Managing Operational Risk in Banks Bangladesh.pptx

Operational Risk For Banks in Bangladesh

1. Overview of Managing Operational Risk, Roles and Responsibilities of the Senior Management. K S Omar Faruk FCA SVP & Head of RMW

2. Operational Risk In Banks Operational risk is defined as the risk of unexpected losses due to physical catastrophe, technical failure and human error in the operation of a bank, including fraud, failure of management, internal process errors and unforeseeable external events. Operational risk in banks is the risk of loss stemming from ineffective or subpar internal systems, processes, or people or external systems or events. It encompasses various threats, including fraud, cybersecurity, third-party risks, regulatory compliance, and operational disruptions, requiring proactive management strategies. Banks face persistent challenges in fraud prevention, managing third-party relationships, safeguarding against cyber threats, ensuring regulatory compliance, and mitigating operational disruptions.

3.   Operational Risk Operational strategic risk   The risk of choosing an inappropriate strategy in response to environmental factors, such as: Political Government Regulation Taxation Societal Competition, etc     Operational failure risk   The risk encountered in the pursuit of a particular strategy due to People Process Technology/system  

4. Top Operational Risks in Banks Fraud and Financial Crimes Fraud and financial crimes remain at the forefront of operational risks faced by banks. This encompasses a wide range of illicit activities, from identity theft and forgery to embezzlement and money laundering. The intricacies of these crimes often involve sophisticated schemes and the exploitation of any loopholes in the bank’s security measures. What makes fraud particularly damaging is its dual impact; immediate financial losses combined with long-term reputational damage that can erode customer trust. Moreover, the rise of digital banking, while convenient, has opened new avenues for fraudsters to exploit, demanding that banks invest in advanced detection and prevention technologies. W ith the rise of Generative AI tools in conversational contexts, bank customers may be unaware of what is a system-generated piece of communication, and what is a scam, resulting in significant additional risk.

5. Event Type Business Line Scenario Descriptions Type A: Internal Fraud Corporate Finance Fraud Embezzlement Failure to follow procedures/limits Trading & Sales Unauthorized trading/rogue trader Misappropriation of assets Breach of trading limits Retail Banking Theft of customer data/information Embezzlement Theft of assets Commercial Banking Fraudulent transfer of funds Embezzlement Theft of customer funds Payment and Settlement Payment fraud Theft of client funds or assets Asset Management Unauthorized trading activities Not allocated to any business line Embezzlement Misuse of confidential information Misappropriation of assets

6. Type B: External Fraud Corporate Finance Client misrepresentation of information Theft Investment (Loan) fraud Trading & Sales Investment (Loan) fraud Cybercrime Forgery Retail Banking Cybercrime Cheque fraud Theft of information/data Commercial Banking Fraudulent transfer of funds Investment product fraud (Investment, L/C, guarantees) Payment and Settlement Payment fraud Not allocated to any business line Investment (Loan) fraud Cybercrime Robbery

7. Cybersecurity threats In the digital era, cybersecurity threats loom larger than ever, with banks being prime targets due to the vast amounts of sensitive financial information they hold. Cyberattacks can range from malware and phishing to sophisticated nation-state attacks aimed at destabilizing financial systems, leading to significant financial losses and compromising sensitive customer information. Moreover, compromised customer information can lead to identity theft, fraud, and regulatory penalties.  To combat these evolving threats, banks must implement robust cybersecurity measures, including firewalls, encryption protocols, multi-factor authentication, and employee training programs. it is vital to understand that even the most well-intentioned person may still end up conducting themselves in a way that puts the bank’s cybersecurity measures at risk.

8. Regulatory Compliance The banking sector operates under a tight regulatory microscope. Laws and regulations are not just complex but are also ever-changing, making compliance a significant operational challenge. Banks are required to navigate a labyrinth of domestic and international regulations, from anti-money laundering (AML) laws and data privacy regulations to the Basel Accords and beyond. Non-compliance can result in hefty fines, legal sanctions, and damage to a bank's reputation, all of which can have profound financial implications. For instance, failure to comply with AML regulations might lead to a scenario where a bank is unknowingly used as a conduit for money laundering, attracting not only financial penalties but also causing irreversible harm to the institution’s trustworthiness.

9. Third-Party Risks As banks increasingly rely on third-party providers for a range of services – from IT support to customer service operations – they inadvertently extend their vulnerability to operational risks. These external entities can become weak links in the security chain, where their failure to comply with stringent security measures can result in data breaches, service disruptions, or compliance violations. The challenge lies in the bank's ability to effectively manage and monitor these third-party relationships. Despite rigorous oversight, the interconnected nature of these relationships means that banks can never entirely eliminate third-party risks. Therefore, establishing transparent communication channels and mutual understanding with vendors about risk management practices is crucial for mitigating potential issues.

10. Operational Disruptions This risk is a stark reminder of the vulnerability inherent in every banking institution's day-to-day operations. It could be as simple as a software update gone wrong, leading to downtime in customer service portals, or as severe as a flood crippling the bank's data centers. Several global banks, for this reason, frequently conduct mock drills that simulate threats to Business As Usual. Outside of these measures, banks can also use virtual simulations and team-wide conversations to drive home the ubiquity of operational risks. The implications of such disruptions are far-reaching. Beyond immediate financial losses, they can erode customer trust — a commodity that’s carefully built over years but can be lost in an instant.

11. Identify Operational Risks in Banks Comprehensive Risk Audits At the foundation, banks should regularly conduct comprehensive risk audits. This involves reviewing and documenting all processes, systems, and controls in place across the bank's operations.  Leveraging Risk Indicators Implementing key risk indicators ( KRIs ) is an essential strategy. KRIs can include metrics such as transaction errors, system downtimes, staff turnover rates, etc. – each providing insights into where operational faults might be brewing. Scenario Analysis and Stress Testing Banks benefit from engaging in scenario analysis and stress testing, wherein they model the potential impact of various adverse operational scenarios.

12. Employee Feedback   A valuable but sometimes underutilized method of identifying operational risks is through direct feedback from employees. Those on the front lines are often the first to notice irregularities or inefficiencies that could signify deeper operational issues.  Regulatory Compliance and Industry Benchmarking Keeping abreast of regulatory changes and industry best practices is crucial for banks in managing operational risks. Regulatory requirements often reflect responses to identified risks within the industry and can provide a blueprint for what banks should be monitoring.  Data Analysis and Trend Observation Utilizing data analytics tools to track and analyze historical data regarding past operational risk incidents can reveal patterns and trends that may not be immediately apparent. For instance, if a specific process or system has failed multiple times in the past, it might indicate a higher-risk area that needs immediate attention.

13. Senior Management Oversight The senior management of the Bank shall: Translate the operational risk management framework established by the board into specific policies, processes and procedures to be implemented and verified within the different business and other related units ; Clearly assign authority, responsibility and reporting relationships to encourage and maintain accountability ensuring availability of necessary resources to manage operational risk effectively; Assess the appropriateness of the management oversight process in light of the risks inherent in a business unit’s policy; Ensure that activities of the Bank are conducted by qualified staff with necessary experience, technical capabilities Ensure that the Bank’s operational risk management policy has been clearly communicated to staff at all levels of the Bank that is exposed to material operational risks .

14. Any Question?