Knowledge sharing
Available posts
Rules regarding suitability assessment of management bodies in financial companies
During the summer 2023, the Swedish FSA introduced new rules regarding suitability of owners and management bodies in financial companies. Rules regarding suitability assessment of the management bodies in banks and other financial companies has been a part of the framework for a long time already, but the new regulation updates and adapt the rules to applicable laws and corresponding framework om EU level.

Do you need guidance and information regarding the demands and the expectation level from law makers and supervisory authorities?

I am now offering a walkthrough with your management body regarding these rules and how you adequately manage these questions internally.

As a complement to such briefing, I can also conduct an analysis, judgement and potential adjustment of your internal steering documents in the area.

I am also offering an actual realisation of such suitability assessment of your management bodies, whenever such need emerges, and then with particular focus on the collective competence of the management body.

If you need such support or need more information, you can reach me through a message here at the webpage or give me a call on my cell phone.
Governance arrangements and risk management
The “governance” notion has during the last decade become one of the most used terms in the banking industry and in many different contexts. But what is actually corporate governance or risk governance in reality?

In a speech by Pablo Hernández de Cos (Chair of the Basel Committee on Banking Supervision and Governor of the Bank of Spain) regarding reflections on the 2023 banking turmoil, he expressed among other things that “…one of the main lessons from the turmoil is the importance of banks risk management and governance arrangements as the first and most important source of financial and operational resilience”. I couldn´t agree more.

But what is actually corporate governance or risk governance in reality?

I would claim that governance in this perspective is a model or a way of steering the operations in an efficient and effective manner by using, in addition to an adequate organisational structure, a combination of three different methods. These methods are (i) steering by values and principles, (ii) steering by objectives or targets and (iii) direct steering. None of them can alone steer a business effectively, they have to be combined in a balanced manner.

Steering by values and principles

A service company normally build its operation on the power of independent co-workers, but at the same time, the acting of the employees needs to be in line with the intentions of the company. That’s why there is a need of a steering tool in the form of established values and principles, working as a leading star for each and everyone in the day-to-day operation and serves a basis for understanding and application of strategies, targets and instructions.

As important as the values and principles in itself, is to ensure that these values are properly implemented in the organisation. Basically, it is about establish and maintain a corporate culture.

Steering by objectives and targets

In addition to values and principles, there is a need for a method which stimulates the achievement of the company’s ambitions. That´s why there is a need for objectives and targets. Steering by objectives and targets means that the company create a strategy, establishing what, why and how, as well as measurable targets, which will serve as engine and guide for the operations. The targets also enable the bank to monitor that the business achieve what the effects and the goals.

Direct steering

Alongside the values and the targets there is also a need to have concrete rules, which regulates who is responsible for what, what and how things should be done, who has the authority to act and other rules on how the operations should be run and how follow up and control should be handled.

Direct steering can be exercised in several ways. Primarily it consists of internal rules and guidelines, which serves as clear conditions for the individual co-worker and the whole operation. Direct steering can also consist of individual concrete decisions and direct orders.

It deserves to emphasise that rules and guidelines are primarily used to handle internal needs of a clear playing field. This leads to the fact that the bank ought to limit the number of rules to what can be seen as appropriate in the actual case, avoid complexity and not regulate areas that does not need to be regulated. There are of course also external expectations (from e.g. supervisory authorities) that needs to be considered. But it is also important to understand that the rules themselves are not the key, it is only when the rules are understood and applied the purpose of the rules can be achieved.
Impending housing crisis?
According to new statistics from the Swedish Statistic Authority new housing construction has decreased abruptly. The number of new-started housing constructions declined with 50 percent during Q1 2023 in comparison to the same period last year. This is unfortunately a natural effect of the current gloomier business-cycle.

In 2021 nearly 70.000 homes were built in Sweden. According to the Swedish Construction Federation this number will fall down to 25.000 this year and according to Boverket (the Swedish National Board of Housing, Building and Planning) the number will be proxy 30.000. In a report in June 2022, Boverket estimated that there ought to be around 63.000 homes built every year until 2030 to correspond to the population growth and pent-up demand. This means that we will not be able to manage the demand with this new-built frequency.

A low number of new housing constructions will unfortunately also cause several other negative consequences.

