Keeping your money safe – In Conversation with Sharon Donnery

Banks sometimes can be overly optimistic and they think things will work out in in too positive a way. So, please go away and look at different scenarios that might happen in the world. War, um cyber attacks, so anything to do with geopolitical type shocks. And what we've seen in the last couple of years, I think has been a big increase in scams, in frauds, in attempts, you know, to use the customer as a way to get at bank accounts or to get at a bank details. >> Now, as you may be aware, the world has become a dangerous place. Wars, cyber attacks, energy shocks are in the news. The question we're going to ask is what do they mean for our savings, our mortgages, and the banks we rely on every day? In short, are Europe's banks equipped for stormy weather? That's the question I'm putting today to Sharon Donnery, a member of the board of the European Central Bank that supervises our banks and has been stress testing them in a special uh way. Well, you're listening to Euro Matters, a podcast by the European Central Bank, and my name is Paul Gordon. And Sharon, thank you very much for joining us today. >> Delighted to be here. Thank you. >> This could be an interesting one cuz you've just completed a geopolitical risk reverse stress test. Now, I want to keep the viewers here. Don't want to scare them away. Let's break that down. What is a reverse stress test? >> Yeah, well, I suppose maybe just to take even a step further back before we talk about what a reverse stress test is. Just to say a word about stress testing because you mentioned in your introduction there how uncertain the world is at the moment. So, one of the key tools that we have here at the ECB, and in fact is used also by supervisors all around the world, is this idea of a stress test. So, to look at what if What if things happened, what would happen in our banks, and how would they manage that? It's very important for us here at the ECB because we want to make sure that the banks can keep the savings of all of our listeners and viewers today uh safe and sound. So, one of It's one of our our key tools, and we do these stress test exercises every year. And but this year we decided to do exactly what you said. It's called a reverse stress test. So, in a normal stress test, what we would do is we'd say to the banks, "Imagine certain things happened in the world. Imagine growth went down. Imagine unemployment went up. Imagine house prices went down, for example. What would happen to your banking business in this scenario?" And we give this same scenario to all the banks and we ask them to look at what happens in that case. In a reverse stress test, we sort of turn it upside down if you could imagine. So, what we do is we say to the banks, "Imagine you had a big financial shock." And we give them a description of that shock. How much capital would you lose? You don't have to worry about the details too much, but what You know, you got this big shock on your your business. What would cause this shock from a geopolitical point of view? So, please go away and look at different scenarios that might happen in the world. War, um cyber attacks. So, anything to do with geopolitical type shocks. And then come back and tell us what shocks you've looked at, how they affected your business, and most importantly, if those shocks happened, how would you manage them? What would you do? How would your bank respond? So, that's the idea of this reverse stress test to look at how this uncertain world might play out in different ways to affect the bank and then what the bank would do in that scenario. >> Okay. Um I have some questions about how the banks would deal with that. But first, let's look at the scenarios that they thought were out there that would So, do you You're asking them to invent scenarios that would hit their business. What did they come up with? >> Yeah, so there was a broad variety of scenarios I would say. So, obviously in the last number of years there's been a lot of issues about trade, trade conflicts, tariffs, for example. So, a lot of the banks looked at scenarios around that. Um since the horrendous invasion of Ukraine, obviously energy has come much more to the fore. So, some of the banks looked at energy shocks, supply shocks. I mentioned cyber attacks a moment ago. So obviously many banks now highly dependent on IT for example. So many of them looked at cyber shocks, wars. So there's a very broad range of scenarios. And then they looked at different things that these scenarios might cause. So they might cause for example an economic slow down or a recession. They might cause inflation to be higher for a long period of time. And one scenario of course and I mean we got a lot of questions about it here at the ECB during the stress testing exercise was about the situation in the Middle East and the Straits of Hormuz. So about a quarter of the banks in actual fact looked at scenarios that were about the the Middle East. Now I think it's really important to say to the viewers and listeners today this is not a test to predict the right scenario. You know, we weren't asking or expecting that every bank was going to come up with the same idea or the same scenarios. What we really wanted was the banks to think about their own business, their customer base, the countries that they're operating in, the currencies that they're operating in, whatever their own business model is. And what was the scenario that would most affect them. So it's not a kind of pass-fail exercise where you get you know, oh they predicted the right one. That's really not what we were looking for. And in actual fact I think one of the big pluses from our point of view here at the ECB is that we have seen this very broad range of scenarios across all of the different