FMP 1: Banks

Market risk is what a bank carries whenever the value of its positions depends on quantities it does not control: exchange rates, interest rates, commodity prices and equity prices. Those quantities are usually called risk factors, and the level of each is settled by trading in the financial markets rather than by any single participant.

The mechanism is ordinary supply and demand. Consider the rate at which the U.S. dollar (USD) exchanges for the British pound (GBP), quoted as USD per GBP: it rises when the demand to buy GBP using USD runs ahead of the demand to sell GBP for USD, and falls when the pressure runs the other way. News is what tips the balance. The British pound lost value after the United Kingdom’s June 2016 vote to leave the European Union, which market participants read as bad news for the British economy. The price of oil rose in May 2018 when the U.S. government reinstated sanctions on the oil producer Iran, because traders judged that global supply might shrink.

Where a bank picks up the exposure

Trading operations are the main channel through which a bank becomes sensitive to market variables. Proprietary trading is not currently permitted in the U.S., yet the exposure does not vanish, because banks sell corporate clients and institutional investors products whose values track market prices. On the USD per GBP rate, a client might ask for the following.

• Spot transactions. GBP is bought or sold for almost immediate delivery.
• Forward contracts. An exchange rate is fixed today for the purchase or sale of a stated quantity of GBP on a future date.
• Options. One side holds the right, but not the obligation, to buy GBP or to sell it at a price arranged in advance, the exercise price, at a stated time in the future.

On many of these contracts the bank acts as a market maker, quoting a bid, the price at which it stands ready to buy, and an ask, the price at which it stands ready to sell. Quoting both sides leaves it holding whatever the client does not want, so a position accumulates as a by-product of servicing customers. Banks set limits that keep the net exposure to each risk factor inside a stated band, but they do not usually flatten it altogether, so some market risk sits on the books at all times.

Credit risk is the possibility that a borrower fails to repay, and loans to corporations and individuals are the largest single source of it. When a borrower defaults there is normally a loss, and its size depends on whether assets were pledged as collateral and on where the bank’s claim ranks against other creditors. Average losses are no surprise, so a bank builds its expected losses into the interest rate it quotes on loans.

The size of that swing is not theoretical. The credit rating agency S&P publishes figures showing that, across all rated corporate debt over the years from 1981 to 2018, the annual default rate ranged from a low of 0.14% to a high of 4.19%, and the high came in 2009. Three other years pushed past 3%: 1991 at 3.25%, 2001 at 3.79% and 2002 at 3.63%. By 2018 the rate was 1.03%. Regulations require enough capital to cover a loss so severe that it should arrive only once in a thousand years.

Credit risk that does not come from a loan

Derivatives carry credit risk as well as market risk. A forward contract or an option gains and loses value with the underlying market variable, which is the market risk. The credit risk is separate: the counterparty may default when the trade is worth something positive to the bank, and therefore something negative to the counterparty.

Accounting rules force expected losses onto the books at the outset. Under IFRS 9, which covers most bank-issued loans, a bank reports outstanding principal net of the expected losses estimated for the following 12 months. The Financial Accounting Standards Board has a similar rule reaching across the whole life of the loan, which IFRS 9 does only where credit risk has increased significantly. For derivatives the equivalent is a credit value adjustment, or CVA, an estimate of what the bank expects to lose to counterparty default, subtracted from the balance sheet value of the contracts. Losses not yet incurred are charged to income.

The third of the three major risks is the hardest to pin down. Bank regulators define operational risk as “the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events.” That is a catch-all: it sweeps in every risk that is neither market risk nor credit risk, with strategic risk and reputational risk carved out.

Measurement is the difficulty. Market risk has prices and credit risk has default histories, whereas an operational loss arrives from a direction nobody modelled. Regulators responded by naming seven categories, which at least gives a bank somewhere to put each loss.

Source: the seven operational risk categories identified by regulators, as set out in the chapter. Event descriptions are paraphrased.

Many practitioners regard operational risk as a larger problem for a bank than either market risk or credit risk, and the record since 2008 supports them. Banks in Europe and North America have paid fines running into hundreds of billions of dollars over money laundering, market manipulation, terrorist financing and inappropriate conduct in the mortgage market. None of those losses came from a price move or a borrower default.

Three sources deserve naming because they are growing rather than shrinking. Cyber risk is the exposure to attack on the bank’s systems and data. Legal risk covers loss from litigation and from contracts that fail to do what the bank believed. Compliance risk is the risk of failing to follow rules and regulations, accidentally or intentionally.