- Investments in building is an important engine for the economy. When the new housing construction slow down it will affect the growth and business-cycle negatively.
- With less working opportunities in the construction industry, there is a risk that construction workers move to other industries and sectors. So when the business-cycle turn into a positive trend again, there will be a shortage of working labour in the industry. This happened during the Swedish crisis in the 1990s.
- When the supply does not correspond to the demands, the simple economic consequence will be higher prices, which in turn means that byers have to borrow more and the total debt situation increases.
- Decreased supply and increasing prices will also raise the bar for young first-time buyers.
- The necessity of workforce migration to bigger cities (where the jobs are) will slow down due to lack of residences.
- New housing constructions is also a part of the green transition. Heavily declined building will also have negative effects in this perspective.

The negative effects of this trend cannot be underestimated. It is therefore time for the Swedish government to take relevant actions.
What is governance and internal control?
The external demands on banks and similar companies have increased substantially during the last years. But how do you secure common understanding of the external expectation and a logical and adequate implementation among the co-workers? Well, you need to start with increased awareness among the management bodies.

During the recent years the external expectations on banks and other financial companies regarding governance and internal control has been clarified and enhanced and a number of regulations and guidelines has been launched both on EU-level and on national level. This requires a more accurate internal framework and relevant implementation, but also increased awareness and understanding within the management bodies.

But really, what is internal governance and control?

I now offer a walkthrough for management bodies, where I will give you answer on the following questions.

- What principles are applicable for governance and internal control?
- How does the expectation level from the authorities look like?
- What does comply or explain actually means?
- Why does the bank need an internal framework?
- Who decides upon the content of the internal framework?
- How do you secure a relevant implementation for the co-workers?
- How does the role and responsibility look like for the management bodies?

I have long-standing knowledge and experience from working with governance issues, internal control and framework development within the banking industry. I have also during many years worked with interpretation and application of external framework and during that period have had continuous dialogue with supervisory authorities and other regulators.

If you are interested in such a lecture or have questions about it, you are welcome to contact us.
Time to enhance the sustainability topic in the banking industry
Sustainability is one of the most essential themes of our time and forms a new era in our society. Banks and other financial players are seen as a crucial factor to finance and realise the transformation to a sustainable economy. The transition is however not going fast enough. It is time for the financial industry to put themselves as frontrunner and actually make a difference. But they need support from the policymakers.

The sustainability topic is more important than ever in the global community and the expectation on the financial system to be a lever to accelerate the transition into a low-fossil and more sustainable society has increased. This new role for the banking industry means that a bank needs to be run in a sustainable way, but even more important and with more impact, banks need to guide the customers to make smart and sustainable choices.

Just before Christmas 2022, EBA released EBA roadmap on ESG risks and sustainable finance. In this document EBA emphasize that “the financial sector has an important role to play, both in terms of financing the transition towards a low-carbon, more resource efficient and sustainable economy and for managing financial risks stemming from ESG factors”. Also other regulators and supervisory authorities has stressed that banks should play an active role in the transformation into a more sustainable society.

So far, the regulators have put most effort in establishing an EU-wide classification system (Taxonomy Regulation) and disclosure principles (Sustainable Finance Disclosure Regulation). This is of course important steps, but even more important is to create incentives to actually achieve something. EU regulators and supervisors need to find ways to facilitate for the financial industry to be this enabler of the transition.

The financial players need to strengthen the integration of sustainability factors, such as environmental, social and ethical aspects, into their policies, processes and decisions, regardless of whether we talk about financing, investments or other types of transactions. Banks also need to become better in promoting more sustainable corporates.

It is clear that the most significant impact on the society development comes from facilitating and enabling the bank customers to make sustainable decisions. The banks need to innovate new and improved ways of meeting the customer needs and the expectations from the society, such as clear green lending strategies and ethical funds. This also means that environmental considerations, social responsibility and business ethics ought to become even more in focus than before when making the analysis of the customers risks and opportunities as well as in the monitoring of the customer. Another important dimension for the banks to observe in this is the reputational risk, i.e. how can the brand and the trust in a bank be affected if doing business with corporates performing unethical activities or other forms of unsustainable operations.

Thus, it is probably fair to say that taken care of sustainability aspects in a prudent manner will be a success factor for any bank going forward.
Big tech business model as a risk factor
Is it time to talk about a potential elephant in the room?

The tech industry and especially the Big tech companies have during the latest years obtained bigger and bigger importance in the financial market. The Big techs specific business model include large and complex structures of interconnected companies and operations which are offering both financial services and non-financial commercial activities. In the current economic situation with a recession, we ought to ask ourselves whether this phenomenon creates new risk aspects in the financial sector which run the risk to deepen or extend the recession.

