OPERATIONAL RISK AND E-BANKING

Abstract

Banking involves a variety of risks. Under Basel II, the main risks are the monitored credit risk, market risk and operational risk. Frequently, operational risks are underestimated, considering that they would not affect the optimal activity of a bank. However, past experience of some credit institutions have shown that operational risk is an important cause of financial losses in the banking sector. Operational risk is generated by a complex of factors that manifests primarily as a result of direct customer interaction with the credit institution. In this context, the provision of e-banking services reduces direct contact with bank customers and thus reduces potential losses arising from operational risk. In sum, we consider it necessary to be aware of the link between operational risk and e-banking services promoted by banks and of the importance of this connection especially in a financial environment affected by the financial crisis. [PUBLICATION ABSTRACT]

Headnote

Abstract: Banking involves a variety of risks. Under Basel II, the main risks are the monitored credit risk, market risk and operational risk. Frequently, operational risks are underestimated, considering that they would not affect the optimal activity of a bank. However, past experience of some credit institutions have shown that operational risk is an important cause of financial losses in the banking sector. Operational risk is generated by a complex of factors that manifests primarily as a result of direct customer interaction with the credit institution. In this context, the provision of e-banking services reduces direct contact with bank customers and thus reduces potential losses arising from operational risk. In sum, we consider it necessary to be aware of the link between operational risk and e-banking services promoted by banks and of the importance of this connection especially in a financial environment affected by the financial crisis.

Key words: operational risk, e-banking, credit institution, Basel II, financial crisis.

1. Introduction

In the last two years, the most common news provided by most media (TV, newspapers, radio, online, Newspapers, etc.) had to show different facets of the current financial crisis. A financial crisis characterized by most authors as a lack-ofliquidity crisis, by other authors as a crisis of the system, while some authors regard it as a crisis of uncertainty or even a psychological crisis. In this context, the financial - banking system has focused on avoiding the effects of the financial crisis that in most cases generate the loss or significant reduction of cost and other benefits. Thus, it brings the risk management activity to the fore.

In banking, risk management involves investigating four major categories of risks that may affect firm value (bank, financial institution etc) and/or the value of portfolio in which it manages. The four risks are: credit risk, liquidity risk, market risk and operational risk (RA Jarrow, 2007.

What draws our attention in particular is operational risk. This is because it is an element of novelty for banking risk management. Even if they have been more or less aware of it before, the international supervisory authorities have decided to include operational risk in the supervisory area only after 2004 when Basel II was issued by Bank specialists of International Settlements (the BIS).

Courses of events that can generate specific operational risk losses include processes or systems inadequately used or designed or generated by human resources actions by means of improperly imposed practices. Banking practice showed mostly that operational risk is caused by improper action of the human factor (In point of the legal provisions applicable, of applicable processes and systems to be used).

So we believe that the emergence and widespread use of payment innovations (for example, internet banking) can positively influence effective operational risk management within a bank.

From one period to another more and more people use the Internet for various purposes and increasing numbers of individuals use the Internet to take advantage of e-commerce or e-banking.

Their motivation is based on efficient use of time, reduced costs and increased safety. (Fig. 1)

The development of electronic payments has been driven by several factors, a crucial one being the rapid development of IT in the second half of the 20th century, which paved the way for electronic payment instruments. (Hoogduin L., 2009).

2. Objectives

This article's goal is to provide an overview of the framework and methodology for identifying, measuring and managing operational risk and banking Also, the presentation of features of distance payment such as the use of ebanking instruments was considered. By introducing the two concepts independently, possible links and reciprocal influences that the two variables might show on one another were outlined.

3. Research Methodology

The operational risk approach tried to investigate the main characteristics and methods of identifying the banks' exposure to operational risks in banking and the stage of operational risk management in Romania. The information, based on research analysis, was conducted particularly through the study of national and international literature. The main sources of information were legislative provisions and published research studies in this area, at the Bank of International Settlements, European Central Bank and National Bank and other institutions or organizations. Also, various articles and studies offered by the national and international literature that addresses these issues were studied.

