LatAm central banks push op risk loss databases

1. Learning to share
Latin American regulators are pushing for increased participation in operational risk loss databases,
but banks are reluctant to share valuable information, finding it hard to trust it will be kept
confidential. John Rumsey finds out what it will take for South American banks to move forward
L
atin American bank regulators are pushing central banks are focusing on market and credit risk sector initiative would be helpful, but he does not see
for wider use of operational risk loss databases before they tackle the more complex area of opera- this happening due to the level of co-operation that
– Argentina has even legislated for manda- tional risk. And they are hampered by a reluctance to would be necessary.
tory databases and others could follow its example. share information.
This regulator-led approach comes as the private Alfredo Roisenzvit, chief executive at AcmeCon- Brazil’s information overload
sector struggles to develop solutions and many sultora in Buenos Aires, and a consultant, academic Brazil, the region’s largest country, has a long road
banks express fears over sharing data, for competitive and former bank regulator, has travelled extensively ahead to build total trust between banks, a prerequi-
reasons. Until that culture of fear can be overcome, in the region talking to banks. “Op risk managers are site for sharing op risk data, notes Marcus Manduca,
the development of operational risk databases could supportive and interested in building databases and a financial services partner at PricewaterhouseCoop-
be limited, and central banks are preparing to play a sharing data, but IT people tend to oppose the trans- ers in São Paulo. Still, most large Brazilian banks
central role in fostering a more positive climate. mission of data over the web, and directors and board already have fairly high standards. The bank market
Latin jurisdictions are taking different approaches members err on the side of caution,” he says. “We is concentrated and most adhere to the US Sarbanes-
to the collection and dissemination of operational need to adapt to a new paradigm: ‘It’s better to share Oxley Act and internal control rules, Manduca notes.
risk data, but many problems are shared. Most data than to hide it’.” A locally supported private- For the most part, Brazilian banks have focused
July 2011 25

2. Latin America
on finalising internal models for credit risk and are the prudential control itself. The central bank does at Brazilian banks but no institutional opinions.
only now turning their attention to operational not have the infrastructure or knowledge to inte- And Brazilian bank executives cannot understand
risk, says Manduca. Large banks are adjusting their grate the information, adds Claudio Paiva, director how data can be anonymous,” he says.
credit risk models to be eligible next year for the and partner at Analytics in São Paulo. Still, Paiva admits things are improving, and notes
advanced internal rating-based approach, while Manduca also highlights legislation recently that two years ago Febraban carried out a workshop
most mid-sized banks are still working to develop enacted to create positive credit bureaus, saying this to discuss operational issues, which included the
internal credit risk models. will show banks the advantages of sharing informa- issue of external databases. Large mortgage bank
And, he notes, Brazilian banks face other distrac- tion (reluctance to do so has dogged attempts by Caixa Econômica Federal has also pushed for a
tions, including the adoption of international finan- private institutions and the central bank to pool Brazilian database to be hosted inside the Opera-
cial reporting standards in a modified version, and data) and paves the way for op risk loss databases. tional Riskdata Exchange (ORX), he says.
concerns over the implications of Basel III for capi- However, he admits such databases are proving Walter Fernandes, head of operational risk and
tal and liquidity requirements. The country’s central difficult to build as many banks don’t have the criti- internal control at HSBC in Brazil, says interna-
bank, Banco Central do Brasil, is working with the cal mass within their institutions to ascertain which tional banks such as his do not have a problem shar-
Brazilian Association of Banks (Associação Brasileira events – such as fraud, process mistakes or person- ing data. The bank uses ORX internationally, which
de Bancos) and the Brazilian Federation of Banks nel problems – caused the loss. is the sole provider of loss-data services in Brazil,
(Febraban), to produce local quantitative impact The central bank might eventually share its infor- he says. “We are aware other Brazilian banks are
studies regarding Basel III to mitigate those fears. mation, but this will take several years, he believes. either using ORX already or are going to start doing
Despite these distractions, Manduca sees some That opens up a space for local credit data providers soon,” he notes.
positive developments. Today, the central bank such as Serasa Experian and local bureaus such as Still, there is a pressing need to co-opt more
requires banks to submit an operational limits Boa Vista Serviços, which in June took over Equi- banks to join the ORX initiative, he believes. “Data
statement and other mandatory risk reports to fax, to fill the gap by providing operational risk collection is good, but because the number of banks
help monitor risk capital. It tends to ask for large models using information taken directly from banks is still small, the data is not covering all our needs.”
