Robust risk management is foundational

A version of this article first appeared in the September BAI Executive Report: Navigating effective risk management. You’ll find more insight within the report on a new approach to commercial real estate, assessing liquidity and credit risk, fraud considerations and more.

The business of banking is the business of taking risk and managing it.

At their core, banks and credit unions create value by providing services to both depositors and borrowers. Depositors need a safe place to stash their cash. And by accepting deposits, banks gather funds they can lend to borrowers, who put those funds to work in the economy through large purchases, or which the bank can invest. This fundamental activity—transforming short-term liabilities (deposits) into long-term assets (loans and investments)—provides an essential service to individuals and businesses and supports the economy at large.

Yet when we really think about it, this transformation is challenging: Day in and day out, banks must ensure that the returns on their loans and investments exceed the interest they’re paying on deposits. It is also inherently steeped in risk, because depositors typically want immediate access to their money, while borrowers seek to lock in interest rates over a much longer time horizon. As anyone who has watched “It’s a Wonderful Life” knows, banks fail when claims on deposits exceed the cash in their coffers.

Indeed, bank runs happened often in the early history of U.S. banking. Spooked depositors, demanding access to their money en masse, threatened banks’ solvency in rapidly escalating, self-fulfilling cycles—reaching a peak during the Great Depression, when around 9,000 banks and nine million savings accounts were wiped out. In response, the deposit insurance system, created with the establishment of the FDIC, certainly helped make bank runs less common.

Only one U.S. bank has failed so far in 2024. But the experience of 2023 demonstrated that bank failures are not a thing of the past, nor are they limited to small institutions. The first three banks that failed in 2023 each held more than $100 billion in assets. Those events, and the related regional bank crisis, brought home to today’s generation of bankers that managing risk on both sides of the balance sheet—the liability (deposit) side, as well as the asset (loans and investments) side—is critical.

As they look ahead to an uncertain economic and regulatory future, bankers today are rising to a set of key challenges: Competing for funding while managing deposit concentration and treasury risks, plus finding sound ways to deploy that funding as credit conditions become more distressed and market conditions more volatile.

Increasing credit risk, and a renewed appreciation for market risk

In a recent Semiannual Risk Perspective (SARP), the must-read for risk managers that lists current threats to the safety and soundness of banks, the Office of the Comptroller of the Currency describes credit conditions as challenging and increasingly risky.

With the financial cushion from the pandemic stimulus now gone for many consumers, a growing number are having difficulty making loan and credit card payments. One example: credit card delinquencies are at their highest rate since 2012. The OCC is expressing concern about banks’ abilities to manage a credit downturn. “Retirements and other attrition, coupled with an extended benign credit period, have decreased the number of credit risk professionals with problem loan identification and mitigation experience,” the SARP says. “It is important for banks to ensure that staffing plans for workout functions are adequate.”

Office real estate is one sector where such capabilities could be needed. Bloomberg reported recently that the value of U.S. office real estate dropped 25% last year. [Read more: “A wobbly CRE market requires maximizing relationships and minimizing risk”] And, according to the commercial real estate data firm Trepp, there were $187 billion of new office delinquencies in June, pushing the sector’s delinquency rate to 7.5%. The OCC says credit risk is also increasing in commercial and industrial lending and other consumer lending.

As banks decide whether to add to the asset side of their balance sheets by lending into these areas, they can analyze a multitude of tried-and-true data points to determine the riskiness of prospective borrowers. Many of these factors fall under the timeless “Five C’s of Credit” maxim—character, capacity, collateral, capital and conditions.

Banks also assess their own portfolios to make sure their asset mix of loans and investment securities matches their risk appetite—the amount and type of risk they want to take based on strategy. For example, banks often avoid high concentrations of similar borrowers, so that trouble in one industry does not degrade a large portion of the lending portfolio. Instead, banks “strive for a larger number of individual borrowers and look for geographic and industry diversification” when extending loans, industry advisor James Clarke noted in an RMA article following last year’s bank failures.

The ratio of loans to securities banks hold on their balance sheets can vary. For example, smaller banks tend to hold a higher ratio of loans. Industrywide, 53% of bank assets at the start of 2023 were loans, 23% were securities, and the rest were held in categories that provide banks with the liquidity they need to do business.

Regardless of the mix, managing loans and securities with interest rate scenarios and market risk in mind is crucial. Consider the path and progression to the 2023 banking crisis. For several years, the federal funds rate was near zero to shore up the economy. After a bump before Covid-19 struck, rates fell to near zero again as the government responded to the pandemic. With interest rates low for so long, it wasn’t easy to imagine they would rise so quickly. Speculation even arose that rates would go negative.

That didn’t happen. But efforts to keep households and businesses afloat did include stimulus payments and the Paycheck Protection Program, which contributed to a mighty influx of deposits at banks.

Bursting with these funds, and with the pandemic dampening loan demand, many banks parked cash in long-term, low-interest Treasury bills and other investments typically considered safe.

When interest rates rose, those investments lost value. The losses had a bigger impact on banks that needed to sell the securities for liquidity, but numerous institutions were affected. The SARP says unrealized losses in OCC-supervised banks’ available-for-sale portfolios and held-to-maturity portfolios as of fourth quarter 2023 were 5.2% and 11.5%, respectively. That’s down from earlier levels, but still elevated to the point that they “could exacerbate risk exposure, particularly if security sales are required to meet funding outflows,” the OCC says.

