New legislation in Brazil on banking systems and controls has triggered a flood of sales from large accountancy firms and specialist service providers. John Rumsey looks at the new rules and how Brazilian banks are responding
Brazilian banks had until the end of May to submit a detailed operational risk plan to the Banco Central do Brasil (Central Bank of Brazil). They now have until the end of the year to implement these plans.
Generally, international and large domestic private banks have seen it as a good dry run for the bigger issue of implementing Basel II and are meeting the challenge; medium-sized banks are scrambling to adapt and spending heavily on vendors; and some smaller banks are floundering as they prioritise minimising costs. Even among the willing and co-opted, many paths to implement the bill are emerging. The move has triggered a flood of sales to the Brazilian market from large accountancy firms and specialist service providers.
The flurry of activity is dictated by Resolution 3380, which updates and continues the thrust of an earlier Central Bank resolution, 2554, that dates back to 1998. Broadly, the earlier law had established the conditions for the development for controls within financial institutions, laying down stipulations on minimum standards and internal controls, says Carlos Gatti, partner, financial services at KPMG in São Paulo. Although the new resolution is complementary to the earlier legislation, the 2554 resolution had only basic provisions on controls and a simple version of risk and mitigation, he notes.
The new legislation is an evolution in compelling banks to recognise and mitigate risks formally. Its more tactical and more systematic, says Gatti. It makes management of op risk more tangible and identifies varieties of op risk through each bank and division more systematically. The new resolution is both wide and shallow, adds Ronaldo Nogueira, a specialist in financial effectiveness at PwC in São Paulo. This wide-shallow model is due to the diverse range of players within the Brazilian banking system, he notes.
Brazil is some two years behind the European Union and Canada, and some two years ahead of some of the other key Latin American countries, according to Celso Mugnela, an industry specialist in the financial area at the São Paulo office of SAS. Canada established its schedule in 2001, Brazil outlined its schedule in 2004, and Argentina got its schedule together only at the end of 2006.
The widely differing levels of readiness of Brazilian banks for the measure comes about partly because of the structure of the banking industry, which comprises five key groups. Unlike almost all other Latin American countries, foreign banks remain a secondary, albeit important, presence in the Brazilian system, notes Nogueira. Instead, the Brazilian system is dominated by local banks, he says.
The first group comprises the two giants, federally owned Banco do Brasil and mortgage specialist Caixa Econômica Federal, as well as a handful of smaller state-owned banks that were never privatised, such as Banrisul, the bank of the southern state of Rio Grande do Sul.
The second group are the two domestic private behemoths, Banco Bradesco, Banco Itaú and the slightly smaller Unibanco. The third group consists of foreign banks with a presence across Brazil, that is, Santander, ABN Amro, HSBC and Citigroup. The fourth group are the limited-scope foreign banks with niches such as investment banking or trade financing. This is a group that has been growing fast in the past four years.
The fifth and final group comprises a host of smaller private banks, often family-owned, that have a local footprint as well as local specialist financial institutions. So although the industry is relatively consolidated, particularly at the top, it supports a wide variety of bank types. That makes designing a one-size-fits-all solution problematic, Nogueira notes.
Brazil is not only complex because of the kinds of institutions that make up the banking industry, but also because of the changing nature of the financial industry in the country. The model for the past few years has been to leave any idle money in high-yielding government paper. That has given banks the luxury of keeping high reserves, says Nogueira. Theres a heritage of keeping extra capital reserves because of Brazils history of crises and instability. Banks have always had extra capital to demonstrate their ability for solvency. In more developed markets, this is seen as inefficiency and not using capital in the most efficient way. For Brazilian banks with high margins, it has been a price worth paying, Nogueira notes.
That model is now being challenged. Interest rates in the country are plunging, with the benchmark Sistema Especial de Liquidação e Custodia (SELIC, the special system of clearance and custody) rate down by some 50% to the current level of 12% over four years. That is changing and diversifying the banks business model, says Nogueira. Now the name of the game is in lending, particularly to consumers and small businesses. Competition in this area is now intense. In about five years time, competitiveness and lower rates will make this extra reserving seem less efficient, he predicts.
That change in the business model will exacerbate another difficulty: the collection of data. Brazilian standards have lagged behind those of more-developed countries. Some banks have inadequate and inaccurate systems producing some unreliable data, and many have a very limited timescale over which they have been collecting data. SAS, for one, has put together a plan that includes help for data modelling. Brazilian banks have widely differing standards, says Mugnela. Many only started to model one or two years ago. Others have experienced problems with data quality, particularly at a branch level. The devil is in the data, quips Mugnela. If you dont establish a good model, self-assessment is going to be very difficult, he cautions.
The Central Bank tried to respect the wide differences between banks and to consult with the different types as it put together the new resolution. It solicited feedback and worked with Febraban (the Brazilian Federation of Banks) to set up committees to allow banks to express concerns on the drafts. Nogueira explains that the Central Bank was determined to strike the correct balance. Febraban invited one from each of the five main groups of banks to represent its peer group. Each bank had its own way of thinking about this, he notes. Even within groupings there have been radically different approaches, he says.
