarantee, there is no policy basis or practical reason why insurance should not be dycs A v Page 5

6 recognised as an appropriate credit risk mitigation technique for capital adequacy purposes under the Framework. (b) Operational Risk Mitigation In the case of operational risk, APRA proposes that subject to meeting certain criteria an ADI may recognise the risk mitigating effect of appropriate insurance in determining its operational risk regulatory capital charge. There is a cap on the available relief, which is set at 20% of the total operational risk regulatory capital charge imposed. Insurance may only be recognised as a mitigant where an Australian ADI qualifies for and uses an AMA approach to operational risk. Draft APRA Prudential Standard APS 115, which was issued for public comment in October 2006 provides that an ADI using an AMA may recognise qualifying insurance as mitigating its operational risk regulatory capital requirement where, relevantly: it has APRA's written approval it is able to demonstrate to APRA that the insurance will cover potential operational risk loses in a manner equivalent to holding regulatory capital. In particular, it will be necessary to satisfy APRA that: the insurer has a minimum claims paying ability rating of A under Standard & Poor's/ AM Best or A2 under Moody's rating systems. the policy has a cancellation period of not less than 90 days the policy does not have any exclusions or limitations for losses or expenses caused by or resulting from any regulatory or supervisory action; the insurance is provided by a third party entity regulated by APRA or is subject to regulatory oversight broadly consistent with that applied by APRA. the ADI has in place policies and procedures for determining the risk mitigating effect of insurance within its operational risk measurement model. The policy has a initial term of no less than one year. Appropriate haircuts will be made to the amount of capital mitigation provided by the policy: where the residual term of the policy is less than a year; where the cancellation terms of the policy provide that the policy could be cancelled before the contractual expiration; to reflect the uncertainty of payment, including the willingness of the insurer to pay the claim in a timely manner and the legal right that a claim may be disputed; and to reflect any mismatches in the coverage of insurance policies. (c) APRA Prudential Practice Guide APG 115 dycs A v Page 6

7 APRA also released in October 2006 a Prudential Practice Guide APG 115 (The Guide) to provide further clarification as to APRA's requirements in relation to its implementation and approach with regard to APS 115. The Guide aims to assist ADI's in complying with those requirements. The Guide includes further guidance on the use of insurance as an operational risk mitigant. Significantly APRA acknowledges that in order to comply with the numerous requirements to enable insurance to be recognised as an operational risk mitigant for the purposes of APS 115 ADI's may need to negotiate certain requirements with their insurers (in particular in respect of certain standard policy exclusions and variations to notification periods of cancellation). Additionally APRA makes the following observations in relation to certain aspects of the insurance related requirements of APS 115: APRA recognises that ADI's will invariably have either deductibles or self insured retentions. The practical effect of this is that insurance will provide less than 100% cover. In such cases APRA suggests that the ADI might need to apply appropriate haircuts to reflect the deductibles/self insured retentions. the ADI is encouraged to consider the ability and willingness of the insurer to pay claims in a timely manner. If the ADI concludes there are concerns, the ADI is encouraged to apply an appropriate haircut to reduce the amount of insurance that is recognised. What constitutes payment within a timely time frame is open to debate. In complex claims an insurer will quite reasonably seek to have sufficient time to properly understand the claim, the issues involved, and to assess and determine whether the policy responds. One way to deal with the issue would be to enter into a binding agreement with the insurer setting out timeframes for the assessment and determination of indemnity under claims. This is however unlikely to be acceptable to insurers as it locks them into a particular timeframe. An alternative might be to enter into a best endeavours arrangement whereby the insurer will agree to expeditiously assess and determine claims. Insureds have legal protection in the sense that the contract is one of utmost good faith and insurers must not unreasonably delay in assessing claims. Commercial pressure also dictates that insurers must deal with claims reasonably promptly in order to maintain the relationship with their insureds. These protections are, however, unlikely to be sufficiently robust to meet APRA's requirements. haircuts are required to reflect any mismatches in the coverage provided by insurance policies. APRA identifies that mismatches may occur in situations including uninsurable events, differences in conditions between local and global programs, differences between coverage on layered programs, and erosion of coverage on aggregate programs. where cover is provided by a third party entity which is not regulated by APRA, that entity must be located and licensed in a jurisdiction which has a broadly comparable insurance prudential regulatory regime to that of Australia. Guidance is given in the Guide as to various criteria which may be relevant to the assessment, including a requirement that the insurer operates under appropriate governance standards and is subject to risk based capital adequacy and solvency dycs A v Page 7

