Flying black swans into stress testing

Geopolitical risks stress tested

Dr. Andrea Burgtorf Head of Group Risk Operating Office Stress Test Europe Conference London, Oct 6th, 2016 Disclaimer

• This document contains certain statements regarding methodology and approaches potenally applicable under future accounng rules. • The informaon herein cannot be used to infer any impact of such future accounng rules on Erste Group Bank AG. • The views expressed herein are the views of the author and may not reflect the official opinion of Erste Group Bank AG. • This document does not constute an offer or invitaon to purchase or subscribe for any shares or other securies and neither it nor any part of it shall form the basis of or be relied upon in connecon with any contract or commitment whatsoever. • The informaon contained herein and this presentaon shall not be further disseminated without wrien consent of the author.

2 Agenda

1 Introduction

2 Black Swans impact and Stress testing environment

3 Modeling of Black swans

4 Integration in Risk Management Framework

3 Black Swans: an erupon of financial risks ?

4 Fundamental shis in Risk Landscape are ongoing...

“Known Companies idenfy and plan for in an 1 Risks” effort to avoid or migate them. uncertainty

“Emerging Risks that have come onto radar, but 2 whose full extent and implicaons are Risks” not yet clear.

“Black Events which are highly unlikely to 3 happen but would have severe Swans” consequences if they did.

Thorough understanding and managing of risks puts companies in a better place to pursue their strategy with a confidence that they have the business resilience to manage known risks and respond to the unexpected 5 ….Black Swans - Management exposed to uncertainty ?

Increased speed and Outdated risk Insufficient Protecon impact of risk events mgmt. processes

They feel the risk They are seeing rapid They are spending too frameworks and processes increases in both speed much me and money on that are currently in place with which risk events take running their current risk in their organizaons are place, and the extent to management processes, no longer giving them the which their impacts on the rather than moving quickly level of protecon they business are “contagious”. and flexibly to tackle new need. risks.

Source: PwC

Large organizations may now have blind spots from which high-impact risks could emerge to damage or potentially destroy their business

6 Management awareness of external risks

Awareness of Risk Total impact External risks originate from outside the Crime and terrorism 16,00% corporate organizaon—from disrupons in Internaonal trade and payments 20,70% Geopolical 30,80% geopolical, economic, regulatory, market, Energy and commodity costs / prices 39,30% Disrupve technologies 40,60% technological, or environmental condions. Commercial market shis 54,20% Because these risks arise from outside of the Data privacy and security 56,30% Talent and labor 57,50% organizaon, management teams oen have Financial market 59,90% Regulaons and government policies 62,10% not developed the experse to monitor and Compeon 62,80% manage them effecvely Economic uncertainty 76,30%

% of respondents who selected The worst-managed risks: "very poor" or "neither poor nor well" Geopolical 59,80% Disrupve technologies 57,10% Talent and labor 55,40% Internaonal trade and payments 52,90% Energy and commodity costs / prices 49,30% Crime and terrorism 49,10% Commercial market shis 45,10% Data privacy and security 42,80% Regulaons and government policies 37,70% Compeon 35,90% Financial market 29,50% Source: PwC

7 What are Black Swan events ?

A Black Swan event is characterized by the following:

1. Carries extreme impact: the disproporonate role of high-impact, hard-to-predict, and rare events that are beyond the realm of normal expectaons in history, science, finance and technology

2. An outlier: the non-computability of the probability of the consequenal rare events using scienfic methods (owing to the very nature of small probabilies)

3. Produces explanaons only aer the fact : the psychological biases that make people

individually and collecvely blind to Source: ??? uncertainty and unaware of the massive role of the rare event in historical affairs

8 Recent developments: Are black swans actually turning grey ? Recent experience suggests events that fit the definion of black swans are happening more and more frequently Chronology of black Swan events

9/11: Series of coordinated terrorist aacks by the Islamic terrorist group al-Qaeda on the United States on the morning of Tuesday, September 11, 2001 (damaged: at least $10 billion in property, $3 trillion in total costs)

Fukushima Daiichi nuclear disaster was an energy accident at the Fukushima I Nuclear Power Plant in Fukushima, iniated primarily by the tsunami following the Tōhoku earthquake on 11 March 2011 Number of events

The dot-com bubble was a historic speculave bubble covering roughly 1995–2001 during which stock markets in industrialized naons saw their equity value rise rapidly from growth in the Internet sector and related fields

1900 2000 2015 2025 Are they now just part of a faster-changing and more uncertain world ?

9 Conclusion: increasing number of Black Swans to impact financial sector

§ The structure of the world is fundamentally different that it was 20 years ago.

