1. Are Banks Ready for Basle II and what are they preparing for… Operational Risk Denis Pellerin Senior Vice-President Operational and Market Risk Management National Bank of Canada Montreal, April 13, 2007 for The Third International Conference on Credit and Operational Risks

2. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 2 AGENDA A.CANADIAN BANKS SITUATION –Major Banks Targeted Approach for Operational Risk –Implementation Time Frame –Implementation Context –Role of Regulators and Market Pressure B.REST OF THE WORLD – Op. Risk Implementation Efforts –Targeted Approaches –Time Frame –Role of Regulators and Market Pressure C.PROS AND CONS OF EACH APPROACH FOR OP. RISK –Basic approach –Standardised approach : manages the risk –Advanced approach : measures the risk

3. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 3 A.CANADIAN BANKS SITUATION (a system highly concentrated) A.1Major banks targeted approach for Operational Risk –5 of the Big 6 are aiming for Standardized + 3 other. –Most of them are also considering Advanced but no commitment. –CIBC aims for Advanced, another did for a while. –Banks have all implemented typical risk management framework. –5 of the Big 6 are subscribing to ORX. –Usage of electronic tools to support RCSA rather limited. –Interesting to note that all Big 6 are aiming for Advanced for credit.

4. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 4 A.CANADIAN BANKS SITUATION A.2Implementation Time Frame –In Canada, BASLE II starts on NOVEMBER 1 st, 2007 –All the Big 6 have been working on their Op. Risk implementation for 8 – 10 years –Big 6 “WILL BE READY” –OSFI will deliver certification this summer

5. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 5 A.CANADIAN BANKS SITUATION A.3Implementation Context –During this time, several other regulatory or compliance driven initiative: Basle II Credit Risk Sarbane Oxley AML Reputational Risk Management Personal Information Privacy Pandemic Flu Preparedness Outsourcing Risk Management and son on… and Operational Risk, of course…

6. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 6 A.CANADIAN BANKS SITUATION A.3Implementation Context –Produced Regulatory Fatigue : Risk Managers Business Lines –Confusions from BU as to who does what. –Most of these initiatives are seen by business lines people as overlapping if not repetitive. –As banks are about to go live with their Op. Risk Capital Model, will they focus on migrating to Advanced Status?

7. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 7 A.CANADIAN BANKS SITUATION A.3Implementation Context (cont.) … Priority to convergence –Initiative to integrate the various processes implemented to assess and improve internal control environment. –Convergence main driver: Desire to simplify implementation by business lines (not quality or efficiency). –Challenge is to preserve “quality” while integrating processes. –One bank is piloting integrated Risk and Control Assessment Program. –Other Banks at various preparation stages will all see more actions in the next 12 – 24 months.

8. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 8 A.CANADIAN BANKS SITUATION A.4Role of Regulators and Market Pressure (layman terms for Pilars II and III) –Implementing a regulatory capital model for Op. Risk is a regulatory driven initiative. Role of regulators is key for smooth implementation. –OSFI is the main regulator of most banks implementing Op. Risk models. –Material from Basle needs to be completed by regulators guidelines for efficient design. –If this is new to banks, it is also new to regulators – they too had to learn. –At first, OSFI didn’t have a dedicated team but eventually they put their act together and started to oversee implementation efficiently.

9. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 9 A.CANADIAN BANKS SITUATION A.4Role of Regulators and Market Pressure (cont.) Two streams – initiated 3 years ago: 1.Gap Analysis: Consisting of analysis by individual banks to identify framework shortfalls compared to OSFI and Basle Requirements Includes action plans and Timetable to fill in the gaps with regular monitoring 2.Three bench marking exercises: Gross income mapping Loss data collection RCSA Very useful work also feeding into gap analysis

10. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 10 B.REST OF THE WORLD (Not an accurate picture of the rest of the world…) B.1Targeted Approaches –3 different approaches to determine regulatory capital for Op. Risk : Basic – Standardized – Advanced. –They represent a continuum from least to most sophisticated. –But to get approval to utilise a given model, regulators require that actual risk management practices of op. risk be in line with the selected model. They are also positioned on a continuum. –There are also unwritten rules : i.prioritize credit risk over operational risk; ii.to be Advanced for operational risk you need to be Advanced for credit risk as well; iii.the opposite is not true.

11. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 11 B.REST OF THE WORLD B.1Targeted Approaches (cont.) –The amount of financial and human resources required to qualify for a given approach sharply increases as you go up the continuum. –Natural tendency is for small banks to opt for Basic, midsize banks for Standardized and largest banks targeting Advanced. –This is a general rule but there are exceptions. The most noticeable being large banks category: The largest banks’ group is made of banks with more than 200 G$; There are only approximately 40 banks that are aiming for Advanced (1 out of 3); 12 of them are American and had the Advanced approach imposed on them – somewhat disappointing – we will come back on this…

12. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 12 B.REST OF THE WORLD B.2 Time Frame –Varying answers –European banks generally target January 2008 –American authorities have postponed it by a year, January 2009 unless –Are banks going to be ready? The vast majority will (confirmed by recent surveys) –Timetable is set for Credit Risk. Gives Op. Risk implementation work ample time.

13. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 13 B.REST OF THE WORLD B.2 Time Frame (cont.) Other factor: –The most delicate implementation is for Advanced Banks. This is for the biggest banks that have more financial and human resources. –There will be few exceptions. –Banks that are falling behind with their credit implementation program will not get regulatory clearance for operational risk model. –Few smaller banks that decided to aim for standardized despite their small size.

14. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 14 B.REST OF THE WORLD B.3 Role of Regulators and Market Pressure –Influence of regulators; a delicate topic. –American authorities’ decision in the public domain. –Generally speaking, regulators probably low key for Op.Risk – not the case for Credit. –Large European banks felt strong market pressure. –No pressure for smaller banks, yet…

15. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 15 C.PROS AND CONS OF EACH APPROACH Views of a professional Op. Risk Manager on the 3 approaches C.1 Basic Approach –Major impact being increased of regulatory capital may be significant. Even the most sophisticated of them, with economic capital model, were probably carrying less than 15% for Op. Risk. –Impact on competitiveness.

16. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 16 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk What it does: –Prior to Basle II, Op. Risk was intuitive; –After Basle II, Standardized approach will make them better risk managers. Feature: –Separate risk discipline; –Transparent and disciplined; –Consistent across all business lines.

17. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 17 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk (cont.) –Standardized model provides for capital to be calculated by multiplying Beta 12, 15 or 18% and gross income. –Resulting capital hardly risk sensitive and delivers little benefits. –Main benefit comes by implementing risk management framework: Op. Risk governance; Loss data collection; RCSA Program; Risk indicators.

18. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 18 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk (cont.) –Loss data collection Increases awareness (specially for low impact) Creates a demand for forward looking tools –RCSA Program : BU managers Assesses risks Evaluates adequacy of controls Implements action plans –Risk indicators Monitoring tool operating on continuous basis Not necessarily accurate but directionally correct –KRT Supposed to offer capability to set risk limit or tolerances. More work needed to demonstrate predictability and correlation.

19. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 19 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk What it does… Not only better management. Two other features: –Decentralized : unlike Credit and Market Risk Central unit, define and design. No limit setting. BU implements, assumes ownership. –Risk based : concentrates on important risks Op.Risk is everywhere. Most risks minor and frequently prohibitive to eliminate. BU are very good at addressing important risk.

20. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 20 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk What it does… (cont.) –BU don’t do it for the regulators. –Respond to their needs. –Value creation. –Very different from other compliance work which is viewed as unproductive and cost of doing business.

21. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 21 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk What it doesn’t do… –No objective tools to set Op. Risk limit. Limit setting either reactive or subjective. –Because: Method requirements vague and unclear; KRI still primitive. –Major Negative: Capital calculation hardly risk sensitive; Might not produce a lower amount of capital than Basic; May produce irrational behaviour.

22. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 22 C.PROS AND CONS OF EACH APPROACH C.2 Standardized Approach – manages the risk What it doesn’t do… (cont.) Conclusion: –Brings better risk management; –Contributes to value creation; –Does not necessarily deliver lower capital – which should be expected from better management.

23. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 23 C.PROS AND CONS OF EACH APPROACH C.3 Advanced Approach – measures the risk What it does… –Good management from Standardized. –Requirement more demanding: aiming at better integrating management and measurement. –Big plus is efforts to better measure capital requirement in a more risk sensitive manner. –LDA provides for capital being determined by unexpected loss for each risk type.

24. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 24 C.PROS AND CONS OF EACH APPROACH C.3 Advanced Approach – measures the risk What it does… (cont.) –You need to understand your severity distribution and impact distribution for each risk type. –Results is regulatory capital by risk type and BU. –This creates risk management possibilities: Charging capital to businesses; Limiting capital to certain business lines. –Another benefit is clearly capital reduction which is a very strong attraction to this method.

25. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 25 C.PROS AND CONS OF EACH APPROACH C.3 Advanced Approach – measures the risk What it doesn’t do… –Scepticism amongst community of professional Op. Risk Managers. –Explains why several large banks like HSBC are not implementing it, at least for now. –The general view is that most of the benefits from better risk management comes with Standardized and to walk the extra mile for Advanced requires more assurance of capital reduction. –No banks internal loss database contains the data required to estimate tail end of loss distribution.

26. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 26 C.PROS AND CONS OF EACH APPROACH C.3 Advanced Approach – measures the risk What it doesn’t do… (cont.) –Regulators knew it but, to encourage banks to go Advanced, proposed means of filling the gaps. –Scenario analysis : external loss database. –Work is being done to make these processes more robust. –Major obstacle not regulators but CFOs. Even if regulatory capital decreases, real capital will not.

27. THIRD INTERNATIONAL CONFERENCE ON CREDIT AND OPERATIONAL RISK April 13, 2007 - by Denis Pellerin, Senior Vice-President – Operational and Market Risk Management 27 C.PROS AND CONS OF EACH APPROACH C.3 Advanced Approach – measures the risk What it doesn’t do… (cont.) Conclusion –Advanced approach has great potential to bring to Op. Risk managers a really risk sensitive approach. –In the short term, the availability of data is an important obstacle. –I suggest that this be addressed progressively and, eventually, as internal loss database becomes more reliable, more banks will move to Advanced.

28. Thank you!