Risk Identification And Assessment Methodologies For Securities . - IOSCO

Transcription

Risk Identification and AssessmentMethodologies for Securities RegulatorsTHE BOARDOF THE INTERNATIONAL ORGANIZATION OF SECURITIESCOMMISSIONSFR02/14JUNE 2014

Table of ContentsABOUT THIS REPORT . 3Chapter 1: Definition of Risk. 7Section 1: IMF/BIS/FSB Systemic Risk Definition . 7Section 2: IAIS Systemic Risk Definition . 7Section 3: IOSCO Systemic Risk Definition. 7Section 4: Definition of Risk aligned to Regulatory Objectives. 8Chapter 2: IOSCO Risk Identification Methods . 10Method 1: IOSCO Committee on Emerging Risks . 10Method 2: IOSCO Risk Outlook Survey. 10Method 3: IOSCO Risk Dashboard . 11Method 4: IOSCO Securities Markets Risk Outlook. 11Chapter 3: Risk Identification Methods used by Securities Regulators. 12Method 1: Risk Committee . 14Method 2: Risk Register . 17Method 3: Regulatory Collaboration . 18Method 4: Risk-focussed Meetings . 20Method 5: Risk Surveys. 21Method 6: Risk Dashboard . 22Method 7: Research and Publications . 23Method 8: Data Analytics and Econometrics . 24Chapter 4: An Analytical Framework for Assessing Systemic Risks . 27Section 1: Macro and Micro-level Indicators . 27Section 2: Factors to assess whether the Risk identified is Systemic. 29Conclusion and Future Evolution . 31ANNEX 1: IOSCO Assessment Committee Thematic Review . 32ANNEX 2: IOSCO Risk Dashboard . 36ANNEX 3: Examples of Risk Register and Heat Map Methodologies . 38

ABOUT THIS REPORTBackgroundFollowing the Global Financial Crisis (GFC), international authorities concluded under the auspices ofthe G-20 that greater emphasis must be placed on the early identification of systemic risk. Since BearStearns and Lehman Brothers were both broker-dealers, it was agreed that not only banking regulatorsbut also securities regulators have a significant role to play in systemic risk identification.Against this backdrop, in 2009 the International Monetary Fund (IMF), the Financial Stability Board(FSB) and the Bank of International Settlements (BIS) set out an approach to assess the systemicimportance of financial institutions, markets and instruments1 and in 2010 the Board of theInternational Organization of Securities Commissions (IOSCO) adopted the two following newprinciples:2 Principle 6:The Regulator should have or contribute to a process to monitor, mitigate and manage systemicrisk, appropriate to its mandate. Principle 7:The Regulator should have or contribute to a process to review the perimeter of regulationregularly.Principles 6 and 7 guide securities regulators to implement methods, approaches and tools to identifyrisks that are relevant to securities regulators, including risks that are at the time of identificationoutside the regulatory perimeter. The methods, approaches and tools can be adjusted to fit the mandateof the securities regulator.Shortly after adopting Principles 6 and 7, IOSCO published Discussion Paper IOSCO OR01/11entitled “Mitigating Systemic Risk: A Role for Securities Regulators.” 3This was followed by the formation of the “IOSCO Standing Committee on Risk and Research”, sincerenamed in 2013 the “IOSCO Committee on Emerging Risk” (“CER”).A key objective of the CER is to further build on Principles 6 and 7 and on IOSCO Discussion PaperOR01/11 to develop and maintain a detailed research methodology for the identification, monitoringand mitigation of systemic risk that can be used by securities regulators around the globe.The CER in conjunction with the IOSCO Research Department committed to: Conduct a review of literature, indicators and methods used for the identification andmeasurement of systemic risks in the securities markets:-123To achieve this, the IOSCO Research Department conducted a research and in July 2012published a staff working paper entitled “Systemic Risk Identification in Securities Markets”.4“Guidance to Assess the Systemic Importance of Financial Institutions, Markets and Instruments: Initial Considerations”,International Monetary Fund, Bank for International Settlements and Financial Stability Board, October s and Principles of Securities Regulation” Principles 6 and 7, IOSCO, June COPD323.pdf“Mitigating Systemic Risk: A Role for Securities Regulators”, IOSCO, February PD347.pdf3