During October, Bank for international settlements (BIS) published a FSI Occasional paper, “Big tech regulation: in search of a new framework” (The Paper). The Paper was written by Johannes Ehrentraud, Jamie Lloyd Evans, Amelie Monteil and Fernando Restoy. In the beginning of The Paper, BIS stress that the views expressed in The Paper are solely those of the authors and do not necessarily reflect those of the BIS or the Basel-based standard-setting bodies.

New technology and new regulations have had positive influence and been the main change drivers of the financial market and customer behaviour the latest decade. The financial technology has transformed the business models of financial service providers and a number of new players has entered into the financial industry. In general this has gained the market development and increased customer satisfaction. But this has also created new risk factors.

This is also the theme in The Paper and the authors state, inter alia, that; “Big tech business models entail complex interdependences between commercial and financial activities and can lead to an excessive concentration in the provision of both financial services to the public and technology services to financial institutions; consequently, big techs could pose a threat to financial stability in some situations.”

They continue by saying; “The challenges that this specific business model pose for society cannot be fully addressed by the current (mostly sectoral) regulatory requirements” Thus, according to the authors of The Paper, there are shortcomings in the regulatory structure to tackle the additional risks which are arisen through these aspects. I tend to agree to this conclusion. The regulatory development has to some extent not kept pace with the changing market environment, i.e. the needed mitigating rules are not there yet.

According to The Economist; “Crunchbase, a data provider, estimates that American tech firms have already shed more than 45,000 jobs this year” The Economist also state that, “Alphabet, Amazon, Apple and Microsoft have collectively lost $2trn in market value over the past 12 months” And according to Forbes, the stock value of Meta Platform is for the year down more than 71% and is no longer in the top 30 largest companies.

But as the authors of The Paper say; “… most of the above risks are not strictly related to the financial soundness of big techs but often with their business models – in particular internal and external interdependencies – and with their conduct of business” As been pointed out by the authors of The Paper, dependency by financial institutions on third-party providers generates additional operational risks and this risk accelerate when the concentration of some of those services is offered by a relatively small set of (big tech) providers.

As been recognised by many we are currently facing a new economic reality, with high inflation, increased interest rates etc. It is probably a good idea to start asking ourselves whether the large interconnection between financial services and non-financial commercial activities in many tech companies in combination with the high linkage to the incumbent banks and other financial institutions might run the risk of worsening the situation.

The tech companies for sure increase competition in financial industry, increase the range of services for the customers and enable traditional banks to improve their business model. But the unique business model of the big tech groups with a wide range of interlinked financial services and non-financial activities will also amplify the operational risk in the financial market and the financial system and by that potentially become an additional risk factor for the financial stability in the current macro-economic situation.
Has there been too much focus on NPLs and default definition?
In the aftermath of the latest recession in 2009-2010, there has been a huge focus from regulators and supervisory authorities regarding identification, management and reporting of non-performing loans, forbearance, default exposures and interconnected measures and topics. During the period 2016-2021 there has been a number of established enhanced regulations and guidelines in these areas.

And don’t get me wrong, these are really important areas to put effort in. Despite the fact that it is more than a decade since the latest financial crisis, non-performing loans is still an important problem in several European countries. ECB also declared as late as this summer that high stock of non-performing loans (NPLs) remains one of the key risks facing euro area banks (ECB Occasional Paper Series No 297 / June 2022).

The interconnection between NPLs, the banking industry performance and the overall macro-economic situation is clear. Therefore, the importance of adopting prudential policies that address the problem of non-performing loans etc. is very much understandable and logical. But is it a bit one-eyed?

Today, potentially entering a new recession, we have to ask ourselves if this has been the best strategy. Putting too much focus on debtors already having financial difficulties run the risk of becoming a reactive approach. Isn’t monitoring and follow-up on the bank’s borrowers primarily about avoidance of economic distress and future defaults, i.e. actively identify and act upon signs of worsening economic situations of certain borrowers, without them (yet) facing financial difficulties. Using huge effort in implementation of new systems and processes for e.g. unlikeliness-to-pay assessment, default identification and attached reporting requirements, might have forced the banks to decrease the pro-active parts of their credit risk management.