Capital is what stands between a loss and a failure, and the most important form it takes is equity capital. Losses reduce equity directly, so a bank stays solvent, meaning it keeps a positive amount of equity capital, only while its equity is large enough to swallow whatever arrives.

Debt capital is the other main category. It usually ranks behind the assets held for depositors, which is why regulators count it: subordination turns the bank’s own lenders into an extra cushion above the depositors. The two differ in when they do their work. Equity capital is called going concern capital, because it absorbs losses while the bank remains in business. Debt capital is called gone concern capital, because losses reach it only once the bank has failed, so in theory depositors are exposed only when losses wipe out both.

How much capital is necessary follows from the size of the possible losses.

Two numbers answer the question of how much capital a bank needs, produced by different parties for different purposes. Regulatory capital is the minimum that regulators require. Economic capital is the bank’s own estimate of what it actually requires. In both cases capital is a pool of funds standing ready to absorb unexpected losses.

The objective differs. A regulator protects depositors and the stability of the financial system, so it sets a floor and enforces it uniformly. A bank calculating economic capital aims at something narrower, most often keeping a high credit rating, since the rating drives what it pays to borrow.

Economic capital also does a job regulatory capital was never designed for. It is allocated down to individual business units, which lets those units be compared on a return on allocated economic capital measure. A trading desk and a corporate lending unit report profits that are not comparable until each has been charged for the capital its risks consume, and once they have been, capital can be directed towards whichever activity earns most per unit of risk.

Source: the distinction between regulatory capital and economic capital as described in the chapter, arranged for comparison.

Banks are regulated to protect depositors and to keep confidence and stability in the financial system. The body that writes the global rules is the Basel Committee for Banking Supervision, established in 1974 as a forum in which bank regulators from different countries could exchange ideas, and housed at the Bank for International Settlements in Basel, Switzerland. Before 1988 each country regulated on its own terms, so a bank in one jurisdiction could be required to hold far more capital than an identical bank in another.

Basel I, the international agreement reached in 1988, ended that: regulators in every signatory country had to calculate capital requirements in the same way, initially covering losses from defaults on loans and on derivatives contracts, so credit risk alone. Trading grew through the 1990s, and a framework covering only credit risk stopped making sense, so the Committee agreed that capital should be held for market risk as well. That change, known as the Market Risk Amendment, was implemented in 1998.

In 1999 the Committee proposed what became Basel II. It reworked the calculation of credit risk capital and added a requirement for operational risk. Working the final rules out and putting them into force took about eight years. Under Basel II the total capital requirement was the sum of three amounts, one for credit risk, one for market risk and one for operational risk.

Then came the crisis of 2007 and 2008, with bank failures and bailouts across the system. Regulators concluded that the market risk capital rules had been inadequate and revised them in the package called Basel 2.5. The Committee also decided that equity capital requirements had to rise, which is the heart of Basel III: a large increase in equity capital, expected to be fully implemented by 2027. The second half of Basel III, agreed in 2016 and 2017 and often called Basel IV by practitioners, limits how far internal models may be used.

Capital cannot be counted without a model, and there are two sources for one. Standardized models are tools developed by the Basel Committee itself; internal models are developed by the banks, and using one generally requires approval from the bank’s national regulator first.

The credit risk models introduced under Basel I were standardized, which carries a useful property: two banks handed the same portfolio should arrive at the same capital requirement. The Market Risk Amendment opened a second route, so a bank could set market risk capital with its own model provided it met the Committee’s requirements and its regulator approved. Basel II extended internal models to credit risk capital and operational risk capital.

Since the crisis the Committee has been pulling that freedom back, having judged that banks were given too much latitude to select internal models producing the lowest capital requirements. That is less a criticism of any single model than of what happens when the party paying for capital also chooses the measuring instrument. Operational risk capital must now be set with a standardized model. For credit risk and market risk a bank must use a standardized model and may, with regulator approval, also use an internal model, but the internal model cannot push the total below a floor set as a percentage of the standardized figure. By 2027 that percentage will be 72.5%.