It outlines a systematic approach that can be used by researchers and securities regulators forthe identification and monitoring of systemic risks and risk build-up in entities, marketinfrastructures, products and activities. The approach presented in the staff working paperrelies on a list of practical and concrete indicators and offers a flexible and coherent process forusing them (Chapter 4 below).- Building further on the July 2012 IOSCO staff working paper, the present paper provides apractical overview of methods, approaches and tools that the IOSCO Research Departmentand CER members have implemented to identify and assess new risks (Chapter 2 and 3below). Securities regulators from around the globe can use this paper as a point of referenceas they decide which methods, approaches and tools are more suitable to their jurisdiction,remit and regulatory context.Provide concrete examples of indicators that can be incorporated into a regular systemic-riskdashboard, along with a preliminary estimation of the future data needs:-To achieve this, the IOSCO Research Department in close collaboration with the CERimplemented and automated in 2013 the “IOSCO Risk Dashboard”. It includes a sizable list ofindicators and data that are used for monitoring trends, vulnerabilities and risks in globalsecurities markets. The IOSCO Risk Dashboard complements other risk identification andassessment methods deployed by the IOSCO Research Department and the CER.-While creating the IOSCO Risk Dashboard, it became apparent that there are data gaps that canonly be filled through greater global regulatory cooperation and exchange. To achieve thelong-term goal of reducing data gaps through greater global regulatory cooperation, the CERobtained approval from the IOSCO Board in 2014 to create a dedicated CER working groupthat will focus on detailing data gaps and on proposing methods to reduce such gaps.5Create systemic risk research that can form the basis for a global discussion on emerging andexisting risks:-The CER meetings, the CER Risk Roundtable and the IOSCO Securities Market Risk Outlookare the principal methods used by the IOCO Research Department and CER to achieve this(Chapter 2 below).-In addition, as and when new risks are identified, such risks are escalated to the IOSCO Boarddepending on severity, probability and urgency.Objectives of this PaperThe objective of this paper is to provide a practical overview of the methods, approaches and tools(jointly referred to as “methods”) that IOSCO and securities regulators have developed andimplemented to identify and assess new risks. By doing so, this paper aims to lay the foundation forcontinued implementation, development and improvement of such methods by securities regulators.Underlying this paper is the realization that, because securities markets are complex and involve awide range of different intermediaries, behaviors, products, investors, geographies, stages of financialdevelopment, macro-economic context, etc., there is at present no “one-size-fits-all” method for the45“Systemic Risk Identification in Securities Markets, Staff Working Paper”, Werner Bijkerk, Rohini Tendulkar, Samad Uddin andShane Worner, July pdf?v 1The “IOSCO Data Gap Working Group” or “IDG”4