Introduction


The latest financial crisis negatively affected the European banking sector and contributed to a build-up of non-performing loans (NPLs) among the banks. There was probably a peak around 2013-2014, but the high level of NPLs remained a problem in some European countries(and also globally).  Regulators and supervisory authorities then put joint efforts in finding ways to deleverage NPLs in banking sector. For example, European Council established an action plan in 2017, ECB introduced NPL guidelines the same year which was further developed in 2018 and 2019. EBA on their side established in 2016 Guidelines on the application of the definition of default (which came into effect 2021) and in 2018, Guidelines on management of non-performing and forborne exposures. Local authorities also developed various rules and guidelines in the same fields. The demands and expectations that were constituted by these regulations and policies also included new or enhanced reporting structures. All of this led to the need of huge investments in IT-systems and efforts in development of adapted processes for the banks. A lot of focus in the banks the recent years has therefore been put on implementation of all these enhanced demands and expectations from the regulators and supervisory authorities.

Credit risk management


In simplified words you might say that the credit risk management process is divided into three phases.

Phase 1 is the analysis and decision phase. It starts with some form of credit application from the potential borrower and continue with credit risk assessment and the analysis of the ability and willingness of the customer to repay the credit. It all ends up in a credit decision made by an empowered decision-making body within the bank. If the decision is positive the amount will be disbursed to the borrower. External regulations, standards and guidelines regarding this process or these stages is quite detailed and specific.

Phase 2 is the continuous monitoring and periodic credit reviews of the performing borrowers. The purpose of this phase is to make sure that the risk level accepted in the credit decision is fairly unchanged, i.e. the economic situation and/or the value of the collateral has not declined. This means that the bank also has to pay attention on any signs showing risk for future financial difficulties or other forms of economic distress. Such signs could be related to a particular borrower or a certain borrower type. These borrowers are still performing but the bank ought to take actions to avoid further decline and by that support the borrower in not getting into a non-performing/default situation. External regulations, standards and guidelines regarding this process is a bit more rudimentary and basic, i.e. not that detailed or specific.

Phase 3 is the management of non-performing borrower, i.e. collection processes, forbearance measures, company restructuring, monitoring and reporting of non-performing and defaulted borrowers etc. This is probably the most regulated phase and also connected to a number of reporting requirements. During the last five-year period, this phase has been in focus from the regulators and supervisory authorities and the expectation level on the banks has increased significantly.

Reflections and conclusions


There is an evident interconnection between the well-being of the banking industry and the macro-economic situation on one hand and the level of NPLs on the other. So it is fully understandable that attention and actions from the authorities has been focused on bad debts and defaulted borrowers. Also, the economic implications of the Covid-19 pandemic have probably to some extent undermined the result of the overall NPL deleveraging strategy. Therefore the authorities have continued to put focus and regulatory demands on this area, all with the purpose of maintaining financial stability.

NPL etc. is for sure an important area with a number of negative implications if it’s not taken care of prudently. My worries are rather on the fact that all the enhanced requirements and unilateral attention in this part of credit risk management - which has triggered a huge need for IT- and process development in the banks and by that a lot of effort and competence tied up in these implementations - might have resulted in decreased attention on phase 2 above. If sufficient resources, effort and competence is put on phase 2, the bank will automatically decrease the risk of building up NPLs and by that being as important as phase 3. It will have to be seen if this a bit one-sided attention of NPL and related topics will affect the outcome and the depth of the next recession, which is currently knocking on our doors.
How to write a credit memo

Summary


Length - 1 day

Price - 5 700 SEK + VAT per head. Travelling costs will be added

Date - As agreed. Minimum five (5) participants per occasion

Location - At your office

Form - IRL - Physical meeting with lecture, discussions and examples'

Educator - Leif Nyberg, Prudent Banking Advisory AB

Content


Better and more evident description


A question that many banks are struggling with is how to improve the quality in credit memos and basis for credit decisions and by that decrease unnecessary credit risks.

The purpose of this education is to guide credit memo writers in how to achieve better and more evident basis for credit decisions and clarifying documentation of the reasons and motives for a specific credit origination.   

You will as participant in this seminar get insight in which method that is the most efficient and useful documentation of the credit assessment that has been made in the specific case. The writer of a credit memo needs to secure that the case is analysed and judged adequately and sufficiently and that relevant motives for the decision is documented in the memo.

Theory and practise in writing a credit memo


You will as participant understand how to write, to whom you write and why you write and by that contribute to increasing the overall quality in the bank’s documentation of credit assessment and credit decisions. By insight in these dimensions you will become faster and more comfort in your business and risk analysis as well as more skilled in capturing relevant aspects in the case.

We will walk-through theory and practise in how to capture the credit assessment and its documentation, including discussions and real cases. We will use some of your own credit memos as examples to achieve a sense of reality.