banks. And then we can also look at how the banks went through these scenarios and and how they worked out. >> Okay. So yeah, no prizes for saying yes you predicted the war. Congratulations. You predicted a cyber attack. Congratulations on that. But they do need to say right this is how it's going to affect us, right? And you did and so what is known as a transmission channel for the shock. You they have to look at particular ones. What were they looking at? >> Yeah, so this geopolitical reverse stress test is not the only piece of work that the ECB is doing around geopolitical changes. So I think we all know that over the last number of years, you know, there have been big changes in the world from a geopolitical point of view, and we expect these changes to continue. I mentioned things like trade shocks and tariffs, for example, earlier on. Um so, as an example. So, this is one piece of work we're doing in relation to geopolitical risk. But, another piece of work that we've done in relation to geopolitical risk is this channels idea that you just mentioned. So, this is the idea that a shock happens like the war in the Straits of Hormuz or a a trade war. How does this actually affect the business of the banks? So, we think there are three main ways that this affects the business of the banks. One is through the economy. So, as I said, it could a shock could affect growth, unemployment, inflation, and this would obviously affect the business model of the bank. Another way is through financial markets. So, shocks cause volatility on financial markets. It causes share prices or bond prices to go up or down, whatever, and how that affects the bank. And the other is what you might call security channels. So, this is the idea that a physical war or a cyber attack or something from a security point of view could affect the bank. And this part I'd say is particularly focused on, let's say, the operations of the bank. So, things like their IT infrastructure, where their businesses physically located, how might sanctions, so when Europe imposes sanctions on other countries or on particular customers, how might sanctions affect that bank. So, we call this the security channel. So, we ask the banks more generally, when they look at geopolitical risk, but particularly in this stress test exercise, to look at these different channels and how would this shock that they're looking at feed through these channels into their business. And as I said, the real idea is to connect the shock to the business of each individual bank as opposed to looking at something more generally across the banking system. >> So, different banks and who are focused on different parts of the economy are going to find themselves affected in different ways. A trade bank is most worried about or maybe not most worried, but is certainly very worried about sanctions, for example. >> Exactly. So, that's exactly the point. I think different banks have different business models, different exposures. They might operate in different countries. They might have different types of clients. Some banks big corporates, some banks are doing maybe mortgages and personal lending. So, how things work out affect them in very different ways and that's exactly what we wanted the banks to look at. And then as I said, very importantly within the bank, you know, if this happened, how would the bank respond in in such a case? What actions would that bank take to manage that shock if it happened? >> Yeah. I mean, it's tempting to think that giving you're giving so many of the tools in this reverse stress test to the banks that they'll come up with a scenario and say, "But no worries. We've got it covered. We can handle it." Is Is that the kind of response you got? >> Yeah, well, of course, that's one of the main reasons why we're here at the ECB. So, of course, on our side when we get all of the input, um there's let's say a a process of quality assurance, I suppose you could call it, where we look at all the different scenarios. Of course, one big advantage we have is even though we wanted the banks to look at individual scenarios in their own businesses, is we can compare. So, we can look at common themes across the different banks, uh maybe across different types of businesses, different business models. So, we can look for common things or we can look for outliers. So, maybe banks that, you know, didn't uh perform so well uh compared with others. So, we have a huge exercise here to look at at quality assurance. And then obviously our teams here at the ECB and also uh in our all of our colleagues in the national competent authorities who work on supervising the banks day-to-day. These We call these teams joint supervisory teams. They, of course, are also heavily involved in the exercise to look at their own individual bank. Is it plausible? Is it reasonable? How did they respond? Um and we have two types of feedback for the banks, I suppose. Um so, each bank will get individual feedback about its own content or its own reverse stress test and how it did and things it needs to work on. Um and then we at the ECB, we will also publish, let's say, an overall thematic report which will give the main highlights or the main messages or the main findings that we have from this reverse [clears throat] stress test. And this, of course, will be published for everybody to look at if they're interested. >> I know you're not going to name names, of course, but were there any banks who you were able to go back and say, "Look, you're deluding yourself. Yeah, this is This isn't Either this is not the risk which is likely to hit you most, you've ignored this one, or yes, the risk is correct, but your remedial measures are not going to be sufficient." >> Yeah, so I would say at an overall level, if you look at all of the banks, the banking