amounts of information – more than most other and other official bodies, he says. A recent scandal involving fraud and the subse-
central banks. “It can be insane about the amount Paiva admits he is underwhelmed by what the quent collapse of a mid-sized bank, PanAmericano
of data it wants,” notes one operational risk expert. country has achieved. In 2006, he started to develop (see table), has helped focus bank managers on oper-
Banco Central do Brasil has called for a minimum operational projects for mid-sized banks with exter- ational risk issues. “Similar to the September 11
of five years of operational risk data for banks wish- nal databases, working with Carol Alexander, an terrorist attacks in New York in 2001, the materiali-
ing to adopt the advanced measurement approach expert in the UK. “The issue of external databases sation of a risk that had no previous history of losses
(AMA) and has provided guidelines on mapping was almost unknown and Brazilian banks were not caused professionals to check whether controls were
operational losses through consistent criteria. The interested in the issue,” he says. Paiva tried to initi- in place for that situation,” says Fernandes. The
bank also outlines the minimum criteria for report- ate a joint effort with Febraban but found little interest might, however, prove short-lived. “I don’t
ing op risk losses. receptivity because banks fear loss of confidentiality. think the Pan Americano incident has caused any
Yet Manduca warns the data is not yet granular He sees the mindset of executives as fundamen- major change,” he adds.
enough, and there are no moves yet to share data tally different to those in banks in the more devel- Another problem is that many operational risk
with the financial system, as the current priority is oped world. “There are plenty of personal opinions bank projects in Brazil have not worked well, says
Paiva – while they collect loss data and measure the
loss distribution, they are not using op risk manage-
major regional op risk losses ment to improve results.
Country loss amount Firm Bis1 event type Bis business line
1 Brazil $1.47 billion Banco PanAmericano Improper business or Retail banking Argentina mandates data sharing
market practices In neighbouring Argentina, AcmeConsultora’s
2 Puerto Rico $45.7 million Popular Improper business or Commercial banking Roisenzvit notes he helped initiate moves at the
market practices central bank, Banco Central de la República Argen-
3 Bermuda $41 million Majestic Capital Improper business or Insurance tina, to make loss databases mandatory, and many
market practices Latin American countries are looking at the country
4 Jamaica $19.68 million First Global Bank Unauthorised activity Trading and sales as a possible role model. Banks have been sending
information to the regulator for more than a year,
Source: SAS
5 Ecuador $7 million Pacific National Bank Monitoring and Retail banking
reporting he notes. But he admits it has been far from smooth
1
Bank for International Settlements sailing on the private sector side.
26 risk.net/operational-risk-and-regulation

3. Latin America
Roisenzvit started his own consultancy to develop
operational risk loss databases, believing “the region
is thirsty for new tools and techniques in op risk”.
He teamed up with RiskBusiness to provide services
for risk data consortiums through an initiative called
the Latin American Consortium of Operational Risk
Losses (the Consorcio Latinoamericano de Pérdidas
por Riesgo Operacional, or CLPRO).
However, he admits the consortium has not been
active. He attributes this to two factors. The first is
cultural: bank managers have a hard time chang-
ing their mindsets regarding the anonymity of the
data. “In the decision-making chain, there is always
someone saying: ‘No, no, no. I don’t want anyone
to see my data.’”
To give the project a shot in the arm, CLPRO
recently launched an incentive to allow the first 10
members to join for free. The consortium might
also look at partnering to gain more resources and
momentum, although this idea is preliminary, notes
Roisenzvit. He insists fees are not an issue and have
been kept low. “It’s hard even to convince banks to
go in free,” he notes. While not specifying dollar
amounts, he says the bank’s asset size could deter-
mine the fee paid.
The consortium plans to add value by collecting
detailed data beyond the ‘eight business lines by
seven risk types’ taxonomy in Basel II. “The idea is to
run as many lines, processes, even products and risk
types, as encountered. If you have 26 products, you
need a much more granular study and more value
Marcus Manduca, PricewaterhouseCoopers
added,” says Roisenzvit.
