Banks make money in one of two ways: providing services to customers and taking risks. For example, retail banks take in customers’ deposits and provide them with the services of check clearance and safe storage. Retail banks also take risks by giving out personal loans and taking the risk that some of the loans may not be repaid. The bank is willing to take that risk if it is able to charge the customers a high rate of interest.
In this book we address the business of making money by taking risk. In general, if a bank takes more risk it can expect to make more money, but greater risk also increases the danger that the bank could lose badly and be forced out of business. Banks must run their operations with two goals in mind: to generate profit and to stay in business. Banks therefore try to ensure that their risk taking is informed and prudent. The control of that gambling is the business of risk management. The primary function of risk management is to ensure that the total risk being taken is matched to the bank’s capacity for absorbing losses in case things go wrong. A second reason for understanding risk is to help the CEO direct the scarce resource of capital to the opportunities that are expected to create the maximum return with the minimum risk.
Proper risk management is essential for bank survival, and it enables management to allocate resources to various risk units based on a trade-off between risk and revenue potential. These risk-management decisions should be supported by quantitative risk measurement. Risk measurement attempts to answer the following four questions:
• How much could we lose?
• Can we absorb a significant loss without going bankrupt?
• Is the return high enough for us to take that risk?
• How can we reduce the risk without significantly reducing the return?
The goal of this book is to provide a detailed guide to the modern techniques for quantifying risk within a bank.
Before going into the mathematics of risk, it is very useful to have an idea of how banks are organized, how they make money, and especially how they can lose money. This chapter therefore describes bank operations and the way that risks are managed at the highest levels of the bank.
Large, international banks are typically organized into five divisions: corporate banking, retail banking, asset management, insurance, and support. Figure 1-1 shows the typical organization of a universal bank.
The corporate banking division deals with other financial institutions and corporate clients such as large, industrial corporations. There are typically five primary groups: underwriting, mergers and acquisitions, sales and trading, commercial lending, and research.
The underwriting group creates new securities, such as stocks and bonds. For example, if a corporation wanted to raise money, it could go to a bank and ask it to underwrite an issuance of bonds. The bank would structure the bond contract then give the corporation cash. The bank would then sell the bonds to investors, and the corporation would be responsible for making the required payments on the bonds. The bank can make money as a fee from the corporation for structuring the contracts and can also make money by selling the bonds for a higher price than the amount given to the corporation. There is also a risk that the bank could lose money if the value of the bonds falls significantly before the bank can sell them.
FIGURE 1-1 Typical Organization of a Universal Bank
The above graphic details the organizational structure of a universal bank. Note that the majority of the book will focus on risk-management techniques for the corporate and retail banking divisions of the bank.
The mergers and acquisitions (M&A) group advises corporations on how they can structure the finances of merged companies so as to minimize the funding cost and maximize the tax credits. The M&A group typically receives a fee from the client and uses some of the services of the underwriting group.
The sales and trading group sells securities to investors, trades securities with other banks, and manages the bank’s asset and liability mismatch. As we will see, most of the bank’s market risk resides in the sales and trading group. Within the trading group there is also the funding desk, which borrows and lends funds with other financial institutions whenever the bank has an overall deficit or surplus of funds.
The commercial finance group provides structured products to corporations, including loans. It also advises companies on their financial structures. For example, if a company wanted to fund a new venture, the commercial finance group would advise it on whether to use debt or equity to raise money. The group makes money largely by lending money to corporations at a moderately high interest rate. Due to the risk of default, a large portion of the credit risk in a bank arises from loans given by the commercial finance group.
The research group produces economic and company-specific reports that are used by the sales and trading group, used by the brokerage group, and sold to clients of the bank.
The retail division deals with the mass of personal customers. The main function is to take deposits from customers in the form of checking accounts, savings, and fixed deposits, then lend funds to other customers in the form of mortgages, credit cards, and personal loans. The division makes a profit by giving low interest rates to depositors and charging high interest rates to borrowers. This profit pays for the cost of processing all the accounts and should cover losses from defaults on loans.
Private banking and brokerage services may also be in the retail division, or they may be in the corporate division. Private banking provides tailored loans and investment to high-net-worth individuals. The brokerage group allows individuals access to the sales and trading group so that for a fee they can trade their securities.
