Risk Concentrations Principles

THE JOINT FORUM

BASEL COMMITTEE ON BANKING SUPERVISION
INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS
INTERNATIONAL ASSOCIATION OF INSURANCE SUPERVISORS

Basel
December 1999

Risk Concentrations Principles

Purpose
1.
To provide to banking, securities and insurance supervisors principles for ensuring
through the regulatory and supervisory process the prudent management and control of risk
concentrations in financial conglomerates.
2.
By combining business lines, conglomerates offer the potential for broad
diversification. However, new risk concentrations may arise at the group level. In particular,
different entities within the conglomerate could be exposed to the same or similar risk factors,
or to apparently unrelated risk factors that may interact under some unusually stressful
circumstances.

Definition and Types of Risk Concentrations

3.
For purposes of this paper, a financial conglomerate is defined as a conglomerate
whose primary business is financial and whose regulated entities engage to a significant
extent in at least two of the banking, securities and insurance sectors. Each supervisory
discipline has developed a perspective on risk concentrations in its respective industry, and
this paper draws on those perspectives in establishing guiding principles for the supervision of
risk concentrations in a financial conglomerate.
4.
A risk concentration refers to an exposure with the potential to produce losses large
enough to threaten a financial institutions health or ability to maintain its core operations.
Risk concentrations can arise in a financial conglomerates assets, liabilities or off-balance
sheet items, through the execution or processing of transactions (either product or service), or
through a combination of exposures across these broad categories. The potential for loss
reflects the size of the position and the extent of loss given a particular adverse circumstance.
Risk concentrations can take many forms, including exposures to:
(a)

individual counterparties;

(b)

groups of individual counterparties or related entities;

(c)

counterparties in specific geographical locations;

(d)

industry sectors;

(e)

specific products;

(f)

service providers; e.g. back office services, and

(g)

natural disasters or catastrophes.

Principles
I.

Supervisors should take steps, directly or through regulated entities, to provide

that conglomerates have adequate risk management processes in place to
manage group-wide risk concentrations. Where necessary the supervisors
should consider appropriate measures, such as reinforcing these processes with
supervisory limits.

II.

Supervisors should monitor material risk concentrations on a timely basis, as

needed, through regular reporting or by other means to help form a clear
understanding of the risk concentrations of the financial conglomerate.

III.

Supervisors should encourage public disclosure of risk concentrations.

IV.

Supervisors should liaise closely with one another to ascertain each others
concerns and coordinate as deemed appropriate any supervisory action relative
to risk concentrations within the group.

V.

Supervisors should deal effectively and appropriately with material risk

concentrations that are considered to have a detrimental effect on the regulated
entities, either directly or through an overall detrimental effect on the group.

The work of the Study Group

5.
The Study Group on Intra-Group Transactions and Exposures and Risk
Concentrations conducted fact-finding work on the management of risk concentrations by
way of two questionnaires: one dealing with supervisory practices and another with
conglomerate practices. The results of these questionnaires are summarised below. The study
group surveyed ten financial conglomerates on their management practices with respect to
concentrations. These included six bank-led conglomerates with activities in securities and/or
insurance business, two insurance-led conglomerates with banking or securities business, one
securities-led conglomerate with banking activities and one mixed conglomerate involved in
banking and insurance.

Review of supervisory practices

6.
Supervisory attention to the nature of concentrations within financial conglomerates
has paralleled the growing attention by conglomerates to possible concentrations across the
three major sectors of banking, securities and insurance. Until recently, conglomerates and
supervisors alike focused on concentrations almost entirely at the sector level.
7.
To date, concentrations in single dimensions of risk, such as credit, country, market,
liquidity and reinsurance risks, have received the most attention from supervisors at the sector
level. The supervisory tools and methodologies currently in place reflect the historical
concerns of supervisors in each sector and therefore vary to some extent across sectors.
3

