Series 3 Episode 9: An ambitious agenda - what the PRA’s business plan means for banks

Andrew Strange: Hi everyone, and welcome back to Risk & Regulation Rundown. I'm your regular host, Andrew Strange, and today we're talking about the PRA's business plan. Joining me are two expert guests, Conor MacManus who’s a Director in our FS Regulatory Insights team, and Stephanie Henderson-Begg is a Director in our banking prudential team. Today, we're going to focus on what the business plan means for the banking sector and then we'll talk about insurance prudential reform and the PRA's approach to insurers in next month's episode. So, the PRA published its business plan in April, setting out an ambitious agenda. Conor, do you want to just start by setting the scene for us in terms of some of the wider context for the plan, and then take us through some of the PRA's key priorities?

Conor MacManus: Yes, absolutely, Andrew, thanks very much. I mean, so, you know, clearly, it's a very challenging economic climate at the moment, so it's an important period for all economic policymakers, including the PRA, but I think it's particularly pronounced for the regulators at the moment, including the PRA. The agenda that they've set out in the business plan is really very ambitious. The PRA's been around since 2013, and I'd argue this is perhaps the most ambitious business plan we've seen from them, and there's a number of reasons for that. They're going to be getting new powers under the Future Regulatory Framework that the Government's proposing, that's quite a big deal, they need to think about that. There's a very significant piece of regulation coming down the track, Basel 3.1, which they'll be consulting on in Q4 of this year, and there is a number of new things that they're going to be focussing on, so digitalisation, D&I, things which they've been talking about for a number of years but I think they're going to progress from a policymaking perspective. Then there's just a huge amount of supervisory activity and priorities that they will need to follow through on. So, for example, embedding climate risk and operational resilience, two things that they've been consulting on over the past couple of years have come into force. I think we'll see those being embedded into 'business as usual' supervision, which I think will take up a lot of time for supervisory teams but also for firms.

Andrew: Okay, and it's clearly been a busy period, so, since then, we've also had the Queen's speech, which announced the new Financial Services and Markets Bill and confirmed, I think, that the UK regulators will get those new secondary objectives around growth and international competitiveness. How is that likely to shape the PRA's plans and maybe its longer-term approach, do you think?

Conor: Well, that's a really interesting and important question. You know, as you say, it's a secondary objective, so their primary objectives around safety and soundness will take precedent, so I think that's an important point to make. So, they've said that they were going to be publishing a discussion paper on this at some point this year, setting out their thoughts on what that new objective will mean for them, and I think the Basel 3.1 proposals will be a really interesting test case for this. We've already seen proposals from the EU, which deviate from the rules which were agreed in Basel quite considerably in some areas. So, there's a question there around does the PRA stick to what was agreed in Basel or do they respond to what the EU's done? We don't know what the US is going to do, for example, and that will be an important factor here. I think the PRA's preference will be to stick to what was agreed in Basel, typically they're pretty in favour of robust prudential standards, and I think that, looking over the past couple of years, the way in which the banking sector has stood up to COVID and other shocks has really vindicated their view that building resilience in the banking sector has been a really important and good thing to do. One of their priorities is to preserve that level of resilience. So, the extent to which they row back from that as a result of the secondary objective, I think is probably quite doubtful.

Andrew: That's interesting, and I guess we'll probably talk about a similar thing with Solvency II when we get to next month and the UK's approach there and divergence too.

Conor: Yes, and, on that, I think there's probably going to be a bit of a difference between the approach they take between insurance and banking. I think, there have been commitments made already around Solvency II, which the Government have made, which the PRA have been broadly supportive of, whereas I don't think we'll see the same dynamic in the banking side.

Andrew: The banking stuff, obviously, is starting at an international point, rather than that European level.

Conor: Exactly.

Andrew: Yes, okay, interesting. Steph, and if I can bring you in here, so supporting competitive and dynamic markets is one of the PRA's four priorities. We've also got the additional growth objective and the competitiveness objective we've just talked about. How do you see the PRA taking this forward in terms of its aims for competitive markets and proportionality, and how's that going to impact the banking sector?

