APPAE0002
Written evidence submitted by Andrea Enria
Personal
I currently work as a senior advisor for the Prudential Regulation Authority (PRA) and will continue in this role also after the start of my mandate. My time schedule and portfolio will be adjusted to ensure proper segregation of tasks and full capacity to primarily devote time to my new role in the PRC.
As a visiting scholar at the Financial Market Group of the London School of Economics (LSE) I have also developed a project for a forum on financial supervision, which intends to promote debate between academics and policy makers. I plan to be an editor of the forum, soliciting contribution, proposing themes for discussion, summarising the outcome of debates. This role will not be remunerated.
I do not consider any of these tasks to potentially give rise to a conflict of interest, but will of course closely follow any indication provided by the Bank of England to avoid even a perception of conflict.
Yes, my role in the PRC will be my main focus and I am fully committed to serve out the full term of my mandate.
As mentioned in my reply to the first question, I will continue on a reduced schedule to work as a senior advisor for the PRA and will contribute as editor to the LSE’s forum on financial supervision. The time commitment for the PRC will always come first, with additional tasks playing only a residual role.
I have always been working in the area of banking regulation and supervision since my first job at Banca d’Italia in 1988. Throughout my career I have been particularly focused on European and international cooperation, participating in different waves of work on international prudential standards and efforts to enhance collaboration amongst supervisors within the European Union. In my first year in the Supervision Department of Banca d’Italia I was involved in the efforts to liberalise and privatise a banking sector heavily constrained by a Banking Law enacted in the 1930s, which severely segmented the domestic market and impaired competition. The Single Market for banking services was an opportunity to trigger change and open up to international competition. At the start of European Monetary Union I moved at the European Central Bank (ECB) where I then became Secretary of the Banking Supervision Committee, which at the time was the only group gathering central banks and supervisory authorities from European countries. When the Committee of European Banking Supervisors was established in London I took up the role of its first Secretary General and led most of the technical work for a more coordinated implementation of the new international standards. This gave me unique visibility on the variety of regulatory and supervisory practices adopted in different European countries. I also saw first-hand the problems generated by the unwillingness to collaborate across countries in the supervision of large and complex banking groups, which became all too apparent when the Great Financial Crisis hit especially hard those cross-border firms.
When I took up my role as first Chairperson of the European Banking Authority (EBA), newly established as part of the European response to the Great Financial Crisis, I had to struggle with the repercussion of the European sovereign debt crisis and drove a significant recapitalisation of the European banking sector. This was a difficult decision, fraught in political controversies, but I think it was an important turning point in the post-crisis repair of the European banks’ balance sheets. In my role I was also extensively involved in the financial reform process led by the Financial Stability Board and the Basel Committee on Banking Supervision.
My last role as Chair of the Supervisory Board of the ECB gave me additional, in-depth visibility on banking business, by overseeing a very diverse set of banks across the banking union. I was also confronted with the difficult managerial challenge of driving to maturity the Single Supervisory Mechanisms, encompassing also 21 national supervisory authorities that collaborate with the ECB in the day-to-day supervision of significant banks. Direct supervision on a European scale also entailed unprecedented legal challenges, as in some areas the ECB has to apply different national rules according to the country where the bank is headquartered. The challenges raised by the Covid19 pandemic and the spring 2023 turmoil required important adjustments to the supervisory model applied by the ECB, to improve the flexibility in the use of limited supervisory resources and achieve a much sharper focus on emerging risks. I also managed to establish close collaboration with my peers at the PRA and the Federal Reserve, especially focused on the supervision of Global Systemically Important Banks (G-SIBs) and on the challenges of post-Brexit reorganisation of business across UK and EU centres.
During my years at Banca d’Italia and the ECB I was also involved in macroprudential analysis and broader financial stability issues. This experience has been important in framing my approach to banking supervision, with a strong focus on the risk outlook guiding the priorities for supervisory teams.