The asset management division administers funds such as mutual funds or unit trusts in which individuals can invest. The asset management division is managing money that belongs not to the bank, but rather to the individuals or institutions. Therefore, if the value of the assets falls, the bank does not lose money directly, but may lose money in the form of reduced fee income.
Some banks also have an insurance division. The insurance division takes fees (or premiums) from its clients and promises to pay the clients if a specific incident happens. To be sure of having enough money to make the required payments, the insurance group holds a large amount of capital in the form of investments in securities such as stocks and bonds. The lines of business include property and casualty insurance, life insurance, and carefully tailored commercial insurance.
The support division has the crucial task of making sure everything works for the other divisions. The operations group ensures that all payments are processed, received, and recorded correctly. Audit and compliance ensures that all the policies and procedures are being followed, and also ensures that the bank complies with all government regulations. The financial reporting group produces information on the profit, loss, and the current amount of assets and liabilities. The risk management group also resides within the support division, where it can be independent from the groups that are taking the risks.
In the section above we noted that banks often hope to make money by taking risks. However, banks can, and often do, lose money when they take these risks. Banking risks can be put in three categories: market risk, credit risk, and operating risk. Examples of losses occur daily and even hourly. To give an intuitive understanding of how money is lost, consider the following sample of case studies.
Market risk arises from the possibility of losses resulting from unfavorable market movements. It is the risk of losing money because the perceived value of an instrument has changed: for example, when investors are no longer willing to pay such a high price for a stock.
The classic market-risk example comes from losses in the stock market:
• The Nasdaq stock index lost 65% between March 2000 and March 2001.
• The Dow Jones index lost 31% in one week in 1987, 23% on Black Monday, October 19.
• The Dow Jones index lost 89% between 1929–1932, and it did not recover until 1954.
In each of these crises, banks made losses, and some went bankrupt. The ones who made the least losses were those who realized that they were vulnerable and reduced their positions before the crisis. For example, when Chase realized that it was overexposed to Russia at the beginning of 1998, it started to shed its Russian holdings; it was then able to carry on business as usual during the ensuing crisis as Russia defaulted.
On the other hand, Long Term Capital Management (LTCM) was a hedge fund that had bet heavily that any Russian default would have a correlated currency devaluation, which LTCM could use as a hedge. The default happened but the devaluation did not. The result was that LTCM lost $3 billion and was taken over.
Losses can also occur due to long-term market trends.
• In the 1980s many U.S. savings and loans (S&L) institutions went bankrupt because they had been lending out long-term fixed-rate mortgages and borrowing short-term deposits. This strategy was safe while interest rates were stable, but rates suddenly rose in the 1980s. The S&Ls were then left receiving low interest-payments from long-term mortgages but paying high interest rates to get deposits. After a few years of paying more than they received, many of these institutions went bankrupt. The management of these long-term interest-rate risks is typically called asset liability management (ALM).
Credit risk arises from defaults, when an individual, company, or government fails to honor a promise to make a payment. There is a gray area between market risk and credit risk. The price of corporate bonds fluctuates relative to treasury bonds due to the market’s perception of the probability of a corporate default. The aspect of risk before the default happens, is generally considered to be market risk. The actual default is considered credit risk.
Credit risk arises in many forms. The most obvious form is default on a loan, i.e., failure to repay an amount that has been lent. The same risk occurs when the issuer of a bond fails to make the payments promised by the bond. More subtle forms of credit risk arise in trading operations. Counterparty risk refers to the possibility that a trading counterparty will fail to pay if it loses money on a deal. Settlement risk occurs if a bank fails to settle its side of a trade; this is also known as Herstatt risk, after the famous default described below.
• In January of 1999, Guangdong International Trust and Investment Corporation defaulted on the repayment of $4.5 billion, half of which was owed to overseas banks.
• In August of 1999, Iridium, the satellite telecommunications company, defaulted on two syndicated loans of $1.5 billion that it had borrowed to launch the satellites but could not repay due to unexpectedly low earnings.
• On August 17, 1998, Russia unilaterally rescheduled repayments on $43 billion of bonds that had been sold to western banks and investors. The investors eventually recovered only a fraction of the $43 billion.
• In February of 2001, PG&E, a Californian electric utility, defaulted on $726 million of short-term bonds that it had issued. However, its default was selective, and it continued to pay interest on $8 billion of other debt.