§ Contribung factors: o increased interconnectedness & complexity o huge debt leverage o hyper-efficiency (just-in-me supply chains) o lack of redundancy etc…

We must build more resilient systems that are better able to withstand the shocks of Black Swan events because it appears they are going to keep coming at an increased pace

10 Was Brexit a Black Swan as well ?

11 … Brexit does indeed make the cut as a black swan

1. It was a surprise, or a “stascal outlier” “No country has ever le the European Union… and no opinion poll or beng market suggested it was possible. So the financial markets assumed a UK vote to leave to be impossible”

2. Must have an extreme impact

“the impact was definitely outsized. No one knew at the me – or knows now – what the full impact of Brexit will be once all is said and done”

3. … and despite it being unpredictable, once it’s happened we spin a story that makes it seem completely predictable in hindsight

“Aer the fact it became “obvious” that Brexit would happen because of the dissasfacon of older, blue-collar Brish voters, the rise of Donald Trump in America or any number of other reasons”

12 Agenda

1 Introduction

2 Black Swans impact and Stress testing environment

3 Modeling of Black swans

4 Integration in Risk Management Framework

13 Impact of the past events on Financial Markets (Equity) 1D 1W 1M 1Y 0% Dot.com bubble

-5% Nasdaq

-10% Dow Jones

-15% FTSE

-20% DAX

-25% Nikkei -30%

-35%

1D 1W 1M 1Y 09/11 0% Nasdaq -5% -10% Dow Jones -15% FTSE -20% DAX -25% Nikkei -30% -35%

1D 1W 1M 1Y Fukushima 10% Nasdaq 5% Dow Jones 0% FTSE -5%

-10% DAX

-15% Nikkei

-20% 14 Impact of the past events on Financial Markets (Credit Spreads)

1D 1M 3M 20 DE5Y BREXIT 15 GB5Y 10 US5Y 5 AT5Y - FR5Y (5) (10) ES5Y (15) IT5Y (20) Banks EUR A

(25) Banks USD A (30)

1D 1M 3M 60 DE5Y Fukushima

GB5Y 40 US5Y

20 AT5Y

FR5Y - ES5Y

(20) IT5Y

Banks EUR A (40) Banks USD A (60)

15 Type of stress test: selected examples

Stress Tests Corresponding Material Risks Scenario Standard

Encompasses all risk areas, such as adverse market events, Enterprise-Wide Stress Tests CP defaults, technology failure, operaonal events, ~150 bp - 250 bp on CET 1 Rao (EST) operaonal error/ligaon Ideosyncrac Stress Tests Idenfies enty- or LOB-specific vulnerabilies ~100 bp - 150 bp on CET 1 Rao Fulfills Fed/DFAST requirements to withstand stressed Comprehensive Capital economic environment and obtain approval for capital ~300 bp on CET 1 Rao Analysis & Review (CCAR) acons; leverages EST & RST Reverse Stress Tests (RST) Idenfies scenarios that could "break the bank" >400 bp on CET 1 Rao Recovery Stress Tests

Liquidity Stress Tesng Assesses liquidity posion aer deposit-run off % of LCR, SPA, etc. Technology Risk Table Top Explores emerging threats, such as cyber aacks wide range or outcomes Exercises Develops conngency plans for high-risk, high Playbook / Simulaons focus on migang acon probability scenarios

Whilst regulatory compliance is challenging, financial institutions should leverage the stress testing exercises to build long-term value, rather than treating it like a check-the-box exercise

16 Do regulators overshoot in scenario seng? Or cover so Black Swans as well ?

EBA Stress Test 2016 – 3Y horizon Swedbank - group Jyske Bank Nykredit Realkredit NORD/LB Norddeutsche Landesbank Groupe BPCE N.V. Bank Nederlandse Gemeenten Raiffeisen-Landesbanken-Holding GmbH Coöperaeve Centrale Raiffeisen- Banca Monte dei Paschi di Siena SpA BFA Tenedora De Acciones S.A. Skandinaviska Enskilda Banken - group Bank of Ireland DNB ASA OTP Bank Nyrt. UniCredit SpA Nordea Bank - group Banco de Sabadell SA Banco Santander SA Société Générale SA BNP Paribas SA Svenska Handelsbanken - group La Banque Postale Lloyds Banking Group Plc Bayerische Landesbank Danske Bank Crédit Mutuel Group NRW.BANK Düsseldorf Banco Popolare Società Cooperava The Royal Bank of Scotland Group Public Limited LandesbankHessen-Thüringen Girozentrale Landesbank Baden-Würemberg Unione di Banche Italiane SCpA VW Financial Services AG Barclays Plc Crédit Agricole Group Banco Popular Español SA Belfius Banque SA Banco Bilbao Vizcaya Argentaria SA OP-Pohjola Group HSBC Holdings Plc ABN AMRO Groep N.V. ING Groep N.V. Powszechna Kasa Oszczednosci Bank Polski SA Deka Bank Deutsche Girozentrale Erste Group Bank AG Intesa Sanpaolo SpA Allied Irish Banks Plc Commerzbank AG Deutsche Bank AG KBC Group NV Criteria Caixa Holding S.A. 0