Goal

After the education you will know and comprehend the opportunities to, as far as possible, ensure a relevant credit memo and understand pros and cons with different ways of structuring the memo. You will be able to do the right thing from the start and avoid pitfalls.

Becoming a better writer is also very much about changing the behaviour. Therefore you will get increased insight in why clarity and enhanced quality is important.

Target audience


The course is targeting credit officers within the business segment, credit heads and business heads, credit decision makers and other officers in the credit process.
S-FSA clarifies the criteria for responsible lending
Swedish FSA (S-FSA) has made decisions on sanction fees towards two banks/creditors, which have not fulfilled the regulatory expectations regarding responsible lending in the consumer credit market.

These creditors in question have, according to S-FSA, not made a sufficient assessment of the total economic situation of the consumer and by that failed in establish the payment capacity of the debtor in a way that is in line with consumer protection framework. The creditors have instead to a large degree trusted in credit scoring models and by that they did not reach the regulatory demands regarding responsible lending.

It can be concluded, out of an analysis of EBA:s guidelines on loan origination and monitoring as well as new guidelines from S-FSA on consumer credits which both came in 2021, that the authorities have enhanced focus on the consumer protection aspects and have clarified the expectation level of the banks regarding credit risk assessment in consumer lending.

The supervisory authorities have a clear ambition to make all creditors which provide consumer credits take a clearer responsibility in securing that a consumer does not borrow more money than is adequate out his/her total economic situation, but also to establish a level playing field within clear frames for all the creditors in the consumer market.

Deficient credit risk assessment



In line with earlier statements from S-FSA, they have kept high focus on the consumer credit area and investigations on specific creditors has been a part of this. S-FSA has been worried about that not all creditors fulfil the regulatory expectation on responsible lending towards consumers. The investigations of current interest have comprised consumer credits of the amount from 80.000 SEK to 400.000 SEK.

In the Swedish consumer credit market, there has to a certain extent been an uncertainty regarding the regulatory expectation level on responsible lending since 2017 when there was an acquittal verdict from the highest administration court in a case against H&M. The existing rules, both on European level and Swedish level, has also given the creditors a certain space of discretion in the establishment of the criteria of sufficient level of assessment in regards of the creditworthiness and payment capacity of a consumer. Some creditors in Sweden have interpreted the situation that a standardised and rudimentary assessment, primary relying on a credit scoring model would be sufficient from this perspective. This has also been referred to by the creditors in these particular investigations.

However, according to my understanding, the H&M verdict should rather be seen as ”the exception that proves the rule” since there was very specific circumstance in this case. This seems also to be the opinion of the S-FSA in the investigations of current interest. S-FSA has among other things pointed at the fact that the amounts of the investigated loans are significantly higher and that there is no connection towards any goods sold by the creditors (which was the case in the H&M verdict). S-FSA instead insist that the demand of a responsible lender normally is higher when making a sufficient assessment of the creditworthiness and payment capacity of the individual consumer.

S-FSA stresses that regarding consumer credits like this, the creditor must create a well-founded and comprehensive picture of the total debt situation of the consumer to be able to assess whether the economic prerequisites are sufficient to be able to repay the credit in question and dismiss the assertion from the creditors that the credit assessment that has been done in these cases would be enough out of the practise of creditors own space of discretion.

The conclusion from S-FSA is instead that these creditors has fallen short against Swedish Consumer Credit Act and responsible lending requirements by using insufficient information of the total debt situation of the borrower and by failing to consider critical expenses as well as not controlling data given by the consumer. This has rendered in sanction fees from S-FSA of 45 and 50 MSEK respectively.

Reflections and conclusions



S-FSA confirms that banks and other creditors has a certain space of discretion when deciding on what is a sufficient level of credit risk assessment and which information that needs to be considered, but they also emphasize that the loan amount is of importance in such establishment as well as the targeted group of customers, e.g. if they have previous payment problems or a low creditworthiness score.

It seems obvious that S-FSA in the new guidelines from 2021 regarding consumer credits (FFFS 2021:29) expect responsible lending to include any type of payment ability calculation (in Swedish KALP) or similar assessment of the total economic situation of the consumer, in any case if the loan amount is in the range that has been investigated in these cases. The lending in questions was however provided already in 2019. At least one of the creditors has claimed that the legal situation has been unclear and the fact the S-FSA has been eager in clarifying the expectation level in new guidelines proves this situation. This assertion was dismissed by S-FSA which instead points at the fact that the consumer credit law has been unchanged during this period (and by that the regulatory expectation level on responsible lending). This F-FSA approach has also been applied for several years by many incumbent creditors.