• In 1998, the Moscow Interbank Currency Exchange and several Russian banks defaulted on currency derivatives with Credit Suisse First Boston (CSFB). The exchange rate had moved such that the banks owed $600 million to CSFB.
• In 1974, a small German bank, Bankhaus Herstatt, had a string of losses in foreign exchange dealings. It went bankrupt at the end of a trading day in Germany. Because it was the end of the trading day in Germany, it had already received $620 million worth of FX payments from its U.S. trading counterparties, but because the U.S. markets were still open, Herstatt had not yet been required to deliver $620 million for its side of the trades. At the time that it went bankrupt, it stopped all payments, and the U.S. banks lost virtually all of the $620 million.
Operating risk encompasses all the other ways in which banks can lose money. The Basel Committee on Banking defines operational risk as “the risk of direct or indirect losses resulting from inadequate or failed internal processes, people and systems or from external events.” Operating risk includes fraud and the possibility of a mistake being made.
• A U.S. government bond trader at the New York branch of a Japanese bank was able to switch securities out of customers’ accounts to cover trading losses, which mounted to over $1 billion over 10 years.
• In 1997, NatWest lost $127 million and had to greatly reduce its trading operations because its options traders had been using the wrong data for implied volatility in their pricing models, and were therefore taking risks that they did not see.
Often banks will lose money from an incident that involves several forms of risk. This is well-illustrated in the collapse of Barings bank.
• Nick Leeson was a trader in the Singapore branch of Barings bank. He had seemingly generated 20% of Barings’ profits in 1994. In fact, he had been making losses and hiding them in a fictitious account. To recover the losses he tried a large, risky gamble with derivatives on the Nikkei 225. In 1995, he lost $1 billion and wiped out Barings’ capital. He was able to hide the original losses because he was in charge of both trading and accounting in the Singapore office. He was able to take the final gamble because senior management had no effective measurement of the risks being taken.
Banks try to minimize their losses by managing risk at three levels: at the transaction level, the business-unit level, and the corporate level. Most of this book will concern risk management and measurement at the transaction and business-unit levels. We will first look at the management and measurement of trading risks, followed by sections on asset/liability management, credit risk, and operating risk. Finally, we will show how each of the bank’s risks can be brought together to estimate the total risk for the bank.
We will often refer to the contribution that the transaction or unit is making to the bank’s overall risk. The next section will therefore describe the management of risk at the highest corporate levels and discuss the macro objectives of risk management.
Ultimately, risk, and all other bank functions, are overseen by the bank’s board of directors. The board is urged to take risk by the shareholders who want high returns. Balancing the shareholders, the board is limited in its risk taking by debt holders, rating agencies, regulators, and the bank’s own desire to stay in business. The result can be seen as a constrained maximization in which the institution is allowed to take a limited amount of risk and tries to maximize the returns on that risk.
The board oversees three key risk-management functions: deciding the target debt rating, determining the amount of available capital, and allocating risk limits to each business unit within the bank.
The debt rating is a measure of the bank’s creditworthiness and corresponds to the bank’s probability of default. A high debt rating corresponds to a low probability of default. The bank’s creditworthiness is determined by the amount of risks it takes compared to the amount of capital held. Capital is the difference in value between the bank’s assets and liabilities. It can be viewed as the current net worth of the bank.
If the bank has a small amount of capital and takes a large amount of risk, there is a high probability that the losses will be greater than the capital, and the bank will go bankrupt. If the bank wants a high rating, it must hold a large amount of capital in relation to its risks.
Although the board sets the credit-rating goal, the actual ratings are granted by independent agencies that use quantitative and qualitative tools to assess a bank’s strengths. These agencies include Standard & Poor’s (S&P), Moody’s, and Fitch.
A low target debt rating has the advantage that the bank can take on many risks and expect to earn a high rate of return for the shareholders. However, a low debt rating means that debt holders will charge higher interest rates to lend to the more risky bank.
The debt rating is also important to the bank’s customers. For example, retail customers do not want to give their savings to a bank that is likely to go bankrupt. Similarly, corporations who are considering buying derivatives want to modify their market-risk positions and do not want to be exposed to the credit risk of a lowly rated counterparty. Therefore, corporations buying derivatives would not deal with lowly rated banks.
