Supervisors on Supervision

“I think the evidence, if you look back at the Global Financial Crisis and many other things that have happened in banks since then, including SVB and other failures in Switzerland, shows that issues around culture and governance are very much a root cause.

My own personal experience with the Financial Crisis in Ireland makes it absolutely clear that this was the case. The remedies were put in place after the Crisis, but before the establishment of the [Single Supervisory Mechanism (SSM)]. So there was a period where Ireland was dealing with the Crisis on its own. 

Even after the SSM was established, which shows how difficult governance and cultural issues can be to address, we had the tracker mortgage issue related to consumer protection. With the caveat that consumer protection is not part of the ECB's mandate, a root cause of that issue was culture. 

It prompted the Central Bank of Ireland to do a large study on cultural factors in banks and how it led to a big scandal that negatively affected consumers. These are cases where you can see the evidence that culture is at the root cause of many things.”

“[W]e see our overall mandate as focused on four safeguarding outcomes: financial stability; safety & soundness; consumer and investor interests; and integrity of the system — which are all highly inter-related and often interdependent. 

Culture and behavioural risks are a perfect example of this. What may manifest itself in the first instance as poor conduct, or weak anti-money-laundering controls, often leads to — or is also uncovered as representing — prudential risks in the firm. 

It is not for nothing that we focused on strengthening the governance framework in the aftermath of financial crisis, or that governance remains a key focus of all supervisors, including prudential ones. We only have to look back to [March 2023] to see the risks to capital and liquidity — and indeed the very survival of firms, with potentially systemic implications — that can emanate from badly run entities or historic instances of poor risk management and governance…  

[T]he importance of supervising governance, risk management, and culture is one of the key takeaways from the banking turmoil [of March 2023].”

“History has shown that, as crises recede, memories can fade. And that is why, for me, it is essential for regulators to retain their focus on the fundamentals of resilience, governance and risk management.”

“If you don't have good core fundamentals around culture and risk management, the propensity for other things to go wrong is always there. So, we should not take our eye off these core things, which are important for managing all the other risks we look at.”

“In the end, even with great frameworks and great tools, the job of supervisors is to make judgments — to assess the evidence in front of you and decide whether you still have concerns or not. Even though we've really developed our framework around this topic, you still need people to make very good judgments. And they have to make those judgments about the people and the firms they're dealing with, as well as the processes, systems, and controls.”

“It's not about only having a framework that comes down to a single score and then you decide something, or a framework that's entirely based on judgment. You need a mix of the two.”

“Both at the Central Bank of Ireland, as well as part of ECB Banking Supervision, supervisory effectiveness and a strong supervisory culture is something we are always seeking to cultivate and uphold — with the effectiveness of our supervisory framework already a focus of the ECB Supervisory Board prior to the events [of March 2023].”

“In the end, banks are commercial entities focused on making a profit for shareholders. I am here to serve the public interest and, in my current role, the interests of European citizens. So, while we can have common endeavors at times, it's important to remember that our fundamental mission is quite different. In the end, if I have to make difficult judgments, they are informed by my focus on safe and sound banks, the public interest, and my legal mandate, which isn't necessarily always aligned with that of the bank I supervise.”

“For me, to deliver ‘state of the art supervision,’ our supervisors need to have the right skills, the right mind-set, the right tools and the right data to do their jobs. But they also need to be adaptable, robust and indeed at times intrusive — with enough empowerment and escalation options to deliver truly effective outcomes.

From where I am sitting, achieving this is about making sure frontline supervisors have the right training, technology, autonomy and flexibility to do their jobs, and to do it right. But it is also about ensuring they know that we have their back — to be risk focused, and to use their toolkit to get traction within supervised entities.”

“Our supervisory experience tells us that firms with good governance, culture and controls are much better set up for success — both in terms of growing safely as well as dealing with the risks facing them and their customers. And on the other hand, we have seen what happens when external shocks or major change coincide with poor management behaviour — not to mention how the risks of consumer or investor detriment rises when poor business practices and weak business processes are allowed to persist within a firm. 

As such, we see sound culture and effective governance as consistent mitigants to risks facing firms, the system and consumers/investors. And, in a rapidly changing world, and an environment of heightened external risks, the need for effective governance underpinned by a strong culture and robust systems of delivery is becoming all the more essential.”

