08/27/2024 | Press release | Distributed by Public on 08/27/2024 09:46
August 27, 2024, Covington Alert
A recent publication issued by the European Central Bank ("ECB") represents the latest influential regulatory pronouncement on the high-priority supervisory areas of bank governance and risk culture. This article highlights some of the key insights which banks may wish to consider.
Since the global financial crisis, governance and risk culture within banks have consistently featured as supervisory focuses for the ECB, with the authority viewing deficiencies in these areas as early warning signals for, or (at the extreme) root causes of, difficulties ahead. Despite increased supervisory attention, the ECB has concluded that the progress made to-date by banks in relation to governance and risk culture has "not generally been sufficient".
Accordingly, on 24 July 2024, the ECB issued a consultation on its new draft guide on governance and risk culture(the "Guide"). The Guide sets out the ECB's expectations regarding banks' governance and risk culture, and is intended to significantly build on and replace the SSM Statement on Governance and Risk Appetite of 2016. This follows the ECB's 'risk culture deep dives' of select banks, as well as a review of international work in this space[1].
Banks and other stakeholders have until 16 October 2024 to provide their views to the ECB on the Guide.
1. Application of the Guide
"Governance and risk culture are essential features of any well-functioning organisation, having an impact on its structure, culture, and people. Shaping the organisation of a bank and its management body, defining its values, norms, expected behaviours and collective mindset are key to ensuring the soundness of its business operations, strategic planning, and decision-making" (Guide, p.3).
The ECB has confirmed that it will intensify its supervisory activities of banks within its remit, to ensure that sufficient actions are being taken to enhance governance standards. Any "non-remediated supervisory" findings may therefore be escalated - with the ECB citing its powers to require reinforcement of arrangements, process, mechanisms and strategies under Article 16(2)(b) of the SSM Regulation.
While supervisory expectations will be applied proportionately, the ECB has emphasised that "good governance and risk culture are equally important for all banks, whatever their size" - indicating that elements of the Guide will be relevant for consideration by smaller institutions. National competent authorities will also be encouraged to align their assessments of governance of less significant institutions with the expectations and practices set out in the Guide.
Whilst the Guide (once finalised) will not be legally binding, the ECB may view any material and inexplicable divergences from its expectations to be non-compliant with applicable EU legal requirements[2]. Banks might usefully conduct a gap analysis of their governance, culture and risk arrangements against the supervisory expectations set out in the Guide[3], including the various best practice and 'red flag' examples. Any identified gaps should then be appropriately remediated or rationalised - with any such rationalisation properly documented and approved.
2. The Key Takeaways from the Guide
The Guide covers:
Our key takeaways from the Guide are as follows:
The Guide describes risk culture as having four dimensions, as follows:
Culture should then be monitored, measured and assessedto ensure adherence across all levels of the bank. This includes senior management - the management body and senior managers are seen as setting the tone of each bank, and should therefore behave in line with the values of the bank. The ECB recommends that banks regularly discuss the bank's culture at management body level, as well as its implementation across the bank. Effective tools should be in place for banks to mitigate their culture risk, i.e. the risk of a misalignment between the bank's stated values and the actions of member of its management body, and the behaviour of its employees. It is recommended that findings from the ongoing monitoring of how such culture is implemented, are reported to, and discussed by the management body and its relevant committees.
It is expected that banks identify and act upon root causes of undesired behaviours.
The ECB is cognisant that a bank's RAF may consist of multiple risk policies and processes. This, in the ECB's view, highlights the importance of having in place a "coherent and consistent risk management procedural framework" that is tied together by a "summary statement" of the RAF.
The RAF should be treated as a 'live' document that is inputted into and approved by the management body on a regular basis - taking into consideration any updates regarding the bank's risk profile, relative to its risk appetite. To support oversight and decision-making, banks are expected to develop appropriate internal monitoring of their risk appetites, via a 'risk appetite dashboard' which compares the risk exposure and risk limits to appetite, in relation to both financial and non-financial risks.
The ECB states that it will assess banks' governance arrangements by using a range of supervisory tools (both on-site and off-site, e.g. the ongoing assessment of a bank's governance documentation) and information sources, to ensure it has a holistic picture. The ECB also promises to ensure compliance by using "all measures in [its] supervisory toolkit" where it identifies deficiencies.
In practice, this means banks should prepare for increased and more regular supervisory activities in this area, from ad hoc information and meeting requests to on-site supervisions and deep dives on behaviour and culture. It may also imply greater information-sharing within ECB departments and across EU authorities, generally.
Our team would be happy to address any questions you may have on the ECB's proposed Guide.
[1]In a September 2023 speech, the ECB referenced, for example, the Australian Prudential Regulation Authority's Bank Executive Accountability Regime, and draft Culture and Behaviour Risk Guidelines released by the Canadian Office of the Superintendent of Financial Institutions.
[2]In particular, the Capital Rights Directive (2013/36/EU) and linked EBA guidelines (EBA/GL/2021/04, EBA/GL/2021/05, EBA/GL/2021/06).
[3]While the Guide is in draft form, we would not expect the final version to contain significant revisions.