Therese McCarthy Hockey remarks to COBA CEO and Directors Forum

A strategy for future sustainability
 

Good morning. This is my third COBA CEO and Directors Forum as the APRA Member with responsibility for banking – and it’s great to see so many board members and senior leaders of mutual banks here to engage on important matters for the good of the mutual sector.

Last month I sat down with COBA’s leadership and the CEOs of a range of the larger mutual banks for a discussion about some of the issues facing the sector. Most of the topics raised were the ones I would have expected – regulatory burden, competition and governance to name a few. But I was also asked by one of the CEOs whether APRA thought about “strategic risk”.

The question really struck me. Firstly, that’s because APRA absolutely thinks about strategic risk – essentially the risk that an entity’s business model and corporate strategy are the wrong ones for the times. Sometimes referred to as “business risk”, it’s specifically mentioned in the Supervision Risk and Intensity (SRI) model we use to assess our regulated entities and determine supervisory intensity. But secondly because it’s a risk we believe is becoming more important to entities’ long-term sustainability, with relevance for customer-owned banks. 

Since the mid-1800s, mutuals have carved out an integral place in the Australian banking landscape through a combination of local knowledge, personal relationships and returning profits to communities. While the number of mutuals has declined over recent decades, what’s often not appreciated is that the sector currently has its greatest market share since APRA began collecting data. From less than 3 per cent a decade ago, mutual banks collectively hold market share in housing lending of roughly 5 per cent today, up half a percentage point in the past 12 months alone. Clearly, you’re doing something right. 

But as the saying goes, “what got you here, won’t get you there”. The qualities that have underpinned customer-owned banks’ success are being challenged by changes to the way Australians interact with financial services and advances in technology. While competition from new financial system players, such as non-bank lenders, fintech giants and cryptocurrencies, is impacting all banks, the way mutuals approach these challenges needs to be different by virtue of the tools available to you. Failing to identify this strategic risk and adapt the business accordingly could leave mutual banks unable to attract the next generation of customers you need to keep your institutions sustainable.

In the time I have today before taking questions, I want to talk more about the importance of managing strategic risk in a highly dynamic environment and give you some insights from the findings of our thematic review into recovery and exit planning.

A world of risk

If you’ve read any of APRA’s Corporate Plans for the past four years, you would have come across the expression “protected today, prepared for tomorrow”. It encapsulates APRA’s vision for maintaining a financial system that is not only strong right now but will be resilient into the future. 

In “protecting today”, we expect entities to have strong levels of capital, robust liquidity and sound operating systems so customers can undertake their daily finances seamlessly and businesses can operate with confidence. 

But uncertainty is everywhere, and banks need to prepare for a range of strategic risks to ensure that they are “prepared for tomorrow”. Let’s unpack a few of these starting with demographic shifts and changing customer preferences.

Today’s consumers demand fast, seamless transactions available at any hour of the day, including the latest mobile apps, online services and other digital tools. They seldom use cash and rarely visit branches. Research from the United States found credit unions there had an ageing customer-base and were finding it increasingly difficult to attract younger members who prioritise a “superior mobile banking app and a superior online banking website”.¹ Anecdotally, APRA has heard some Australian mutuals pointing to the challenges associated with changing customer behaviour which is backed-up by the RBA’s recent data on mobile and digital banking showing a strong trend to increased digital activity.²

The stark reality of investing in and developing new technology to attract a younger and more digitally enabled customer base is that it comes with a high upfront cost. Of course, we know that in the longer term, better tech can bring cost-savings through greater efficiency, but it can feel like a never-ending drain on resources too. These costs include developing and upgrading websites, creating mobile apps and building API-enabled architecture and cloud-based services.

While consumers demand this faster, digital offering, they want to be safe from scammers and fraudsters. This is yet another source of cost for banks – and regulators including APRA have been forced to act to ensure the community is adequately protected from the new risks associated with cyber criminals and other bad actors. 

Customer expectations are at the heart of this. They want to know that no matter the circumstances, their bank will be suitably equipped to provide continuity of service – such as payments. To that end, they want to be confident that their bank has invested in the necessarily operational resilience measures that we have set out in CPS230 Operational Risk Management. All is not lost, however; some banks are really leaning in – they see outstanding cyber resilience is a strategic enabler and an attractive customer proposition.