Stephanie Henderson-Begg: I think there are different elements to this. So, there's been chatter about the PRA expanding the number of jurisdictions that they have memorandums of understanding in place for that, element around encouraging international expansion into the UK. Closer to home, there are elements in the business plan around reviewing the ring-fencing rules, and it'll be interesting to see what comes out of that. Of course, there's quite a lot of the discussion on the strong and simple regime, and we've seen the first CP of a series come out, so it'll be interesting to see how that develops over the next year or two. I think, for me, the most interesting element is actually this piece around orderly exit. That comes through in the business plan and we know that there's going to be a consultation paper in the second half of this year. I've certainly seen it coming through in supervision, with the firms that I work with. There are now wind-down plans in place for all of the new banks that are coming through, those that are early in their life-cycle have been asked for them, as well as, of course, the big banks that are looking at wind-down. So, I think this is one to watch, and certainly something that we're going to hear more on over the next year.

Andrew: Okay, that's interesting, and certainly orderly exit and wind-down are something, in my sector, in asset management, we've been thinking about too. I'm also aware that the FCA, also in their business plan, talked about orderly market entry, so the other half of exit. How are we seeing PRA approach authorisations?

Stephanie: Yes, so they set up the new banks unit back in 2013, to assist firms that are applying to enter the market. That's continued but we've seen a bit of a change over the last year or so. There's been a big revamp of the website, there's been some changes in the team that's supervising, and there's been this introduction of a head of department, looking over ARTIS, which is authorisations, reg-tech and-,

Andrew: I'm going to go innovation.

Stephanie: Innovation, there we go.

Andrew: As a guess.

Stephanie: Yes, so they're certainly looking at it in a different way now, they haven't shown any indication that they are, in any way, slowing down the number of new entrants coming through or putting extra barriers, and in fact the narrative is always to the opposite, that they're trying to think about how they can make it easier and more efficient for firms coming through.

Andrew: It's interesting, you weren't here last month, but we talked a little bit about some of the public policy objectives versus regulatory objectives that we've seen. Am I right in thinking that, fairly recently, there was some commentary around some of those smaller new entrant banks having less robust financial crime-type provisions and things like that as well? I'm not sure if I read that somewhere.

Stephanie: I'm less sure on the financial crime side of things but certainly things like the 'strong and simple' regime that the PRA are discussing are very much aimed at those new firms, to make it easier, they're being less of an obstacle in terms of regulation, because it is very disproportionate at the moment. You know, the rules that the large high street banks have to meet are the same as the small ones. And some of the banks I work with have, you know, 21 members of staff.

Andrew: Oh wow, okay, they really are small. So one of the other PRA priorities was around its own operations, and I know the FCA spent a lot of time talking about its own footprint and where it's focussing. So, in terms of its own objectives as an organisation, for the PRA, what are the issues it's tackling there and how is it making progress on some of those things that I know our our clients are struggling with?

Stephanie: Yes, for me, this was something that I was really pleased to see, that all of those things that they're asking the firms that they regulate to do, they are actually looking internally and thinking about themselves. So, there are points in the business plan around how they're going to help drive their own inclusion and diversity agenda, around how they are trying to develop their data and analytics capability to support supervision, how they're strengthening their governance and how they're strengthening their own internal controls. So, I think that's quite comforting, to see that they're applying the same lens as they are to the firms that they regulate.

Andrew: Okay, great, and the plan also talks about responding to new and emerging risks, such as those resulting from things like digitalisation of financial services. Conor, how are you seeing the PRA respond to some of that digital innovation?

Conor: Yes, it's a really interesting topic and it's a good example of that broadening out of focus that we've seen from both the PRA and the FCA in recent years, and them really responding to innovation and change in the sector. I suppose you could probably characterise the response two-fold, one is responding to risks as they emerge, so, for example, if you think about crypto, there was a recent 'Dear CEO' letter to the banks on the prudential treatment of crypto. That's something that's being discussed at the Basel Committee at the moment, and the regulators, perhaps understandably, taking a pretty conservative view on the prudential treatment of crypto, to kind of address that risk. It's pretty minimal at the moment to the banking sector but they clearly think it could grow. The other area is around critical third parties, so primarily thinking about cloud service providers, and we're expecting a discussion paper from the PRA and the Bank of England on this quite soon around what powers they should have over those critical third parties. So, moving away from the regulatory focus being entirely on the banks themselves, to probably more oversight from the regulators on firms like cloud service providers.