8 requirements comparable to the Australian model. In practical terms however it is likely to be extremely difficult for an ADI to itself assess and determine the comparability of an overseas insurance prudential and regulatory regime with the Australian regime. This is particularly the case in light of the fact that APRA has itself rejected proposals that it undertake similar assessments in the context of recent Commonwealth Department of Treasury proposals for the regulation of overseas insurers. It remains to be seen how this particular issue will play out in practice. 4. What needs to be done? 4.1 Risk Measurement and Mapping A necessary prerequisite to obtaining operational risk capital relief is the presence of an appropriate APRA operational risk measurement model. That requires amongst other things an ADI firstly to undertake an appropriate risk mapping analysis by reference to the various categories of business lines which are more particularly identified in attachment D to APS 115. Separate business lines identified include corporate finance, trading and sales, retail banking, commercial banking, payment and settlement functions, agency services, asset management and retail brokerage, to the extent that the ADI operates in these business areas. Secondly, the ADI's operational risk measurement system must be consistent with and take into account the various loss event categories set out at attachment E to APS 115. The attachment contains a table which sets out in some detail 7 broad loss event type categories together with, in each case, a definition of the types of losses falling within each category. The table further drills down to more specifically identify and illustrate examples of sub categories and types of activity which may give rise to loss. The main loss event categories are: internal fraud external fraud employment practices and workplace safety clients, products and business practices damage to physical assets business disruption; and execution, delivery and process management. As an example, in respect of internal fraud the types of activity identified in the table include unauthorised activity (including unreported transactions, unauthorised transactions and mis-marking of positions); and theft and fraud (including credit fraud, theft, extortion, robbery, forgery, insider trading, misappropriation/malicious destruction of assets). As can be seen from the above, the categories and potential loss events falling within each of those categories are extremely broad. They reflect the complete range and complexity dycs A v Page 8

9 of the operations of a major Australian ADI and seek to identify the operational risk exposures which the ADI faces in conducting its day to day business in those areas. The challenge for an ADI will be to accurately identify and map its exposures having regard to these categories and to obtain appropriate matching insurance coverage which meets the APRA criteria for acceptable insurance cover for those operational risks. Whether insurers will be prepared to provide cover for these risks on terms which are prescribed by APS 115 is open to question. Even assuming this is the case, the premium rates which the insurance industry will seek for providing the cover will reflect the increased exposures borne by the insurer in providing cover on the terms required by APRA. Ultimately it will be a question of the ADI determining on a case by case approach whether the capital reduction benefit which accrues to the ADI as a consequence of having obtained qualifying insurance cover justifies the cost of obtaining the cover. One would assume however that given the likely capital costs savings involved, obtaining qualifying insurance cover will be economically attractive to ADI's. 4.2 Long term insurance cover Only highly rated insurers will qualify as acceptable insurance providers for APRA purposes. Naturally, the cost of obtaining cover from highly rated insurers is generally higher than the cost of obtaining similar cover from less highly rated organisations. APRA requires that the cover provided under qualifying policies will be long term and subject to lengthy cancellation periods. Appropriate haircuts to the regulatory capital relief available will be applied where the longevity criteria are not met. Insurers are likely to demand premium rates that reflect their increased exposure arising from being tied into these long term contracts and in agreeing to limit their cancellation rights. The mechanism for ensuring that the residual term of the contract does not fall below 12 months will need to be carefully considered so that it operates fairly as between the ADI and the insurer. A range of options may be available such as evergreen contracts where the cover automatically rolls forward and is extended before the residual unexpired term falls below 12 months; mechanisms whereby the ADI has a call option to extend the term of the policy for a further extended period once the term reaches 12 months; or long term policies with mechanisms inbuilt to require the parties to commence negotiations for renewal at a time sufficiently far in advance of the approach of the 12 month residual period date. Although the market will no doubt identify and agree appropriate mechanisms to deal with this issue there will inevitably be tension between on the one hand insurers' reluctance to be tied into long term commitments during which the structure, operations and risk profile of the insured ADI's business may change, and on the other hand the ADI's requirement, for regulatory capital relief purposes, to enter into qualifying long term arrangements with insurers. 4.3 The Structure of the ADI's policy and the ADI's insurance programme Another challenge for ADI's will be to coordinate and align the various different separate covers which comprise its insurance programme both so that each separate coverage individually, and the overall programme when taken together meet the APRA requirements. This may be particularly problematic in situations where the insurance programme is dycs A v Page 9

