## Good cop/bad cop
Speech given by
Sam Woods, Deputy Governor, Prudential Regulation and Chief Executive Officer,
Prudential Regulation Authority
Mansion House City Banquet, London 25 October 2018
I am grateful to Ivar van Hasselt and Joanna Keeble for their assistance in preparing this speech and to other colleagues for comments and contributions.
1
Lord Mayor, Ladies and Gentlemen,
Andrew and I have worked together for a long time, and we've often found it useful to adopt a regulatory good cop/bad cop routine. In the context of Mansion House, the rules are simple: whoever gives the shortest speech is good cop! Now Andrew I timed you just now, and with a few edits I think I can sneak in under the line…
But why am I talking about the police at all? Police metaphors are dangerous, but as it happens 'good cop/bad cop' is a good analogy for two different aspects of our role as regulator:
- First, bad cop: areas where we need actively to insert the public interest into privately or mutually-owned firms, because some of the costs of their failure would be externalised and they therefore have an incentive to run too much risk. Here there is inherently a degree of conflict between regulator and firm - it is the way our system is set up. Capital is the most obvious example of these battlegrounds, where reasonable people with different objectives quite naturally come to different answers. But there are many others.
- Second, good cop: areas where we and firms are collectively facing a shared challenge. There is no inherent conflict between the public and private interest - we have a shared interest in mitigating the risk, and there is a role for both public and private sectors. Cyber is the classic case of these shared endeavours.
With the post-crisis reform job now largely complete, I will set out what firms should expect to see from the PRA across these areas as we enter a new phase.
## Bad cop
Let me turn first to areas where our incentives and those of firms are not perfectly aligned, and where there may therefore be a degree of tension between us as we seek to secure the benefits of the new system we have spent the last decade putting in place. I will give you five examples - in highly abridged form, as I'm determined to beat Andrew's time.
First, our brand-new retail ring-fence, the last major section of which was erected by a team at RBS on the weekend of 12 August. This has been a truly massive operation, including the three largest-ever bank authorisations here in the UK, over £800 billion of assets moved and over 1.3 million sort code changes. So I would like to say a big thank you to all of the teams at the PRA and at the banks for some really hard work during the construction phase.
But now that the fence is up, we need it to do its job. It is of course a twenty-first century, modern fence - not a medieval stone wall, and as part of this it was electrified by Parliament in order to discourage attempts to
2
climb over it: the legislation empowers the PRA to use a group restructuring tool to require a banking group to sell its ring-fenced bank or other parts of its group.
Hopefully the prospect of electrocution will discourage any blatant attempts to climb over the fence. But there is still perhaps the possibility of wicked burrowing under the fence, passing things through it or even perhaps using a drone to create mischief. We are therefore setting up a border patrol of PRA staff who will police the fence.
The patrol will ensure there is compliance with restrictions on activities performed by the ring-fenced entities and independence from the rest of the group. In particular, we will closely monitor governance arrangements, seeking evidence that ring-fenced banks can identify conflicts of interest and are able to make decisions on their own. We will set capital and liquidity for the ring-fenced banks, and more generally keep an eye on the risks they face.
Let me move to my second example: accountability. As with the ring-fence, we and firms have gone to great lengths to bring in the Senior Managers Regime here in the UK. But the SMR is not an end in itself - the accountability it delivers should contribute to safety and soundness. Firms should therefore expect us to make more use of the SMR to deliver supervisory priorities. There is no magic to this: we will simply ask, when we set out those priorities, which senior manager is on the hook to deliver them, and what will happen if they do not?
We want to know who is on the hook if things go badly wrong, and have recently asked firms to spell this out in developing areas such a crypto-assets, operational resilience and algo-trading. And enforcement cases have shown that we can, and will, take action against Senior Managers if our red lines are crossed. However, we are not an enforcement-led regulator: in my opinion, the real prudential value of the regime lies in creating opportunities for preventative or remedial action through supervision.
