APRA Chair John Lonsdale - Speech to Citi Australia and New Zealand Investment Conference

Aftershock: lessons from a real-life banking stress test

Good morning and thank you for the opportunity to speak here today.

We’re now a little more than six months on from the most significant system-wide banking stress event since the global financial crisis (GFC). In only 11 days in March, four overseas banks with total assets of more than a trillion Australian dollars needed to be wound up, put into receivership or rescued. An additional bank was closed at the start of May.

Unlike the GFC, none of the four US banks that failed was considered especially significant to systemic stability prior to their collapse; one of the first to go, Silicon Valley Bank (SVB), was a large regional bank specialising in servicing technology companies – not quite David, but very far from Goliath. Yet the impact of its rapid and unprecedented collapse in only two days sent shockwaves around the global banking system. 

Far from the dual epicentres of the turmoil, most Australians would have barely felt a tremor as their banking system stood strong, supported by a prudential framework that exceeds Basel requirements in some areas. 

But earthquakes do shake foundations and, if unchecked, can undermine long-term stability and introduce weakness.  In the same way, this crisis exposed weak spots in the regulatory architecture for banking and highlighted new risks associated with the digital finance revolution. 

Over the past few months, APRA has sought to strengthen further the Australian banking system to withstand future shocks. We are reinforcing areas of the framework where we can further solidify foundations, including requirements around liquidity and interest rate risk. We are also assessing the effectiveness of Additional Tier 1 (AT1) instruments designed to stabilise a bank in stress or support resolution in the event of failure.

Underpinning this is perhaps the key lesson from this year’s events: the speed at which a bank run can now take place and spread to other institutions means even banks that aren’t considered “systemically important” can undermine confidence in and stability of the financial system should they fail. 

This recognition is causing a global rethink about crisis preparedness, including the optimum use of proportionality in the regulatory framework, and how to balance promoting competition and innovation with preserving safety and stability. If the fall of a small bank can bring down bigger ones, then all banks have systemic importance and it’s in everyone’s interests to keep them strong and secure.

Turning over rocks

A bank’s capital base is the bedrock of its financial soundness. The bank capital framework aims to protect depositors and promote financial system stability by ensuring banks have sufficient capital to withstand shocks and absorb losses while continuing to lend. 

This framework has served Australia well; the financial system has remained stable through some major tests of its resilience.

Fresh evidence that Australians can have confidence in the safety of their banks will be released when APRA publishes the results of our latest authorised deposit-taking institution (ADI) stress test.

Eleven large banks, including all the majors, took part in this year’s test, which was conducted for the first time using the new bank capital framework that took effect this year. The scenario used was a severe downturn featuring high inflation, unemployment rising to 10 per cent and house prices falling by more than a third. 

We are still in the process of reviewing the results, which will be published externally early next year. What I can tell you now is that no banks breached their prudential requirements on capital, all retained sufficient liquidity and banks continued to provide credit to households and businesses. Although a hypothetical exercise, these results provide confidence in overall financial system resilience.

The scenarios used for APRA’s stress tests are designed to be severe yet still plausible. That’s why, in addition to hypothetical factors such as a domestic recession and high unemployment, we often insert a sudden non-financial shock – such as a natural disaster or a major cyber-attack. 

Back to what happened at SVB - the most concise answer as to why SVB failed was poor risk management by the bank’s board and leadership. A more fulsome response would point to a number of factors that left the bank unusually vulnerable to the fastest bank run we’ve ever seen. 

These included:

• SVB mismanaging its interest rate exposures, leading to large unrealised losses that required an equity raise when these losses started to be realised;
   
• a highly concentrated, tech-savvy depositor base that fled when it became apparent the bank would have to realise these losses that sat in their liquid asset portfolio; and 
   
• the fact that almost 95 per cent of the bank’s deposits were above the $250,000 limit of the US Government’s bank guarantee, and therefore uninsured.