system as a whole, I think we've had a reasonable outcome in terms of the the overall stress test. Of course, there are lessons to be learned, um but I think banks have done reasonably well. As you say, of course, I think it's always the case when we do these kind of exercises across the whole banking sector, you know, that some banks have more specific feedback than others. And of course, there are banks, I think, where what we saw was I suppose you could say a bit too theoretical, and they didn't really go through in actual practice, you know, in real detail how something would play out and how they would respond. Um we see in many stress tests and similar exercises that banks sometimes can be overly optimistic, and they think things will work out in in too positive a way. Um so, there will certainly be banks that will be getting feedback about, you know, levels of over-optimism or the need to do more work around converting something from being theoretical into practice. But as I said earlier on, I suppose this is I suppose one of the really important things about this stress test, it's not about passing or failing. It really was an exercise about something is happening in the world, something is changing at a macro level, big geopolitical changes, Um, it's really an opportunity, I think, for the banks to think about that and what it means for their business. And of course, to address things before they become problems. I think that's one of the real things we want to see here is the banks get this feedback from us. Uh, they've gone through the exercise themselves and it's an opportunity for them really to think about what's changing in the world and how they might respond to that and to be really prepared, I suppose, as a sort of contingency planning and preparations to make sure that they have good plans in place for different scenarios that might play out over the coming years. >> Yeah. One of the things that is changing a lot at the moment, of course, moving forward at a very fast pace is, uh, digital technology and AI, in other words. Um, uh, and this was a running theme, right? The cyber threat. It, it, it, it's hard to keep on top of it. Correct? >> Um, yeah, I think it's become, uh, very challenging. I would say, you know, I've worked in, in supervision for, uh, a number of years and after the global financial crisis, people might remember it was a very challenging time and a lot of the focus was on the financial parts of the banks. So, things that we talk about here, like their capital and liquidity, their profitability, etc. So, the financial part. But in the last, I would say, five, six years, this whole issue of cyber, the resilience or the strength of IT systems in banks, their ability to respond to cyber attacks if they happen has become much more, uh, part of our supervision, I think. Uh, we'd call this non-financial risk or operational, uh, risk and resilience. So, it's a big part of our supervision. Um, and exactly as you say, I think the pace of that has also changed a lot over the last year or so and now we also see issues around AI and new AI models. What they mean for cyber and cyber threats and also what they mean for banks, um, and their business models. So, in addition to the work that we're doing, uh, obviously on, on geopolitical, uh, this whole area of the digitization of finance or the banking system becoming more digital is another of our big, uh, supervisory, uh, topics. And, I mean, separate to this work, people might have seen, even in the last couple of weeks, um, we've issued a new letter to all of the banks that we supervise uh, about AI and things that they need to consider in terms of managing some of the risk about AI. And, as you Exactly as you said, how it connects to cyber as well. >> Okay. So, that's a It's a It's a big There's a lot going on. Let's put it there. Ultimately, um, you you take these results, you feed them you analyze them, you feed them back into the other work we do to uh, supervise banks. And the game is to make sure the banks are safe and sound, while still being competitive, of course. Are Are we well positioned, do you say, at the moment? >> Yes, so I would say, um, I suppose our assessment overall is that the banking system is is broadly resilient. So, since, as I mentioned, the financial crisis, it might seem a like a long time ago now to people, more than a decade ago. But, basically, since then, we've put in place new rules. So, new rules the banks have to follow, obviously. A new way of supervising the banks with the ECB, um, here in Frankfurt, working with all of our colleagues in the national competent authorities. And the banks, um, have become stronger in that time period, of course, both from a financial point of view and from an operational point of view. So, I would say, overall, the banking sector is is broadly resilient. I think I would also say, though, we should never be complacent. Um, you started this podcast by talking about all of the things that are going on in the world, how risky it is, how uncertain it is. And so, I suppose one of our our key messages here at the ECB is this resilience. We've worked very hard over the last number of years to build financial and operational resilience. And we need to make sure we protect it, because we live in a very uncertain world. Um, so, you know, we would want the banks not to be complacent, to continue to focus on the importance of things like thinking about geopolitical risk, things like cybersecurity, things like contingency planning to make sure that they're prepared for um, unexpected uh, shocks. And I I think overall we would say, you know, this resilience and protecting this resilience is absolutely crucial to make sure that banks remain safe and sound. And why do safe and sound banks matter so much? Well, first of all, for our