So, it's them responding to risk but then we're also seeing them being more encouraging of innovation in other areas. So, for example, artificial intelligence and machine learning is a topic that the Bank of England and FCA have been looking at for a number of years. There was a report that came out fairly recently from an industry group that the regulators convened. We're expecting a discussion paper from them at some point this year around the regulatory treatment of AI, which is both them responding to risk but also them recognising that regulatory certainty and a robust regulatory framework is something which encourages firms to innovate. So, there's a lot going on here and I think broadly it's around them responding to risk but also trying to be supportive of innovation.

Andrew: You commented there on a lot of discussion papers and consultation papers we're expecting. Have they actually got the bandwidth to deliver all this by the end of the year, or sooner in some of those cases?

Conor: Well, it's a big question, isn't it? I mean, there is a lot to do at the moment, both for the PRA and the FCA. As I said at the start, I think the regulatory agenda at the moment is as busy as it's ever been, and, clearly, they think they do but it's going to be a challenge. The other thing which I think both regulators recognise is that they'll have to respond to events, and we've seen, over recent years, things happen that perhaps they hadn't anticipated. Clearly things like COVID or Russia/Ukraine weren't in any business plans and they've had to respond to that. So we're living through a period where events happen, which I think the regulators and industry have to respond to and that will have an effect on prioritisation.

Andrew: We've talked about some of those key themes, so turning to some of the specific initiatives in the banking sector and one of my personal favourites, Basel 3.1. What do we know about the PRA's plans in this space? I know you've touched a little bit already about how this might compare to the approach of some other jurisdictions but what do we know?

Conor: So, this was a package which was agreed back in 2017, and originally it was supposed to come into force at the start of this year. It was pushed back, at the Basel Committee level, to the start of 2023 because of COVID, but it's pretty clear that none of the major jurisdictions are going to meet that deadline. So the PRA have committed to a consultation paper in Q4 of this year. The EU are discussing their proposals at the moment. Obviously, that's a process which takes quite a long time. In the US, we haven't seen any proposals or an indication from the authorities there in terms of when they're going to put the proposals out. So, we're expecting the consultation towards the end of this year. The PRA have said they're aiming for an implementation date of 1 January 2025, which is in line with the EU.

Andrew: Okay, and in practical terms for banks, how do we see this impacting their strategy and business models?

Conor: Significantly, I think is the short answer. So this started off as a finalisation of Basel 3, that's how the regulators like to describe it. Industry describes it as Basel 4 because they see it as a more fundamental change, and we haven't quite met in the middle but we've ended up with Basel 3.1 as the term that's usually used now. So, it was really designed as a way of addressing the variability in risk weights that we saw coming out of banks’ internal models but the outcome of the package is something pretty fundamental actually, an overhaul of the credit risk framework, operational risk framework, market risk framework through the fundamental review of the trading book. Then, perhaps most controversially, the introduction of an output floor, which puts a floor on the risk weights that internal models can produce, as a percentage of the standardised approach. So, we're looking at reasonably significant increases in capital requirements for a number of different banks with different business models. That, inevitably, has an impact on profitability, on product mix, that banks will have to think about. As always, there's a big data element to the package, which firms will need to respond to, and then additional reporting requirements as a consequence. Regulatory reporting, as we know, is something that the banks have struggled with over a number of years now and that challenge is going to get even more complicated with the introduction of Basel 3.1.

Andrew: Yes, not just banks, I think it would be fair to say, in terms of reporting but I agree entirely. If we turn then to the supervisory priorities, one of the biggest areas of focus for the PRA at the moment is around governance and risk management. Conor, do you want to talk us through some of the comments from the regulator, where they're concerned, and how they're addressing issues they're seeing?