Seismology

There are important differences between the US and Australian banking systems, with generally more stringent regulatory requirements here, especially in relation to capital and liquidity. We don’t have the same level of concentration risk among Australian banks’ deposit bases, and there is no local bank with anything remotely approaching SVB’s level of uninsured deposits. 

But that doesn’t mean we are immune from the same types of contagion risks that we saw spread from America to Europe. The crisis provided important insights regarding the global regulatory framework for banks.  While some of the subsequent strengthening work is happening through multilateral forums, APRA has also embarked on a program of policy revisions to incorporate learnings from the turmoil. 

One lesson learned the hard way this year was the speed at which bank runs in the digital age now occur. Many of you will remember images of customers in the UK lined up around the block to withdraw money from Northern Rock during the GFC. This “analogue” run saw the bank lose 20 per cent of its deposit book in four days. 

But in today’s digital age, queuing to withdraw money in person is as redundant as a rotary telephone. Armed with smart phones and internet banking, SVB faced outflows of an astonishing 85 per cent of its money in just two days, while First Republic Bank faced outflows of about 37 per cent of deposits over the same length of time.

Even the largest, most financially resilient and best resourced banks would struggle to cope with deposit outflows of this volume and velocity. For smaller banks, it would be especially difficult. With the recent turmoil highlighting the outsized impact that the failure of a smaller bank can have on overall system stability, we will soon commence consultation to update our prudential standard on bank liquidity (APS 210). The consultation is examining targeted changes to the simpler minimum liquidity holdings (MLH) approach used to calculate the requirements for smaller banks, which stands in contrast to the more complex and sophisticated liquidity coverage ratio (LCR) used by larger banks. Our goal is to ensure all banks reflect the market value of their liquid assets for regulatory purposes and don’t get caught short in the way SVB did. In addition, to reduce contagion risk across the system, we will be examining where banks are holding each other’s securities for liquidity purposes. A more complete review of the liquidity standard for banks has been pushed back to next year.

Another policy area where APRA is seeking to strengthen bank resilience concerns interest rate risk in the banking book (IRRBB) – the issue arguably most responsible for the collapse of SVB. Australia is the only jurisdiction in the world that mandates banks carry capital to address the risk of rising interest rates as part of their core (pillar one) capital requirements. However, as in many other areas of the prudential framework, smaller banks face simpler, less onerous requirements than large banks. In response to lessons learned from the March stress event, we have examined the calibration of the IRRBB standard and are now in the throes of finalising an updated version. This will include a proportionate focus on smaller banks, confirming that APRA expects them to have an appropriate interest rate framework tailored to their own risks and management awareness. 

A third issue exposed by the collapse of SVB and Credit Suisse is that some of the key crisis response tools that banks, regulators and Governments can call on in such moments were not sufficient. For example, in Switzerland, Credit Suisse’s AT1s did not absorb losses early enough, in part due to concern that publicly signalling the bank’s distress would worsen the situation. This contributed to APRA’s concerns that these instruments may not work as intended to help mitigate or resolve a future Australian bank crisis. As a result, last month we commenced a conversation with the banking industry and investors about how to improve their effectiveness as a crisis management tool. 

Fault lines

While strengthening the resilience and crisis readiness of smaller banks makes sense in the context of the recent bank turmoil, we’re mindful that a careful balance needs to be struck if we’re not to adversely impact competition in a way that’s detrimental to the community.

As a risk-based prudential regulator, proportionality is part of the discussion in every policy and supervision initiative that APRA undertakes. Our supervisory framework considers factors such as the size, complexity, risk profile and systemic importance of regulated entities, with greater attention applied to the areas of greatest risk. 

Our policy framework also draws distinctions between “significant” and “non-significant” financial institutions, with larger, more complex and entities subject to heightened requirements that reflect their greater systemic importance. Smaller entities (including the vast majority of banks), with simpler business models and fewer resources, face streamlined and simplified requirements in areas where it’s safe to do so. Recent examples include simplified requirements for smaller, less complex entities regarding remuneration and ADI capital adequacy, and in new prudential standards for financial contingency and resolution planning. This distinction reduces the cost and administrative burden on smaller entities compared to the industry giants with greater scale and resources. 