identification of all trends, vulnerabilities and risks in securities markets. Instead, it is concluded thatsecurities regulators benefit from combining a series of methods. Taken together a series of methodsconstitute a methodology.6The paper provides concrete examples of how the different methods are already in use at the varioussecurities regulators who are members of the CER. It also takes into account the recommendations ofthe IOSCO Assessment Committee as published in September 2013 in the “Thematic Review ofPrinciples 6 and 7 of the IOSCO Objectives and Principles of Securities Regulation”.7This paper is organized as follows: Chapter 1: Definition of Risk: This Chapter sets out commonly used definitions of systemic risk.Since Principle 7 is broader than systemic risk, it also provides a practical definition of risk thatcasts the net wider than systemic risk to capture new and emerging risks as well as risks to theobjectives of the securities regulator.- Chapter 2: IOSCO Risk Identification Methods: This Chapter sets out the methodsimplemented by the IOSCO Research Department in conjunction with the CER to identify newrisks of global significance:- Section 1: IMF/BIS/FSB Systemic Risk DefinitionSection 2: IAIS Systemic Risk DefinitionSection 3: IOSCO Systemic Risk DefinitionSection 4: Definition of Risk aligned to Regulatory ObjectivesMethod 1: IOSCO Committee on Emerging RisksMethod 2: IOSCO Emerging Risk SurveyMethod 3: IOSCO Risk DashboardMethod 4: IOSCO Securities Markets Risk OutlookChapter 3: Risk Identification Methods used by Securities Regulators: This Chapter sets outthe methods implemented on national levels by CER members to identify new risks relevant to thespecific jurisdiction/ market/ securities regulator:-Method 1: Risk CommitteeMethod 2: Risk RegisterMethod 3: Regulatory CollaborationMethod 4: Risk-focussed MeetingsMethod 5: Risk SurveysMethod 6: Risk DashboardMethod 7: Research and PublicationsMethod 8: Data Analytics and EconometricsWhether each of these methods are relevant or appropriate for a given jurisdiction depends onseveral factors, including the size and complexity of its financial markets, the mandate and scopeof the securities regulatory authority and the broader financial regulatory structure of thejurisdiction. Therefore, Chapter 3 does not prescribe which methods should be used, but instead67Definition of “methodology” in the Oxford dictionaries: “A system of methods used in a particular area of study or nition/english/methodology“Thematic Review of Principles 6 and 7 of the IOSCO Objectives and Principles of Securities Regulation”, IOSCO, September 2013.This Review was based on a survey of 34 IOSCO members from 31 jurisdictions indicating and provides an overview of the toolswhich those members noted they are using to implement IOSCO Principles 6 and 7. The recommendations from this review areincluded in Annex 1. 4.pdf5

provides a range of options that securities regulators can consider using as part of their riskidentification framework. Chapter 4: An Analytical Framework for Assessing Systemic Risks: This Chapter offersguidance on assessing whether or not a risk, trend, or vulnerability is systemic, regardless of themethod used to originally identify the risk.-Section 1: Macro and Micro-level IndicatorsSection 2: Factors to assess whether a Risk is SystemicContinued EvolutionIdentifying, analyzing, and monitoring systemic risk remain a new discipline for securities regulators.Therefore this paper should be viewed as another step in the evolutionary work performed bysecurities regulators in this area. By the same token, the methods described in this document willcontinue to evolve and, consequently, this paper will need to be updated or supplemented from time totime.For example, a working group of the CER is seeking to identify the data that global securities requireon financial market entities, infrastructures, products and activities, in order to implement effectivelyIOSCO Principle 6. The outcomes of the group s work will be incorporated into a future follow-up ofthis paper. Also, the CER will continue to serve as a forum for active dialogue on new or improvedmethods and models that facilitate the early identification and analysis of risk in securities markets.Contact PersonsThis paper is the work product of the IOSCO Committee on Emerging Risks (CER).Any comments or suggestions can be addressed to research@iosco.org or to any of the belowmembers of the CER:IOSCO Research Department, Werner BijkerkCanada, ASC, Steven WeimerHong Kong, SFC, Bénédicte NolensMexico, CNBV, Yearim VallésUnited States, SEC, Jennifer Marietta-Westberg6