-500

-1000 ∆ CET 1 Rao 2018 (bps) - Adverse Scenario

-1500

Source: ECB/EBA Website

17 Black Swans qualify for various types of stress tesng

§ In order to capture the impact of so-called unexpected events, stress tesng could be 1. Does it carry an extreme impact ? replaced by reverse stress tesng or extreme scenario stress tests

2. Is it an outlier ? § The black swan stress tesng should be seen as being part of a wider risk management framework like a tail risk management that would also involve risk 3. Does it produce hindsight explanaons ? mapping, early warning system, scenario planning and financial conngency planning

Stress tests can’t guarantee against any black swan event in the future, but they do improve visibility and transparency. They create capital constraints and a somewhat healthy discourse between risk management, the capital planning function and the broader bank, whether it’s for trading or investment banking, across global operations

18 Agenda

1 Introduction

2 Black Swans impact and Stress testing environment

3 Modeling of Black swans

4 Integration in Risk Management Framework

19 Black Swans: How to measure and manage?

20 Future Black Swan Events (Selecon) Economic § Liquidity of EU § 3rd world war iniated by financial crises § Tax crisis (e.g. evasion pracces) § Private real estate sector crash § Scotland & North Ireland leave Commonwealth /UK (grey swan = foreseeable but impact and consequence unknown)

NFR – cyberaacks § Cyber compromise (e.g. global computer virus) § Blackout

Natural events / Scenarios CHINA § More terrorist aacks § New war scenarios (e.g. Africa like a “naon emigraon”, SE China Sea) § Meteor strike § Nuclear war § Earthquake

Problem: Real impact ? Unforeseeable and difficult to model?

21 Black Swan events clustering Black Swan Event Type Reach Impact Esmate

Liquidity of EU Economic Global High 3rd world war iniated by financial crises Economic Global High Tax crisis (e.g. missing tax) Economic Global Medium Private real estate sector crash Economic Global Medium Scotland & North Ireland leave Economic Regional / Medium Commonwealth /UK Naonal Cyber compromise (e.g. global computer virus) NFR - Cyber aacks Regional / Medium – polical or economical targets Naonal “Blackout” NFR - Cyber aacks Global High

More terrorist aacks Polical events Global / Medium Regional Nuclear war Polical events Global / Medium Regional New war scenarios (e.g. Africa “naon Natural events Global / Medium emigraon”, SE China Sea Conflict) Regional Meteor Strike Natural events Global / High Regional Earthquake Natural events Global / High Regional 22 Future Black Swan Events: Examples from industry

Source: Societe Generale Cross Asset Research, Quarterly Black Swan Chart September 2016

23 Heatmap of Black Swans

Terrorist aacks EU Dissoluon Cyber aack SE Asia Pandemic Military Conflict Earthquake

Global impact Regional Impact 24 Heatmap of Black Swans

Impact

High Cyber aack EU Dissoluon

Pandemic Terrorist aacks Medium SE Asia Military Conflict Earthquake

Low

Less uncertain Uncertain Very uncertain Probability

25 Agenda

1 Introduction

2 Black Swans impact and Stress testing environment

3 Modeling of Black swans

4 Integration in Risk Management Framework

26 Risk governance and tools aligned to foster risk-return steering Risk–return to drive business strategies and investment decisions

Governance Limit system Reporng

• Approved by: Group Risk Mgt and Core metrics Appete Supervisory (Actuals & Statement Boards (Risk Stress) Commiee)

• Approved by: validaon Management Supporng Strategic Oversight Group Risk and Supervisory metrics & Strategy Boards strategic

limits Group Risk Report (quarterly) Stress tesng as a steering input &

Limit • Cross divisional Monitoring management commiees and metrics & & risk risk management operave

decisions funcons limits reports Specific risk Operaonal Single porolio / risk stress tests

