RBNZ revokes ANZ NZ's accreditation to model its own capital requirements due to 'persistent failure' in its controls and attestation, bank must increase minimum capital for operational risk by 60% to $760m

By Gareth Vaughan

The Reserve Bank has revoked ANZ New Zealand’s accreditation to model its own capital requirements for operational risk, citing a persistent failure in controls and the director attestation process at the country’s biggest bank that dates back five years.

The move comes on deadline day for submissions on the Reserve Bank’s proposals to increase banks’ regulatory capital requirements.

 “ANZ is now required to use the standardised approach for calculating appropriate operational risk capital. From March 2019, this will increase its minimum capital held for operational risk by around 60%, to $760 million,” the Reserve Bank says.

ANZ, along with ASB, BNZ and Westpac has been allowed to use what's known as the Internal Ratings Based (IRB) approach to calculate regulatory capital requirements since 2008. That means they set their own models for measuring credit risk exposure, which they must then get approved by the Reserve Bank. In contrast all other New Zealand banks must use the standardised approach through which they have their credit risk prescribed by the Reserve Bank.

Reserve Bank Deputy Governor Geoff Bascand says accreditation to use the IRB approach is earned through maintaining high risk management standards, and comes with stringent responsibilities for a bank’s directors and management.

 “The Reserve Bank’s role is to review and approve internal models. The onus is then on bank directors to ensure, and attest, that their bank is compliant with the Reserve Bank’s regulatory requirements. To do that, bank directors need to be satisfied that the internal assurance processes that sit behind the attestations are being adhered to,” Bascand says.

'A persistent weakness with ANZ’s assurance process'

The bank disclosure regime the Reserve Bank oversees is supported by a requirement for bank directors to attest to, i.e. sign-off on, the accuracy of information contained in bank general disclosure statements. 

But Bascand says; “ANZ’s directors have attested to compliance despite the approved model not being used since 2014. The fact that this issue was not identified for so long highlights a persistent weakness with ANZ’s assurance process.”

Bascand says the Reserve Bank had encouraged ANZ to undertake a full review of its attestation process, and assess its compliance with capital regulations. 

“ANZ’s failure to use an approved model was revealed through that review. A bank's disclosure statement is required to contain certain statements signed by each director of the bank. These must state, among other things: whether the bank has systems in place to monitor and control adequately the banking group's material risks and whether those systems are being properly applied; and whether the bank has complied with its conditions of registration over the period covered by the disclosure statement.”

“These directors’ attestations are important because they strengthen the incentives for directors to oversee, and take ultimate responsibility for, the sound management of their bank. We continue to work with ANZ in assessing its systems controls before determining any further action,” Bascand says.

If a disclosure statement is found to be false or misleading, bank directors can potentially face criminal and civil penalties including a jail term of up to three years.

ANZ NZ's directors are independent directors Tony Carter, Mark Verbiest, Joan Withers and chairman John Key, Shayne Elliott who is CEO of parent the ANZ Banking Group, CEO David Hisco, and Michelle Jablko who is chief financial officer of the ANZ Banking Group. Former prime minister Key joined the board in October 2017 succeeding the departing John Judge as chairman in January 2018.

Asked by interest.co.nz if any further action might be taken against ANZ and/or its directors, a Reserve Bank spokesman would only reiterate the comments attributed to Bascand above that; "We continue to work with ANZ in assessing its systems controls before determining any further action."

Problem discovered last month, ANZ says, with capital increased by $277 mln

ANZ, meanwhile, says during a review last month it discovered it wasn’t using an approved model for the calculation of its operational risk capital. Once the mistake was discovered, ANZ says it "promptly escalated" the matter to its board and reported the issue to the Reserve Bank.

"In December 2014, the calculation of operational risk capital was changed to be based on a final run of a previous model, that was decommissioned without Reserve Bank approval, with an annual adjustment to reflect the growth of the ANZ’s business. While isolated, and with no impact on customers or the operation of the bank, ANZ New Zealand is disappointed this error occurred. ANZ New Zealand, its board and its management takes the attestation regime very seriously," the bank says. 