8.
In the insurance sector, concentrations can arise from an insurance companys assets,
liabilities, and off-balance sheet exposures, including exposures to future insurance claims.1
Supervisors use a variety of approaches to promote diversification and expect companies to
have underwriting and reinsurance policies ensuring that undue concentrations are avoided.
Other supervisory approaches include supervisory limits, requirements for additional
technical provisions, legal restrictions on investments, restrictions on the admissibility of
assets in meeting capital requirements, and review of the adequacy of the reinsurance
program. Reporting is an integral part of the monitoring process by most insurance
supervisors, and some supervisors require additional or more frequent reporting when
insurance companies approach statutory limits. Supervisors also require insurers to have in
place policies and procedures to prudently manage and control risk concentrations.
9.
In the banking sector, supervisors have incorporated large exposure guidance into
their national supervisory frameworks. This guidance encourages supervisors to set
quantitative limits on exposures to a single counterparty or group of related counterparties,
using capital as a base. In addition, some jurisdictions impose quantitative limits on
investments by regulation. Generally, supervisors require banks to have in place policies and
procedures to prudently manage and control risk concentrations and hold boards of directors
and senior management responsible for compliance. Some bank supervisory regimes also
have the ability to impose additional capital requirements or take other supervisory action if a
firm has unwarranted risk concentrations.
10.
In the securities sector, supervisors require firms to establish robust systems of
internal control and risk management to detect and appropriately manage risk concentrations.
These are supplemented by strict liquidity and credit requirements. In some jurisdictions,
securities firms are subject to large exposure limits generally identical with those applied to
banks. Supervisors hold boards of directors and senior management responsible for
compliance with these requirements. Supervisors can impose additional capital requirements
or take other action if a firm is overly exposed to a particular risk.
11.
Across all three sectors, supervisors and management recognise that financial
institutions face an increased risk of loss when their assets, liabilities or business activities are
not diversified. Supervisors use regulation, in particular limits on large exposures, to
encourage firms to control concentrations. Some supervisors have developed reporting
systems to assist them in monitoring risk concentrations.
12.
Supervisors in all three sectors consider that the prudent management of
concentrations is integral to risk management. They expect financial institutions to have in
place comprehensive systems for measuring, monitoring and managing risk concentrations. In
some jurisdictions, supervisors increasingly rely on financial institutions risk management
processes to control and monitor concentrations. To that end, supervisors have issued
supervisory guidance or required institutions to establish internal policies and procedures to
control and monitor risk exposure in general and risk concentrations in particular.

On balance-sheet liabilities of insurance companies reflect known losses and future claims; it is recognised that once
claims are made, management cannot use diversification to alter its risk concentration.

13.
Experience has led financial institutions and supervisors to broaden the concept of
risk concentration over time. In recent years, financial institutions and supervisors have given
increasing attention to the interaction of risks, recognising that there are circumstances where
a single large transaction or set of transactions can generate unusually large losses as the
market, credit and country risks interact. As a result, supervisors of regulated entities within a
financial conglomerate have focused increasing attention on both concentrations arising from
large single risks involving exposures across the conglomerate and concentrations arising
from the interaction of risks which affect exposures in more than one sector.

Financial Conglomerates Risk Concentration Management Practices

14.
The survey of conglomerates revealed an important recent development. Some
conglomerates are monitoring risk concentrations across sectors on a group-wide basis, and in
some cases combining insurance with banking and securities exposures. However, the
majority of the small sample of conglomerates surveyed are monitoring risk concentration
only at the sector level. In the past, the focus on monitoring risk concentration has been
almost entirely sectoral. As a result, risk management and internal control systems designed
to monitor concentrations remain more advanced at the sector level.
15.
In addition to looking for exposures to common counterparties or industries across
sectors, some conglomerates are focusing on the correlation and interactions of risks in
making group-wide assessments of risk concentrations, following similar developments at the
sector level. For example, one insurance-based conglomerate has begun to analyse the
relationship between loss potential in its property/casualty insurance business and in the
lending business of its banking arm, particularly in the event of a natural disaster. Another
conglomerate has been developing a common set of risk factors to analyse risk across the
entire group, which includes entities in all three sectors.
16.
Generally, the measures that conglomerates put in place to control risk
concentrations either at the group or sector level go beyond compliance with regulatory
requirements. This is consistent with the expectations of most supervisory regimes. Financial
institutions appear to recognise the potential for material losses stemming from an
uncontrolled concentration, and that such losses could significantly weaken their competitive
position in the international marketplace, resulting in a loss of customer, investor and/or
depositor confidence.
17.
At the conglomerates surveyed, the board of directors or other appropriate high level
committee of the parent company2 is usually responsible for approving the conglomerates
policies on risk management. Senior executive management develops and implements these
policies. In some jurisdictions, both these functions may rest with the same body. To monitor