S-FSA has also in several reports previous years emphasized that the accuracy of the credit risk assessment plays an important role in avoidance of payment problems later on. Statistics also shows that it is more common with payment reminder and debt collection for borrowers among niche-banks than incumbent banks (which more often makes concrete payment ability calculations).

One interesting detail in these investigations is a statement from S-FSA regarding the fact that one of the creditors admitted deviations of 30 % between the income stated by the borrower and the one displayed in official records without controlling the information (if the credit was lower than 150.000 SEK). The view from S-FSA was that this practise created a big risk of using wrong information in the creditworthiness assessment and also that this process as such was a deficiency in the respect of responsible lending.

EBA has also established new guidelines during 2021 (EBA guidelines on loan origination and monitoring). These guidelines have put enhanced focus on the consumer protection area and the authorities, both on European and Swedish level, has chosen to clarify and visualise the expectation level on responsible lending towards consumers. This increased clarity ought to be welcomed by the majority of market players as well as the consumers since it improves the conditions for a level playing field and uniformity among the creditors as well as decreased risk of overindebtness among consumers.
The obsession of three lines of defence
The three-lines-of-defence concept has been a well-known and well-used notion in the financial industry for many years and was initially designed to help organisations clearly identify and define roles and responsibilities and provide proper practice regarding prudent risk management and risk activities. Unfortunately the perception of the three-line-of-defence concept has developed into a view as a compulsory organisational model rather than an idea or example of a prudent governance model.

Instead of enabling an efficient and prudent risk management model, this perception has many times led to the creation of layers with strict formalistic borders, literal application and communicative bureaucracy that makes the risk processes complex and inefficient. Risk control functions should not be strictly separated from the business and reactive, instead use opportunities to collaborate, interact and coordinate and become more advising towards the business organisation.

Does this mean that the underlying principles from three-lines-of-defence concept is wrong? No, but too often it is applied in a way that is not logic or appropriate.

Introduction and background



Trust in the reliability of the banking system is crucial for its proper functioning. Consequently, effective and relevant internal governance and control arrangements are fundamental if banks and the banking system are to operate well and become trustworthy.

The three-lines-of-defence concept has been a well-known and well-used notion in the financial industry for many years and has over the years been promoted by the regulators. Despite this, the story of its emergence is opaque and there is no consensus on how the three-lines-of-defence concept entered the risk area. Some claims that the three-lines-of-defence model was developed around 2010 by the Federation of European Risk Management Associations (FERMA) together with the European Confederation of Institutes of Internal Auditing (ECIIA). But it is a fact that it was referred to by UK FSA already in 2003. There are also signs indicating that three-lines-of-defence model evolved as early as late 1990s. It is however a fact that the analysis made by regulators and various experts as an aftermath of the latest recession in 2008-2010 concluded that many bank failures were caused or at least aggravated by unclear risk governance and poor risk management. As a result the three-lines-of defence were “reintroduced” and promoted as the magic wand, supposedly solving the identified deficiencies in corporate governance and risk management practices.

In autumn 2011, EBA launched their first Guidelines on internal governance (GL44). EBA claimed that the guideline was consistent with the three-lines-of-defence model, but they didn’t define the model or the concept as such. EBA guidelines on internal governance has been reviewed and altered, first in 2017 (GL11) and secondly in 2021 (GL05), but there isn’t any concrete definition inserted. The guidelines focus mainly on the responsibilities of the management body and the second line of defence and set out detailed elements for these control functions. EBA is also declaring that the internal control functions must be independent of the business they control in line with the CRD.

The concept was initially developed and designed to help organisations clearly identify and define roles and responsibilities, provide best practice regarding prudent risk management and proper risk activities. A huge number of banks and other financial institutions have adopted a three-lines-of-defence approach, but it seems that many of them has executed such organisational change without a sufficient level of analysis and reflection and without the authorities actually requiring such an operational model. The expectations and demands from the FSAs have rather been for the banks to secure robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent division of responsibility, effective processes to manage risks it is or might be exposed to. But unfortunately the perception of the three-line-of-defence concept has developed into a compulsory organisational model rather than an idea or example of a prudent governance model.

So the provocative question to be asked is if the three lines of defence model has become an overrated metaphor and only provide a false sense of security?

