What exactly is “regulatory risk”?

I must admit that I cringe every time I hear the phrase “regulatory risk”. In the days when I was a banking supervisor, I saw my role as being to help maintain the stability of the financial system and to represent the interests of depositors/the public, and I would have been mortified to think that I constituted a source of “risk”. But I guess times have changed, supervisors/regulators now play a more interventionist and obtrusive role, and more commonly fine and/or “name and shame” transgressors, such that supervised institutions now see the risk of upsetting the regulator as a significant issue.

So, what exactly is “regulatory risk”? Is it, as I allude to above, simply the risk that the regulator will take actions against a supervised institution that affect its reputation and standing, and possibly its financial position (e.g. fines, public censure, restrictions on business, withdrawal of licences)?

This may be what many have in mind when they talk about “regulatory risk”, but I think there are at least two further aspects. One is the risk (which I’ve mentioned before) that regulators will not put in place a regulatory regime that promotes business and innovation, such that supervised institutions’ business suffers, or that regulators are arbitrary, inconsistent or politically-influenced, which again can affect business (as well as affecting the jursidiction’s attractiveness as a financial centre). In short, if the quality of supervision/regulation is poor, this is a risk for supervised institutions.

Second is the risk that regulators will issue so much regulation that supervised institutions spend too much time focusing on compliance with regulatory requirements and too little on business, on strategy, and on customers. I have heard this complaint a number of times over the years, and it is one with which I have some sympathy. Certainly, contrary to all the good stuff regulators have put out on corporate governance, it sometimes seems like the regulators themselves have as much of a role in running a bank as the bank management/owners!

So, to my mind, regulatory risk is not just the risk of being caught out by the regulator on some compliance issue and made to pay; it is as much about the risk that poor regulation or over-regulation poses to business, to market confidence, and to institutions being able to develop their own strategy and manage their risk in their own way.

This is why two of the best regulators regionally (in fact, globally) – the Monetary Authority of Singapore and the Hong Kong Monetary Authority – focus so much on the implementation of international standards, on governance and culture, and on ensuring consistency, fairness and transparency in their supervision, such that the regulatory regime represents a positive, not a negative, for financial stability, for depositors/the public, and for business.

Sure, both can be very tough when necessary, and supervised institutions are certainly extremely wary of the risk of getting on the wrong side of them. However, at the same time, this approach reduces the "regulatory risk" for institutions operating in their respective markets, by providing market confidence that regulation will be firmly-based on international best practices and will provide an appropriate environment for their business...