A Starling Insights Deeper Dive Report

Supervisors on Supervision

Public Exposure Draft

Bill Dudley

past-President

Federal Reserve Bank of New York

Picture of Bill Dudley
View Full Report

Contributions to the Supervisors on Supervision Stocktake

What does culture mean in the supervisory context?

1.1.1a There is recognition among stocktake participants that culture lacks a commonly agreed-upon definition, which makes it difficult to understand or to discuss, let alone to assess.

“I think the problem you’re getting at is: what is the authority under which the supervisor or regulator can argue that culture is part of their purview?

It’s sort of a soft concept. That’s what people are unhappy with. I get that. I mean, what is culture, exactly? That’s one of the challenges.

Since culture is pretty hard to identify and evaluate — and behaviors are also hard to evaluate — it’s difficult for supervisors to be confident that what they’re doing is going to meaningfully move the needle in terms of outcomes.

So I've backed away from ‘culture’ as the way I talk about this. I talk about it more in terms of incentives. We need to have the right incentives in the system because incentives drive behavior, and behavior sets the social norms. And then that collection of social norms ultimately defines what we call culture.

So the culture is the end of the road rather than the beginning of the road. And that puts culture as less central. It’s sort of the result of all this.

But the social norms are what we really need to be working on. And the incentives to shape those social norms are what we should be working on. And I think that makes it a lot more tangible.”

What is the relationship between culture and governance and how does ambiguity about that relationship contribute to uncertainty?

1.1.3b Other participants noted that culture and governance are interconnected and influence one another.

“The culture gets affected by how people perceive the governance and the outcomes of the governance. So if someone who is, for example, a very high revenue producer but an asshole gets kept on and promoted and well-compensated — that's a governance issue. The governance let that happen. But it has cultural implications. Good governance is going to affect the culture outcome, for sure.

So the two are definitely related. I mean, good governance is going to affect the cultural outcome for sure. If you have a bad culture, you're probably going to have poor governance. You're going to have gaps in governance. You're going to have a lack of accountability in governance, presumably. So it probably goes both directions.

Governance is something that’s more tangible. Culture can be regarded as being too soft to be actionable, but we can do something about governance.”

Should culture, and the conduct proclivities it may promote or discourage among employees, factor into supervisory engagements?

1.2.1a Many participants see culture as a precursor to misconduct and consumer harm, making it of key interest to conduct regulators.

“The Financial Crisis got me going because you saw so many egregious things that were clearly not in the gray area. They were well over the line into what I thought was very bad behavior. The most obvious one was the manipulation of LIBOR. That is blatantly criminal; that's not in the gray area. 

You remember Charlie Prince's famous ‘when the music is playing, you've got to get up and dance’ line? That really got under my skin, because it implied that people lack the free will to actually decide what they want to do.”

1.2.1e Some participants observed that culture problems can ultimately lead to a loss of credibility for the financial sector as a whole.

“If you have good behaviors, good outcomes, that creates credibility about and confidence in the regime. And if you don't, then — look what happened in the outgrowth of the Great Financial Crisis. People were so angry about the firms that were rescued versus what happened to people as individual mortgage holders. That asymmetry of treatment caused tremendous loss of confidence in U.S. institutions. 

Loss of confidence in U.S. institutions really has a very pernicious effect on the ability of the system to perform well. And when a large number of people in the United States are deeply alienated that’s an erosion of trust and is not a good outcome.”

What might cross-border coordination regarding culture risk governance and supervision look like?

1.3.2a Some participants suggest cross-border coordination would enable better practices.

“One way to motivate all this stuff is you can get the G20 to decide they want to do something. When you look at the movement on things like central clearing, that was all because the G20 made decisions that these things had to happen, and then the regulatory community came quickly behind that. 

Where regulators can be helpful is twofold. 

Number one, identifying best practices. One thing regulators have going for them is they can look at different banks and say, ‘Look, I've done a horizontal review of these banks, and you think you're pretty good in this area? No, you're not, because I've looked at how other banks do it.’ Regulators do have better information about certain things than any individual bank.

The second thing, in the same vein, is they can identify what's good and what's not so good and share that across the banking community.”

If culture is a factor in governance outcomes, should supervisors take stock of their own cultures to improve supervisory outcomes?

1.4.2b Some participants argue that because the nature of supervision is different from banking, that culture as a matter of supervisory effectiveness should be considered differently than when examining culture as it drives outcomes for industry participants. Often pointed to in this regard is that private industry is profit-motivated while supervisors seek to serve the ‘public good.’

“I always used to say to the senior guys, ‘Look, I want your bank to be well-run, and I would hope that you want your bank to be well-run. Where we disagree is that I don't really care as much about your share price as you do. And I don't really care how much you're paid. But in terms of the bank being well-run, that should be a shared interest.’ 