4. Theoretical Perspectives

4.1. Specificity of Operational Risk

Under the revised recommendations of the Basel Committee (Basel Committee on Banking Supervision, 2005) transposed in European legislation (Directives 48/2006 and 49/2006) and national legislation (NBR Regulation NSC no. 24/29 of 14.12.2006) 'Operational risk is the risk of loss generated by the use of processes, systems and inadequate human resources, or who have not served properly, or external events and actions. Operational risk includes legal risk'. Intensification of operations for individuals and small traders, increased economic trade, the increased use of automated technologies, and the increased use of external sources and of sophisticated techniques for reducing the risk market risk have generated increasing operational risk. (H.van Greuning, Brajovic Bratanovic, S., 2004).

Under Basel II, banks should provide further capital reserves to cover potential operational risk losses. In this sense, capital requirements for operational risk can be calculated by three methods:

- Basic indicator approach involves applying a coefficient (alpha) on the bank's gross income. Coefficient alpha level set by the Basel Committee is 15%;

- Standardized approach requires the bank to organize activities into eight business lines. (Table No. 1.) For each business line, adjusted gross income is determined individually with a coefficient (beta). This will quantify the cost for each business line;

- Advanced Measurement Approaches based on internal models for operational risk evaluation.

In Romania the initiatives and legislative changes in operational risk have been achieved in the years 2006, 2007 and continued to harmonize with EU requirements in the field in the years 2008 and 2009 as well. According to them, credit institutions in Romania are required to apply operational risk management procedures (procedures for evaluating, monitoring the risk mitigation on banking internally).

Regulation NBR NSC no. 24/29 of 14.12.2006 shows that the specific operational risk loss events are the following:

- Internal fraud arising out of acts committed with intent to fraud, fraudulent appropriation of property or violation of regulations or policies of the bank;

- External fraud resulting from acts committed with intent to fraud, fraudulent appropriation of property or violation of regulations or policies of the bank by a third party;

- Employment practices and workplace safety that generate losses in action against the laws and conventions relating to employment, health and safety at work, the payment of damages for injuries, etc.

- Customers, products and commercial practices may cause loss in the form of unintentional or negligent breach of professional obligations to clients or of the nature or characteristics of a product.

- Damage to tangible assets arising from their destruction or damage by natural disasters or other events.

- Discontinuation of activity and operations and system failure.

- Execution delivery and management of processes. In this case losses can result from failed transaction processing or process management failure, loss of relationships with business partners / suppliers and trading.

To cover the losses arising from the manifestation of one of those events, credit institutions in Romania have to establish the necessary capital for operational risk using one of the following approaches: the basic approach, the standard approach, the standard approach for assessing alternative and advanced approach of evaluation. Since 01/01/2008 credit institutions from Romania have chosen the application of operational risk assessment methods as follows: 22 credit institutions chose the based approach, other 9 institutions opted for the standard approach, and only a credit institution chose to apply the advanced approach for operational risk assessment. (Georgescu F., 2007).

4.2. E-banking Particularities

The rapid development of e-commerce in parallel with the widespread use of the Internet led to the emergence and development of payment mechanisms through the Internet. Payments made through the Internet grew rapidly and became an important part in the products and services offered by various institutions, especially banking.

E - banking is a service available to all persons, who can perform banking transactions 24 hours a day, seven days a week, anywhere in the world where there is an Internet connection, providing mobility and comfort. Transactions take place online and in real time having the same degree of protection afforded by the Utility bank computer system. (Roman M., 2005) Also, e-banking represents all channels of distribution in banking services through Internet-connected computer appliances or telephones (fixed or mobile) and used by customers so that they conduct their banking transactions without visiting the bank, institution or any one of its physical points of distribution.

The literature recognizes three types of Internet banking (Comptroller's Handbook, 1999, p. 2), namely the Internet Banking:

- informational. This is the basic level of Internet banking site. Normally, the bank has information about its products on a stand-alone server. The risk is relatively low, because the information systems are not generally connected with the server and the bank's internal network. This may be offered by the bank or by an external source.

- communicative. This type of Internet banking system allows interaction between the banking system and customers. Interaction may be limited to the corresponding electronic account consulting, applying for loans, changing static information (change of name or address).

- transactional. This allows customers to transact. Since there is normally a direct connection between the banks internal networks, the risks are very high and should be placed under very strict control. Customer transactions may include: access accounts, pay bills, transfers, etc.

