Jan Bellens, a partner and Global Banking & Capital Markets Sector Leader at EY in New York, spoke with Martin Boer of the Institute of International Finance to discuss the relatively new concept of “Operational Resilience” - which has been defined as the ability of firms to identify, detect, protect, adapt and respond to, as well as recover and learn from, operational disruptions. In this podcast, they exchange ideas around the concept and discuss what steps firms are currently undertaking given the challenges around the Covid-19 Pandemic.
Transcript:
Martin Boer, IIF:
Welcome to the IIF's Global Regulatory Update podcast. I'm Martin Boer, the Director of Regulatory Affairs at the Institute of International Finance in Washington DC. For this episode, I'm delighted to be joined by Jan Bellens who is the Global Banking and capital markets sector leader at EY and based in New York. In this podcast, we're going to discuss the relatively new concept of operational resilience, which has been defined as the ability of firms to identify techs, protect, adapt and respond to as well as recover and learn from operational disruptions. Operational resilience is an important topic for IIF firms and we're engaged in regular discussions with key regulators to exchange ideas around the concept and to ensure the frameworks are workable for firms operating across jurisdictions. It's also of course, especially topical given the challenges we are all currently facing around the COVID-19 pandemic. Jan, welcome to our podcast. I hope that you, your family, and colleagues are staying safe and healthy in these difficult times.
Jan Bellens, EY:
Thanks a lot, Martin, and thanks very much for inviting me here. Well, I think the Bellens family's operational resilience has been, quite robust. There have been some complaints about my cooking skills under lockdown, but otherwise all good. I have to say our EY staff around the world has also been incredibly resilient. Everyone is motivated by a very proactive and caring tone from the top on in this respect.
Martin Boer, IIF:
Great. I'm very glad to hear that. Jan, you've been advising financial firms for 25-plus years. Have you ever seen anything like this period before and what makes it different in previous crises?
Jan Bellens, EY:
No, I certainly have not seen anything with this severity. Such a large part of the global economy coming to a near standstill so rapidly at almost the same time is unprecedented in my lifetime. And, I think it is well noted already that this crisis is very different from 2008, which was largely a financial crisis triggered by excesses in the financial markets. COVID-19 is a global health crisis in the real economy, which has hit very fast. Global supply chains are disrupted. Unemployment rates have shot up quite dramatically. Government intervention is bigger than ever before. And bankruptcies are expected to spike. So, we will see a recession. But I think this time around we should trust that a well-capitalized and well-regulated banking system can play its role in getting the real economy, back to growth, and play its role in that.
Martin Boer, IIF:
Great. We heard from the Financial Stability Board this morning that there have already been 850 or so discrete measures being taken by different governments. So, as you say, there's a lot of activity here. What have the banks done in response to the evolving regulatory and supervisory requirements on operational resilience, and how does operational resilience in practice help firms safeguard their operations and provide continuity through these periods of uncertainty?
Jan Bellens, EY:
So, I think banks recognized already that achieving operational resilience is not a regulatory compliance exercise, iIt's a business imperative. You know the building and maintaining trust with consumers and businesses is a key part of the financial services system, and it benefits clients, shareholders, and the broader economy. A continuity of service across the sector is a key element in creating trust with customers, protecting society. And it's a strategic consideration at board level, not just regulatory compliance, you know, a challenge. Now that being said, what have firms done in practice, you know, as you pointed out, achieving operational resilience requires a bank not only to focus on minimizing the likelihood of an incident occurring and causing disruption but also to assume, in this case of the virus to assume that disruptions do occur and put robust response and recovery processes in place and some of the key activities that the banks already undertake in that respect is identifying their most important, business services. Then exploring mechanisms for setting impact tolerances and performing a gap assessment of their current approach against consumer and market expectations. And these activities lay the foundation for developing a response that evolves, their existing approach to managing risk and achieving that operational resilience. But it's also proportionated and should be proportionate to the services they provide and how consumers and markets rely on them.
Martin Boer, IIF:
Picking up on those points, can you share with us some of the experiences that you and your colleagues at EY have seen across the financial industry? Where have the banks' plans and investments in operational resilience held up well? Where have you seen challenges? What are firms doing to remain resilient in this context?
Jan Bellens, EY:
Well, Martin, overall, I believe the financial systems and the banks have until now proven to be operational resilient in this pandemic. And this should not be taken for granted. It's a great achievement. Thanks to regulatory and supervisory oversight, but also the prudent risk-based planning and investments by the banks -- I would say that in general around the world, the shift to working from home for the majority of the bank staff and the switch to digital interactions with customers only has gone well, no critical processes and infrastructure have held up despite often unprecedented shifts in and less productive capacity. So, I believe where we have seen some temporary challenges to banks have, as operational resilience requires, have adapted quickly. We've seen some areas spike such as, you know, how to deal with remote trading and especially the compliance challenges that come with remote trading.