viewers and listeners today, they want to know that their deposits are safe, of course. But banks are really fundamental to the economy, particularly in Europe. You know, the European economy really depends on on banks and the ability of households, businesses, big corporates to be able to borrow, to invest. And so we want strong, resilient banks that can make sure that they can also lend to the real economy, to lend to householders, to lend to businesses, um so that we can have, you know, a strong Europe and and growth at European level. >> Yeah, of course that leads to a whole new topic, which is the savings and investment union and whether we should be so reliant on banks in Europe. We're not going to do that this podcast. Um just a a quick point here on the results. Were there any surprises there? Was anything you said, well, we never thought of that as a potential risk out there? >> Yeah, so I I think always in these cases it's also partly I suppose an exercise for us to learn about things. I mean, I wouldn't say in terms of any of the scenarios that there was anything that we we didn't really expect, but I do think that always in the dialogue with the banks, when we look at particularly how banks respond to shocks, you know, that of course we see different things. And one thing that's very informative for us, as I said, is this comparison across the banks, so to see how different banks respond. And when whenever we do a stress test here at the ECB, afterwards we do a sort of let's say a stock take to see how it went, to see if from the point of view of our supervisors are there things that we can learn, including to make it, you know, stress testing exercises in the future more efficient. So we're always trying to to learn and evolve and and be more agile in our supervision and that will also be the case in the on this stress test. >> Okay, before you go though, as always with our guests, like to get a hot tip if you have one. Do you? >> Yeah, so I think I I know people might think, you know, talking about all these geopolitical issues, it's a bit doom and gloom. And you know, they in a certain way I suppose they shouldn't have to worry about what we're doing here from a supervisory point of view, that's our job and you know, we'll take care of that. But of course things like cyber and operational resilience might also affect you as a customer. Because one thing that happens is that cybercriminals for example may also target individual customers, not only the banks. >> Yeah. >> And what we've seen in the last couple of years I think has been a big increase in scams, in frauds, in attempts, you know, to use the customer as a way to get at bank accounts or to get at a bank details. So I don't to alarm our viewers or listeners too much, I would just say again I suppose a message for them about not being complacent about these things. Always think very carefully if you're contacted by your bank, if you're sent a text message or an email or something like that that you're really not expecting, if you're asked to you know, to give your bank account details or security details over the phone or anything like that. Be quite skeptical. Always check if it's really your bank, you know, were you really expecting this contact? And if you're not sure, use your normal contact details for your bank, the normal phone number or your normal branch details or whoever you normally engage with your bank just to double check. So that that way you also protect yourself from what unfortunately is happening in the world, which is this big increase in fraud and cyberattacks on individual customers as well as on the banks themselves. >> There is a lot of it. I I I give you even a a personal episode and I don't know if it was fraud. Only recently I received a rebate from my internet provider for late installation, but they weren't late. >> Mhm. >> And it seemed to come from a legitimate account. It could be legitimate, but the problem is now there's so much fraud online that you just don't know. You have to be skeptical. >> I agree you have to be skeptical. It's not only your bank, exactly as you say, it comes in many forms. So I think it's always a good idea to just stop for a second, just pause, just think, is this too good to be true? Should I really have got this contact? Is this plausible? Is this, you know, what would normally happen? And just take a moment before you sort of instantly reply to something or very quickly give away any details. So, think exactly as you say, just that moment to think, is this really something that I should be getting or not? And then if you're unsure, you know, check it out with directly with your actual provider as opposed to using maybe the link or the contact that you've been sent. >> Totally agree. But for viewers out there who want more on the online fraud, we do have a web page on the ECB website, by the way, that talks about the types of fraud that are out there. And also who to contact if you need to contact We're talking about the authorities here rather than the individual banks, but the information is there. So, look at that. Sharon, thank you very much indeed. It's been a a great conversation. Very interesting to look at the results of the reverse geopolitical stress test or geopolitical risk reverse stress test. But those results are on our website, so you can look at them in the show notes and our press release as well. That does bring us to the end of this episode though. So, I would like to thank Sharon. You've been listening to Euro Matters with Paul Gordon. If you like what you've heard, then of course subscribe to the podcast wherever you're listening. Leave us a review. We can only get better. And in the spirit of Europe, I'm going to end it in Maltese and say, "Come on, until next time." Thank you very much for listening.