Which brings me to my third example: pay. This has been another area of massive reform. No pay system is perfect, but I remain convinced that the 100% cash, paid out up-front bonus systems which existed for risk-takers in some of our largest firms before the crisis were an important part of what broke the financial system. The new system of deferral, malus and clawback is much safer. So we are not planning to come up with some new approach at this stage - seven year deferral is long enough, and has a pleasingly biblical ring to it. But we are going to ask more pointedly and regularly than before: how is the pay of that senior manager who is tasked with delivering a major supervisory priority going to be affected by their success or failure in that task?
A fourth area is a more traditional battleground for firms and regulators: internal models, where we need to lean against the natural incentive firms have to maximise their room for manoeuvre above regulatory requirements by minimising those requirements.
We are keeping a close eye on risk-weights for large UK banks. Average risk-weights have fallen substantially over the past two decades: from over 60% in the 1990s to 31% today. Many drivers are benign
3
- genuine de-risking, in part as a direct result of the strengthening of our prudential framework. But where a reduction is caused by model design or calibration changes firms should expect us to demand strong evidence of a corresponding decrease in real risk. We are also looking at whether parts of our risk-weight framework are too cyclical - in particular for mortgages. These challenges reinforce the importance of having a leverage ratio to complement a risk-weighted regime for bank capital. Nevertheless, the leverage ratio has challenges of its own: we are having a closer look at whether it appropriately captures all forms of secured financing.
My last example is more specific to the insurance side of our work. In the area of equity-release mortgages (ERMs) we have consulted on measures to ensure that investments 1 in that asset class, which is growing by more than 10% a year, are appropriately and consistently reflected in the regulatory balance sheet. We want to do this both for prudential reasons and to facilitate competition by establishing a level playing field. Our proposition is a simple one: house price growth above the risk-free rate is a risk to which ERM providers are exposed; it should not therefore be assumed and banked up-front as capital in the form of the Matching Adjustment, even if a reasonable person could expect house prices to increase in that way - instead, that benefit should be earned if and when the house price growth actually materialises. We have received many strong views in response to this suggestion, and are considering them now before reaching a final view.
## Good cop
I will turn now to the other part of our work - areas where, as I see it, there is generally no inherent conflict and we and firms are engaged in a shared endeavour to deal with the challenges we face. You may be relieved to hear that, in my determination to be the Mansion House good cop this year, I will only touch on two examples of this - though each of them is a huge topic.
## Operational Resilience
First, what we call 'operational resilience' - the ability of firms to keep going operationally as well as financially. Compared to our framework for things like capital, liquidity and accountability, the regulatory framework for operational resilience is thoroughly under-developed not only here in the UK but also internationally.
This matters more than it used to for a number of reasons, but let me pick out two. First, the emergence of cyber-attacks is a clear and present danger to the financial system which our forebears simply did not have to worry about. And second, as more and more of us access banks and insurance companies digitally, with a major programme of bank branch closures in full swing, and in the age of social media where problems become very visible very quickly, operational failures hurt more than they used to. For the same reasons the Treasury Select Committee is rightly taking a strong interest in this topic.
1 £20bn as at year-end 2017
4
We therefore published during the summer - jointly between the PRA, FCA and Bank as supervisor of market infrastructure - a discussion paper proposing a new framework for thinking about these issues. The central idea is a simple one: how much operational disruption to key business services should firms, the PRA, the FCA, and the wider Bank of England be prepared to tolerate? We call this 'impact tolerance'.
The focus of our future policy will be on the continuity of the business services that a firm's customers and the wider economy rely upon. Preventative mitigation is obviously very important, but having impact tolerance means acknowledging that disruptive events will happen, and that firms need to be able to recover within their set tolerance. I'm talking about planning for scenarios that are severe but plausible - we expect firms to be resilient against a wide range of scenarios, but not against Armageddon.
I think it likely that the ordering of these impact tolerances between firms and the PRA will often be the opposite way round from capital. On capital, inserting the public interest means that as a general matter we will require firms to hold more capital than they would if left to their own devices - hence, a battleground. For operational resilience, a firm is likely to experience significant private costs - for instance, impact on their profits or damage to their brand - before their safety and soundness is at risk.
The exception to this may be a subset of operations whose failure might pose a systemic risk to financial stability. But in most cases, I think interests are likely to be aligned - we all just need to get better at managing this set of risks, as some recent events have illustrated all too painfully. In this context, I will expand briefly on the PRA's particular focus in this important area.