One issue will be deciding how much qualita- believes Argentine authorities will get there in the based framework that recognises differences between
tive information should be included. The CLPRO medium term. The central bank has not shared the entities but leverages common issues to foster efficacy
platform allows for descriptions of loss, particularly information but should be able to soon, he says. and reduce risks of regulatory arbitrage, says Alejan-
useful for building advanced models, but there will Foreign banks, which are significant players in dro Medina, manager of operational risk at the SBS.
need to be considerable professionalism and care to Argentina as they are in most of the continent (with Only seven banks and one other entity have been
retain anonymity and quality of information. the notable exception of Brazil), are already members approved for the alternative standardised approach
Roisenzvit is convinced of the benefits of aggre- of international consortiums. But it is unclear under Basel II in Peru.
gate information on op risk losses for banks and whether the local branches will adhere to local initia- SBS decided to implement a specialised unit for
regulators, not just for advanced models but also to tives, he notes. Local branches in Argentina could operational risk supervision in 2002. In 2009, the
calibrate for basic capital requirements. Much work not use information from US or European consorti- operational risk regulation was updated, meaning
has been done in neighbouring Brazil that shows the ums as the loss thresholds are too high. that financial institutions have had to include opera-
15% of income calibrated for Europe is not appropri- tional risk capital, at least under the basic method, as
ate for Latin America, he says. “Recalibration for the Initiatives in Peru part of their capital requirements.
region would be possible if we had five or six years’ In Peru, the Superintendency of Banking, Insur- All supervised sectors must have operational risk
worth of system-wide data,” he notes. ance and Private Pension Funds (SBS) is the leading management in place, regardless of the method applied
Roisenzvit admits the op risk data submitted agency in charge of regulation and supervision of the to calculate op risk capital requirement, sector or size –
by banks to the regulator needs to be polished but wider financial sector. It has tried to develop a risk- financial entities that remain under the basic method
July 2011 27

4. Latin America
Risk Loss Centre (Central de Pérdidas por Riesgo
Operacional or CPRO), says Medina. The aim is to
increase the reliability and relevance of data; fill a
gap that might not be covered by private initiatives;
facilitate the development of advanced measure-
ment approaches; provide data for other players,
such as pension funds; and allow the authority to
better understand the risk profile of the financial
system, he says.
The preliminary design is finished, and the author-
ity is starting training to assist private initiatives in
the rollout of good practice, including capturing loss
data, conciliation and book-keeping. The CPRO will
be compatible with international loss databases while
taking into account Peruvian specifics. It should
reach a pilot phase next year, he notes.
Some issues remain with regards to privacy, he
admits. “We will study whether the data should be
available already scaled for the use of financial insti-
tutions, for instance”. The authority is developing
its own taxonomy, which will add detail more suited
to Peruvian characteristics. For instance, investment
banking is less important but Peru has a strong
microfinance sector, which might require attention.
One worry is developing data recording and
keeping it consistent. “That could be a challenge,
and more technical work is needed, both through
consultation with banking participants and using
international expertise,” Medina says.
The CPRO will provide a clear advantage for all
participants to better understand the risk profile of
which takes into account the mandatory national their activities, Medina says. “We have also found in
“We have found in practice that the database. The intention was to bring microfinance practice that the better the methods of data collec-
better the methods of data collection, entities, insurance companies and pension funds tion, the better the consistency of risk management
into line, as most banks already had loss databases, and also the qualitative assessments regarding oper-
the better the consistency of risk explains Medina. Banks that applied for the alterna- ational risk factors,” he says. For those that might
management and also the qualitative tive standardised approach had their databases veri- pursue AMA authorisation, the CPRO will provide
assessments regarding op risk factors” fied as part of the authorisation process. information about entities with a similar profile.
Alejandro Medina, SBS In the private sector, while most small financial Overall, Latin America is fertile territory for the
institutions prefer in-house solutions, other banks development of risk-loss databases. Some juris-
tend to use specialised solutions such as Reveleus dictions are mandating these through laws, while
also have minimum requirements for operational risk (provided by Oracle) and Chase Cooper. As key play- others are encouraging the private sector to set them
management, security information and continuity ers in the banking industry include international up. The great difficulty remains in persuading banks
management. Moreover, loss databases are required for banks, providers such as ORX and the British Bank- that their jealously guarded data and business strat-
all, with the exception of some small, specialist enti- ers’ Association’s Global Operational Loss Database egies will be made completely anonymous in the
ties. The requirement for databases was implemented are also present, mainly to feed data to international transition to a shared database, and that the time
in March 2010. offices or apply data extraction, says Medina. to act is now. That will be a struggle, at least until
While there is scope for institutions to build their The SBS is establishing its own external loss more progress has been made on market and credit
own loss databases, a minimum content is specified, database, provisionally named the Operational risk models and the development of Basel III. ■
28 risk.net/operational-risk-and-regulation