Strategic risk can also arise through overseas contagion challenges. When you’re a small credit union in a rural area, it’s easy to think that overseas conflicts and diplomatic ruptures aren’t your concern. That would be a mistake – and the overseas bank failures of 2023 which necessitated unprecedented central bank action to thwart the contagion is a case in point. In an increasingly interconnected global financial system, a trade dispute or armed conflict in the Asia-Pacific have the potential to severely impact the economy and entities operating within it – and that includes all banks, as well as insurers and superannuation funds.  If the economy were to suffer a shock, customers want to be sure their bank can support them. They ultimately expect their bank to have thought ahead to a “rainy day” and be prepared.

The last of the strategic risks I will cover today relates to the internal workings of a mutual bank. That is the ability to identify, recruit and retain the right people for your organisation – for now and for your long-term prosperity. In my discussions with boards and executives of mutuals, the “war for talent” is a recurring theme – at all levels, from the board room to the executive suite to the team members dealing with customers, building IT platforms and managing the risks. 

Let’s start at the top – the board. The importance of skilled boards cannot be understated for all banks including mutuals who have the privilege of keeping depositors' money safe – and our recently released consultation paper on governance goes to that. Through our supervision, we see the pitfalls of poor governance with almost 80 per cent of APRA-regulated entities subject to heightened risk-based supervision having underlying governance problems. As the demands on directors have grown in line with changing community expectations and a more complex risk landscape, APRA is acting to ensure our standards keep pace with contemporary practice.  Along with our focus on lifting the skills and capabilities of the directors, we are mindful of burden. APRA is seeking to streamline where we can, clarify what is most important for board members and set out our expectations for senior executives on how they support you. Specifically, we will look to give boards more confidence about what APRA requirements they can delegate – and what they ought to expect of senior management. 

For the mutuals, our observation is that some boards lack the necessary skills to guide their banks in a modern banking environment, in particular technology skills. That may require you to upskill existing directors, but you might also need to look beyond your bank’s traditional geographic or industry-based pool to seek fresh talent.

Tenure is another long-standing issue among mutuals. Long tenure begins to raise questions about the ongoing ability of directors to exercise impartial judgement, challenge management effectively and be open to new ideas. 

Of course, mutual banks aren’t the only financial services companies looking to ensure they attract the best directors with the pool of suitably qualified candidates being in high demand. But getting the appointments right at the top of the organisation will give mutuals the best chance of charting a bold strategy for the future and as a result, attract the best team to enact it.

Head on

We believe these strategic risks are real, material and becoming more acute as the pace of change in financial services increases. 

Recognising the challenges facing smaller banks, APRA is strongly committed to the Council of Financial Regulators (CFR) Review of Small and Medium Banks. We’ve heard the mutual sector’s call for regulatory changes to enhance your ability to compete with the majors and mid-tiers. Along with our peer CFR regulators and the ACCC, we will consider what changes we can make that support competition and consumer choice without harming financial safety and stability. 

Mutual boards that wish to remain in control of their own destinies must face into these competitive challenges and develop a strategy that adapts to the changing landscape. 

In this highly competitive environment, we’ve seen mutuals taking immediate actions to shore up their businesses and reach customers such as: 

• leveraging their branch network – COBA entities run one in 4 regional branches, which shows they are committed to the local community and that customers are rewarding them for it; and
   
• leveraging mortgage broker channels to reach more customers. The data shows that mutuals have gone from a quarter of new housing loans originating from brokers to almost half. (Mutual boards should be aware relying on brokers for loan origination does carry risks as these customers are more likely to leave if they can find a cheaper deal somewhere else).

But with the evolving strategic risk landscape, these kinds of initiatives alone are unlikely to be enough to sustain mutual organisations long into the future. 

In a story relayed to me by our frontline supervisors, a CEO of a mutual recently updated their previous three-year planning cycle to a longer-term 10-year outlook. In taking this longer-term view, they identified ongoing difficult operating conditions and realised that they needed to start making some decisions around the future of their mutual while it was still in a position of strength. They ultimately wanted to ensure that they could meet customer expectations and continue to serve their community well. 