“In our case, as you probably know, we have the Supervisory Review and Evaluation Process (SREP). This is our fundamental methodology for dealing with the banks that we supervise. 

It looks at all the core elements of what you would want to look at in a bank: its business model, its governance and risk management, its credit risk, its liquidity risk, et cetera. We have an internal methodology so that all of our supervisors understand how to undertake that process. We explain that process to the banks, and then on an annual basis we go through that process. It's also guided though by many other things. 

We have a very detailed inspection process that we can go through. We have findings and measures. We have all of these things, I suppose, which are really tangible things to inform our thinking. 

In the end, you have to put all of that information together and decide in some way what it tells you about that bank. And that's the role of judgment in the end. What do we really think? All of those indicators, data, forms, whatever we gather, whatever engagements we have, whatever inspections we undertake, what do they actually tell us?”

“When discussing what makes a supervisory engagement successful, for me, the word engagement itself is very important. We may get to a point where we disagree with a firm, which is common. But this disagreement must be based on an ongoing dialogue, because supervision is not a one-off process. 

Your supervisory team is dealing with the supervised institution constantly. It's partly about understanding and listening to each other, and it's very important to have no surprises on either side. You get to a place with mutual respect and understanding, but also an acceptance that a supervisor's role is to make judgments — and in many cases, legal decisions — on things like capital levels, authorizations, or fitness and probity. 

We may not always agree on these decisions, but at least we understand where we're coming from. I would always want a situation where a bank, even if they disagree with our view on governance or culture, understands the basis of our work and our decision, and that there's been a dialogue around it.”

“Because of our legal grounding with the ECB, we have, in many cases, formal processes called the ‘right to be heard,’ where the bank can give us feedback if they disagree with our determination. And ultimately, there is an appeals process also to the administrative board of review where we've made a legal decision if a bank disagrees with us.

And that's not unfettered judgment. You can't just decide whatever you like because it's Tuesday. It is also, I suppose, more constrained. We have internal processes, we have a second line of defense, for example, that looks at the decisions made by our supervisors and compares them. 

So, the benchmarking is not only of the banks; it's also internal about what we're doing and how we're comparing. We work on quality assurance and effectiveness to make sure that our judgments are made on a consistent basis.”

“In the SSM, we use benchmarking a lot because we have a diverse population of over 100 significant institutions, allowing us to make comparisons across peers. We try to focus on tangible, evidential facts. Of course, we don't do this in complete isolation. We have an ongoing supervisory relationship with the firms we supervise, dealing with individual banks on specific issues. We also have dialogue with the industry more generally with cohorts of banks or representative bodies. 

When it comes to benchmarking, there are a couple of different ways to think about it. 

First, within this large group of over 100 institutions, we have many different business models, from the biggest G-SIBs to retail and local banks. We can group banks into categories based on these business models and look for commonalities or differences. This isn't just for culture and risk management; we also look at data, business practices, and investment.
Benchmarking across the broader population has advantages, helping us identify good practices where some banks are ahead of others, or to spot gaps. We also look at what approaches are more suitable for a bank's size, nature, and complexity, so there are different dimensions through which we can look at these.”

“Our assessment process looks at several dimensions: tone from the top, leadership, communication, diversity and challenge, incentives, and accountability. Like all our other supervisory work, we have a toolkit. We look at evidence, including how meetings are held, documents, and data. We may observe the board.”

“We see the [Individual Accountability Framework (IAF)] as an important addition to the wider regulatory framework — one which will help underpin sound governance across the financial sector by setting out clearly what is expected of well-run firms and responsible role holders. 

The overarching aim of its introduction is to strengthen and enhance individual accountability in the financial services industry. It also seeks to ensure that there is clarity within firms on the responsibilities and functions of senior executives — providing transparency to supervisors and the public, but also empowering role holders-by making clear what they are responsible for.
While the IAF is an important step in a regulatory framework designed to foster a well-run and stable financial sector, it goes without saying that ensuring and delivering good corporate governance will remain the responsibility of firms themselves. 

Over time our strategic hope is that, along with our other efforts, the IAF will help make firms take more ownership and responsibility for running their business and addressing any risks or deficiencies they may have. Our supervision will continue to take a risk-based, proportionate approach, reflecting the context of smaller, less complex, and/or less risky firms.”
 

