There are three key areas where Hong Kong regulators are expected to turn up the heat in 2020, says KPMG’s Simon Topping.
Over the last decade or so, regulators worldwide have enacted a number of measures to strengthen the resilience of the banking sector. Banks in Hong Kong have done well to strengthen their balance sheets and risk management accordingly. However, there are three key areas where we expect the regulators in Hong Kong to turn up the heat in 2020, and which therefore require a greater focus from banks.
While Basel 4 is due to be implemented in January 2022, regulators – with the exception of Europe – are yet to consult the industry or provide advice on how they plan to implement the new framework. However, while the Hong Kong Monetary Authority (HKMA) and other regulators are not yet committing themselves to implementation, banks cannot neglect this area. There is still a lot of preparation work to be done, as regulators are expected to conduct quantitative impact studies and consult the industry on how banks calculate the risk weighted assets for credit, operational and market risk. At the same time, proactive banks will conduct gap analyses to determine whether their data and systems are fit for purpose for Basel 4.
Banks have for many years had contingency/disaster recovery plans in relation to specific problem areas, such as IT breakdowns or security breaches, liquidity problems or outsourcing issues. However, regulators in Asia are starting to take a much broader view of operational resilience, focusing on how the continuity of key business services could be preserved in the event of disruptions occurring. We expect banks in Hong Kong to think much more about how to reduce operational risks and the potential costs of disruption – to themselves, their customers and the financial system as a whole.
In 2020, leading banks will explore opportunities to strengthen their operational resilience in a way that brings business benefits. These banks will take a more explicit end-to-end view of key business services to generate synergies across strategic, financial and operational resilience. This comprehensive view will also help many banks generate better customer outcomes, enhance customer trust and loyalty, reduce their operational risks and the costs of disruption, and allocate resources more effectively and efficiently.
Third party risk management (TPRM)
Banks have always made some form of assessment of their customers, their main outsourcing providers, and to some extent their main suppliers – but they generally do not have a comprehensive and effective process for assessing the full range of third parties to which they are exposed. However, the world has moved on, and in 2020 banks will continue to seek to collaborate closely with fintech players, and will be increasingly interlinked with technology providers, telecoms firms, and potentially other third parties (through open banking).
We expect the HKMA to increase their focus on how banks manage their relationships with third parties and how they risk assess them. The more forward looking banks will start to treat TPRM as a standalone subject instead of as a piecemeal exercise. The successful banks will consider not just the potential financial impact of these relationships, but also how these third parties handle the bank’s customer data, and the associated reputational risk.
This article was first published in KPMG’s Hong Kong Banking Outlook 2020, available here.
Simon Topping is a former banking supervisor and a partner with KPMG in Hong Kong, where he provides regulatory, compliance and risk management advice and solutions to both global and Asian clients.