Chapter 1: Definition of RiskIntroductionThis Chapter sets out commonly used definitions of systemic risk. Since IOSCO Principle 7 is broaderthan systemic risk, it also provides a practical definition of risk that casts the net wider than systemicrisk to capture new and emerging risks as well as risks to the mandate of the securities regulator.Section 1: IMF/BIS/FSB Systemic Risk DefinitionThe IMF/BIS/FSB describes systemic risk as: 8“Systemic risk is the risk of disruption to financial services that is (i) caused by an impairment ofall or parts of the financial system and (ii) has the potential to have serious negativeconsequences for the real economy.”The definition reflects certain key features of systemic risk: negative externalities of actions byfinancial institutions which cause disruption to financial services and negative impact on the realeconomy.Section 2: IAIS Systemic Risk DefinitionThe International Association of Insurance Supervisors (IAIS) added two additional elements to theIMF/BIS/FSB definition: 9“An impairment or disruption to the flow of financial services would include situations wherecertain financial services are temporarily unavailable, as well as situations where the cost ofobtaining the financial services is sharply increased.”“The definition requires significant spill-overs to the real economy, without which an impairmentof financial services would not be considered systemic. The real economy impact could be eitherthrough an effect on supply or through an effect on demand for other goods and services.”Section 3: IOSCO Systemic Risk DefinitionIn 2011, IOSCO published a definition of systemic risk in IOSCO OR01/11 entitled “MitigatingSystemic Risk: A Role for Securities Regulators”: 10“Systemic risk refers to the potential that an event, action, or series of events or actions will havea widespread adverse effect on the financial system and, in consequence, on the economy.”While the IOSCO definition is largely consistent with the IMF/BIS/FSB definition, it also recognizedthat:8910“Guidance to Assess the Systemic Importance of Financial Institutions, Markets and Instruments: Initial Considerations”,International Monetary Fund, Bank for International Settlements and Financial Stability Board, October OPD347.pdf“Systemic Risk and the Insurance Sector”, International Association of Insurance Supervisors, October 2009.http://iaisweb.org/ temp/Note on systemic risk and the insurance sector.pdf“Mitigating Systemic Risk: A Role for Securities Regulators”, IOSCO, February OPD347.pdf7

“Systemic risk, in the context of securities markets is not limited to sudden catastrophic events; itmay also take the form of a more gradual erosion of market trust.”This refinement is necessary because focussing on a narrow definition of systemic risk may interferewith early foresight, especially in securities markets where often new trends, vulnerabilities and risksare not systemic by nature or from the onset, but rather become systemic due to size or a specificconfluence of other conditions and circumstances.In particular, securities products may lead to “a gradual erosion of market trust” in instances whereother elements of the regulatory mandate were not complied with, for example risk governance wasnot solid (weak risk governance is often seen as the main cause of the collapse of Lehman Brothers)11or where risk culture failed (for example in the context of material conduct lapses or mis-selling).Furthermore, in accordance with IOSCO objectives, other significant considerations in the assessmentof systemic risk include: (i) the effect of a risk on the cost or availability of capital; and (ii) the effectof a risk on investor confidence in the fairness of a market.The existence of many complexities and factors that may contribute to the emergence of new risks thatare relevant to securities regulators is visualized in Exhibit 1 below.12Exhibit 1: Complexities and factors that may contribute to the emergence of new risksSection 4: Definition of Risk aligned to Regulatory ObjectivesThe “Thematic review of the implementation of Principles 6 and 7 of the IOSCO Objectives andPrinciples of Securities Regulation” noted that less than 20% of securities regulators surveyed have alegally-imposed definition of system risk and that most securities regulators base their implementationof the IOSCO Objectives and Principles of Securities Regulation, including Principles 6 and 7 on a“Principles for effective risk data aggregation and risk reporting", Basel Committee on Banking Supervision, January 2013,http://www.bis.org/publ/bcbs239.pdf It states: “One of the most significant lessons learned from the global financial crisis that beganin 2007 was that banks’ information technology (IT) and data architectures were inadequate to support the broad management offinancial risks.”12 Source: United Kingdom Financial Conduct Authority (FCA).118