Conor: So clearly, governance and risk management have always been priorities for the PRA but I think what we've seen is them responding to events, such as the failure of Archegos and the impact that had on some of the international banks in particular that they supervise, and them looking at what they would describe as risk culture in firms. There was a very strongly worded letter, a 'Dear CEO' letter, that went out to the banks towards the end of last year on this, with the PRA basically saying, 'We don't think you've learnt the lessons properly of the financial crisis,' which was a pretty forceful thing for them to say. So, firms have had to respond to that already but I think we'll see a lot of supervisory activity in this space, really questioning risk management capability and this concept of risk culture, and the extent to which senior management in banks are really focussed on risk management and taking accountability for that. That's where we could see the link with the senior managers' regime, with the remuneration regime, the PRA really saying, 'You are accountable for driving this, as senior managers in the firm.' So, I think we'll see a lot of this from supervisory teams. It's in the public sphere that there have been a number of section 166s in this space recently, and I wouldn't be surprised if we saw more of that.

Stephanie: Yes, do you know, it always interests me that it's such a big focus of the regulator but there isn't a specific process or a set of rules around risk and governance itself. So, I wouldn't be surprised if that's something that emerges over coming years.

Andrew: Steph, so we've heard some of the theory behind what we think the regulator's doing. What are you actually feeling and seeing with your clients on the shop floor, in terms of a supervisory approach from the PRA?

Stephanie: So, I think there are two things that are really interesting for me. One is there's definitely mutterings amongst our clients but also directly from the regulators around how they're looking more to third parties for conducting what would have previously been done by supervision. Now, sometimes that's in very formal section 166 activity. Sometimes that's through alternative tools, like the internal audit thematics that is run out of the UK deposits area at the PRA. We're hearing from supervision and from firms that, just generally, they are looking more to ask for third parties to look at particular areas that they might not have done a deep dive on themselves. So, I think that's certainly quite a step-change, and one that we can expect to see continue. The other one that I think we're on the cusp of, relates back to this orderly exit point. I've heard mutterings from supervision around how, potentially, if you can focus more on, 'Is there a good recovery plan? Is there a good exit plan?' then it might mean that they can step back a little bit from some of the more day-to-day supervisory activities that they've typically done. So, that's one to watch.

Andrew: That's interesting, and if I compare that to the FCA, where they're moving to more of an outcomes-focussed regime, again, there's that focus on 'What's the outcome?' rather than necessarily the details of how you got there.

Stephanie: Exactly, and it links in really nicely to this competition piece, around letting markets take care of themselves by entering and exit, as markets do.

Andrew: Yes, fantastic. Okay, thank you both, that was a really interesting discussion. To wrap up, it'd be great to get both of your views on practical steps that firms who are listening in to this should be taking off the back of the plan. What should they be focussed on in coming months? I'm going to come to you first, Steph.

Stephanie: So, I think, from my perspective, it's doing what you probably should be doing for day-to-day business anyway, making sure that your governance structures, your risk management frameworks are appropriate for the business that you have, looking at that regulatory horizon scanning, and thinking about, 'Well, how does that impact our strategy, our stress-tests and our risk appetite?' If you haven't got it yet, that one eye on orderly exit and thinking about what you might need to start doing over the coming months to get ready for that impending regime.

Andrew: Great, thank you, and, Conor, what are you views?

Conor: I would agree with Steph. The only thing I would add is, try and stay ahead of the agenda. It's difficult, there's a lot to do, there are many other challenges other than regulation, that firms are dealing with but we have a pretty good sense of what the PRA's priorities are going to be over the next six months to a year. We know that they're going to come and scrutinise firms on things like climate risk, on operational resilience. They're going to start asking more questions around diversity and inclusion. Firms really need to be prepared to answer those questions and show that they are making the adequate level of progress, and then Basel 3.1, that's going to be a big deal. We haven't seen the proposals yet from the PRA but the Basel Committee rules have been out there for a number of years and the PRA aren't going to stray too far away from that, so really start to think about an implementation approach, about what it means for business models. 2025 might seem like a little way off but really, if you think about the significance of the package, it's not that far.

Andrew: Okay, brilliant, thank you, Conor, and thank you, Steph, for joining us. I love it when we get topics where we've got public policy and regulatory policy at UK and international levels, and then the realities of what it's feeling like on the ground, and how it all links together. It sounds like there’s lots of change coming, lots of things to stay on top of, and potentially lots of opportunity for firms but equally, as I think both of you have said, getting the basics right and doing what you should be doing is equally important as well. To our listeners, I hope you've also enjoyed this conversation. Please do subscribe to future episodes and rate and review the series, as it helps other listeners to find us. We'll be back next month to talk about what the PRA has in store for insurers.