A good example for me is it was very easy to be motivated working at the New York Fed because of the public mission, the public interest. I wasn't going to work to earn a lot of money; I was going to work because this can make a difference in terms of how well the US economy operates.”

1.4.2c Participants observed that demonstrating attentiveness to supervisory culture is critical to gaining buy-in from the firms they supervise.

“You can’t tell other people to fix themselves if you don’t try to fix yourself as well. People watch what you do, not what you say. You’ve got to walk the walk. No question about that. 

That’s why at the New York Fed, we also took a really deep dive and looked at our own supervisory practices during the Great Financial Crisis.”

What role does culture play in governance failures that ultimately require supervisory attention?

2.1.1c Some participants emphasize that culture and governance are fundamental to performance outcomes such that reliance on formal controls and processes without addressing culture undermines risk management.

“The interesting question is not so much that people do bad stuff. The question is: why does that bad stuff persist?

There does seem to be a sort of slippery slope aspect to all this. But I think the question is: why didn't people put up their hands and say something? I guess the question is: how broadly known were the bad behaviors, and then what did people do about it? If people are colluding — a number of bad actors are colluding — that’s one thing. It's another thing if people are broadly aware and just looking the other way. So we have to distinguish those two issues.

So a good example is: when do I speak up? When do I object? When do I say, ‘Hey, what about this?’ And how does the firm react to that, or how does my boss react to that? Is a good defense, ‘I followed the rules,’ or is that not a good defense?

I mean, the thing that makes me the most annoyed when I'm in an organization is when someone says, ‘Well, I did everything I was supposed to do.’ ... ‘I followed the hierarchy.’”

What are the consequences for failing to consider the influence of culture in assessments of governance effectiveness?

2.1.2b Participants discussed the outcomes of the COVID-19 pandemic and the impacts of increased remote working environments on culture supervision.

“I define culture as the norms that drive people’s behaviors. They’re often unwritten rules. That’s one of the big issues with working from home. How do you get inculcated with a firm’s culture if you’re remote all the time?”

How is supervision made more challenging by a reliance on judgment?

2.2.2a Many participants describe challenges with engaging management teams and boards on questions related to culture risk supervision.

“I think supervision is too often about process, like, ‘You didn't include that file in this report.’ I remember when I was a bank examiner very, very early in my career for the state of Massachusetts. Literally, examinations where you went in, looked at the mortgage, and saw if they had all the required paperwork in the mortgage file. But no one was actually driving out to look at the house to see if the valuation was consistent with the mortgage.”

Why have supervisors found it challenging to identify and assess culture-related risks prior to a risk event?

2.3.2b Other participants described the importance of collaborative engagement with the management team of the firms they oversee.

“It’s amazing how much talking past on another there is between the regulators and the bankers. 

I always felt one of my comparative advantages was that early in my career, I worked at the Fed. Then I worked at JP Morgan in regulatory policy. And because I worked in both places, I could talk to the regulators and the bankers and understand both sides. 

But they often couldn’t. They literally could not understand each other. Partly because the language is different, the goals are different, the incentives are different. But I think that's another thing to focus on — to try to get to the dialogue between the regulatory community, the supervisory community, and the bankers — to improve the quality of that dialogue.”

2.3.2c Some participants note that data is sometimes collected but then it may be unclear how it may be properly used for risk assessment or enforcement.

“I think there are some legitimate issues with supervision. The supervisory process can get too down in the weeds. It can get way too complex, where the cost-benefit of the outcome is pretty low. 

Living wills are a good example. They are thousands and thousands of pages. What’s the point? Who can even take that on board?”

What emerging techniques and tools offer promise to improve culture measurement and risk assessments?

3.2.2c Participants point to the value that would be achieved were we able to conduct reliable horizontal peer reviews and benchmarking exercises in the realm of culture risk supervision.

“One thing the regulators have going for them is they can look across different banks and say, look, I've done a horizontal review of these banks. You think you're pretty good in this? No, you're not — because I’ve looked at how other banks do. So regulators do have better information about certain things than any individual bank. 

And I think the regulators can also help identify, in the same vein, best practices — what's good and what's not so good — and share that across the banking community.”

What have we learned from past approaches to culture risk governance and supervision?

3.3.2a Participants noted both opportunities and challenges in connection with individual accountability regimes.

“When someone is dismissed from a firm and a new firm hires that person or is thinking of hiring them, the firm calls the old firm, and the old firm's incentives are on the side of ‘no comment’ because they don't want to risk being sued. They don't want the potential legal liability. And so that allows bad actors to essentially move around the regime. 