These kinds of planning exercises are enabling mutual banks to explore initiatives which go to operational scalability by partnering. This can enable small and medium banks to access advanced technologies and specialised expertise that would otherwise be prohibitively expensive or too complex to develop internally. APRA believes there is scope for mutual banks to explore the possibilities of pooling resources or expertise. We would encourage the sector to look at these types of innovative ideas provided they can manage the risks and potential conflicts.

Another way to achieve scale is through merger; a common way for mutuals to yield operating dividends to reinvest into the business in support of customers.  This year alone we’ve seen two mergers in the mutual sector completed and another three are in progress.

Regardless of which path mutuals choose, a rapidly evolving financial system where non-traditional players such as private credit and fintechs are moving towards the mainstream means banks that fail to evolve could find themselves struggling to stay relevant. 

Winter is coming

This brings me to the issue of recovery and exit planning. For mutuals, investing in this area is critical as you tend to have fewer options than larger banks, which can raise equity from the market, divest a potential subsidiary or run-down trading books. The lower profitability of mutuals also leaves you particularly vulnerable to a sudden shock; for example, it would only take one severe cyber-incident to put many mutual banks in a financial position that would be very difficult to recover from.

Last year, we introduced the new prudential standard CPS 190 Recovery and Exit Planning. This placed obligations on all APRA-regulated entities to make sure they had plans in place for a crisis scenario. With CPS 190 now in effect for all entities, we conducted a thematic review last year into how banks were managing this issue. As a proportionate regulator, APRA doesn’t expect the level of detail or sophistication in planning from a small mutual as we do from a major bank. But even taking this proportionate lens into account, mutuals need to do much better. 

The areas with the most room for improvement were “triggers” – knowing when you have a problem – and “recovery and exit actions” – knowing what steps you will take in response to the problem. In short, for a number of you, there is a risk that you may discover too late that you are in trouble and find your contingency plans don’t protect your bank or your customers as intended. 

With regards to triggers, our review found they were often set too late and too close to regulatory minimums in areas such as capital and liquidity, giving banks insufficient time to respond effectively. Trigger frameworks were often overly complex or ambiguous, and we also saw a lack of non-financial triggers.  

We also found proposed recovery and exit actions were often unsuitable for the crisis they are intended to avert and lacked credible and readily executable steps. We also observed a lack of preparatory measures, unclear language and an absence of a preferred exit option in the plan. 

So, what does good look like for mutuals? Better practice for triggers is to have early warning indicators built into the mutual’s monitoring framework with the use of cascading triggers to support a gradual dialling up of an entity’s crisis response. For recovery measures, we were pleased to see some mutuals assessing the capital and liquidity impacts of each measure and the likely implementations challenges such as for the business transfer as an exit option where mutuals have included what due diligence would be needed, the necessary regulatory approvals and the timeframes. Even better is to have held discussions with potential partners, while the gold standard is to have a signed, non-binding agreement to facilitate a fast, efficient process in a crisis.

Recovery and exit planning is not an issue responsible boards and senior managers can neglect if they wish to remain in control of their destinies. Should boards be ill-prepared to handle a crisis, they risk APRA needing to step in and take over to protect depositors and financial stability. When this happens, boards lose control of some of the key considerations around the future of their bank, their employees and their customers. That includes the possibility of ending up in a merger that doesn’t reflect their preferred values, culture or member priorities. APRA’s CPS190 is designed to give boards a tool to avoid that outcome to the extent possible.

Fit for the future

As technological innovation and changing consumer preferences push banking further into the virtual world of websites, mobile apps and digital wallets, maintaining a sustainable bank business model will require more than just tenacity and community spirit. Banks of all sizes will need to be agile enough to develop the products and services that the next generation of mutual customers is demanding and strong enough to remain resilient in a crisis.

Thriving in this highly dynamic environment will require the right long-term business strategy as well as detailed and deliverable plans to identify and recover from threats to their viability. The message I want to leave you with today is that while many of you have these in place and are set up for future success, others have work to do. 

Whatever your preferred strategy for long-term sustainability, it cannot be complacency. The customer-owned banking model may have prospered in Australia for more than a century and a half, but not every mutual has lasted the distance. So no matter how confident you are that your bank and its customers are protected today, make sure you also reflect deeply on whether you are prepared for tomorrow.