Regulatory prerequisites



It is a fact that there are no regulatory demands on using a strict three-lines-of-defence model on EU level. Neither can such demands be found in the national regulations in Sweden. EU Parliament stressed in the introduction of the CRD (2013/36/EU) that weaknesses in corporate governance in a number of institutions have contributed to excessive and imprudent risk-taking in the banking sector which has led to the failure of individual institutions and systemic problems in Member States and globally. But they do not require the banks to use the three-lines-of-defence model, rather pointing at the fact that they expect the institutions to have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility but also that the arrangements, processes and mechanisms shall be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution´s activities (article 74). Thus, they do not advocate on any particular governance structure.

In the EBA Guidelines on Internal Governance a detailed expectation level is described towards the risk and compliance functions as well as the internal audit function. The Risk function is in the current guidelines called “Risk management function” while the same function in the first version of the guidelines was named “Risk control function”. This shift in vocabulary has been unfortunate since it has contributed to blurriness and unclarity regarding the comprehensive responsibility of risk management. The concept of risk management covers everything from a clear organisational structure with clear roles and responsibilities and effective processes to identify, manage, monitor and report the risks, not just the activities of monitoring and controlling the risk processes.

Risk governance flaws and misunderstandings



Probably almost all risk experts agree upon that it is the business managers that owns the risk and are responsible for acting in accordance with internal rules and process and also responsible for managing the risks that stem from those processes or the business operations. But do these people feel sufficiently responsible of managing and tackling the risks that emerge?

There are several other departments, such as risk control functions, compliance, internal audit, and others, e.g. dedicated risk managers in the business organisation, who monitor and review risks, ensure that internal standards and external regulations are being met, and look for ways to identify risks in the internal processes. So who is actually in charge of the risk management?

The main risk in creating layers of similar and overlapping risk roles in the organisation, especially creating specific risk managers in the business organisation, is that business managers and other staff executing the operations hand over the responsibility of risk management to these people and departments. In addition, often these many controlling layers create unclarity and communicative bureaucracy that makes the process complex and inefficient.

Experience shows unfortunately that there are often inefficient control duplications and very few good examples of true collaboration and coordination between the control functions. Instead many times the perception among business staff are that the organisation have a complex and dense structure of controllers controlling other controllers.

As been displayed above, there is no specific regulatory demand to use the three-lines-of-defence. This means that any assertion or perception that this model is a compulsory organisational model is incorrect. Another common misunderstanding is that the demand on risk control function to be independent from the business organisation makes them incapable of giving advice or become sounding board to the business units.

Best practise in risk management



The macro-economic situation has changed, becoming more unpredictable and volatile. The technology shift has also affected the prerequisites for the banking industry. New competitors, often with different view on risk appetite and risk management, has entered into the market. The world is everchanging and dynamic. This means that risk management also need to be dynamic and adaptive to changes.

Financial institutions do not afford to run the operation as the world was static. This means among others that the risk control functions cannot act as totally separated and reactive functions. The risk control functions need to coordinate and cooperate more, improve anticipation of emerging risks but also dare to act as advisors towards the business managers. The control functions need for sure to be independent and are not expected to perform any operational tasks that falls within the scope of the controls, but this does not hinder them to act as sounding board to the business organisation. On the contrary, their expertise is an important factor for successful operations. This also means that every part of the organisation needs to be adequately risk aware and a collaborative approach need to be established between the departments and risk management layers to continue to be successful and efficient from the risk governance perspective.

Even if certain roles and responsibilities are to be seen as obligatory, e.g. a risk control function and internal audit, there is no key or compulsory model of how a financial institutions total organisation must look like. You are permitted to adapt your governance model and structure to your specific prerequisites and needs. This means that you can have three, four or other number of lines of defence or even call it something completely different, as long as you do it within the objectives of external regulatory framework.

To summarise, you need to reflect and conclude upon what kind of governance model that would be most logic and efficient out of your company’s individual prerequisites. Create a transparent risk management collaborative eco-system within the organisation that is understandable and observed by the staff and avoid any silos in the structure. Finally, make sure that the model and division of responsibilities comply with the regulatory expectations.
S-SFA consumer protection report 2022
Unhealthy lending towards consumers and commissions connected to sales of financial instruments is of highest priority for Swedish FSA (S-FSA) during 2022.

S-FSA released already in autumn 2021 updated guidelines regarding consumer credits. In these they pointed at the need of better basis for the credit assessment of a consumer. Careful and sound assessments reduce the risk of payment problems later on. This new report could therefore partly be seen as a follow-up on these new guidelines.

