When a regulator announces enforcement action, the fine usually gets the headline.
It is an easy number to report and an easy number to focus on. But it may not be the part of the story that has the greatest effect on the business.
Serious control or governance failures can lead to intervention that changes the conditions under which an organisation operates. Once that starts to affect decisions management would normally make for itself, regulatory risk has moved beyond the direct cost of getting something wrong.
It can start to reduce the organisation’s room to manoeuvre.
The consequence does not have to be a fine
APRA’s action against ING Australia in September is a good example.
The bank notified the Australian regulator in July that it had identified material miscalculations in its liquidity position over several years. Although it had been reporting a Liquidity Coverage Ratio of around 160%, APRA said the true position was substantially lower and had at times fallen below the regulatory minimum of 100%.
APRA imposed licence conditions and increased ING Australia’s minimum liquidity requirements. It also applied a A$50 million operational risk capital add-on.
The licence conditions require independent reviews into the causes of the reporting failures and the bank’s wider risk management and governance practices. ING must then develop a comprehensive remediation plan and provide independent assurance that the resulting actions have been effectively implemented and embedded.
Those measures remain in place until APRA is satisfied that the required work has been completed.
None of this took the form of a fine.
Instead, the bank is operating under tighter prudential conditions while it demonstrates that the weaknesses have been addressed. That creates a very different type of impact from a one-off financial penalty.
It also raises a question for firms assessing their own regulatory exposure. Does the impact assessment stop at the likely cost of enforcement, or does it consider what continuing supervisory intervention could mean for the business afterwards?
When supervision reaches management decisions
The recent FINMA proceedings involving Julius Bär go further.
FINMA found serious breaches of supervisory law relating to the bank’s credit risk management and anti-money laundering obligations. It also identified deeper weaknesses in the bank’s risk and compliance culture.
Julius Bär has already made substantial changes and some measures imposed earlier in the proceedings have been lifted or relaxed.
Others remain.
Until the bank completes the divestment of client assets that no longer fit its revised risk appetite, it must hold CHF250 million of additional capital. Payments to shareholders, including dividends, require prior FINMA approval.
The bank must also report to FINMA on its risk, error and compliance culture until 2032. A temporary restriction on entering new relationships with PEP clients from high-risk countries is being phased out as the divestment progresses. FINMA notes that its ruling is not yet legally binding.
The effect on management discretion is clear.
A decision such as whether to make a distribution to shareholders is no longer entirely the banks to make. Earlier failures have also affected which new client relationships the bank can enter into.
That is something a headline penalty would struggle to capture.
Looking back through RiskBusiness Newsflashes since 1 January 2020, we identified 226 cases of serious regulatory intervention across 41 countries and jurisdictions in which firms were closed or severely restricted from taking new business, management was replaced, or liquidators or other third parties were appointed to manage the firm. That total does not include cases where management remained in place but operated under increased capital requirements or required regulatory approval for business decisions.
The response can become more intrusive
Regulatory intervention does not necessarily peak when a problem is first identified.
On 6 October, ECB Supervisory Board Vice-Chair Frank Elderson described the ECB’s increasing use of an escalation ladder where material weaknesses are not addressed quickly enough. Its supervisory toolkit includes additional capital requirements and can extend to restrictions on business activity.
Elderson also made the point that remediation has to deal with the underlying weakness, rather than simply completing the actions attached to an individual finding.
For risk teams, the timing is worth thinking about.
The original failure may be only the start of the impact. If remediation does not satisfy the supervisor, the response can intensify.
That means a scenario based on regulatory failure should not necessarily end with investigation, enforcement and remediation. What happens during remediation can affect how far the consequences eventually reach.
Does the scenario go far enough?
This is where regulatory risk scenarios can sometimes stop too early.
A breach occurs. The regulator investigates, the potential penalty is then estimated, and remediation costs are considered.
That may be a reasonable assessment for some events.
For a serious failure, though, there may be another stage to work through: what happens if the regulator begins to constrain decisions that the organisation was expecting to make?
Take a growth strategy that relies on deploying capital over the next two years.
A fine can be modelled as a direct cost. An additional capital requirement may affect whether the original plan still works in the same way.
Or consider a strategy built around an activity that could become subject to regulatory restriction. Again, the effect is no longer confined to the cost of the failure itself.
The organisation may have fewer options than it expected.
That is why loss of management discretion deserves more attention in regulatory risk assessment.
It does not mean assuming every control failure will lead to severe intervention. Supervisory action is intended to be proportionate. The ECB, for example, links escalation to the seriousness and persistence of a weakness and to the way the bank responds.
But where more intrusive intervention is credible, it belongs in the scenario.
Looking beyond the penalty
Regulatory risk often starts with the obvious questions: what does the rule require, are we meeting it and what happens if we are not?
For more serious failures, boards may need to follow the consequences further.
If supervisory intervention starts to influence decisions management would normally control, the effect of the original failure can reach well beyond compliance.
The headline penalty tells you what an organisation has paid for something that went wrong.
It may tell you very little about how much room it has left afterwards.
Stay up to date with the latest news and views from the world of governance, risk, audit and compliance >>>
