The directors of New Zealand's big banks told the Reserve Bank quarterly for years that their banks were fully compliant with their regulator's outsourcing policy when they may not have been.
A 2014 stocktake of five banks’ compliance with the then eight year-old outsourcing policy showed compliance ranged from 65% to 90% in terms of the overall effectiveness of practical and legal controls. This is revealed in a consultation paper issued as part of phase two of the Government's review of the Reserve Bank of New Zealand (RBNZ) Act.
The directors of each bank had been attesting that their bank was fully compliant with the 2006 policy on a quarterly basis. The Reserve Bank's attestation regime means bank directors must attest to, i.e. sign-off on, the accuracy of information contained in bank general disclosure statements.
"The degree of variation suggested there was a material risk to the financial system, from a possible failure of a supplier to one of the large banks, resulting in that bank being unable to continue to operate. Given the size of the large banks in the New Zealand financial system, an issue for one of them could result in an issue for the entire system," the consultation paper says.
ANZ, ASB, BNZ, Westpac & Kiwibank big enough to qualify
The Reserve Bank's outsourcing policy requires large banks, being locally incorporated registered banks with liabilities, net of amounts owed to related parties of $10 billion or more, to have the legal and practical ability to control and execute outsourced functions such as IT processing, accounting and call centres themselves. ANZ NZ, ASB, BNZ, Westpac NZ, and Kiwibank are big enough to meet that criteria. Between them the four Australian owned banks control about 88% of NZ banking system assets.
The outsourcing policy was designed to ensure a large bank’s outsourcing arrangements don't create risk that the operation and management of the bank could be interrupted for a material length of time. The risk associated with outsourcing, including to an overseas parent bank, is if a supplier of outsourced functions was unable to provide that function for some reason. This could result in an unacceptable risk to the bank’s ability to operate, and therefore the wider financial system, the consultation paper says.
"The 2006 Policy was outcomes-focused, and required large banks to structure their business so that each bank’s board of directors had the legal and practical ability to control and execute all functions needed for the bank to continue to provide and circulate liquidity to the financial system, following the failure of a third party supplier or parent entity."
"Under the Reserve Bank’s approach to supervision, responsibility for ensuring compliance with the 2006 Policy lay with the directors of each bank. The Reserve Bank relied on the directors’ attesting that their bank was complying with its CoRs [conditions of banking registration], for confirmation that this was indeed the case. The Reserve Bank did not, and still does not, validate attestations unless specific concerns are raised or it commissions a compliance review," the consultation paper says.
The 2014 stocktake of banks’ compliance involved a consulting firm being hired to assess the degree of effectiveness of each bank’s compliance with the outsourcing policy. All five banks voluntarily agreed to the stocktake.
"The stocktake highlighted a wide variation between banks in respect to the degree of the legal and practical control they exercised over outsourced functions," the consultation paper says.
"The finding from the stocktake was that while the five banks had practical and legal controls in place to exercise control over outsourced functions, it was uncertain in some instances if these controls were appropriate. It was also observed that the means and standards applied by the individual banks to achieve the specified outcomes resulted in wide variations in the interpretation and application of practical and legal controls."
(Also see: Is the attestation regime fit for purpose?)
Outsourcing policy strengthened
The Reserve Bank subsequently decided to strengthen the outsourcing policy to include a regulatory approval process for some outsourcing arrangements and other safeguards, such as independent reviews of compliance. The revised outsourcing policy was introduced in September 2017, much to the annoyance of some of the major banks. The Reserve Bank put the cost, to banks, of the revised policy at $550 million, and the net benefit of the policy at $2.2 billion. Banks put these respective figures at $870 million and $1.9 billion, respectively.
In May last year BNZ suffered a major weekend service loss, including most banking, online banking, EFTPOS and ATM services, which was blamed on its parent National Australia Bank. At the time the Reserve Bank said NZ's major banks should have systems in place to prevent a repeat of that BNZ service loss once they've implemented the new outsourcing policy, which has a deadline of September 2022.
The revelation about some of the big banks being off the pace with the outsourcing policy comes with Reserve Bank Deputy Governor Geoff Bascand having used a recent speech to signal a shift in regulatory approach to a more pro-active, more intensive and more intrusive one.
"Our experience over the last decade has been that regulations have not always been well applied or complied with, and that tells us that we cannot rely solely on self discipline. Crucially, it is not just the fact of non-compliance that concerns us - regulated entities have not been as proactive as we would have liked in identifying and remedying issues before the risks become more significant," Bascand said.
The deadline for submissions on the consultation paper is 5pm on Friday, August 16. The RBNZ Act review is being overseen by a team jointly resourced by Treasury and the RBNZ. Finance Minister Grant Robertson announced the RBNZ Act review in November 2017.
“The current Reserve Bank Act is now nearly 30 years old. While it has served New Zealand well in general, now is the right time to undertake a review to ensure our monetary policy framework still provides the most efficient and effective model for New Zealand," Robertson said in 2017.
Phase 1 of the RBNZ Act review focused on monetary policy.
We welcome your comments below. If you are not already registered, please register to comment.
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.