21-07-2025
Why are banks letting a useful tool for risk management gather dust?
The term 'risk appetite'(RA) gained currency after the 2008-09 financial crisis that began in the US. In 2013, the European Banking Authority (EBA) and Financial Stability Board (FSB) were the earliest regulators to include RA in formal regulatory asks.
The Reserve Bank of India (RBI) in its 2014 Master Circular on Basel III Capital Regulations articulated the need for banks to document their RAs clearly. Bank boards and their managements are expected to set risk limits and lay down the types of risk exposure they plan to take in pursuit of profits.
This is to be formally documented as a Risk Appetite Statement (RAS) and monitored for any breach. It calls for an upfront resolve that the bank will not take certain types of risk and keep those taken within the ambit of its stated risk appetite.
Since some forms of lending are highly profitable in times of an economic boom but can erode more capital than the profits made if and when the cycle turns, an RAS encourages thinking beyond the short-term.
The act of stating what level of risk the bank's board acknowledges as being borne by the business heightens the awareness of risks and ensures capital planning to cover them.
To achieve their objectives, RAS limits and thresholds must be unambiguous, granular and quantitatively robust. However, that is often not the case.
Also Read: Devina Mehra: Why investing in a bank often takes nerves of steel
RAS as a neglected risk management tool: The actionability of a risk appetite statement has remained an issue. Globally and in India, only a few exemplar banks have well- designed, strategically relevant and definitive statements. In such cases, the RAS drives the strategic planning exercise.
Further, enterprise-level thresholds cascade to the business-unit level, translating into growth projections, capital requirements and risk guard-rails for each unit.
In contrast, at banks where the RAS serves only as a regulatory tick box, the strategy planning exercise rarely refers to the statement and business-unit level planning and risk-taking are not aligned with enterprise-level risk limits.
At times, business unit heads are not even aware of how the enterprise-wide risk appetite applies to their operations. This leaves the board with limited control over the risks the bank actually ends up taking.
Banks need impactful risk appetite statements. Let's focus on three aspects.
Also Read: Banking on trust, losing billions: India's bank fraud epidemic needs urgent answers
Explicit quantitative thresholds: Let's take the capital adequacy ratio (CAR), a common metric of a capital cushion to absorb losses. RA thresholds are often set on these. Say, the regulatory minimum CAR is 12% of risk-weighted assets.
A bank cannot have a business plan that will cause its CAR to fall below 12% in an adverse situation of loans going bad. If a hypothetical Bank XYZ's CAR is 18%, to set a CAR threshold, it may take the average of the two (i.e. 15%) or review its historical CAR level and limit it to the average of that.
Or it could take a number between its historically lowest CAR and its average. While this sounds comforting, such approaches lack economic rigour and risk relevance.
Typically, for a healthy bank, the minimum capital to be held as directed by CAR regulation should be higher than its economic capital (EC), or the amount of equity required by the bank to cover a loss of 1-in-1000 odds, stylized as a 'once-in-1,000-years loss.'
Likewise, a bank could take multicycle loss data to—adjusting for the fat-tail nature of credit losses—estimate the size of a 1-in-3 odds loss.
If such an event reduces the capital cushion by a sum that hits the bank's CAR by one percentage point, then an RA limit set at 13% implies a 1-in-3 chance of dropping below the 12% regulatory minimum. Such a choice suggests a very high risk appetite.
What would a conservative bank with a lower risk appetite do? If a 1-in-20 shock (much less likely to happen) is estimated to hit the CAR by 4 percentage points, it could set an RAS threshold of 16%. Either way, for the RAS to work meaningfully, the bank must make an explicit choice.
Also Read: Needed: A hard policy reset to make Indian banks shape up
Risk-adjusted performance measures: The Risk Appetite Statements of banks often have return-on-asset (RoA) and return-on-equity (RoE) thresholds. But this does not allow the estimation of capital consumption at the business-unit level.
For this to be done, banks must calculate return-on-economic-capital (RoEC). This would help in measuring the economic value added at the business-unit level and thus help both in improving capital allocation and ensuring that the RAS cascades through the bank.
Stress testing: Bottom-up portfolio-wise stress tests should be carried out to estimate the sensitivity of the bank's losses to relevant macroeconomic and geopolitical factors. This is critical to simulate and assess how a portfolio growth strategy will impact losses during a downturn.
While banks perform stress tests to meet regulatory requirements, there is scant evidence that this exercise has been integrated with their RAS and strategic planning processes.
Most banks perform 'static' stress tests, with their capital sufficiency tested under the assumption of, say, an X% surge in bank-wide losses.
Also Read: IndusInd saga: No escape from heightened bank vigilance
Banks must shift from treating the RAS as a tick-box routine to using it as a steering wheel for their strategy in the context of risk control. Without a functional RAS, a bank's board cannot properly supervise the risks being taken by business units in their rush to meet short-term targets.
When stakeholders are hit by earning shocks or adverse disclosures, bank boards are often just as surprised as shareholders and the regulator. A well- designed Risk Appetite Statement could tackle this problem and result in markedly safer banking.
The author is a quantitative risk management professional and a visiting faculty of risk management at IIM Calcutta.