Regulatory capital calculations begin with a sorting exercise: every asset and liability is assigned to one of two books, and the assignment decides which capital rules apply. The trading book, as the name implies, holds the assets and liabilities a bank keeps in order to trade them. The banking book holds those the bank expects to hold until maturity. A corporate loan advanced with the intention of collecting interest and principal belongs in the banking book; a position in government bonds bought so a desk can quote prices in them belongs in the trading book.

What follows is not a formality. Trading book items attract market risk capital calculations; banking book items attract credit risk capital calculations. The two work quite differently and produce different answers for the same instrument.

Source: the trading book and banking book distinction as described in the chapter.

For years the boundary was porous. There had sometimes been genuine ambiguity over where a transaction belonged, a credit derivative being the standard illustration. Banks used that ambiguity in the obvious way, placing each transaction in whichever book produced the lower capital requirement, usually the trading book.

Due to be implemented in 2022, the Fundamental Review of the Trading Book set out to close the gap by replacing judgement about intent with an observable fact. Where a bank runs a desk that trades a specific instrument, that instrument is normally treated as part of the trading book; otherwise it belongs in the banking book. A bank still chooses how to organise its desks, but it can no longer reclassify a single position after the fact because the capital charge would be smaller.

Many of the problems that surfaced during the financial crisis were about liquidity rather than capital. Banks that failed were not always short of equity; they were short of cash on the day they needed it, and no amount of capital in a solvent balance sheet substitutes for funding that has walked away.

The mechanism is easiest to see in a funding choice. Suppose a bank wants to fund five-year loans. One option is to issue five-year bonds, matching the maturity of the liabilities to that of the assets. The tempting alternative, cheaper in many interest rate environments, is to issue three-month commercial paper and keep rolling it forward, repaying each issue out of the next, for the whole five years.

The strategy works until the day it does not. If the market loses confidence in the bank, rightly or wrongly, maturing commercial paper either cannot be replaced at all or can be replaced only at much higher interest rates. Without guaranteed lines of credit elsewhere, the bank could default on its borrowing and go bankrupt, and none of this requires the five-year loans to have gone bad. Five-year debt would have avoided the problem, because loan repayments would have arrived in time to repay it.

Northern Rock in the United Kingdom failed in exactly this way. Its mortgage portfolio, partly funded with commercial paper, was not unduly risky, but trouble in the American mortgage market unsettled investors and the paper could not be rolled over. Lehman’s demise in 2008 was largely a liquidity failure of the same shape.

The two ratios in Basel III

The Basel Committee responded with two requirements that banks must meet, both part of Basel III.

• The Liquidity Coverage Ratio. This ensures a bank holds sufficient sources of funding to survive a 30-day period of acute stress, of the kind in which it is downgraded, loses deposits, or finds its lines of credit drawn down at once.
• The Net Stable Funding Ratio. This limits the size of the mismatch between the maturity of a bank’s assets and that of its liabilities, attacking the rollover strategy at its root rather than waiting for the run to begin.

Confidence is what keeps a banking system upright, and many countries buy it directly by offering deposit insurance. The scheme gives a depositor a stated amount of protection against the losses that follow when a bank fails. The amount in the U.S. is currently USD 250,000. Some jurisdictions charge every bank the same annual premium for each dollar of insured deposits. Others, the U.S. among them, set the premium according to an assessment of each individual bank’s risk.

Insurance changes behaviour. Left on its own, deposit insurance would encourage a bank to take on more risk than it otherwise would. The strategy is simple: offer depositors slightly above average interest rates, then lend the funds at relatively high rates to risky borrowers. Without insurance it collapses, because depositors would pull their money out as soon as the risks became apparent. With insurance they have no reason to move, since they are protected if the bank fails and are enjoying an above average return in the meantime.

This is a textbook instance of moral hazard, which is the risk that an insured party behaves differently simply because the insurance exists, making the insurance contract riskier than it was written to be. It is a serious matter in deposit insurance specifically, since no government intends to set up a programme whose effect is to reward a bank for taking larger risks.

Two countermeasures reduce the problem without removing it. Risk-based deposit insurance premiums make the strategy more expensive, since a bank that lends aggressively pays more for its insurance. Capital regulation does the rest, because required capital rises with the risks taken, so the aggressive lender must fund a larger equity cushion. Neither eliminates the incentive; together they blunt it enough that the insurance can do its job.