Corporate governance with respect to financial institutions varies from jurisdiction to jurisdiction. In some countries, the
board has the main, if not exclusive, function of supervising the executive body (senior management, general
management) so as to ensure that the latter fulfils its tasks. For this reason, it is known as a supervisory board. This
means that the board has no executive functions. In other countries, by contrast, the board has a broader competence in
that it lays down the general framework for the management of the financial institution.

compliance with policies, risk managers prepare reports on concentrations for a committee of
senior managers who review, discuss and provide direction for reducing, mitigating or
managing concentration risks. In most cases, positions in excess of established limits require
approval from successively higher levels of management the larger the position and the
longer it exceeds the internal limits, the higher the approval necessary, sometimes as high as
the board of directors. In many cases, the conglomerates internal limits are set lower than the
relevant regulatory limits.
18.
Information and communication technology developments create the potential for
firms to monitor risk at all levels, but management information systems to monitor
compliance with limits on an ongoing basis currently exist only at the sector level. For
example, many firms in the insurance sector now set and monitor underwriting limits by type
of risk and thereby both limit the risk and ensure diversification of their exposures on a
continuous basis. Systems with similar capabilities have been developed in the banking and
securities sectors. In contrast, those conglomerates monitoring exposures across insurance and
banking/securities activities appear to rely on a manual process, since the systems used to
measure and monitor risk tend to differ substantially across the sectors.
19.
Financial conglomerates are enhancing analytical techniques to identify, measure,
monitor and control risk concentrations. Among the most important techniques now used at
some conglomerates are stress testing and scenario analysis, often based on models. These
techniques assess the impact of such adverse events as large changes in market values,
declines in creditworthiness, or natural disasters on individual regulated entities or the
conglomerate as a whole. Scenarios reflect historical experience or focus on particular
vulnerabilities that the firms risk managers identify. Stress testing also involves the
systematic testing of the loss potential in a series of large changes in key risk factors. The
Russian default in August 1998 reinforced the need to identify common risk factors across all
elements of the firms financial exposure. In that case, the losses experienced included
repurchase agreements on Russian debt with non-Russian counterparties and credit extended
to hedge funds with Russian concentrations. These were in addition to the losses on loans and
other direct credit to Russian counterparties that are traditionally associated with country risk.
20.
As some conglomerates have devoted greater attention to assessing the impact of
correlations on risk, stress testing of correlation assumptions has become important. The 1998
disturbances in Asia and elsewhere illustrate how previously uncorrelated price movements
across debt and equity markets in emerging market countries perceived to be in different
economic and trading blocs could suddenly become highly correlated under stress, affecting
exposures in all three sectors.
21.
The developments in stress testing and scenario analysis in risk management should
be encouraged and illustrate the increasing level of complexity and the growing information
requirements involved in understanding how concentrations can arise. Stress testing requires
comprehensive management information systems that aggregate information in a consistent
and timely manner and permit positions to be analysed in a number of ways. Important
elements of stress testing, however, cannot be automated, but require sound judgement. For
example, judgement is required in understanding new products, analysing correlations and
interpreting the results of the testing.

Analysis of Issues in the Supervision of Financial Conglomerates

22.
While risk concentrations are generally seen by supervisors to be problematic, the
potential for risk concentrations in a conglomerate needs to be balanced against the broad
diversification benefits associated with combining business lines under the single ownership
of a conglomerate. Apart from unusual, generally distressed, market conditions, cyclical
effects in other markets would normally offset ebbs and flows in any one business line. In
addition, a certain degree of concentration is the inevitable result of a well-articulated
business strategy as well as product specialisation, the targeting of a customer base or a sound
strategy of outsourcing data processing activities. The implication is that not all risk
concentrations are inherently bad.
23.
Nonetheless, since risk concentrations historically have been an important cause of
losses in all three sectors, supervisors need to balance these benefits against the risks of
concentrations at the conglomerate level. To identify some ways in which such concentrations
arise, it is helpful to assess how large losses can develop in a conglomerate. Some of these are
described below:

Losses at the conglomerate level can reflect the aggregate of losses on similar types
of exposures (e.g. bonds, loans and investments with the same obligor) across the
sectors. These are the types of major losses which large exposure rules have
traditionally tried to prevent. Losses can not only strain overall capital resources, but
short-term liquidity may also be impaired if the position is very large relative to
market size or market-making capacity. Positions can reach a large size relative to
the market, even if the conglomerate adheres to large exposure rules at group level,
because of the large capital base of some conglomerates.