“working definition” of systemic risk appropriate to their mandate and to the domestic market, ratherthan on a statutory definition. 13The thematic review proceeds to recommend that securities regulators consider adopting a morespecific definition of systemic risk because a definition allows a securities regulator to have a cleareridea of the necessary thresholds and scope to identify a systemic risk that is relevant to the markets itregulates and that doing so will also support securities regulators more directly fulfilling the IOSCOObjectives and Principles of Securities Regulation, while also supporting broader financial stability. 14Since IOSCO Principle 7 is broader than systemic risk, we insert below a practical definition of riskthat casts the net wider than systemic risk to capture new and emerging risks as well as risks to themandate of the securities regulator:“Risks, including potential emerging and systemic risks, in financial market, entities,infrastructures, products and activities15 which may impact the ability of the securitiesregulator to meet its regulatory objectives as set out in [relevant rules and regulations/regulatory objectives].”131415“Thematic Review of Principles 6 and 7 of the IOSCO Objectives and Principles of Securities Regulation”, IOSCO, September 2013.This Review was based on a survey of 34 IOSCO members from 31 jurisdictions indicating and provides an overview of the toolswhich those members noted they are using to implement IOSCO Principles 6 and 424.pdf. The recommendations from this review are included in Annex 1.“Objective and Principles of Securities Regulation” Principles 6 and 7, IOSCO, June COPD323.pdfLanguage taken from the “IOSCO Methodology for Assessing Implementation of the IOSCO Objectives and Principles of SecuritiesRegulation, Principle 6”, IOSCO, September 2011, available at 9.pdf9

Chapter 2: IOSCO Risk Identification MethodsIntroductionIn this Chapter 2, we list the methods implemented by the IOSCO Research Department inconjunction with the CER to identify, research and assess risks that may be of global or multijurisdictional significance, typically emerging or systemic risks. CER members may use the outcomesof these methods to supplement their regional and national perspective of risk (Chapter 3).Method 1: IOSCO Committee on Emerging RisksThe IOSCO Committee on Emerging Risks (CER) meets three or four times annually. A key target ofthe CER meetings is to foster an active and open dialogue on risk among CER members who representa large number of jurisdictions. To this effect, the CER meetings include various sections focussed onrisk sharing and assessment, including:(i)The Risk Roundtable – before the CER meetings take place, members are asked toprovide risk themes which they would like to table at or present at the CER. For example,in the January 2014 CER, members from emerging markets each presented on the risks asthey perceive them from the perspective of their markets.(ii)Industry Experts – the risk roundtable is supplemented by presentations by industryexperts. For example, in the January 2014 CER, industry experts were invited to share theirviews on risks in emerging markets. Furthermore, industry experts were invited to providetheir latest perspective and research on other topics set out in the IOSCO SecuritiesMarkets Risk Outlook 2013-2014. 16(iii) Research Sharing – in addition to the above, CER members share research which they arein advanced stages on and which they believe is of relevance to other markets. Examples ofthis include sharing of the latest research on topics such as crowd-funding and virtualcurrencies.(iv) Sharing of Risk Identification Methods – CER members also share improvements theymake in their risk identification methods. Examples of this include sharing ofdevelopments in the use of data analytics and econometric models to complementsupervisory prioritization. Other examples include sharing of product specific risk analysisor research on investor behaviour and market structure.Method 2: IOSCO Risk Outlook SurveyAnnually the IOSCO Research Department surveys IOSCO members and experts from the market,academic and regulatory community about emerging risks.The IOSCO Risk Outlook Survey17 sets out a number of areas where risks could be building up basedon market intelligence meetings and roundtables with the industry, regulators, internationalorganizations and academics. The results of the survey are used as input to the IOSCO SecuritiesMarkets Risk Outlook.16IOSCO Research Department, IOSCO Securities Markets Risk Outlook 2013-2014, October OPD426.pdf17See Shane Worner, A Survey of Securities Markets Risk Trends 2014: Methodology and Detailed Results. IOSCO StaffWorking Paper, June 2014. http://www.iosco.org/research/pdf/swp/SWP5.pdf10