In his article, Clarke noted that some blamed the bank failures on the Fed, for increasing rates in a way that placed “tremendous pressure on asset-liability management in the banking industry.” But many banks, he said, “did not take the level of interest-rate risk some failed banks did, realizing that “market interest rates eventually revert to the mean. If rates are at historically low levels, as in 2020 and 2021, they will at some point revert to higher rates.”

One crucial lesson from the crisis: banks benefit from consistent, close attention to the full range of banking fundamentals, including monitoring the composition of the investment portfolio and its sensitivity to interest-rate changes.

Renewed attention on liquidity and funding

“There are absolute ‘truths’ in banking,” Richard Parsons, author, lecturer and former head of operational risk at Bank of America said earlier this year. He was reflecting on Silicon Valley Bank’s failure 12 months on. Even as the industry changes, he said, the need for expertise in “how to govern and manage the balance between short and long-term risk and reward/return” remains.

Parsons, whose RMA-published book “Broke” was inspired by the global financial crisis, said last year’s lessons included “liquidity cannot be taken for granted” and “interest rate risk matters.”

As rapidly rising interest rates devalued banks’ investments, they also helped to pry deposits loose and drain liquidity from the banking system. Once-cheap deposits commanded higher interest rates and fueled competition from other banks and money market funds—where combined assets have jumped from $4.5 trillion to $6.2 trillion since the Fed started raising rates.

At some banks, deposit runs were supercharged by anxious social media chats and lightning-fast transactions, including $42 billion withdrawn in a single day from one institution.

Parsons has said the crisis would have been much worse if not for the FDIC’s move to cover uninsured deposits and the creation of the Bank Term Funding Program, which allowed banks to borrow from the Fed using less-liquid long-term securities as collateral. “No doubt more banks would have failed for liquidity reasons,” he said.

Now, with last year’s deposit runs fresh in their minds, industry thought leaders are discussing how to attach the same kind of rigor they apply to evaluating the risk that a borrower will not repay to the risk that depositors will not stay.

That includes assessing concentration risk. To wit: The crisis showed that banking a large percentage of uninsured depositors is risky because the uninsured have a powerful incentive to rapidly pull funds over any perceived bank weakness.

The crisis also showed concentrations in depositors from a particular industry are risky because they might withdraw funds in concert as they react to the same information or developments.

In his RMA Journal article “Thoughts on Managing Deposit Stability,” retired Frost Bank Chief Risk Officer Bill Perotti says other concentration factors to watch include geographic region, deposit type (public funds, brokered, etc.) and increasing versus decreasing balances.

While deposits have stabilized since last year, the pressure on banks to offer attractive deposit rates in the current higher-interest rate environment remains, as evidenced by second quarter bank earnings reports describing a squeeze on net interest margins.  At the same time, regulation to limit bank income from fees is putting additional pressure on banks to widen the difference between deposit interest and loan and investment returns.

Wintrust Bank Chief Risk Officer James Lentino has noted that the current rate environment highlights the importance of determining a bank’s deposit betas, which measure the degree to which banks pass fed funds rate moves through to customers. “The challenge of managing the fed funds rate moves amid such competitive market conditions is often a fine balancing act with plenty to lose if done incorrectly,” he says.

In its Fiscal Year 2024 Bank Supervision Operation Plan, the OCC put asset and liability management at the top of its list of supervision priorities and objectives, recommending “stress testing across a sufficient range of scenarios, sensitivity analyses of key model assumptions and liquidity sources, and appropriate contingency planning.”

Despite recent cuts to fed funds rate, the central bank’s primary monetary policy tool, the competitive rate environment may linger for longer. “Many economists predict that interest rates will remain elevated over the next two years,” the OCC’s SARP report says.

Meanwhile, like most businesses, banks also face growing risks in operations overall. Largely due to cyber threats, the increased reliance on technology and the cloud, as well as spikes in fraud, the SARP classifies operational risk as “elevated.”

With risks rising on several fronts, the OCC is warning against complacency. And, as ever, regulators and risk leaders alike are stressing the importance of a strong risk culture.

Final thoughts

For risk management to be effective, leadership needs to instill it with the authority to challenge the deals and positions that are outside of compliance or the bank’s risk appetite. Leadership can signal that risk management is a priority by penalizing employees who run afoul of risk limits and rules, and incentivizing behaviors that align with good risk management.

“Culture comes from the top,” Massimo Cutuli, CRO at Optiver U.S., told the audience at a recent CRO Roundtable held by RMA’s New York Chapter. When you work at a firm, “you can easily tell the level of priority the risk culture has. If it’s embedded in the fabric of the front line and second and third lines, management has made it a priority. It comes with the DNA of the firm.”

“Firms that don’t have it tend to struggle,” Cutuli said.

As the industry changes, there is an understandable focus on incorporating generative AI and other new technologies, responding to ever more sophisticated and advanced cyber threats, and meeting customer demands for convenience and speed. Through it all, banks are well advised to strengthen and maintain the risk management that facilitates the heart of their operations: the ability to serve borrowers and depositors by properly balancing their short-term liabilities against long-term assets.

As the industry advisor Clarke sums it up: “The liquidity crisis and bank failures of 2023 underscore the importance of banking fundamentals. It is crucial for banks to diligently monitor asset growth, liquidity rate risk and interest rate risk. It may sound rudimentary, but these things matter.”

Frank Devlin is Senior Editor and Celina Rogers is Managing Director, Content with RMA.