While I believe that my extensive experience on banking regulation and supervision, also on an international scale, will be an asset for my new role in the PRC, I am also aware that I will have to deepen the knowledge of specific challenges of local UK markets, on the post-Brexit regulatory framework for UK firms and, especially, on insurance supervision, which I so far have only seen through the lens of the supervision of financial conglomerates.
The Prudential Regulation Committee and Prudential Regulation Authority
The PRA is definitely a world leading authority on prudential regulation and supervision. I believe the simple institutional set-up, allocating to the PRA wide-ranging responsibilities for rule-making, supervision and, within the broader set of tasks of the Bank of England, macroprudential supervision and crisis management, has put the PRA at the front of international debates following the Global Financial Crisis. More complex institutional environments, like those in place in the EU or the US, tend to generate a more cumbersome and rigid set of rules and supervisory practices, slower to react to market developments.
I think that thanks to the strong role played by the PRA since its establishment the UK banking sector has significantly improved its resilience, moving to stronger capital positions, addressing promptly asset quality problems, achieving robust liquidity positions. Also the introduction of sizeable macroprudential buffers is in my view an element of strength. The first test of the newly achieved stability was in the immediate aftermath of the Covid19 pandemic, where the stronger balance sheets and the release of capital buffers enabled the banking sector to continue lending to the real economy, thus softening the blow for households and corporates compared to the knee-jerk increase in risk aversion experienced at the start of the Global Financial Crisis. Another important test was the spring 2023 turmoil, when the crisis of Silicon Valley Bank (SVB) and Signature Bank unleashed instability at US regional banks and triggered widespread turmoil, which also led to the demise of Credit Suisse. The UK banking sector navigated well these turbulent waters, with a smooth sale of the UK subsidiary of SVB and no meaningful contagion to the UK banking sector. These episodes also show that a well-capitalised banking sector is key to sustain growth: while the transition to higher levels of capital might have implied some adverse impact on lending and growth, once the higher levels are achieved and maintained they enable banks to soften the impact of exogenous shocks on the economy. Another ingredient of the PRA’s success is the excellent framework for international cooperation with other supervisory authorities and central banks, which was key in dealing with these shocks.
The international leadership of the PRA is built also on its intellectual capacity to address complex issues in a structured and pragmatic way. The extraordinary blend of skills and experience available in its staff enables the PRA to be ahead of the curve, raise fundamental issues at international tables, and lead in the search for effective and efficient solutions.
Another element of strength is in the relationship with the industry. Differently from other jurisdictions, where the relation between supervisor and supervised entities is often adversarial in nature, the PRA has built its engagement with firms on extensive dialogue and reciprocal trust. As firms generally recognise the strong standing of the PRA, unwillingness or inability to address the issues highlighted by the supervisors would carry reputational risk. This is a model that works well, but it requires a continuous attention to maintain a clear distinction in roles, a distinct capacity to challenge poor industry practices and an ability to escalate supervisory action when warranted.
Areas where more work remains to be done are internal governance, risk controls and business model sustainability, where persistent shortcomings are often identified. These are areas of attention also for other supervisory authorities – the ECB also has the highest number of supervisory findings in these areas, and a similar conclusion applies for the US authorities. Weaknesses in these areas are not easily remediated, unless firms’ boards take full ownership. A number of tools are being tested to obtain faster progress in these areas, but the root causes often lay in the firm’s risk culture, which is not always amenable to be treated with traditional supervisory tools.
As to the PRC I believe its role and set-up are a best practice across supervisory authorities. In other jurisdictions decision-making bodies of supervisory authorities are generally composed only of supervisors and very seldom encompass also independent members. The balanced composition of the PRC, with a blend of supervisory, central banking and industry experience and a good balance of executive and independent members, ensures appropriate debate and challenge. This is what supervisors asks of firms, it is good practice that they live up to the same expectations.