We've seen an entire country -- We had a lot of shared service centers by banks going in lockdown. India went in lockdown, it was a scramble for laptops, for internet connections. But in the end, the entire system has proven to be operationally resilient, and then I think a third one where we have seen temporarily challenges is where sometimes banks were requested to provide new services and had to establish new processes. For example, in the transmission of government stimulus across, across the world. And providing government stimulus to small, medium-size enterprises to consumers or corporates. But overall, I think banks have responded very well to this pandemic. And you know, actually one of my clients told me recently that they, they made an operational fix that was required. It would typically take them -- in business as usual -- It would take them about six months, and they accomplished it in about six days.
Martin Boer, IIF:
That's great. As you say, Jan, as part of operational resilience banks there’s a plan for disruptions, but to what extent had firms been planning for pandemics in particular before COVID-19? And is there something different about COVID-19 than previous types of wide-scale disruptions?
Jan Bellens, EY:
I think it's a good question, Martin, and as highlighted, disruption to the banking system comes from a variety of sources. I have to say, typically a risk survey and most of the discussions, before this pandemic hit, we were more focused on operational disruptions related to cyber technology, data, and third parties. So, IT obsolescence and data unavailability prolonged IT outages, and highlighted again cyber risks, which was often the number one. That I think was very much the focus, perhaps less so a global pandemic, but although banks may not have modeled for a truly global pandemic of this severity, a lot of the response and recovery programs are still relevant in this case. As many of them have put the reliability of the technology infrastructure to the test, and I think one of the key differences for COVID-19 is its truly global nature, and that exposes a global supply chain of businesses, banks included. Also, in my view that operational resilience is a global effort that will require the adoption of an international common approach by the public and private sectors.
Martin Boer, IIF:
If we move to the regulatory approach for a moment, the UK authorities, including the Bank of England, the Prudential Regulatory Authority, and the Financial Conduct Authority have been at the forefront of thinking about operational or resilience or releasing their first discussion paper in July 2018. How do you see the UK approach working in the context of COVID-19 and as regulatory and supervisory authorities around the world? Think of how to approach operational resilience, what do you think that they're learning from the current pandemic and from what the banks have been doing so far?
Jan Bellens, EY:
As you point out, Martin. I think the UK approach has certainly elevated the topic of operational resilience, with boards and with regulators around the world. It has put a stake in the ground on, on the definitions, the lexicon and also on approach and on policy and yes, I do believe that the policy has already had an impact -- for example, as I mentioned, in third party management and outsourcing. I think importantly in addition to the UK authorities now, we are seeing resilience become a core focus, not just in the UK, but across the EU, the US, and further afield. So the European Commission and the European supervisory authorities are updating requirements and outside the EU we have seen global regulatory focus starting to turn operational to turn to operational resilience as well. For example, with the Basel Committee, and US regulators mandating remediation activity relating to resilience. I think the collaboration between regulators and the private sectors should continue. It should know and recognize that in times of crisis, flexibility and ongoing communication will be required. And I think this global pandemic will be a great learning exercise for both the public and private sectors in updating their data approach.
Martin Boer, IIF:
Yes, definitely flexibility and global regulatory coordination are very important here. In terms of the banks and how they respond to this, do you expect that leading banks around the world will have to update their operational resilience plans after their experiences in the current pandemic?
Jan Bellens, EY:
It's a good question, Martin. And of course, I don't have a crystal ball, unfortunately, but, the financial industry is constantly learning from events and if identifying gaps and implementing changes necessary to continue improving and updating its processes in line with the changes. I think we will certainly see because of this pandemic a renewed focus on operational resilience. And I think as I highlighted, operational resilience in the banking system has held up well, we will see banks thinking about some of the gaps and I think the banks will also have to adapt their approaches to perhaps changes in their operating model and their ecosystem. So for example, quite a lot of banks are currently thinking about what is going to happen to my workforce. You know, beyond this crisis, we can see more working from home, perhaps less in the office. We can see more nearshore operations with a specific operational resilience question. And we will also perhaps as we've seen already in Asia, dramatically increased digital adoption, by both consumers and businesses alike, which will lead to different customers' expectations. And, and again, we'll also change how operational resilience has to evolve.
Martin Boer, IIF:
Great to know. Those are great insights, as the last question, can I ask you, what would you recommend to smaller organizations that might not have the resources and the technical expertise of the large global financial firms? Are there any relatively quick wins that can make a big difference in terms of supporting their resilience in the current circumstances?
Jan Bellens, EY:
I wouldn't necessarily call them quick wins, but I hope that some of these ideas address the challenges in terms of resources and technical expertise. I think a key point is a tone from the top, which doesn't have to be very costly. I think another one here for such as these, are important is learning from peers. You know, sometimes are larger peers, but just across the peer group, learning benchmarking and sharing of best practices. I firmly believe that testing, simulating, and exercising are good ways to make dramatic improvements. And some of those tests or exercises can again be done across peer groups or even across the industry. I think smaller institutions will also benefit from investments made by utilities and by third-party infrastructure providers that will be held to a high standard by perhaps some of the larger global banks. Where again, you know, smaller firms should be able to benefit from using similar services or standards.
Martin Boer, IIF:
Great. Thank you very much, Jan for your insights. I've very much enjoyed our conversation and I look forward to seeing you again winter when things normalize. We thank everyone for listening to this podcast and hope you all stay safe and healthy. Please consider subscribing to the IIF Global Regulatory Update wherever you get your podcasts. Thank you.