For example, within the foreign bank groupings, some banks pushed for the wide but shallow approach that was finally implemented. They did not want very detailed guidance but simply some guidelines. One peculiarity with foreign banks is that they pushed for loss-capturing models that may be appropriate for home markets but dont necessarily make much sense in Brazil. They were only interested in looking into losses of more than $10,000. In Brazil, fraud is relatively widespread, but more typical in areas where individual losses are small, points out Nogueira. Key areas include internet crime, credit-card cloning and ATM scams. Because of the granularity of losses in the Brazilian market, significant losses could be recorded even when the $10,000 mark is not reached.
Other banks were more interested in a narrow but deep approach. They wanted to carry out exhaustive work, including cause-effect, analysis of processes and modelling loss possibilities, but in a few confined areas. Finally, still others were interested in having legislation that outlined how to build a fundamental structure with key indicators.
Generally, large Brazilian banks have appointed one project management officer (PMO) from outside the bank, one PMO from the vendor, an IT project manager, and a sponsor from the risk area, says Mugnela. These large banks also have two or three senior consultants for modelling and a similar number for data management, for example, one covering analytical issues and another responsible for data modelling.
Not all Brazilian banks have seen the need to bring in outside expertise. Foreign banks usually follow policies handed down from their headquarters. The federal government-owned banks are so large that they have usually sought out their own bespoke systems for implementing op risk, as they have the in-house technology departments to design the products to do so.
Small and medium-sized banks are most resistant to the resolution. Many small Brazilian banks are family-owned, as indeed are two of the largest: Itaú and Unibanco. Owners of these small family-owned banks can be highly resistant to the idea of large outlays on op risk management. There is a lot of confusion between the functions of compliance, op risk management and internal controls. Many banks have responded by grudgingly accepting the resolution, and they are contracting consultants and accountants to help them put together plans to implement it.
The banks that did the bare minimum to meet resolution 2554 are most likely to be at the back of the class this time too, predicts Gatti, adding that those that have built up structures in the past few years on the back of 2554 have a good head-start. For the great majority of larger banks, including Itaú, Bradesco and Unibanco, the Central Bank resolution is just part of a more complex picture, including Sarbanes-Oxley and Basel II, he adds. These new requirements have seen large banks establish op risk departments and put in place a methodology and process at the minimum on the qualitative side that is well run, Gatti believes.
The implementation of the resolution is leading to bonanza times for providers. Most agree it is difficult to provide off-the-shelf solutions for banks in the market because of their very different structures, so tailor-made solutions are the order of the day. Some smaller banks have yet to hire consultants: that means they are likely to have left it beyond the last possible minute. There are just six months left to the implementation of the resolution, and a programme typically takes some nine months to develop.
Buoyant financial markets mean that risk professionals are in short supply throughout the industry. In Brazil, professionals with strong statistical analytical skill are particularly needed. Banks are increasingly sourcing these professionals from important universities, such as Unicamp in the city of Campinas in São Paulo state, the University of São Paulo and Fundação Getulio Vargas, both in São Paulo city; and the Instituto Militar de Engenharia in Rio de Janeiro, says Mugnela. Theres a concern to cultivate staff with analytical backgrounds to get ready for Basel II requirements, he notes.
Case study: ABN Amro
ABN Amro in Brazil has long thought about op risk, and beat its headquarters to developing op risk plans. We started to look at this in 1999, a year before our Amsterdam office did, says Lourenço Miranda, head of integrated risk management in São Paulo.
Miranda started thinking about op risk in the days when the term had not yet settled in the late 1990s. We were still struggling with the differences between op risk and compliance, and op risk was just too broadly defined, he remembers. These ambiguities led to some confusion for Brazilian banks when implementing resolution 2554 on compliance and internal controls. In 2000-01, Basel papers came out that helped to pin down the meaning of op risk.
ABN concentrated on inculcating an appropriate culture throughout the bank. That required massive training, with Miranda personally responsible for training 1,000 people.
Greater difficulties lay in compiling data. We started scrutinising products that might generate losses. We looked for possible losses in the general ledger, manager products and processes. Data remains a greater problem, with less acknowledgement of its importance. Even the largest banks are facing a number of difficulties in gathering uncorrupted data. In Brazil, were still struggling with a data gathering culture, says Miranda.
Unlike in the US, where individuals and companies alike recognise the vital importance, including on the bottom line, of data and information, the link is much less obvious for Brazils institutions and people, he says.
The new resolution 3380 catalyses and incentivises banks to adopt best op risk management practices. If implemented intelligently, it will lead you to be compliant organically, says Miranda. Banks such as ABN are using it as a path to Basel II, as many features are similar. The Central Bank issued a consultative paper, as had the Basel Committee, and invited comment. ABN wrote to clarify the appointment of a director or directors for banks with multiple divisions. The Central Bank was responsive and has shown flexibility in dealing with practical situations, Miranda says.
ABN also followed the discussions that Febraban organised to solicit the views of banks. The discussions were really interesting and showed the very different kind of difficulties faced by other types of banks, says Miranda. He corroborates what Nogueira says, that some small and medium-sized banks are still struggling with the resolution. They continue to see this as a cost and not as something that will enhance revenues over the long term, he says. So, to be compliant, many will need to turn to outside vendors.
This is an excellent opportunity for consultants and vendors. If small banks do hire them, it will be good for the industry, he says. ABN picked São Paulo-based Controlbanc in 2005 to make sure its op risk project is delivered to spec and on time. Despite what he sees as a high fee for their services, Miranda thinks they are useful and is also using them to get the bank ready for the introduction of the new resolution. The large accountancy firms offer similar services at similar fees, he notes.