Our general statutory objective is safety and soundness, with policyholder protection on the insurance side and a secondary objective to facilitate competition. But nested within these objectives is an instruction that our objectives are to be advanced by avoiding adverse effects on the stability of the UK financial system. In other words, although our work is primarily microprudential we have an important role to play in ensuring financial stability.
What does this imply for how the PRA should take an interest in operational resilience? It implies that we are interested in operational resilience for its own sake, not just because its absence can have a financial consequence for firms. But we are interested only to the extent that it could have a negative impact on safety and soundness and/or the stability of the UK financial system.
That is a fairly high bar. In practice this is likely to mean that we put more emphasis on operational resilience for larger firms doing activity whose disruption could have a financial stability impact. For smaller firms we are only strongly interested where something is going on that is big enough to threaten the firm's safety and soundness.
So for example: if you are a big bank you can expect us to take an interest in your ability to process payments; if you are an insurer with a large annuity book, we will want to know what the operational risks are to your ability to supply people's retirement income; and if you are a smaller firm spending huge sums on a
5
major IT project, we will be interested in that. Across all of these, we will also want to dig into systemic risks - most obviously those associated with cyber-attacks and the risks associated with a heavy concentration of activity across firms with a handful of outsourcers.
But there is also a much wider set of more day-to-day operational issues and problems which arise for firms, and given the increasing importance of digital service delivery firms need to get much better at this. Sometimes these issues will engage the FCA's objectives, which will be a judgement for Andrew and his team. But in general, they will only be a priority for the PRA if they meet the criteria I have just mentioned. With sufficient but limited resource we need to focus our efforts where they can have the biggest impact in terms of advancing our statutory objectives.
## Brexit
Now Lord Mayor, I admit that I am very tempted to conclude this speech without a mention of the B-word, not least because this would surely guarantee a speech shorter than Andrew's. But our philosophy on Brexit issues happens to illustrate the point I am making here about shared endeavours.
Because getting from A to B on Brexit is very much a shared endeavour, although let's be honest it doesn't always feel like that! Of course there are some debates between us and firms as they restructure, in particular where we see structures that appear overly complex or lacking in proper accountability. But in general this is not a battleground where the incentives of regulator and regulated are inherently in tension: we all want as smooth a transition as possible, and to reduce cliff-edge risks as best we can.
Actions speak louder than words so I will simply mention three key actions we have in hand, with the help of Government and Parliament:
- First, Parliament has been asked to approve our Temporary Permissions Regime (TPR), on which John Glen led for the government in the House of Commons debate yesterday. Simply put, this will allow us to bridge incoming EU27 firms for three years from March of next year while they seek an authorisation to continue business in the UK. We encourage all firms to opt into the regime because it will provide certainty until March 2022, independent of the existence and duration of any wider implementation period. This is a straightforward, common sense way of lowering the risk of disruption to the City of London.
- Second, our efforts to avoid disruption to financial contracts. To allow for those firms exiting the UK to wind down their operations here in an orderly manner, the UK government is drafting temporary recognition and run-off regimes so that contracts written before Brexit can still be appropriately cleared and serviced after it, and I hope Parliament will support this. I strongly urge colleagues in the EU27 to take similar steps. I see no tension on this issue between the interests of regulators and firms - we all want to reduce the risk of disruption.
6
- Third, just in case things go badly we have been working with firms to ensure they have in place liquidity sufficient to accommodate a severe dislocation in financial markets. This is another shared endeavour - we all need to be ready for a range of outcomes.
## Conclusion
I have aimed to describe in this speech two different modes in which we often find ourselves operating at the PRA.
First, 'battlegrounds' where there is an inherent degree of tension between our interests and those of firms, and we play the bad cop role. This covers many of the more traditional areas of prudential regulation such as capital and we should not be discomfited by a certain amount of conflict on these as we come out of the reform phase.
Second, 'common grounds' where we and firms collectively face a challenge and have a shared interest in tackling it. In these areas we are good cop and we should simply find the most effective and pragmatic way of dealing with problems. The Brexit risks are the most pressing current example of these shared endeavours and I hope that we, firms and EU27 colleagues will succeed in working together to mitigate them.
7