New Zealand banks were required to factor in a cyber-attack for the first time in their latest Reserve Bank solvency stress test, which showed they would be able to continue operating in a severe stagflation-type scenario, albeit most would need to take action to do so such as raise fresh capital, restrict shareholders' dividends and cut expenses, the Reserve Bank says.
The stagflation scenario modelled includes high inflation, rising interest rates and a severe economic downturn including surging unemployment. It's the first Reserve Bank stress test since 2014 to feature high interest rates.
Banks included in the annual stress test were ANZ NZ, ASB, BNZ, Westpac NZ, Kiwibank, Heartland Bank, TSB, ICBC and Bank of China. They received instructions from the Reserve Bank in April.
These had the NZ economy with Consumers Price Index inflation of 6%, lower than the current 7.2% and the 6.9% reported by Statistics NZ in May for the March year. They also had the Reserve Bank increasing the Official Cash Rate (OCR) to 3% by the end of 2022 at a time when it was at just 1%. The OCR is currently at 3.5% and is expected to be raised to at least 4% when it's reviewed for the last time in 2022 on November 23. The scenario also saw the NZ dollar sold off, adding to the imported component of inflation, something which has occurred this year.
The 2022 stress test is is the first time the Reserve Bank has included a specific cyber risk event for participating banks to model. This created aggregate costs of $1.3 billion.
"This year's solvency stress test also asked banks to consider how a cyber-attack would impact their business. Banks were required to base this off a one-in-25 year cyber risk event/s which affects the general banking system," the Reserve Bank says.
"Banks approached this challenge in a number of different ways and modelled the impacts of scenarios including various distributed denial of service attacks, attacks locking banks out of critical infrastructure, kill chain malware and ransomware events with all attacks modelled to extend over a significant period of around one to two months."
"Estimated losses from the respective events varied in line with the benchmark and bank operational risk as expected. Losses related to a variety of factors such as reimbursements to customers, consultancy and legal fees, loss of business, technology upgrades and communication and media costs," the Reserve Bank says.
"Whilst the aggregate cost from the cyber risk event in this stress test was small in comparison to impairment expenses, it highlights to banks our view that multiple risks can crystallise and need to be managed during an economic downturn. The exercise furthered our understanding of banks’ process management in handling and quantifying a cyber-risk stress event."
'The thing that's least in your control'
Speaking to interest.co.nz last week, ANZ NZ CEO Antonia Watson said people were trying to penetrate the bank's systems "all the time."
"It's the thing that's least in your control because there's always someone that finds some backdoor somewhere," Watson said.
"A cyber-attack is the sort of thing that can be really, really disruptive for a really long period of time. So it's definitely one of the key risks that we see as a business, which is why we invest so much money both internally and on helping educate our customers."
Ross McEwan, CEO of BNZ's parent National Australia Bank (NAB), recently revealed NAB faces has more than 50 million attacks on its digital channels every month, noting the recent cyber-attack on Optus in Australia "is the kind of incident that keeps CEOs up at night."
The scenario
In the stress test scenario the NZ economy experiences:
- Falling house prices of 42% (47% from the peak in November 2021)
- Equity prices falling 38% (42% since December 2021)
- The unemployment rate rising to 9.3%. (It's currently 3.3%)
- Gross Domestic Product contracting by 5%
- The OCR peaking at 5.5% and the 2-year mortgage rate at 8.4% (the average bank 2-year rate is currently 5.8% but the big five banks all have rates above 6%); and
- In addition to the economic scenario, banks are impacted by and required to model a 1-in-25-year cyber risk event.
This scenario causes aggregate bank impairment expenses of $20.8 billion over four years, compared to the $1.7 billion real impairment cost of the COVID-19 pandemic over the last four years, the Reserve Bank says. Banks sink into the red in year two of the four-year stress test.
"The combination of negative economic growth, rising interest rates and increasing unemployment lead to high levels of defaults whilst falling asset prices reduce the collateral banks hold to minimise losses in the event of a default. The cyber event leads to aggregate costs of $1.3 billion," the Reserve Bank says.
"The stress test results and sensitivity analysis we requested banks to carry out suggests unemployment was the main factor driving higher residential mortgage customer defaults. However, mortgage rates became an important driver of defaults as they increased above 6% to 7%, consistent with test rates that large banks have used since 2019 for their affordability assessments of mortgage applications."
Difficulty for banks in modelling the impact of higher interest rates
The Reserve Bank says banks noted the difficulty in modelling the impact of higher interest rates, given the lack of historical data. This seems surprising given the rise in interest rates leading up to the Global Financial Crisis (GFC) when the OCR peaked at 8.25% between July 2007 and July 2008.
"This highlighted some limitations for the stress test modelling of new economic risk factors. A number of banks indicated they are investing in their modelling capability and that this stress test proved a useful exercise," the Reserve Bank says.
"This was the first stress test conducted under the new capital framework that requires banks to hold more capital in the future. The combination of this stress event and rising capital requirements could make it difficult for banks to meet the new capital requirements when they are fully implemented in 2028. Our annual stress test will continue to be used to monitor this transition risk."
The Reserve Bank says the results of the stress test show the NZ banking sector "well placed" to withstand a stagflation scenario of high inflation and low or negative economic growth, which it partly attributes to the build-up of regulatory capital requirements since the GFC.
"The aggregate Common Equity Tier 1 ratio in the stress test fell 3.3 percentage points to a minimum of 8.9% before mitigants, as shown in Figure 1 [below], well above the 4.5% regulatory minimum. The results before mitigating actions leave sufficient capital for banks to continue lending while maintaining capital ratios above the regulatory minima. That said, this would be a challenging macroeconomic environment for households and businesses with a large number of bank customers unable to repay their loans and experiencing large declines in wealth," the Reserve Bank says.
"The results of this stress test show that in a severe scenario with higher interest rates and a severe economic downturn, losses would reduce bank capital buffers. In the stress test the buffers were used as they were designed to be during a period of stress. In aggregate, banks would be able to continue to operate but some would face more stress than others. Most banks would need to initiate mitigating actions such as capital issuance, distribution restriction and expense reductions to replenish their capital buffers and to meet the rising capital requirements being implemented in accordance with the revised capital adequacy framework."
The 2022 Reserve Bank stress testing programme included the annual solvency stress test covered in this article and reported by the Reserve Bank here, plus a liquidity stress test, and a residential mortgage portfolio sensitivity to flooding risk test. The "high-level results" for the latter two will be reported in the Reserve Bank's Financial Stability Report on Wednesday.
The Reserve Bank describes the solvency stress test as "predominantly a bottom-up exercise where banks use their own modelling, in many cases on a loan level basis, to estimate the impact of the Reserve Bank’s prescribed scenario on capital ratios."
It notes this is the first time it has publicly released the instructions and templates used to conduct the solvency stress test.
*This article was first published in our email for paying subscribers. See here for more details and how to subscribe.
1 Comments
Conducting stress tests are always a good exercise, I wonder how effective the suggested mitigating actions (noted in the article) would be given that many of the banks owners would likely be going through a similar scenario ... increasing rates etc. or may not have the desire to inject more capital leaving it to the Govenrment to find a solution. Wonder if the stress test extended to key stakeholders/owners. If things were that bad it's probably unlikely that Mum & Dad investors would come the rescue !
We welcome your comments below. If you are not already registered, please register to comment.
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.