"While ANZ believes it has appropriate controls and attestation processes in place, it will work with the RBNZ in its assessment of those controls and processes. ANZ New Zealand accepts the RBNZ’s decision that the operational risk capital model to be used from now will be based on the Reserve Banks 'standardised approach'. This approach means that as at 31 March 2019, ANZ New Zealand’s operational risk capital requirement increased by $277 million, and its capital ratios have decreased by 0.4% for common equity tier 1 capital and 0.6% for total capital. At 31 March 2019, ANZ New Zealand’s total capital was $12.46 billion," ANZ says.

The bank says it's working to provide the Reserve Bank with further information to show there are no other similar capital model compliance issues. Furthermore ANZ says a governance framework including appropriate systems and controls has been established to ensure Reserve Bank approved models can't be decommissioned without the required approvals.

Attestation regime reviewed at IMF's behest

The Reserve Bank's attestation regime has been a key feature of the regulator's idiosyncratic, hands-off bank supervision regime since the 1990s. In 2017 the Reserve Bank hired Deloitte to review the attestation regime after the International Monetary Fund urged the Reserve Bank to more rigorously test director attestations in its Financial Sector Assessment Program report on New Zealand. Interest.co.nz obtained a copy of the Deloitte report, and wrote about it here, after an Official Information Act request was initially rejected by the Reserve Bank and we went to the Ombudsman.

The Deloitte review called for a more prescriptive approach to the oversight of bank risk management.

Meanwhile, a key aspect of the Reserve Bank's proposals to increase banks' regulatory capital requirements is to level the playing field between banks using the IRB approach and those using the standardised approach.

In 2017 Westpac was also found to be in breach of credit risk modelling requirements.

The additional information below was released by the Reserve Bank.

Attestation regime

A bank's disclosure statement is required to contain certain statements signed by each director of the bank. These must state, among other things: whether the bank has systems in place to monitor and control adequately the banking group's material risks and whether those systems are being properly applied; and whether the bank has complied with its conditions of registration over the period covered by the disclosure statement.

These directors’ attestations are important because they strengthen the incentives for directors to oversee, and take ultimate responsibility for, the sound management of their bank.

What are capital requirements?

Bank capital is a source of funding that banks use that stand first in line to absorb financial losses they might make. The Reserve Bank, like other regulators around the world, sets the minimum level of capital a bank must use to fund its operations. The more capital a bank has, the less likely it is to fail.

There are three broad types of risks that banks are required to have capital for:

Credit risk - the risk that borrowers will be unable to pay back their loans

Market risk – the risk that a change in market conditions, such as changes in the exchange rate, will cause losses for banks

Operational risk – other risks that relate largely to the systems of a bank, such as a computer systems failure

What is internal modelling?

Locally incorporated banks in New Zealand can calculate their capital requirements in two ways: the internal models approach or the standardised approach.

Under the internal models approach a bank is able to use statistical models to assess the riskiness of its business such as the risk of its mortgage loans, or its level of operational risk. The bank’s internal models need to be approved by the Reserve Bank to ensure they are conservatively designed. Banks also need to meet several qualitative criteria to use this approach, such as proper governance and validation of these internal models. The banks in New Zealand that are accredited to use the internal models approach are ANZ, ASB, BNZ, and Westpac.

Under the standardised approach, the amount of capital that is required is prescribed in a set of formulae by the Reserve Bank.  This approach is simpler for banks to use than the internal models approach and easier to implement.

What is an operational risk model?

Operational risk capital requirements are designed to provide banks with sufficient capacity to absorb a wide range and magnitude of operational risk-related losses (from, for example: inadequate or failed internal processes, people or systems; or from external events, including legal risks). Underestimation of the amount of operational risk capital that a bank needs can undermine a bank’s financial soundness and could make it more likely to fail.

What is the Capital Review?

The Capital Review is a review of the capital requirements that the Reserve Bank sets for locally incorporated banks. It seeks to address several questions about New Zealand’s current framework: What should New Zealand’s risk tolerance be for banking crises? Do banks have sufficient levels of capital? What should the quality of capital be in New Zealand? Should we allow internal modelling for capital requirements? Should there be a significant difference between internal modelling and standardised approaches?

As part of its current Capital Review, the Reserve Bank is reviewing its capital framework for banks. Due in part to proven weaknesses with the internal models approach and in line with moves by other supervisor banks around the world, the review proposes that all banks adopt a new standardised approach for calculating operational risk capital.