Method 3: IOSCO Risk DashboardThe IOSCO Research Department has developed in close collaboration with the CER an automatedIOSCO Risk Dashboard that is updated and shared before every IOSCO Board Meeting.Monitoring of longer time series of data allows for the identification of changes in patterns and trends,which in turn may point towards the emergence of new area of risk or vulnerability. By including asizable series of indicators, the IOSCO Risk Dashboard complements other risk identification andassessment methods deployed by the IOSCO Research Department and the CER.Annex 2 shows the indicators that are currently tracked. The IOSCO Risk Dashboard is expected tocontinue to evolve. For example, indicators may be added in due course based on market evolution,availability of data and further work of the CER and its working groups.Method 4: IOSCO Securities Markets Risk OutlookThis IOSCO Securities Market Risk Outlook 2013-14 (the Outlook) 18 is the first external publicationof an annual series of Outlooks that aim to identify and assess potential systemic risks from securitiesmarkets. The Outlook is a forward-looking report focusing on issues relevant to the securities marketsand whether they are, or could become, a threat to the financial system as a whole.The Outlook is written by the IOSCO Research Department in close collaboration with the CER. It isbased on a number of inputs including: risk topics derived from the CER meetings (Method 1 above),risk topics derived from the IOSCO Risk Outlook Survey (Method 2 above), developments ofquantitative indicators contained in the IOSCO Risk Dashboard (Method 3 above). These methods arefurther supplemented by independent research, data collection and analysis by the IOSCO ResearchDepartment, as well as by the outcomes derived from a series of market intelligence meetings,interviews and risk roundtables in major financial centers and involving prominent members of theindustry and regulators.The purpose of the annual Risk Outlook series is three fold: It is intended to inform the IOSCO Board and other IOSCO members about potential systemicrisks to securities markets. As such, the Outlook constitutes one data point to assist nationalregulators in implementing IOSCO’s two new principles on identifying, assessing and mitigatingsystemic risk (Principle 6), and on reviewing the regulatory perimeter (Principle 7); It aims to support the global risk identification and mitigation efforts by the Group of Twenty(G20), the Financial Stability Board (FSB), the IMF and other global organizations that aretackling similar issues; and In the interest of public disclosure, it synthesizes and presents in a single, accessible document keyissues and potential systemic risks currently being discussed by market participants, securitiesexperts and regulators around the globe.18IOSCO Research Department , IOSCO Securities Markets Risk Outlook 2013-2014, October OPD426.pdf11

Chapter 3: Risk Identification Methods used by Securities RegulatorsIntroductionCER members complement the IOSCO Risk Identification methods (which are primarily focussed onidentifying risks of global or multi-jurisdictional significance), with their own national riskidentification, assessment and mitigation frameworks (which are focussed on identifying risks directlyrelevant to the jurisdiction in which the CER member operates.) Chapter 3 provides an overview ofvarious methods for the identification, monitoring and assessment of trends, vulnerabilities and risksthat are already in use by CER members.Multiple methods to identify riskIn complex systems, no single risk identification method can realistically identify all risks. Instead,risk identification frameworks consist of various risk identification methods that are appropriate forthe subject matter under surveillance, which can then be combined into an overall approach for theidentification and monitoring of risk. To put it more simply and as also noted in the “Thematic reviewof the implementation of Principles 6 and 7 of the IOSCO Objectives and Principles of SecuritiesRegulation”,19 there is at present no “one-size-fits-all” method for the identification of all trends,vulnerabilities and risks in securities markets. Instead, regulators benefit from using multiple methods.This is illustrated in Exhibit 2 below, which is based on a survey conducted among CER members in2014.20 It lists the methods elaborated upon in this Chapter 3 and shows which methods the variousCER members already have in use, compared to those methods which they do not yet have in use. Itconfirms that while no authority uses each of the methods (no vertical column is all light blue)

identification of all trends, vulnerabilities and risks in securities markets. Instead, it is concluded that securities regulators benefit from combining a series of methods. Taken together a series of methods constitute a methodology.6 The paper provides concrete examples of how the different methods are already in use at the various