27 Group-wide governance as basis for stress tesng processes

STANDARD AD HOC RECOVERY AND INTERNAL / REGULATORY REGULATORY ST RESOLUTION PLANNING

§ SENSITIVITIES § EBA ST § RECOVERY PLAN

§ COMPREHENSIVE ST § RESOLUTION PLAN

§ REVERSE ST

I. RESPONSI- BILITY

I. Responsibility ð Board of Directors

V. II. INTEGRA- II. Integration ð Risk Management Process FLEXIBILITY TION STRESS TEST III. Support ð Strategic Decisions GOVERNANCE PRINCIPLES IV. Internal Policies ð Implementation of ST Program

V. Flexibility ð Changing External Conditions

IV. III. INTERNAL SUPPORT POLICIES

Black swan stress testing also to be integrated in Risk Management Framework

28 Embedding stress tesng in different areas of strategic risk management… also for Black Swan events

Define stress scenario

§ Idenfy vulnerabilies § Assess weaknesses § Discussion across group

Strengthen capital Adjust risk profile management § Efficient capital allocaon § Ability to withstand and adequate buffers severe stress scenarios § Focus on risk-return (EVA) § Focus on risk-steering

Adjust strategy Apply simulaon § Basis for capital adequacy § On-going cycle § Foundaon for risk § Monitor warning signals targets § Detect deterioraons § Influencing budget cycle

Seng limits

§ Risk Appete Statement § Risk limits (per type, industry, desk, etc.)

29 Risk-return decisions embedded into Group RAS and Risk Strategy

Managing Compeng Interests Managing Different Interests Holding Supervisory Regulator Regulatory Risk Board Board EBA/ ECB /FMA

Risk Appete Statement Investors Financial Risk Customers Reputaon / Service Risk Strategy ROE / ROI

Legal Risk Reputaonal Risk Compliance Risk IT Risk Fraud Risk etc.

„There is no rule book for this and it can only be guaranteed by managers and employees who understand that a „yes“ or „no“ must always be in the best interest of our customers whilst at the same time must never violate the interest of our Group“

30 Risk Appete represenng strategic guidance… … and providing effecve defense against excessive risk-taking

Group Risk Appetite Statement RAG Governance Requirements 1 Core metrics unified to provide top-down direction for overall steering - Monitoring and reporng regularly Trigger levels established across core Normal Performance to local Management Board in 2 aligned with Regular ongoing monitoring local risk reports metrics (Green) targets (RAG) - Regular reporng to Group ERM 3 Enable immediate escalation and timely response to adverse developments Inform Group ERM asap; provide Embedding into existing governance Designated detailed analysis, remediaon Trigger Breach Detailed commiee to

4 and daily operations to drive decision Local plan with measures and Business goals analysis and decide if potenal impacts making at all levels of organization Warning and management management Core metrics actively monitored via (Amber) shareholders’ discussion acons are Group ERM to decide on 5 expectaons at with potenal necessary and regular (quarterly) Group Risk Report remediaon plan jointly with risk acon Mgt. Board to local mgt. and inform relevant Group approve governance 6 Set as input into annual strategic/ budgeting process Linked to Group Recovery Plan, where Designated Instant mgt. acons required to 7 Limit Breach commiee to be put in effect as outlined in the relevant (red level trigger = recovery Instant Potenal cap/ inform Mgt. Local remediaon plan; regular management indicator) Crisis liq adequacy Board, propose updates to relevant governance acon plan endanger and necessary • Group ERM to approve the remediaon plan and (Red) required to be Relevant core metrics also stressed as regulatory management 8 put in effect Group ERM to inform Group CRO monitor its progress part of regular extreme stress testing limits at risk acons and Mgt. or Holidng Board, as necessary framework to provide early warning and Board to approve Group • Group ERM to align & escalate with relevant support proactive management of risk and Group stakeholders if needed capital profile 9 Link to remuneration to enforce alignment with long-term strategic targets (in process)

31 Integraon in RM Strategy, Risk Appete and Risk Culture Three steps to improve investment decisions: 1) Arculang the risk appete of the instuons 2) Translang risk appete into risk limits 3) Designing investment policies that are aligned with risk appete and risk limits

Source: McKinsey & Company 32 Conclusion

§ Ultimately, it doesn’t really matter whether today’s new risks are still „risks‟ in the traditional sense

§ What matters is the growing size, unpredictability and variety of the threats to organizations and their stakeholders

§ In our view, businesses need to respond to these changes by identifying and adopting new, more holistic and more agile approaches to managing risk and uncertainty

“There are so many errors we can no longer predict, what you can predict is the effect of the error on you ! “ Nassim Nicholas Taleb

33 Can we prevent the crisis ?

=> only if shield fits to the outburst

34