Secrétariat général de la Commission bancaire AFGAP La surveillance de la liquidité Réflexions en cours Paris, 18 septembre 2008 Dominique LABOUREIX, Directeur de la Surveillance Générale du Système Bancaire

Plan I. Le contexte international et européen II. Les recommandations du Comité Européen des Contrôleurs Bancaires (CEBS) III. Les réflexions en cours en France The article 644 of the accord defines operational risk. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Le contexte international et européen CEBS Comité de Bâle La France participe aux travaux bâlois et préside les travaux européens. Publication : étude comparative des régimes de supervision du risque de liquidité Analyse des premières leçons de la crise Consultation publique sur le projet de recommandations Publication recommandations finales Mandat de la Commission européenne Mars 2007 Août 2007 Décembre 2007 Juin 2008 Septembre 2008 Rapport sur les défis posés en matière de gestion du risque liquidité Publication des principes révisés Consultation publique sur la révision des principes de 2000 What is at stake is a global european move towards the most advanced approaches. Around 20 European credit institutions have applied to AMA approaches. French credit institutions have committed themselves to a gradual but sustained transition to the most advanced approaches. Since 1 January 2008, three groups representing 60% of the total gross assets of the banking system have been authorised to use the Advanced Measurement Approach for operational risk. Two other groups that have not been approved last year have asked for other approval. This overwhelming choice in favour of the most sophisticated methods is explained by the fact that the banking system is not only mature but also quite highly concentrated. This trend is likely to continue in 2008 : five more banks have already initiated the procedure for requesting authorisation to use an IRB approach for credit risk and five more groups have taken the same step for the AMA approach for operational risk. The gradual extension of the universe of portfolios to which the advanced methods apply is evident at credit institutions, most of which have implemented internal approaches little by little. As a result, the portion of their portfolios (or the number of group entities) that continue to use the Standardised Approach has contracted. Thus, at those institutions authorised on 1 January 2008 to use an IRB approach, the fraction of capital requirements calculated using the Standardised Approach averages 20% of total capital requirements for credit risk. This fraction is expected to shrink rapidly, since only a small number of entities are authorised to remain indefinitely on the Standardised Approach. Février 2008 Juin 2008 Octobre 2008

