Operational Resilience in focus: APRA Chair says Australia's banking system is 'among the strongest and most resilient in the world' (but there is still room for improvement)

4 minute read  28.03.2023 Kate Hilder, Siobhan Doherty

Key takeaways from APRA Chair John Lonsdale’s 28 March 2023 address to the AFR Banking Summit


Key takeouts

  • A key message running through Mr Lonsdale's address is that 'Australians can be confident…their banking system is among the strongest and most resilient in the world, with prudential safeguards above and beyond minimum international requirements'. 
  • Mr Lonsdale said that APRA (and other financial regulators globally) are considering whether the existing regulatory framework 'needs strengthening', especially in light of the speed with which regulators may need to respond to future shocks.
  • Mr Lonsdale made clear that he considers there is scope for Australia's banks (and other financial institutions) to further strengthen their operational resilience, including:
    • taking steps to ensure they 'effectively identify and manage all operational risks, are able to continue to deliver critical operations during disruptions, and prudently manage the risks of service providers'.  On this point, APRA expects to finalise CPS 230 by the end of 2023.  
    • Implementation of CPS 234 was also highlighted as an area where APRA sees scope for improvement.

Overview 

Our high level summary of Australian Prudential Regulation Authority (APRA) Chair John Lonsdale's 28 March 2023 speech to the AFR Banking Summit on banking system stability is below.  

Recent developments have had little impact on Australian banks

  • Mr Lonsdale observed that the collapse of Silicon Valley Bank (SVB) and subsequent takeover of Credit Suisse, 'have had little impact' on the stability of the Australian banking sector. 
  • Mr Lonsdale suggested that these recent events highlight both:
    • how interconnected the international financial system has become (though in doing so, Mr Lonsdale made clear that Australian banks are insulated by 'tougher standards and requirements than many peer jurisdictions)
    • the importance of consumer confidence – ie confidence and trust that 'one's money is safe and available on demand - in maintaining bank stability.  Mr Lonsdale pointed to the rapidity of the collapse of SVB in illustration of 'what can happen when customers lose that confidence'. '

APRA's 'tougher standards' (and APRA's regulatory approach) have enabled consumer confidence to 'flourish

  • Mr Lonsdale attributed banks' resilience to the regulatory settings in place/APRA's approach over a number of years.  Mr Lonsdale observed that while APRA 'can’t prescribe a set level of “confidence” that our regulated entities need to maintain more broadly…we can work to create the conditions for it to flourish' adding that the level of trust in Australian banks is the product of 'many years of regulatory reform designed to reinforce the system's financial and operational resilience'. 
  • Importantly, Mr Lonsdale underlined that Australia's system has:

'different and often tougher standards and requirements than many peer jurisdictions.  We might be connected, but their issues and problems are not necessarily ours.  It’s also why, as new challenges present – whether climate, cyber or sharply rising interest rates – you can trust that APRA will act decisively to help keep deposits safe'. 

Australia's regulatory settings are 'super-equivalent' to Basel requirements 

  • Building on the points made above, Mr Lonsdale identified the Basel III regulatory framework for banks as one of the 'most consequential' reforms to emerge in the aftermath of the Global Financial Crisis. 
  • Mr Lonsdale underlined that in a number of areas, APRA’s prudential framework is 'super-equivalent' to the Basel III requirements in that it exceeds them in a number of instances.  Mr Lonsdale cited a number of examples of this including:
    • APRA's new bank capital framework which is informed by both the Basel reforms and also incorporates a key finding from the 2014 Financial System Inquiry that Australia's banks be 'unquestionably strong'.   
    • APRA's capital framework is also 'calibrated to offset…[concentration risk in residential mortgage lending] with higher risk weightings, and so higher capital requirements'.
    • Australia's tougher liquidity requirements allow: 

    'a much narrower range of definitions of high-quality liquid assets (HQLA) when determining the liquidity coverage ratio (LCR): no corporate bonds, and no residential or commercial mortgage-backed securities.  Removing these assets, which can’t always be sold easily, from the equation not only strengthens the quality of bank liquidity, it increases simplicity and transparency, which boosts confidence from investors'. 

    • Australia is the only jurisdiction in the world that 'mandates banks carry capital to address the risk of rising interest rates as part of their core (pillar one) capital requirements'. 
  • On this last point, Mr Lonsdale commented: 

'The significance of this measure in light of current events is hard to overstate.  SVB’s exposure to rising interest rates was one of the main factors behind its collapse. In contrast, as markets moved in response to RBA changes in the official cash rate, Australian banks have had to hold additional capital.  Some banks had expressed displeasure about the application of capital for IRRBB but two weeks ago the IRRBB requirement proved its worth.  We are currently in the process of updating our prudential standard in this area and will be sure to consider lessons from the past few weeks'.