Losses at the conglomerate level could reflect risk factors that have consequences for
different types of exposure in different entities. For example, a natural disaster could
cause insurance losses in a conglomerates insurance operation and credit losses in
its banking operation if both offered products in the affected region

Losses could also reflect the interaction of risk factors. For example, the loss
potential in a derivative or exchange rate contract resulting from an exchange rate
depreciation may be intensified if the same price movement adversely affects the
repayment ability of a counterparty or the financial stability of the counterpartys
country of residence. Losses can be further compounded in a conglomerate when the
same external developments generate large losses in separate, apparently unrelated
sectors, such as simultaneous losses after devaluation in foreign exchange trading in
the bank and emerging market bond portfolios in the securities firm.

Losses could also reflect the breakdown of previously observed correlations, such as
occurs in a flight to quality in which all risky assets decline in value, where
previously many of them were measured to be uncorrelated.

Losses therefore can arise from large exposures that can be simply aggregated across sectors
within the conglomerate or more complex concentrations arising from the correlation or
interaction of risks.
24.
Moreover, even risk concentrations confined to the sector level can have spillover
effects within the conglomerate. Material problems resulting from excessive risk
7

concentrations in one entity, either regulated or unregulated, could be transmitted to other

entities in the conglomerate because the entities are linked by reputation or by intra-group
transactions and exposures, or both. For example, if it is known that there are serious losses in
a conglomerates securities activities, its banking operations may suffer liquidity or market
access problems through reputational effects and perceived close financial linkages between
the securities and banking entities. While this potential seems most important for the
transmission of liquidity risk, it can be relevant for any risk when a regulated entity has a
large, concentrated exposure to the entity with the concentration in the conglomerate.
25.
The possibility that large losses could threaten the ongoing business operations of a
financial conglomerate clearly motivates supervisory concern that risk concentrations be
identified, monitored and subject to an adequate management strategy. This concern starts at
the sectoral level. But concentrations arising at the conglomerate level, whether from
concentrations in the individual legal entities, from risks cutting across sectors or from the
interaction of risk concentrations within the conglomerate, could affect the efficacy of sectoral
supervision. In addition, where there are very different approaches to setting limits or defining
concentrations or where there are unregulated entities, the differences in requirements can
produce an incentive to book positions within the conglomerate to reduce or minimise the
impact of regulatory constraints. Thus, supervisors should seek to make sure that their
objectives for individual regulated entities within the conglomerate are not undermined either
as a result of material risk concentrations and potential losses that emerge at the conglomerate
level or as a result of regulatory arbitrage.
26.
The additive nature of concentrations and the risk of transmission of material
problems within a conglomerate point to the value of both conglomerate management and
supervisors conducting a group-wide assessment of potential concentrations. Supervisors will
likely find it useful to co-operate with other supervisors of the conglomerates regulated
entities to understand material risk concentrations as part of their larger efforts to determine
the overall risk profile of the conglomerate.
27.
The need for a group-wide assessment of concentrations highlights the importance of
supervisors access to information. Whether in a system of consolidated supervision, where a
group-wide assessment may be an integral part of oversight, or in other approaches to
conglomerate supervision, supervisors should have access to adequate information about risk
concentrations within the conglomerate, including exposures in unregulated entities. These
information needs can be satisfied by the conglomerate providing necessary information to
the supervisor, by a bilateral or multilateral meeting of relevant supervisors, or by enhancing
the information-gathering powers of the supervisors. In addition, sectoral supervisors may
benefit from any future harmonisation in measuring risk concentrations across sectors, in
exchanging information. Thus, information sharing and liaison among supervisors are
important. Possible approaches to supervisory cooperation are described in the Joint Forums
Coordinator Paper and the Principles for Supervisory Information Sharing Paper.
28.
As conglomerates evolve, the complexity of risk concentrations in the structure of
these conglomerates is increasing, and the analytical and information demands on risk
management are growing. The changing insights into the nature of risk concentrations suggest
that both financial conglomerates and supervisors need to continue to advance their respective
approaches to risk identification and monitoring. Thus, supervisors believe it is crucial that
conglomerates have adequate systems to measure, monitor, manage and control risk
concentrations as part of a broader program of risk management at the group-wide level,
including scenario analysis and stress testing where appropriate. In turn, as they conduct their
8