Plan I. Le contexte international et européen II. Les recommandations du Comité Européen des Contrôleurs Bancaires (CEBS) III. Les réflexions en cours en France The article 644 of the accord defines operational risk. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Le constat : diversité des réglementations nationales existantes Des régimes reposant sur un ratio « quantitatif » complétés éventuellement par le respect de critères dits qualitatifs Des régimes reposant essentiellement sur le respect de critères qualitatifs ► Les systèmes de garantie des dépôts, le droit des sociétés et de la faillite restent nationaux ► La liquidité ne fait pas l’objet d’une directive harmonisée (contrairement à la solvabilité) Certes des réformes récentes vont dans le sens d’une reconnaissance plus large des méthodologies internes ou d’une combinaison entre « ratios quantitatifs » et « utilisation des méthodologies internes » (Allemagne, Belgique)…mais aucun véritable « modèle » de gestion du risque de liquidité dans sa globalité ne se dégage. The article 644 of the accord defines operational risk. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Le constat : complexification de la gestion du risque de liquidité Croissance des instruments financiers de titrisation structurés de façon complexe Dépendance accrue des banques envers les financements de marché Usage croissant du collatéral dans des contextes autres que du refinancement sécurisé => Conséquences : fragilité accrue ; renforcement nécessaire des stress tests The article 644 of the accord defines operational risk. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Principales recommandations du CEBS Pour les établissements de crédit Définition d’une politique générale/stratégie en matière de gestion du risque de liquidité et d’un niveau de tolérance à ce risque Implication des organes dirigeants Nécessité de constituer un coussin d’actifs liquides Utilisation de scénarii de stress tests (idiosyncratique, de marché…) et mise en place de plans de contingence (CFP) pour faire face à une situation de crise Transparence de l’information adaptée (qualitative, quantitative) The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Principales recommandations du CEBS Pour les superviseurs nationaux Principe de proportionnalité : adapter le régime de supervision aux profils de risque des établissements. Possibilité de tenir compte des méthodologies internes développées par les établissements, sous certaines conditions Coopération accrue entre superviseurs, notamment dans le cadre des collèges mis en place pour les groupes transfrontières The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Principales recommandations du CEBS Principaux messages reçus par les banques : Points positifs Cohérence avec les principes bâlois et ceux développés par la profession dans le cadre notamment de l’IIF Enseignements de la crise Points négatifs Vers un régime de liquidité harmonisé en Europe? Reconnaissance des méthodologies internes par tous les superviseurs ? The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Prochaines étapes – Horizon 2009-2010 En Europe Renforcement des dispositions de la Directive CRD en matière de gestion du risque de liquidité sur la base des recommandations du CEBS (Pilier 2) En France Mise en place d’un régime révisé de supervision du risque de liquidité The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Plan I. Le contexte international et européen II. Les recommandations du Comité Européen des Contrôleurs Bancaires (CEBS) III. Les réflexions en cours en France The article 644 of the accord defines operational risk. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Réflexions en cours en France Tout projet de réforme doit s’appuyer sur les trois principes suivants : Mise en place par les banques de systèmes de mesure et de gestion du risque de liquidité renforcés Ces systèmes doivent respecter les principes internationaux et européens et tirer les leçons de la crise La supervision doit être adaptée à la diversité des profils de risque des établissements : des approches différenciées Following the inspections of the Advanced Measurement Approaches (AMA), findings of a general nature can be formulated concerning the mapping and control of operational risk and the outsourcing of certain functions essential for measuring operational risk. Regarding the outsourcing of components involved in measuring operational risk, the Commission Bancaire draws the attention of institutions to the need to retain full control over activities that are outsourced, as required by Regulation 97-02 and the Order of 20 February which transposes the Capital Requirements Directive. Credit institutions seeking to move to the AMA approach should take care not to become dependent on outside service providers to develop their internal methods without adequate oversight.  This applies in particular to activities related to modelling and the internal validation of AMA systems. In such cases, a transfer of responsibilities to internal resources is indispensable.

Réflexions en cours en France Une approche différenciée Une approche dite « avancée »  qui s’appuierait sur les méthodologies internes développées par les banques qui ont un profil de risque spécialisé ou complexe Une approche dite «  standard » pour les établissements au profil de risque plus simple The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Réflexions en cours en France Approche avancée Dispositif qui doit permettre à l’établissement d’avoir suffisamment de liquidités en temps normal et pour faire face à des situations de crise Outils et méthodologies (hypothèses, indicateurs, limites) propres à chaque établissement Renforcement des stress tests et des plans de contingence => Constitution d’un coussin d’actifs liquides The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Réflexions en cours en France Approche standard Inspirée par la logique du règlement 88-01 mais en tirant des enseignements de la crise : => Suppression des fonds propres => Révision des hypothèses de fuite des dépôts et de traitement des engagements de hors bilan The architecture of the op risk function generally relies on a central function with defines rules, framework, modelling and measure and manage the risk profile of the bank. And decentralized op risk units at the business unit level : that collect op risk losses and manage the local op risk profile. Both level must be independant from the business unit The on-site inspections found that the resources devoted by institutions to operational risk have increased significantly, as evidenced, for example, by the designation of ‘operational risk’ officers in the various entities or business lines of groups, and by the creation of specific control units. Along the same lines, institutions have generally established committees dedicated to operational risk and sometimes involving senior management. All of these elements tend to improve the management of operational risk and accelerate the early detection of fraud. However, these new resources and systems are often very recent and therefore need to demonstrate their effectiveness over time. Furthermore, practices in large, complex groups are sometimes inconsistent due to insufficient of the procedures relating to operational risk.

Merci de votre attention Y a-t-il des questions ?