10 placed with a range of different insurers, potentially in different jurisdictions, with terms and expiry dates which differ, and where multiple insurers provide cover on co-insurance or excess of loss arrangements. This will present some particular difficulties for ADI's internal risk and insurance departments and for the brokers advising them. Aligning the covers in such situations in a cohesive and commercial manner is likely to prove extremely difficult particularly when insurance markets harden. There are however a number of ways in which the problems could be approached. There have already been examples of large global insurers marketing bespoke policies to banks which are intended to provide holistic coverage in relation to the entire range of credit and operational risk exposures which they face. Such policies need to be very carefully crafted having regard to the particular profile of the bank and its exposures. Alternatively, some appropriate form of overarching or umbrella cover arrangement could be considered. This could include a structure pursuant to which insurance cover is provided in conjunction with, and on top of, the existing insurance programme which a bank already has in place. It could be tailored to be APRA compliant, and to complement an existing insurance programme. Such a model might also involve arrangements for the cover to drop down and provide infill cover to the extent that any of the underlying primary policies were not APRA compliant for any reason. A further approach might involve the adoption by the insurance industry of a standard APRA compliant endorsement for use with existing policies and which operates to convert otherwise non compliant policies to complying policies. A standard endorsement might deal with policy longevity issues and policy renewal; and modify the terms of the existing policy as appropriate so that it was APRA compliant (for example in relation to the deletion of exclusions or limitations in the policy in respect of losses or expenses caused by or resulting from regulatory or supervisory action). This approach would have the benefit of permitting the ADI to retain its existing programme and modify the programme or particular selected covers in the programme only to the extent to which the programme or certain aspects of the programme are required to be APRA compliant having regard to the amount of regulatory capital relief sought to be obtained. 4.4 How much capital relief do I get? Although the Framework provides that recognition of insurance mitigation is available for up to 20% of the total operational risk capital charge, there is no clear guidance either under the Framework, or under the proposed APRA model as to how exactly much relief in any particular case will be available, and how the extent of the relief sought to be claimed should be assessed and calculated. Although when matching their insurance coverage to their identified operating risk exposures banks must account for factors including the probability of the coverage actually responding, the probability of timely payment by insurers, the application of deductibles, the risk of insurer default, the application of policy limits and the potential application of aggregation provisions in the policies for certain losses, there is no detailed or objective criteria prescribed as to exactly how those elements should be assessed and weighted. Some banks have approached the task by modelling outcomes having regard to severe loss event scenarios, then mapping outcomes dycs A v Page 10

11 having regard to the probability of the relevant insurance policies responding to the loss events, applying haircuts as considered appropriate and having regard to the prescribed criteria. However, it is clear from recent BIS publications that there has been a wide divergence in the approaches adopted by banks in this regard. 2 BIS notes that whereas many banks do not take an insurance off-set into account within their current operational risk framework, a number of the banks that do so calculate the off-set in a very rough manner. BIS provides an example of some banks basing the calculated off-set on a small number of large losses for which insurance recoveries have been significant, while others seem to have interpreted the regulatory language as indicating that a 20% off-set can be taken without much justification. It appears that only a few banks have embedded the calculation of the insurance off-set within their operational risk model. This demonstrates the very wide range of practices currently adopted. It would be interesting to see whether BIS or APRA take steps to mandate a more focused, prescriptive approach to the calculation methodology Clearly, however banks will need to approach the risk mapping and insurance matching assessment by applying robust and consistent methodologies. Similar to the overseas experience reported by BIS, there are likely to be variations, perhaps significant, in the approach and methodology adopted as between Australian ADI's in this regard. It will be interesting to see what APRA's attitude to the various approaches is. It is likely that APRA will require ADI's to be able to explain and justify the rationale and methodology they have used when seeking insurance mitigation relief. Presumably, the greater the relief sought to be obtained, the greater the likely APRA scrutiny of the methodology adopted. 4.5 Insurers' likely Approach As noted above the APRA requirements for complying insurance cover are stringent. The long-term requirements, the restrictions on insurers' ability to impose exclusions and limitations on the cover and the requirement that cover provided under the insurance be certain will undoubtedly have an impact on premium rates. Whether the industry wishes to provide cover on the required terms remains to be seen. Clearly however there is an opportunity for insurers in this area who wish to do so and are able to do so on terms and conditions acceptable to the ADI's and APRA. 4.6 Other options Given the recognition of appropriate qualifying guarantees and credit derivatives as capital mitigators there are also opportunities for the capital markets to become involved in the provision of appropriate capital mitigation products, whether that is in the nature of guarantees, credit derivatives, or other novel qualifying types of products. 2 Basel Committee on Banking Supervision Observed range of Practices in key elements of Advanced Measurement Approaches (AMA) October dycs A v Page 11