oversight, supervisors should understand and may make use of the methodologies and
systems used by financial conglomerates.
29.
In addition to risk management by conglomerates and supervisory oversight, public
disclosure can contribute to sound management of risk concentrations by enhancing market
discipline. Public disclosure by the conglomerate of its risk concentrations can serve two
purposes. First, it can enhance market discipline by allowing other market participants to
differentiate between organisations that manage risk concentrations safely and soundly and
those that do not, thereby assisting supervisors in promoting the adoption of sound risk
management practices. Second, disclosure can be helpful to supervisors in understanding
material concentrations in the conglomerate. While supervisors often find such disclosures are
just the starting point for further questions and discussion, such disclosures may reduce the
burden faced by a financial conglomerate in dealing with a number of supervisory authorities.
30.
Market discipline can only be effective if disclosures are timely, reliable, relevant
and sufficient. Based on a review of published financial statements by a small sample of
financial conglomerates, disclosures of risk concentrations are minimal and could be
considerably enhanced. At the same time, the new and extensive types of analysis
conglomerates are undertaking to identify concentrations have the potential to produce a
burdensome volume of information. In this respect, the prompt, detailed information on
particular exposures disclosed by some conglomerates outside of the normal financial
reporting cycle and in response to market concerns during the 1998 financial market turmoil
were widely seen as effective and constructive. This suggests that conglomerates could both
expand their periodic public disclosures of risk concentrations while continuing to focus on
only the most important risks, and use timely, topical disclosures to provide additional detail
as necessary.

Guiding Principles
31.
Supervisory strategy with respect to risk concentrations in a conglomerate
necessarily reflects the powers that supervisors have to induce financial institutions to reduce
excessive concentrations and other dangerous exposures. In some cases, supervisors will have
ample authority to supervise risk management throughout the conglomerate. In many cases,
they will not. In all cases, supervisors should have sufficient authority to gather and safeguard
information to be able to monitor material risk concentrations across sectors and to understand
how such risks are managed. Supervisors at the sector level should review whether they have
sufficient powers to protect the regulated entity from problematic risk concentrations, for
example, through requiring reductions in exposures or higher capital at the regulated entity.
Where supervisors lack sufficient powers, they should seek the additional authority they need.

I.

Supervisors should take steps, directly or through regulated entities, to provide

that conglomerates have adequate risk management processes in place to
manage group-wide risk concentrations. Where necessary the supervisors
should consider appropriate measures, such as reinforcing these processes with
supervisory limits.

32.
Supervisory concerns emerging from risk concentrations can be mitigated by good
risk management and internal control policies, and supplemented by the holding of adequate
capital. Risk concentrations need to be monitored both in the legal entity and across the
different sectors of the conglomerate to provide for the protection of the regulated entities.
Supervisors should take steps directly or through regulated entities to provide that financial
conglomerates have controls in place to manage their risk concentrations. For example, where
the supervisor does not consider the controls adequate, supervisors should consider imposing
supervisory limits.
33.
A sound risk management process begins with policies and procedures approved by
the board of directors or other appropriate body and active oversight by both the board and
senior management. The process should include clearly assigned responsibility for the
measurement and monitoring of risks and risk concentrations at the conglomerate level. The
conglomerate should have in place a process to identify the conglomerates principal risks, a
comprehensive measurement system, a system of limits to manage large exposures and other
risk concentrations, and processes of stress testing and scenario and correlation analysis.
Comprehensive management information and reporting systems are essential to a sound risk
management approach. Finally, sufficient attention should be given to non-quantifiable, as
well as quantifiable, risks.
34.
In addition, as financial institutions from different sectors merge and financial
conglomerates evolve, the potential for new types of concentrations arises. When evaluating
proposed mergers or expansions, supervisors should take into account management plans to
manage material risk concentrations at a group-wide level.

