Roadmap for Virtual Banks in Hong Kong

After the Hong Kong Monetary Authority ("HKMA") granted licenses last year, virtual banks ("VBs") in Hong Kong SAR have been making progress in preparation for their official opening to retail customers: earlier this year, some started allowing selected users to test their services, such as remote account opening, multicurrency savings account, time deposits, local transfers and e-statements.

While VBs have been focusing on attracting customers and developing business strategy, it is also equally imperative that they turn their attention towards sound risk management. VBs will need to implement several important policies and frameworks because, as their customer base and service offering grow, so too will their need for a robust governance framework with adequate and effective management of various risks.

In this article, we will discuss the following key risk management policies and frameworks that VBs should look to implement within the first year of operation:

• Problem Credit Management;
• Internal Capital Adequacy Assessment Process ("ICAAP");
• Recovery Plan; and
• Stress Testing Programme.

Problem Credit Management

A comprehensive problem credit management framework can help VBs protect their profitability (through minimizing both the need to make provisions and the carrying cost), preserve their liquidity, and reduce the amount of time and attention required to manage problem credits.

By developing and implementing procedures and information systems to monitor the condition of credits and obligors across portfolios, VBs will be able to identify problem credits in their early stages and manage out such positions to minimize credit losses. VBs should set up an independent and dedicated unit to handle the restructuring and recovery of problem credits; at the same time, VBs should also set up guidelines, criteria, and trigger points for identifying and transferring credits to the problem credit management unit, where a structured process should be in place for further review and assessment.

ICAAP

ICAAP, as its name suggests, consists of internal procedures and systems that ensure that VBs understand the risks embedded in their business strategies as well as possess adequate capital to cover all material risks identified by themselves.

While Pillar 1 risks cover credit, market, operational and sovereign concentration risks, ICAAP takes into consideration other risks faced by VBs and how well those risks are being managed. ICAAP helps VBs evaluate the extent to which they are required to hold more capital to cover those risks (i.e. the Pillar 2 capital requirement), such as interest rate risk in the banking book, liquidity risk, strategic risk and reputation risk.

Through the establishment of an ICAAP using scorecards, calculation templates and industry data, VBs will be in a better position to understand their actual risk profile and assess their overall capital adequacy accordingly. They will also be able to benchmark themselves against peers within the industry. Based on the assessment results, VBs can then identify potential vulnerabilities and develop better risk management strategy for maintaining the required level of capital.

Recovery Plan

The main objective of recovery planning is to ensure that financial institutions, including VBs, are well prepared to react quickly to, and to recover from, severe stress, through their own actions. Given this objective, recovery planning should focus on formulating possible courses of action a financial institution may feasibly take in a range of stress situations to restore its financial strength and viability and thereby maximise its prospects for survival.

A comprehensive recovery plan can help reduce disruption to critical services that are vital for the day-to-day operation of VBs. More importantly, the recovery plan should be fully integrated into the VB's overall governance framework, which should cover (i) the development, review, approval, and ongoing maintenance of the recovery plan; (ii) the monitoring process for triggering the recovery plan; and (iii) the activation of the recovery plan.

Stress Testing Programme

A stress-testing programme represents an integrated strategy, by means of the origination, development, execution and application of a suitable range of stress tests, to achieve a range of objectives, including:

• Providing an assessment of a VB’s risk exposures under stressed conditions and enabling the VB to develop appropriate risk-mitigating strategies and contingency plans across a range of stressed conditions;
• Improving the VB’s understanding of its own risk profile and facilitating its monitoring of changes in such profile over time; and
• Feeding into the VB’s capital and liquidity planning and strategic decision-making processes.

By embedding a stress-testing programme in their governance and infrastructure, VBs can achieve comprehensive coverage for their stress-testing with respect to different types of risks, using both quantitative (e.g. sensitivity tests, scenario analyses and reverse stress tests) and qualitative (e.g. judgement and perspectives from relevant experts) techniques. Furthermore, VBs should look to develop formal processes, policies and procedures to properly outline the approaches and methodologies adopted in the stress-testing programme.

How Deloitte Can Help

The lean operating model and high automation of processes certainly give VBs cost advantage over established brick-and-mortar banks. However, with regulatory expectations from the HKMA being that VBs abide by the same risk management practices and standards as a physical bank, this can pose challenges for VBs who by design have less staff to manage risks.

Also, VBs are part of a larger push by the HKMA via their smart banking initiative to digitise banking in Hong Kong and to expand financial inclusion. Therefore, it is even more important that VBs manage their risks properly, given that a larger-than-normal segment of the customers that sign on to VBs will likely be from vulnerable groups who will face outsize impacts of any missteps on VBs' side.

Our expertise and experience with financial risk management allow us to support clients with a broad range of services that are tailored to VBs' specific needs, including:

• Development and review of credit risk management framework relating to drawdown and post-lending monitoring and controls; 
• Model development, implementation and validation on scorecards, internal ratings, and ECL models; 
• Assessment of loan classification & adequacy of impairment allowance;
• ICAAP design, implementation and assessment;
• Design and implementation of recovery and resolution plans, as well as recommendations with respect to information disclosure; and
• Setup of stress test framework such as risk management framework for credit risk and asset liability review, regulatory and country wholesale credit risk stress testing, independent review on operational risk management, and retail banking stress testing support.

Deloitte's approach takes all of the components required to deliver a client outreach project, and wraps them up together as a single service. We can help clients chart a path that is most suited to their organisation's specific needs.