International In-house Counsel Journal Vol. 1, No. 1, June 2007, 43–49 The definition of legal risk and its management by central banks KATJA JULIE WU¨ RTZ Principal Legal Counsel at the European Central Bank, Frankfurt, Germany1 Currently, there are no international rules specific to central banks on what is to be understood by ‘legal risk’ and how it should be managed. In the context of the discussion on Basel II (the International Convergence of Capital Measurement and Capital Standards), it was considered that assessing, monitoring and mitigating legal risk may positively affect the way in which financial institutions conduct business. Basel II was transposed into Community legislation by means of the Recast Banking Directive2 and the Recast Capital Adequacy Directive3 which do not define the concept of legal risk but instead include it under the wider definition of operational risk. The concept of legal risk as applied by central banks may have some common ground with the concept as applied to credit institutions. However, when managing legal risk, the fundamental differences between central banks and credit institutions in terms of functions, risk profile, etc. and the roles of central banks as public entities and the risk of reputational loss related to their tasks need to be taken into account. Nonetheless, some elements of managing legal risk may be common to both central banks and credit institutions, depending on the special characteristics of the institution in question. Introduction In the aftermath of the corporate scandals of recent years, increased focus has been given to the importance of financial institutions’ legal risk management as part of their overall risk management. In this respect, the Recast Banking Directive which implements the Basel II accord implies that institutions must also dedicate resources to identifying and managing legal risks. More specifically, the Recast Banking Directive includes legal risk in the wider definition of operational risk4. Generally, establishing comprehensive and workable standards to assess and consequently mitigate legal risk in the financial markets is likely to have a positive effect on the conduct of the business of financial institutions. In particular, the soundness and the reliability of the operations of credit institutions will benefit from 1 The author works in the Legal Services Directorate General of the European Central Bank (ECB) and can be contacted by e-mail at: [email protected]. The opinions expressed in this article are those of the author and do not necessarily express the views of the ECB. 2 Directive 2006/48/EC of the European Parliament and of the Council of 14 June 2006 relating to the taking up and pursuit of the business of credit institutions (recast), (OJ L 177, 30.6.2006, p. 1). 3 Directive 2006/49/EC of the European Parliament and of the Council of 14 June 2006 on the capital adequacy of investment firms and credit institutions (recast) (OJ L 177, 30.6.2006, p. 201). 4 Article 4 defines ‘operational risk’ as ‘the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events, and includes legal risk’. International In-house Counsel Journal ISSN 1754-0607 print/ISSN 1754-0607 online 44 the implementation of such measures5. In this context, it is of particular interest that euro area credit institutions are as a rule eligible counterparties for Eurosystem operations6. Thus, standards for appropriate identification and mitigation of legal risk also have a bearing on the operational framework of the ECB and the central banks of the Member States which together constitute the European System of Central Banks (ESCB). However, the Recast Banking Directive does not apply to the ESCB7. When addressing the question of legal risk in relation to the ESCB, certain special characteristics should be taken into account as the central banks are public bodies governed by primary Community legislation and, in the case of the national central banks (NCB), by the laws of the Member States for non-ESCB related matters. More specifically, the ESCB’s primary objective is to maintain price stability in accordance with Article 105(1) of the Treaty establishing the European Communities. Without prejudice to this primary objective, the ESCB must support the general economic policies in the Community with a view to contributing to the achievement of the objectives of the Community. Moreover, the ESCB must act in accordance with the principle of an open market economy with free competition, favouring an efficient allocation of resources. In addition, Article 105(2) of the EC Treaty lays down the basic tasks to be carried out through the ESCB which are (i) to define and implement the monetary policy of the Community, (ii) to conduct foreign-exchange operations, (iii) to hold and manage the official foreign reserves of the Member States, and (iv) to promote the smooth operation of payment systems. Another difference between the members of the ESCB and the investment firms and credit institutions which are covered by the