Discharging supervisory responsibilities entails access to a large amount of confidential information, which doesn’t enable the same amount of transparency that is asked of other central banking and more generally public functions. I am not aware of supervisory authorities publishing minutes of their meetings, although some arrangements for accountability are sometimes in place to ensure confidential discussions (e.g., when at the ECB I used to hold “in camera”, non-recorded, confidential meetings with a dedicated committee of Members of the European Parliament). Still, I developed a deep conviction that financial supervisors should also enhance the level of transparency on the conduct of their functions. During my time at the ECB I declared that promoting greater transparency was one of the key objectives of my mandate and I think I delivered on my commitment. The amount of information that the ECB discloses on its supervisory practices, processes and outcomes has significantly increased during my tenure, of course always respecting the need not to make individual firms’ information visible to the general public. I also grew convinced that supervisors should embrace some form of “forward guidance”, as developed in monetary policy: in particular, this means clearly identifying and communicating the priorities for risk-focused supervision for the coming year, together with a series of horizontal analyses and targeted reviews that enable to sharpen the focus on those areas and communicate on outcomes. I notice that also the PRA has a practice of sending letters to firms fleshing out the focus of supervisory activities for different types of firms in the year to come, with the Annual Report providing details of the way in which the PRA discharged its responsibilities. Given the sensitivity of the supervisory function I believe that there should be an on-going debate as to how the right balance between confidentiality and transparency can be achieved.
I do not plan to give speeches or seek visibility in the public debate. I view my role in the PRC more oriented to foster the internal debate, which I consider a vital element for the effectiveness and efficiency of prudential authorities. I would however always be available for informal or formal discussions with members of this Committee, if these are seen as potentially helpful and supportive of effective accountability.
The PRA has taken into consideration the competitiveness and growth objecting in its proposal to implement in the UK the final Basel III package. In some areas, this implied deviating from the international standard to ensure lighter overall capital requirements for lending to sectors that are viewed as critical for growth (lending to small and medium enterprises, infrastructure financing, trade financing). In order to enhance the attractiveness of the UK as a financial centre the bonus cap has been removed and the deferral periods are being shortened. Proportionality of the prudential framework is being enhanced with the “Strong and Simple” framework for small domestic deposit takers. More generally, prominence is being given to cost-benefit analysis with the establishment of an independent panel. Internal training is taking place to increase the understanding of the secondary objective across the PRA staff. A research network is also being set up to assist the PRA in its implementation of the secondary objective. The shift in regulatory policy to fulfil the secondary objective looks quite far-reaching to me.
I have consistently argued in favour of a loyal implementation of international standards across all jurisdictions and remain convinced that this would be an ideal outcome to ensure robust prudential standards and a level playing field supporting cross-border business at the global level. However, I understand that most jurisdictions have chosen areas in which targeted deviations from international standards have been introduced, to support lending in specific lines of business. What remains essential is that all jurisdictions remain broadly compliant with international standards and that prudential requirements are not seen as tools in a race to the bottom, which would be detrimental for financial stability. The approach adopted by the PRA seems balanced to me.
I am particularly supportive of the PRA intention to identify areas in which requirements are generating unduly high compliance costs, which could be contained with no detriment for the safety and soundness of regulated firms. Supervisory reporting is a clear area where improvements could and should be achieved in a way that supports the secondary objective. I understand that a significant downsizing of reporting requirements has already occurred for insurance companies; in all likelihood there is room to obtain an equally sizeable reduction also for banks.
More generally, it is undeniable that the post-crisis reforms made the regulatory framework much more complex. I see room for a simplification effort, for instance in the stack of capital instruments that can be used to fulfil capital requirements, capital buffers, and minimum requirements for own funds and eligible liabilities (MREL). I understand however that continuous change in the regulatory framework by itself generates significant adjustment costs for regulated firms and would argue that some self-restraint in the issuance of new rules could probably serve best the objective to support growth and competitiveness.