It would be pretty simple to set up a registry that people could query to ask ‘what are the reports about this person?’ And if there was a consistent story of bad behavior, then people would be aware of it. 

The purpose is not just preventing bad people from being hired again. It creates a different set of incentives: if I know that I do something bad, and not only am I going to cost myself a job at my current firm, but it might cost me my career in the industry. That raises the bar considerably.”

3.3.2c Some participants noted challenges associated with utilizing compensation and incentive schemes to drive cultural change.

“A lot of times, if you don’t like the outcomes, it’s usually because the incentives are misaligned. I’ve argued that having more of the compensation be deferred, long-term subordinated debt — sort of mimicking a partnership-type structure — might create different incentives for risk taking, a longer time horizon, and greater consequences if the firm were to get into great difficulty or even fail.”

3.3.2d Participants highlighted how difficult it can be to push through meaningful culture change and the tendency towards superficial fixes.

“I've had many conversations over the years where it took me quite a bit of time to convince senior bankers that no, fixing the problems the supervisors have uncovered is not sufficient. It’s necessary, but it’s not sufficient.

You need to be able to figure out how to do this on your own. And only when you do it on your own will you be where you need to be in terms of the supervisory community. 

A classic example is the three lines of defense for risk. I think it works as long as people understand what each line is supposed to do… For a long time, banks didn’t really get that the first line needed to own it.

And for many, many years, banks didn't get that when the supervisor came in and had a finding, it wasn't sufficient for the bank to remedy the failure that was uncovered. The bank really needed to get to the point where they could identify the problems and fix them on their own.”

How can supervisory bodies move to embed culture risk into supervision and governance frameworks?

3.4.1b Participants also described the role of the supervisor in making culture risk governance tangible for supervised firms through training, tools, and targeted frameworks.

“Something that could be helpful is more rotation across the different lines. I feel like one thing that could be helpful is if part of a person’s career path was that they actually had to spend some time in the second line. People often don’t understand the perspective of the other side. That makes it harder to solve things in a less adversarial, more coherent way.”

What steps should regulators consider to enable more effective culture risk supervision?

4.1.1a Some participants described the importance of establishing a firm legal basis for supervising culture.

“I think the legal profession is not always so helpful for culture, frankly, because the legal profession is about ‘what am I allowed to do?’ And there's a presumption that, as long as what I'm doing is legal, then it's okay to do. And the reality is, that's just not true in my opinion. 

The legal profession is always going to be behind — the laws and regulatory structures are always going to lag behind the current reality. People are going to innovate to get around legal constraints. So I think part of what we probably should be looking at is the rule of law versus the rule of reason. That’s sort of the classic issue, from a legal perspective. 

Maybe we need to think about how we promulgate regulations and supervision that are more based on the rule of reason than the rule of law, more focused on what outcomes we are trying to achieve, as opposed to what constraints we are putting in place.”

4.1.1c Participants noted that greater transparency and accountability in supervisory processes would improve outcomes and preserve independence.

“You have a conflict right now between the fact that confidential supervisory information is confidential, yet oftentimes it's material from the perspective of the stock price, and yet the company can't disclose it. 

I'd like to see all supervisory actions that are truly a restraint and material to the firm have to be disclosed, with a lag — not necessarily the day of the finding, but maybe six or twelve months later. 

It creates better incentives for firms. They are now really well-motivated because, let's say the timeline is six months, they’d better have a pretty damn good plan for how they're going to mitigate this problem. That creates more focus from senior management on the issue and also gives shareholders a better sense of what's really going on. It seems like a win-win.”

What steps should supervisory bodies consider to help drive their own culture change?

4.2.1c Participants also recognized the need to develop new capabilities and frameworks

“To my mind, how about some notion of a periodic review of how supervisors are doing things? For example, the Fed is now doing a five-year monetary policy review. The ECB does a five-year monetary policy review. Why don't we do periodic reviews of supervision and ask, ‘What's working, what's not working? Where can we peel back?’”

What would a global initiative to transform culture risk governance and supervision in the financial sector look like?

4.4.1a Participants noted that global standard-setters have yet to prioritize culture risk governance and supervision, and urge that greater attention to such would be helpful.

“The problem is that in Basel, the BCBS, is really too narrow and technical and there are no other committees that it really fits into. The FSB seems like its mandate is too broad relative to banking. So it’s a good question [to ask who can lead related global efforts].”

4.4.1b Participants described the need to have a forum where public and private sector participants can collaborate to reach consensus on new approaches to culture risk governance and supervision.

“It's better if the banks understand that it's in their interest to own this — because not only can it lead to better outcomes, less risk, fewer blow-up kind of events, but it can also lead to better relations with their regulators, better trust, more scope to do what they want to do from a strategic perspective. So I don't really see this as regulator-driven.”