Recast Banking Directive, is that in achieving their objectives and carrying out their tasks, central banks have to follow a strictly conservative approach in the sense that their credit operations have to be based on adequate collateral8. Finally, it should be recalled that the ECB has regulatory competence9 and is subject to specific confidentiality requirements10. In view of the above non-exhaustive list of special characteristics, it is clear that although central banks are also players in the financial markets, their objectives, tasks and risk profiles differ considerably from those of other market players. Although there is clearly increasing awareness of legal risk in the central banking community, it is also worth bearing in mind that reputational risk, which does not seem to be covered by the general concept of legal risk (see below), is a very important risk factor for central banks, since it relates to their credibility and thus 5 According to Article 157 of the Recast Banking Directive, the Directive had to be implemented in the laws of the Member States by 31 December 2006 and applicable as from 1 January 2007. However, according to Article 157(3), the Member States may not apply the laws, regulations and administrative provisions necessary for the use of the Advanced Measurement Approach before 1 January 2008. 6 All supervised credit institutions, as defined in Article 4(1) of the Recast Banking Directive, which are established in the EEA, are admitted as participants in the Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET), from 19 November 2007 onwards replaced by TARGET2, which is a real-time gross settlement system (RTGS) for payments in euro. The RTGS systems of Member States that have not adopted the euro are allowed to connect to TARGET, if they conclude an agreement with the ECB and the national central banks of the Member States that have adopted the euro. 7 The first indent of Article 2 exempts ‘central banks of Member States’ from the scope of application of the Recast Banking Directive and Article 4(23) defines the term ‘central banks’ (as opposed to ‘central banks of Member States’) as including the ECB unless otherwise indicated. 8 See Article 18 of the Statute of the European System of Central Banks and of the European Central Bank (‘the ESCB Statute’). 9 See Article 110 of the EC Treaty and Article 34 of the ESCB Statute. 10 See Article 38 of the ESCB Statute. 45 their perceived ability to ensure price stability and market confidence in general11. For this reason the adaptation of the definition and the application of the concept of legal risk to central banks involves some fundamental differences from investment firms and credit institutions, which should be taken into account. Definition of legal risk Neither the Recast Banking Directive nor the underlying Basel II documentation contain any detailed definition of legal risk. However, Basel II does provide some guidance since it states that operational risk includes ‘legal risk, but excludes strategic and reputational risk’12. Moreover, it is stated that ‘legal risk includes, but is not limited to, exposures to fines, penalties or punitive damages resulting from supervisory actions, as well as private settlements’13. However, as noted above, the Recast Banking Directive does not contain any definition but only refers to legal risk as being covered by the overall concept of operational risk. In various publications practitioners have highlighted the main elements that could be classified under the heading of legal risk. However, this has mainly been by focusing on specific aspects but without approaching the issue systematically14. The European Financial Market Lawyers Group (EFMLG) hosted by the ECB and the Financial Market Lawyers Group (FMGL) hosted by the Federal Reserve Bank of New York have undertaken some initiatives in this area, though without any conclusive results so far. Also the International Bar Association’s (IBA) sub- committee ‘E 8’ (on law reform) has embarked on analysing and making suggestions on the elements of legal risk in a somewhat more systematic way15. This is an exercise which is still ongoing. 11 See also Roger McCormick, Legal Risk in the Financial Markets, Oxford University Press, 2006, pp. 117-118. 12 See paragraph 644 of the report of the Basel Committee on Banking Supervision ‘International Convergence of Capital Measurement and Capital Standards, A revised Framework’, June 2004. 13 See footnote 90 to paragraph 644 of the report of the Basel Committee on Banking Supervision ‘International Convergence of Capital Measurement and Capital Standards, A revised Framework’, June 2004. 14 See, e.g., Andrew Whittaker, ‘Lawyers as Risk Managers’ in JIBFL (2003) 5; Schuyler K. Henderson, Henderson on Derivatives, in particular Chapter 10 ‘Legal risk: the law, certainty and derivatives’; and Christos Hadjiemmanuil, ‘Legal risks and fraud: capital charges, control and insurance’ in Carol Alexander (ed.) Operational Risk: Regulation, Analysis and Management, 2003, pp.