Regulatory and policy issues
I particularly appreciate the extensive reliance of the PRA on supervisory judgment, within a clear set of rules and supervisory expectations. This is in my view superior to other approaches more based on “tick-the-box”, rules-based supervision, which are less capable of focusing on emerging risks and tend to be heavier in terms of compliance costs placed on supervised entities. This is visible in a number of areas, but particularly effective in the vetting of senior management at regulated firms. The UK Senior Management and Certification Regime is an important reference for reforms that have been introduced or are being considered in other jurisdictions. But besides the regulatory framework what is key is effective supervision, the ability of supervisor to challenge the choices of key function holders at regulated firms when these do not give sufficient reassurance in terms of effective governance, professional skills, matching with the firm’s needs, and ethical standards. The respect the PRA elicits from regulated firms and the proportionality with which this delicate function is being carried out is an example for many other supervisory authorities.
In light of the global scale of the London financial marketplace, supervision of market risk and the policing of the interface between banks and other, less- or non-regulated financial institutions is particularly strong at the PRA. The recent System-Wide Exploratory Scenario (SWES) has established a world-leading practice, which is now considered also in other jurisdictions to assess risks arising from the interaction between banks, insurance companies and other types of intermediaries and financial market infrastructures at times of stress.
Another area in which the PRA has developed world-leading practices is in my view the assessment of operational resilience, a topic that is due to gain more and more relevance in the years to come. The PRA has developed a well-structured supervisory approach, has made its supervisory expectations clear already back in 2021 and since then it has been closely monitoring the progress achieved by firms. The risk of cyber-attacks has been at the forefront of financial firms’ and their supervisors’ concerns for some time, but it has become even more prominent considering current geopolitical tensions. The recent emphasis the PRA is putting on supervision of critical third parties is also extremely appropriate and calls for close collaboration with other key jurisdictions.
I believe the PRA, as other supervisory authorities, will have to devote more attention to climate risk going forward. Physical risks are clearly on the rise and although global political alignment on net-zero objectives is faltering there will be a multi-speed transition which will be difficult to manage, especially for financial firms operating across multiple jurisdictions. While important messages have been conveyed by the Bank of England to financial firms, there is still some way to go to set clear supervisory expectations for the management of climate risk.
Another challenge I think lies in the development of Supervisory Technology (so-called SupTech) instruments. My impression is that other supervisory authorities invested more on Generative Artificial Intelligence (GenAI) tools for supervision, aimed both at simplifying supervisory processes and at sharpening supervisory analytics. It is my understanding that the Bank of England is now launching an important revamp of its data infrastructure, which could provide an opportunity to set in place a more robust framework for supervisory analysis.
The measurement of operational risk is a difficult challenge for supervisors. The large set of alternative methods to compute capital requirements for operational risks, and especially the possibility to resort to sophisticated internal models developed by the firms themselves, failed to deliver the expected results and international consensus has been easily reached at the Basel Committee to transition to a single, much simpler standardised approach. The implementation of the new international standards in the UK will adopt this simpler method. Admittedly, the metrics used in the calibration of capital requirements are rough estimates of operational risk, based on profitability level in different business lines, under the assumption that size and levels of activity are acceptable proxies of complexity.
I think the PRA correctly shifted focus from the ambition to precisely measure operational risk to a supervisory approach based on a variety of tests and focused on operational resilience, i.e. the ability of firms to withstand shocks and maintain critical functions in operation. As mentioned above, I consider the framework developed by the PRA, based on the identification of important business services, the definition of impact tolerances, and mapping and testing the ability of firms to stay within tolerances, as the most advanced approach developed by a supervisory authority to protect firms and the financial system from the materialisation of operational risk.