The highest S&P rating is “AAA,” most international banks are rated “AA,” and national and regional banks tend to be rated “A” or “BBB.”
Once the board has decided the target debt rating, it must align the risks that it allows the bank to take with the amount of capital available.
In this discussion we will refer to liabilities, debt, assets, and shares. Readers unfamiliar with these concepts should refer to the appendix to this chapter. The available capital is the current value of the assets minus the current value of the liabilities. If all the assets and liabilities are traded, their values are simply the prices at which they trade. However, many assets such as personal loans are not frequently traded. Management must then determine a reasonable value for the assets. This is done by taking the nominal value of the assets and subtracting specific and general provisions. The nominal value is the total amount owed to the bank. The specific provisions is the amount that is expected to be unpaid by customers who are already in financial trouble. The general provisions is the amount that is expected to be unpaid by other customers who get in trouble over the next year. The capital is then the nominal amount, minus the provisions, minus the expected value of the liabilities:
Capital = Nominal Asset Value – Provisions – Liabilities
If the board wishes to increase the capital quickly, it can do so by issuing more bank shares. This gives the bank more cash without increasing the liabilities that must be paid to avoid default. Alternatively, the capital can be increased over several years by retaining earnings and not paying dividends to shareholders.
Once the target debt rating is set and the amount of available capital has been calculated, the bank’s total risk capacity is fixed. Conceptually, the relationship can be simplified to the following equation:
Risk Capacity = Probability of Default x Available Capital
The board then decides how to allocate the total risk capacity to the different business units, e.g., trading, credit cards, and corporate lending. In doing this it must consider the expected return from each unit and the diversification of the risk between units. We will deal extensively with diversification later. In general, the board will allocate most of the risk capacity to the units that are expected to make the highest returns. The risk capacity is allocated by giving each business unit a limit on the amount of risk it can take. This limit may be in terms of risk capital or in more familiar terms, such as the total amount of loans it can give.
Having allocated a block of capital to a business unit, the board will expect the unit to make a profit on the risks it takes. The target rate of profit is called the hurdle rate.
These policy decisions are typically made by the board on an annual or quarterly basis. The day-to-day management of risk is delegated to the CEO, the chief risk officer, and the risk management group, who create risk reports and advise the board and the business units as to how they can maximize the bank’s return with a limited amount of risk.
Importantly, for the risk-management function to be credible to shareholders, regulators, and senior management, it must be independent of line management interference. For example, risk managers should not report to the heads of the business units who are taking the risks, because in some circumstances, they may be tempted to “massage” the numbers to make the profitability of their own business units look good. Instead, risk managers should report to senior executives, such as CEOs and CFOs, who will recognize and reward accurate reporting.
This chapter has given a qualitative overview of how banks make money and how they manage the risk of losing money. In the next chapter, we will start to build the quantitative framework of risk measurement.
In general, the term liabilites refers to all transactions for which the bank owes money to another party, however in common usage, the term liabilities may not include the equity owed to the shareholders, and would therefore only include the debt.
The debt may be in the form of bonds that the bank issues for itself, it may be in the form of loans given to the bank by other banks, or it may be in the form of deposits taken from corporations and retail customers. Debt holders expect to be paid a relatively small interest rate, but they also expect to get back the full amount of the principle that they lent to the bank.
Banks use the money that they have raised from debt and shares to buy assets. Generally, assets are any securities or transactions for which the bank is owed money by another party. The assets may, for example, be loans that they grant or equities they buy. In granting a loan, the bank gives cash to an individual or corporation. In return, the individual or corporation commits to making a series of future payments to the bank. This commitment of future payments is an asset to the bank, and a liability to the individual or corporation.
The shareholders are the owners of the bank and expect to get a share in the profits after the debt is paid. Most of the bank’s profit and loss is reflected in the return that the shareholders receive. If the bank is profitable, it will pay dividends to the shareholders; if it is unprofitable, the shareholders will lose the money that they invested when they bought shares in the bank. Shares are also called equities. The value of the equity is close to the net value of the bank, i.e., the assets minus the liabilities. The net value of the bank is also called capital. There are several definitions for different types of capital, depending on how the value of the assets and liabilities are measured; therefore, it is not always true that the equity equals the capital, but often the terms are used interchangeably.