APRA’s approach to proportionality is often described as stability-at-least-cost. But “least cost” to whom? 

Proportionality enables competition, and competition brings innovation and enhanced outcomes for customers. We recognise, however, that there are some areas where the potential cost of weaker requirements is high. 

One such area is cyber security. With cyber-attacks becoming more prevalent and scams on the rise as consumers increasingly do all their banking online, we simply cannot afford some entities to have lower cyber security standards than others. As a result, our prudential standard on information security (CPS 234) applies equally to all entities. 

Yet where it is possible to introduce or enhance proportionality in the framework in the interests of competition, we will do so. Such is the case with our prudential standard on operational resilience (CPS 230), which was finalised this year. To assist the smaller end of town, we’ve indicated, as we regularly do, that each entity can apply the standard in a way that is commensurate with the size, business mix and complexity of its operations and we will work with industry through upcoming roundtables to support implementation in line with this approach. 

Early warning detection

The speed at which events unfolded this year has also refocused attention on the importance of prevention, through proactive supervision and sound risk management, rather than cure, through reactive recovery or resolution.

The risks faced by the banks which failed were not unknown. Bank supervisors in both jurisdictions had identified the prudential risks these institutions faced and warned them accordingly. SVB had 31 open supervisory findings against it when it failed, which is about triple the number observed at peer firms. But these warnings didn’t drive sufficient change at either bank to protect them in a stress scenario. 

A lesson for APRA’s supervisors here then is the importance of continued strong and effective supervision, which not only identifies weaknesses but takes and enforces prompt action to address them. I can assure our regulated entities that APRA will continue to use its full suite of supervisory and enforcement tools to ensure poor risk management practices are addressed in a timely manner. In recent years this has included the application of material capital or liquidity add-ons where appropriate, alongside other public enforcement actions and, of course, ensuring that accountability is where it needs to be. 

Building resilience

This focus on disaster prevention, rather than disaster response, informs APRA’s approach to macroprudential policy and risks in the residential mortgage sector. It is consistently the topic I am asked most about. In particular, I’m quizzed about the 3 per cent serviceability buffer. 

Our focus in monitoring the housing market stems from our responsibility to protect bank depositors – who provide the funds that banks lend for housing – and to promote overall financial system stability. We do that by ensuring bank balance sheets are sound and lending standards are appropriate. 

Currently, the main considerations for macroprudential policy settings are:

• the quality of new housing loans has improved markedly over the years, but there are heightened risks in the economic environment, cost of living pressures, and the possibility of higher unemployment;
   
• risks in business lending, with higher business insolvencies and slowing consumer spending; and
  global economic and financial risks, including from China and now the Middle East. 
   
• Given these uncertainties in the economic environment, housing market and geopolitical sphere, the answer to the inevitable question about the serviceability buffer is that we continue to think 3 per cent is appropriate in the current environment. As always, these settings are under constant review.

Shifting ground

While this year’s banking difficulties were but a blip on the Richter scale compared to other seismic downturns like the GFC, there are still lessons to learn from and act on.

We’ve seen that the speed of modern bank runs, assisted by digital technology and fuelled by social media, can make them hard to stop once depositors lose confidence that their money is safe. We’ve also seen how quickly that instability can spread to other institutions across countries and international borders due to greater interconnectivity.

To ensure Australia’s banking system is equipped for this new reality, APRA will continue to press boards to lift their standards of risk management, and is prepared to act promptly, and forcefully if necessary, to rectify weaknesses ahead of serious problems emerging. As our policy agenda evolves in response to developing risks, we will also look to respond in a way that enables competition while recognising that all banks are significant to financial system stability.  

Just as importantly – all bank customers are significant. And regardless of whether they choose an industry giant, a mid-size bank or their local credit union, all depositors need to know their money is safe and will be available when they need it.