If we look back to the major episodes of failures at financial firms, we can always identify a root cause in poor culture – especially risk culture – and ineffective governance. This was the case for Credit Suisse, which had experienced a series of loss events without being able to fix the cultural issues that eventually led to its crisis. Interestingly enough, an independent report commissioned by Credit Suisse had clearly identified the shortcomings in internal risk controls, but when issues are so deeply ingrained in a firm’s culture remediation requires a strong common understanding from all levels within the firm – Board, senior management, middle management and staff. Also US regional banks showed widespread weaknesses in internal governance and a culture that was always oriented to growing the balance sheet, with little attention paid to the levels of risk. The role played by warped incentives embodied in remuneration packages was also a widespread cultural weakness that played a major role in the build-up of the Great Financial Crisis.
Culture is a difficult area for supervisors to intervene. It is not easy to show evidence of an inadequate risk culture, as most frequently poor behaviour and decision making are driven by internal non-codified norms, behaviours and attitudes. Hence the first challenge is to develop a thorough analysis that triggers reflections within and actions by the firm’s board and senior management, thus effectively driving cultural and organisational change. Several tools are being tested by supervisory authorities. When I was at the ECB I benefited from the input provided by a specialised team of behavioural and organisational psychologists at De Nederlandsche Bank, who engaged in a specific programme covering a few banks. They observed Board and Board Committees meetings, engaged with senior and middle management, ran surveys with staff and eventually provided an independent assessment of each bank’s risk culture. In some cases Boards found the findings very useful and took ownership of the problem, thus becoming a force for change. I am aware also that some private companies are developing metrics based on the analysis of communication within firms (using only metadata) to identify areas of weakness. This is a topic I am passionate about and look forward to opportunities to discuss it at the PRC.
The use of Artificial Intelligence (AI) by financial firms is expanding fast. On the positive side, this could push banks to invest more on the quality of their data and the reliability of their data infrastructure, an issue that has been very high on the supervisory agenda for some years. The deployment of AI for standard, repetitive tasks could also free resources for more substantive work, including risk management. More timely, tailored data analytics might support effective decision making at financial firms – for instance, firms might run more frequent stress test scenarios, tailored to their specific business model. However, there are also a number of risks supervisory authorities should be alert to. First, the expansion in the use of AI is relying to a significant extent on the provision of services by specialised third parties, creating potential vulnerabilities to operational risk. Second, if the commercial drive prevails over the risk management objectives, AI tools might be applied without due attention to the quality of the underlying data, which in turn could lead to poor automated decisions. Third, the typical black box nature of GenAI tools might reduce the ability of management and staff to understand the functioning of models and apply the appropriate oversight. As a result, a firm might be less in control of its own risk appetite.
While the PRA and the PRC should be careful not to hinder the ability of regulated firms to experiment powerful new technologies, they should request that appropriate attention is paid to the potential risks. The PRA’s work on critical third parties, on compliance with the Basel Committee’s Principles on data quality and risk aggregation and on the quality of internal controls should provide all the supervisory tools needed to monitor new developments linked with the use of AI by regulated entities.
I also think the PRA should pro-actively invest in AI as a tool to enhance efficiency in processing administrative work and in sharpening its own supervisory analytics.
While post-crisis financial reforms led banks to operate with higher levels of capital, the overall amount of leverage in the financial system has kept steadily increasing at the global level. A stronger role for non-bank finance was an intended goal of regulatory reforms, to diversify financing channels and disseminate risk across a wider set of investors with more stable sources of funding. However, there is a concerning increase in concentration over several dimensions – in the provision of liquidity to key market segments, in equity market capitalisation, in market behaviour with the growing role of Exchange-traded Funds (ETFs) and passive investing, in sponsors and valuers in private markets. There is also increasing evidence that highly leveraged borrowers, which lost access to bank financing, are increasingly relying on private credit, with contractual provisions that risk creating leverage spirals. These non-bank actors are not directly subject to PRA supervision, but there is evidence pointing to a relevant role of banks in financing their activities, especially in repo markets. The PRA has already sharpened its focus on prime brokerage activities of banks and on their exposures to counterparty credit risk. I think these areas of supervisory activity need to remain prominent at the current juncture of the credit cycle.
February 2025