An investment banking arm spends much of its time raising money for corporate clients, whether as debt, as equity or in some more complicated form such as convertible debt, and that work is called underwriting. Once the plans are settled the securities are originated with documentation itemizing the rights of the investors who buy them, and a prospectus is produced covering past performance, future prospects, risks and outstanding lawsuits. A road show usually follows, in which senior management and bank executives persuade investors to buy. A price is agreed and the bank markets the securities.

There are two types of offering. A private placement sells the securities to a handful of large institutional investors, pension plans and life insurance companies being the usual buyers, and the bank receives an agreed fee. A public offering makes the securities available to the general public, on either of two bases.

• Best efforts. The bank undertakes to try its hardest to place the securities at the agreed price and guarantees nothing, its fee usually depending to some extent on how successfully it sells at that price.
• Firm commitment. The bank guarantees the securities will be sold at the agreed price, buys them at that price and tries to sell them for more, its profit being the difference. If it cannot sell above the agreed price it takes the loss. A firm commitment is sometimes called a bought deal, and it is riskier for the bank and less risky for the issuer than a best efforts arrangement.

Source: the underwriting comparison set out in the chapter.

An IPO, or initial public offering, is the first occasion on which a company offers its shares to the public. Beforehand they are typically held by founders, venture capitalists and others who provided early stage funding. The shares on sale may be new ones, existing ones or a blend, and only the new ones bring additional capital into the company. Founders sometimes keep control by arranging for the shares they retain to carry better voting rights.

Pricing is hard, because no exchange yet quotes the shares. To place an issue raising USD 100 million, the bank estimates the value of the company after the cash injection and divides it by the number of shares in issue afterwards. It then sets the offering price below that estimate, so the issue is more likely to sell, and a substantial first-day increase in the share price is the common result. That increase carries three messages: the company could probably have issued higher, IPOs tend to be good investments, and small investors often find it difficult to buy them.

Letting the market set the price

Some issuers would rather the market decided what their company is worth, and one route is a Dutch auction. All investors, not merely the clients of an investment bank, submit bids stating how many shares they want and at what price, and the sale price is the highest at which the whole offering can be placed.

Source: the Dutch auction bids given in the chapter. The final column is computed.

The Google auction of 2004

Google’s IPO in 2004 used a Dutch auction, though not the plain vanilla version. At the last minute Google kept the right to alter both the number of shares on offer and the share of each bidder’s request that would be filled. Having seen the bids, it settled on 19,605,052 shares at USD 85, valuing the offering at USD 1.67 billion, and investors bidding USD 85 or more were filled on 74.2% of what they asked for. Had those bidders been filled in full, as a usual auction would have done, the proceeds would have been USD 2.25 billion rather than USD 1.67 billion. The founders, Larry Page and Sergei Brin, may have judged, rightly as things turned out, that shares could be issued later at a much higher price. Trading closed at USD 100.34 on the first day, 18% above the issue price, and added a further 7% on the second, so the auction did not remove underpricing. Two banks assisted, Credit Suisse First Boston and Morgan Stanley, for a smaller fee than a regular IPO.

A large bank does more than issue securities. It advises corporations on mergers and acquisitions, on divestments and on restructurings, valuing a target, assessing the synergies a merger would release, and recommending whether the offer should be a cash offer, a share-for-share exchange or a combination. It also acts for companies resisting a bid, where the defences available are known as poison pills: stock options for key employees that become exercisable on a takeover, a charter provision barring a new owner from dismissing the existing directors, preferred shares that convert into regular shares if a bid succeeds, discounted share purchases for existing shareholders, and a right letting the remaining shareholders sell out at a 50% premium to whoever acquires the company. Elsewhere the bank makes markets in products tied to exchange rates, interest rates and commodity prices for corporate treasurers and institutional investors, and runs brokerage services for retail clients, supplying research and advice, executing orders on exchanges and in some cases managing discretionary accounts in which the client has authorised the broker to make the investment decisions.

Putting all of that alongside deposit taking inside one corporation creates opportunities that are profitable for the bank and damaging for at least one of its clients. Four examples show the pattern.

• An investment banker struggling to place a new equity issue asks the bank’s brokers to recommend the shares to their clients and to buy them into clients’ discretionary accounts.
• An investment banker advising on an acquisition realises the target banks with the commercial banking arm, and asks the commercial bankers for their impressions, picking up confidential information that can be passed to the acquirer.
• An investment bank hoping for lucrative business from a company asks the researchers in the brokerage arm to produce a buy recommendation on its stock, to please its management.
• A commercial banking arm holding a large loan where a loss looks likely suggests the client replace it with a bond issue arranged by the investment banking arm, moving the exposure to investors who know less about the borrower.