II.

Supervisors should monitor material risk concentrations on a timely basis, as

needed, through regular reporting or by other means to help form a clear
understanding of the risk concentrations of the financial conglomerate.

35.
Supervisors should have access to information or should be informed on a regular
basis of the nature and size of material risk concentrations. To facilitate that process,
supervisors may find it useful to set limits or thresholds that serve as reporting or supervisory
benchmarks. Given the dynamic nature of conglomerate organisations and the ease with
which risk profiles can change, monitoring should be frequent. Risk concentrations or stress
scenarios that generate large losses should be acted upon promptly through follow-up
questions of the conglomerates management.

III.

Supervisors should encourage public disclosure of risk concentrations.

36.
Public disclosure of risk concentrations at the group-wide level can promote market
discipline. Effective public disclosures allow market participants to reward conglomerates that
manage risk effectively and to penalise those which do not, thus reinforcing the messages
provided by the supervisor. For market discipline to be effective, disclosures need to be
10

timely, reliable, relevant and sufficient. Given the complexity and variety of possible risk
concentrations in a financial conglomerate, enhancing disclosures includes expanding the
range of the most important risk concentrations in periodic financial statements, especially in
annual reports, while making timely and reliable disclosures of exposures outside the normal
reporting cycle as necessary to provide greater detail in response to market concerns. A
description of the conglomerates risk management approach to concentrations would be a
useful supplement to quantitative information. In addition, public disclosure can facilitate
supervisory monitoring and risk assessment and lead supervisors to explore further material
issues.
37.
It is not intended that disclosure of risk concentrations be done in a way that would
involve the disclosure of proprietary information or information about customers that would
unreasonably violate their privacy.

IV.

Supervisors should liaise closely with one another to ascertain each others
concerns and coordinate as deemed appropriate any supervisory action relative
to risk concentrations within the group.

38.
Risk concentrations may arise from exposures in many parts of a financial
conglomerate. The effective assessment, monitoring and control of such concentrations by
supervisors is likely to require sectoral expertise as well as a good understanding of the
techniques used by other supervisors. Supervisors need to communicate on risk
concentrations found within sectors or jurisdictions, as supervision at the sector level may not
detect instances of arbitrage. In addition, supervisors may need to coordinate across sectors
and jurisdictions.
39.
Generally, channels to permit the exchange of information within sectors have been
established. The Joint Forum has set out principles for sharing information across sectors,
inter alia, in the document entitled Principles for Supervisory Information Sharing Paper and
in The Coordinator Paper. These documents, along with others in the Joint Forum package,
provide principles and techniques to assist supervisors in efforts to liaise more closely and
effectively with one another in the supervision of financial conglomerates.

V.

Supervisors should deal effectively and appropriately with material risk

concentrations that are considered to have a detrimental effect on the regulated
entities, either directly or through an overall detrimental effect on the group.

40.
If a financial conglomerate is exposed to risk concentrations that may affect its
financial stability, supervisors should take appropriate measures with respect to regulated
entities. In some cases, supervisors may elect to take preventive measures. For example,
supervisors with the necessary powers may consider establishing cross-sector limits for risk
concentrations. Exceeding these limits could trigger supervisory intervention directed at
controlling situations affecting the viability of the regulated entities of the conglomerate.
Once a problem arises, supervisory intervention almost always begins with bringing the issue
to the attention of management and the board of directors and asking them to address the
supervisory concern. While supervisors generally feel they have the power to seek corrective
action by the entity they regulate, actions elsewhere in the conglomerate may be necessary to
effectively reduce or mitigate the concentration. Where risk concentrations cut across the
11

regulated entities of the firm, cooperation among the relevant supervisors (as well as with the
primary supervisor3) is important.

For purposes of this document, the term primary supervisor is generally considered to be the supervisor of the parent
or the dominant regulated entity in the conglomerate, for example, in terms of balance sheet assets, revenues or solvency
requirements. Supervision of Financial Conglomerates, Papers prepared by the Joint Forum on Financial
Conglomerates, February 1999, page 101.

12