The conclusion from S-FSA is that there is still problem in the consumer credit market with consumer getting loans that they cannot afford. S-FSA also emphasize that also intermediaries have to apply responsible lending, which is not always the case. For this reason S-FSA will continue to focus on the consumer credit market during 2022.

S-FSA made during 2021a survey on the consumer credit market and several analyses regarding consumer credits and payment problems. These actions ended up in the new guidelines on consumer credit with focus on the interpretation and application of responsible lending and prudent credit assessments. S-FSA also referred to EBA guidelines on loan origination and monitoring which came into force 30 of June 2021.

S-FSA pointed at the undesired development of the consumer credit market with offerings, sales methods and credit assessments that not always live up to the regulatory expectations. This has resulted in consumers getting credits that they cannot afford.

S-FSA state that a part of responsible lending is to make sure that the consumer does not borrow more than manageable out of his/her economic situation and to avoid overindebtness. The target with the new guidelines was to create clearer guidance in how creditors are to apply the demands in the consumer credit law and the regulatory expectations on responsible lending and how the credit assessment is supposed to be made.

In this new report, which was published in the beginning of April, S-FSA pointed at that there are still risks within the consumer credit market and consumers are getting loans that they cannot afford. S-FSA underlined the fact that also intermediaries, which get commission from the creditors and in their marketing encourage consumers to borrow, is also forced to live up to responsible lending.

Even if the development in the consumer credit area is going in the right direction according to the S-FSA, they have noticed continuing problems in certain area, especially among youngster and persons with low incomes which end up in payment difficulties more often and that consumer getting loans from creditors that are not banks have a higher likelihood of reaching problems.

S-FSA are also concerned about extensive marketing of consumer credits and that performed credit assessment are not always compliant with regulatory demands, which means that certain creditors does not apply responsible lending in a correct way

S-FSA will therefore continue to have strong focus on consumer credits during 2022. As a part of this, S-FSA will together with Swedish Consumer Agency make further analysis regarding the role of the intermediaries and their way of applying responsible lending. At the moment S-FSA are making specific inquiries on five different cases (creditors), which might lead to sanctions from the supervisory authority during 2022.
S-FSA publish its yearly report on the residential mortgage market
In the yearly report from Swedish FSA (S-FSA) that was published in the end of April they highlight that Swedish households continue to take bigger loans, primary due to increasing prices on the property market, but also that the number are increasing of borrowers having high debt-to-income and higher loan-to-value at the same time. Moreover S-FSA points at the fact that higher inflation and increasing interest rates lead to that mortgage borrowers get less margins in their economy.

S-FSA however underline that many mortgage borrowers have sufficient margins in their economy to be able to pay their loans even in a worsening economic situation. But since more new borrowers have taken larger loans in relation to their income, they become more sensitive to increased interest rates than before. According to S-FSA, the lowered demands from the banks on the interest ratio in the affordability calculation has contributed to this development.

Private mortgage loans are a large part of the total credit market. These loans imply risks for individual households, banks, the financial stability, and the macroeconomic development. Therefore S-FSA continuously monitor the development of private mortgage loan market and release a yearly report on the subject.

The S-FSA points at that the Swedish households have borrowed larger and larger sums during the last two decades. The loan volumes have increased more than the income levels, mainly depending on significant increased price levels on the property market and low interest rates. This means also that the average debt-to-income has continued to increase. S-FSA now sees higher inflation and increased interest levels, which increase the risks for all parties involved. They also identified that the lowered demands from the banks on the interest ratio in the affordability calculation has contributed to this development.

S-FSA however conclude that many households will manage to pay their loans even in a worsening economic situation, but the sensitivity has increased due to larger total loans in average and higher debt-to-income ratios. Their judgement is that amply 10 percent of the household will get a deficit in their economy if the interest rates would raise to seven (7) percent.

The total credits for each household has a rapid growth, in average has the total debt increased with almost 8 percent per annum during the last twenty years. Private mortgage loans constitute proxy 80 percent of the total debts of the households. During the years, S-FSA has taken several measures to decrease the vulnerability among the households, e.g. a cap for maximum LTV and minimum amortisations levels. The main target with these measures has been to discourage borrowers to borrow loan volumes that is not in line with their economic prerequisites.

Due to the current uncertain macro-economic situation, e.g. higher inflation and increasing interest rates, S-FSA wants the banks to reassess their interest ratios and other cost assumptions in their affordability calculations.