  • Mr Lonsdale also observed that APRA's analysis of the results of the most recent banking stress tests 'give us some confidence' that Australian banks stand well-prepared for future crises.  

Financial regulators globally are considering whether existing requirements need strengthening

  • In making these points, Mr Lonsdale also made clear that:

'no matter how resilient our financial system, what happens globally affects us to a greater or lesser extent' and that though the impact of recent events has been 'limited', this 'does not mean there are no lessons for us'.  .

  • In light of this, Mr Lonsdale said that APRA (and other financial regulators globally) are considering whether the existing regulatory framework 'needs strengthening', especially in light of the speed with which regulators may need to respond.  
  • Mr Lonsdale observed that:

'As the speed of crises has accelerated, regulators have less time to respond than they once did. We can no longer expect to have days or weeks to debate and plan considered responses.  We need to be ready to act quickly, but we also need greater confidence than ever in the prudential safeguards we have in place.  It may be that we need to look more closely at concentration risk in deposits and adjust requirements where an ADI has particularly high exposure to a particular industry or demographic.  These types of contemplations are already underway among international regulators'.

  • In addition, Mr Lonsdale observed that:

'Over recent years, we have seen an increased frequency of events outside the scope of what financial institutions typically model for: fluctuations in commodity prices that we’ve rarely seen before, sharper movements in interest rates and a higher number of extreme weather events. The causes and impact of this greater financial volatility is something we as regulators also need to examine'.

Focus on strengthening operational resilience

Mr Lonsdale underlined that APRA's focus on 'building resilience in the banking system is never finished', especially in light of evolving risks facing the sector including (among other areas) cyber risk.  

Cyber risk

  • Mr Lonsdale underlined that 'boosting cyber resilience remains one of APRA's top priorities'.  
  • Touching briefly on the results of APRA's tripartite audit reviews - APRA required regulated entities to engage an independent auditor to assess the entities' compliance with CPS 234 - Mr Lonsdale said that the first tranche of results 'show that entities have more work to do and that there is a need to continuously raise the bar on cyber preparedness and resilience across banking, insurance and superannuation'. 
  • Expanding on this, Mr Lonsdale nominated the following as areas where APRA would like to see improvement:  a) 'a lack of rigour in the nature and frequency of security control testing'; b) 'insufficient board oversight on cyber'; c) 'incident response plans not regularly reviewed or tested'; d) 'insufficient safeguards to protect sensitive customer data'; and e) 'inadequate service provider oversight arrangements'.

New prudential standard CPS 230 expected to be finalised later this year 

  • Mr Lonsdale made clear that APRA expects all regulated entities to:

'ensure they effectively identify and manage all operational risks, are able to continue to deliver critical operations during disruptions, and prudently manage the risks of service providers'. 

  • Mr Lonsdale reiterated that APRA plans to finalise Prudential Standard CPS 230 Operational Risk Management, (which will replace five existing standards for business continuity and outsourcing) later this year.. 
  • Mr Lonsdale observed that: 

'if avoiding a costly and damaging cyber incident or other operational risk event is not enough of a carrot, APRA is prepared to wield the stick and take enforcement action if necessary'. 

[Source: APRA Chair John Lonsdale speech to the AFR Banking Summit on banking system stability 28/03/2023]

Interested in this (and similar) topics?

Subscribe to alerts and our weekly wrap up of key financial services, risk, regulatory and ESG developments.  

Contact

Tags

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1laWQiOiIyNzJkYjg5ZS05MzIxLTQ3OGItYTJkZi0zYTg2MWVmNTU2YWUiLCJyb2xlIjoiQXBpVXNlciIsIm5iZiI6MTczNzI1OTAzNiwiZXhwIjoxNzM3MjYwMjM2LCJpYXQiOjE3MzcyNTkwMzYsImlzcyI6Imh0dHBzOi8vd3d3Lm1pbnRlcmVsbGlzb24uY29tL2FydGljbGVzL2FwcmEtY2hhaXItYWRkcmVzcy10by0yMDIzLWFmci1iYW5raW5nLXN1bW1pdC1rZXktdGFrZWF3YXlzIiwiYXVkIjoiaHR0cHM6Ly93d3cubWludGVyZWxsaXNvbi5jb20vYXJ0aWNsZXMvYXByYS1jaGFpci1hZGRyZXNzLXRvLTIwMjMtYWZyLWJhbmtpbmctc3VtbWl0LWtleS10YWtlYXdheXMifQ.GPtz8rE0LvCemGwzRSF6fWJI37auxWXw6ldQwjwXDOU
https://www.minterellison.com/articles/apra-chair-address-to-2023-afr-banking-summit-key-takeaways