“For us, in the guidance that we give to firms, we talk about things like norms, attitudes, and behaviors related to risk awareness, risk-taking, and risk management. We also look at the controls around how decisions are made. We believe risk culture influences the decisions made by employees and management in individual firms. While that may sound hard to pin down, it goes to the fundamental idea that these norms, behaviors, and attitudes inform decision-making and risk-taking. Since we are concerned with decision making and risk-taking, we should be concerned with these norms. 

We directly supervise over 100 so-called significant institutions — the largest banks in Europe. The ECB also oversees the supervision of many thousands of other firms, the less-significant institutions supervised by national competent authorities. These issues of governance, risk management, and culture, of course, prevail across all these banks. We must find a way to put a framework around them and think about these issues.”

“In our supervision now at the ECB, which is focused on prudential aspects, where you have issues and you look at their root causes, not in every case, but in many, governance and culture are at the heart of it. 

So for me, it's about being efficient and effective as a supervisor. If you want to solve issues quickly, you need to get to their root causes. Being alert to the idea that these factors can be a part of the root cause is very important. The most timely and effective way to deal with things is to mitigate the root cause.”

“We always try to ground our supervision in tangible supervisory outcomes. This is no different. When thinking about culture and risk management, we consider the outcomes we want to achieve. The first thing, of course, is that the supervision is in line with the legal framework and mandate we've been given, for instance, the CRD and the guidelines from the EBA. The outcome we're really trying to achieve is well-governed banks with proper checks and balances. We want banks to own and define their culture, ensuring it's aligned with being prudent risk managers.

It’s not about there being no risk. Rather, it's about prudently managing risk. We lean into that through our engagement. We consider it successful when we've thoroughly examined the issues, gathered the necessary evidence, and are satisfied that any concerns have been properly remediated. This gives us assurance that the bank is managed in a very controlled way, with a proper process for paying attention to risks at all levels of the organization.”

“Because the world and the bank you're supervising are always changing, the job of a supervisor is never really done. You have to continue to evolve your own understanding of the institution. As the risk landscape, macro environment, and risk outlook change, you also have to keep your own thinking up to date on how you're going to look at these issues.”

“I fully agree on the importance of international collaboration, and indeed my own career has involved extensive international work. Simply looking at the global nature of the financial sector, the case for global cooperation is clear. 

What we have also seen in the last few years is that, with a rapidly changing financial sector, the importance of engagement with a wide variety of stakeholders has increased.

Going forward I expect such engagement to only become more important — particularly in the context of an uncertain and changing world, not to mention the increasing digitalisation of finance — with increasingly complex inter-linkages and dependencies outside of the financial system being something that regulators cannot and will not ignore.

We also regularly engage with the public — through regional outreach events and meeting members of the public, as well as our extensive links to academia through our work, including our Research Exchange — a forum for research engagement between our teams and external experts and researchers. Such engagement is crucial to retaining the trust placed in us as a central bank and financial regulator — by building a shared social understanding of the benefits of our work for the public, consumers, and the wider economy.”

“A big part of our work is broader engagement with colleagues like yourself [Starling Insights], academics, researchers, and very importantly, with civic society. 

In the eyes of the public, particularly after the Global Financial Crisis, expectations for proper governance, risk management, and a healthy firm culture have really come to the fore. We also think about the ultimate goal of what we're trying to do, which is to deliver safe and sound banks for the public. A key element of that is how they're run — the nature of how they're run in the risk management and culture.

 I am generally in favor of international dialogue. Why? Because we don't know everything, and we have to have a certain dose of humility.

Even when we take actions or make supervisory interventions, they may not be fully effective or deliver the desired outcome. Other things can happen in the macroeconomic or financial environment that cause issues, so we are not all-knowing. For that reason, dialogue is very important to get different perspectives. 

But it's also really important that it's not just about industry perspectives. I've mentioned the important role of academics, think tanks, and civic society. I agree that there are common issues and outcomes we want to achieve between the supervisor and supervised entities, and our interests can be aligned. 

We supervise a very large part of the global banking system, so we feel a huge responsibility to participate in international standard setting institutions. We also see an important aspect in benchmarking ourselves: What are we doing? How does that compare with others? Are we keeping up our supervisory standards as things evolve globally? This is all part of being involved in implementing standards and the direction of travel set out by international bodies.”