In every case the loser is a party who trusted the bank: the brokerage client, the target company, the research reader, the bond investor.

Chinese walls and why banks enforce them

The usual defence is a set of internal rules known as Chinese walls, which block the transfer of information from one part of a bank to another. A cynic might say a bank will not enforce such rules when enforcement costs it money, but the economics point the other way. Big fines for breaching conflict of interest rules can be and have been levied, and a bank seen to ignore them loses business, its reputation being its most valuable asset. Set against the gains from a violation, the fines and the reputational damage are generally far greater.

The regulatory response

Conflicts of this kind are why U.S. regulators once separated investment banking from commercial banking outright. Under the Glass-Steagall Act of 1933 a commercial bank could assist with issues of Treasury and municipal bonds and could handle private placements, but was barred from public offerings and other investment banking activities, while investment banks could not take deposits or make commercial loans.

Neither the separation nor most of the firms it produced survived. Five large investment banks operated in the U.S. as of 2007: Goldman Sachs, Morgan Stanley, Merrill Lynch, Lehman Brothers and Bear Stearns. Lehman declared bankruptcy, JPMorgan Chase took over Bear Stearns, and Bank of America took over Merrill Lynch. The remaining two converted into banking holding companies with both commercial and investment banking interests, so the pair left standing adopted the combined model Glass-Steagall had been written to prevent.

Traditionally a bank originated a loan and held it on the balance sheet until maturity. The originate-to-distribute model breaks that link: the bank uses its expertise to originate loans and then sells them, directly or indirectly, to investors, who take on the credit risk.

The U.S. mortgage market has worked this way for many years, with help from three government sponsored entities: the Government National Mortgage Association (GNMA), known as Ginnie Mae, the Federal National Mortgage Association (FNMA), known as Fannie Mae, and the Federal Home Loan Mortgage Corporation (FHLMC), known as Freddie Mac. Each buys mortgage portfolios from banks and other originators, packages the cash flows into securities and sells them on. Investors face no credit risk, because the agency guarantees the mortgage payments, but they do face prepayment risk, the risk that principal comes back earlier than expected. That usually follows a decrease in interest rates, since the mortgage can then be refinanced more cheaply, leaving the investor to reinvest at a lower rate. Prior to 1999 the agencies handled only mortgages with a low probability of default; in 1999 they began accepting subprime mortgages, which are much riskier.

Since the 1990s banks have run the model across a wide range of loans without any agency involvement and, in most cases, without payment guarantees. Loans the bank originates are converted into securities, and whoever buys them bears the credit risk. The process is called securitization. It takes the loans off the balance sheet and frees up funds so more loans can be written, while the bank earns a fee for originating each loan and a further fee if it services it.

Tranches and the order of losses

Loan portfolios are usually carved into tranches, each carrying a different exposure to losses on the portfolio. Take a portfolio with a total principal of USD 100 million, sold by the bank to a special purpose vehicle (SPV) which passes the cash flows through to three tranches. The senior tranche funds 70% of the portfolio, the mezzanine tranche 25% and the equity tranche 5%. Where no losses occur, the senior tranche returns 5%, the mezzanine tranche returns 8% and the equity tranche returns 25%.

Two waterfalls run in opposite directions. Principal comes back to the senior tranche first, then to the mezzanine tranche, then to the equity tranche. Interest goes to the senior tranche until its promised 5% on outstanding principal has been paid, next to the mezzanine tranche until its promised 8% has been paid, and whatever is left goes to the equity tranche. Losses arrive from the other end: the equity tranche bears the first 5%, which is the first USD 5 million, the mezzanine tranche bears the next 25%, and the senior tranche bears all losses beyond 30%.

The benefits are real. Credit risk moves to investors who want it, the balance sheet is freed for new lending, and the bank collects origination and servicing fees on volume rather than tying up capital for the life of every loan. The drawback is the incentive it creates: a bank that will not hold a loan has less reason to care whether it is good.

That is roughly what happened before the crisis of 2007 and 2008. Lending standards were relaxed and the quality of the mortgages originated declined, yet banks still securitized them, and went further by re-securitizing, creating tranches out of tranches. As defaults grew, tranche holders took the losses, investors stopped trusting the structures, and for a period after the crisis the model could not be used at all.