In Romania, the launch of e-banking services began with the stage of modernization of the banking system and the process of adopting the acquis communautaire in the areas involved in the accession negotiations between Romania and the EU (2000-2004). The regulation of such services was made progressively by adopting ordinances, regulations and orders in 2002, 2004 and 2006.

According to NBR Regulation no. 6 of 11 October 2006 on the issue and use of electronic payment instruments and the relationship between participants in transactions with these tools, Internetbanking is a form of payment instrument with remote access.

This tool allows users to access the funds of the account holder, and through it payments can be made to a beneficiary or other types of funds transfer operations could be performed usually requiring a user name or a personal identification code / password or any other proof of identity, authentication being required.

In addition to funds transfer operations, the user can accomplish and exchange transactions, can make deposits and obtain balance information on accounts and transactions.

The use of internet banking in Romania has developed in time. Since 2004, a total of 13 banks from a total of 39 existing at the time, have offered customers Internet banking applications. (BIS, 2004). In the context of increasing competition among banks, the number of banks offering internet banking services increased from 26 banks in 2006 to 35 in 2008. At the same time the number of payment instruments with remote access such as Internet banking has increased from 25 (2006) to 39 (2008). (MCTI, 2008).

According to the latest data published by the Ministry of Communications and Information Society, turnover, in RON, generated by Internet banking in 2009 was of 138.472.989.264,00 lei, and the total amount of foreign currency transactions in euro performed in the same period was of 10,131 .822.484,374 euro. Both values recorded substantial growth trends from one year to another, which demonstrates the customers' increasing preference for using this type of remote electronic payment tool. The analysis of the resulting data revealed the fact that users of electronic payment instruments with remote access prefer internet banking in greater proportion than the other two forms of such instruments launched by banks, i.e. home banking and phone banking.

5. Operational Risk Correlation and E-Banking

One of the objectives of the study was to outline a possible correlation between operational risk and the main type of electronic payment tool with remote access, Internet - banking.

As it has already been mentioned, the current environment pays particular attention to operational risk management. This is due to specific events that have caused great losses among financial institutions.

Analyzing examples of events that can generate specific operational risk losses we see that most of them are based on human factor action. Actions can be internal or external, international activist actions that may be malicious and actions that can be performed out of neglect or unintentionally.

Also, actions which were illegal or manifested as legal risk, etc., have often triggered losses. These actions involve direct contact with the actual bank, a bankclient relationship or a relationship between the supplier and the bank or between a third party and the bank.

On the other hand, we have an internet banking tool, which by its mechanism, excludes direct contact with the actual bank. Avoiding physical contact with the bank may somewhat lead to the avoidance of potential actions thus diminishing the operational risk

One can say however that this could not have the desired impact but, on the contrary, it could generate a higher operational risk due to failure to produce the systems that are at the base of internet banking.

Our view is that arbitration between the two variables could have a positive impact on reducing operational risk within a bank. Arguments supporting this idea could be:

- in the current banking system, most banks (at least in Romania) and banks operating worldwide, control the largest share of retail activities (with individuals and with small-scale and medium-scale enterprises).

- because of this, at the bank numerous transactions and activities which are directly related to individuals and legal entities are performed in order to offer bank products and services. These activities generate the most frequent specific operational risk events;

- Internet banking applications have been developed continuously, giving customers the ability to perform various operations: funds transfer, creation of deposits, foreign exchange and balance of accounts consultation whenever needed.

- Internet banking applications have at least two important advantages for customers - reduced costs (at least by 34% lower compared directly to bank transactions - World Retail Banking Report, 2009) and savings in time (so important nowadays);

- Internet banking applications are approved by specific institutions (in Romania - National Bank and Ministry of Communications and Information).

- The launch on the market of the application is based on minimum safety requirements, such as confidentiality and non-repudiation of transactions, confidentiality and integrity of communications, confidentiality and data integrity, authenticity of the parties involved in transactions;

- Personal data protection, banking secrecy, prevention, intrusion detection and monitoring the system, restoring information system managed for natural disasters, unforeseen events, activities or any other technical measures taken for the safe operation of the system. This way are chiefly avoiding all faults that would break the system, and default losses that may influence the evaluation of the operational risk;

- Internet banking will occupy an important place in the launch and use of SEPA products and services (Single Euro Payments Area) by the ECB.

If this correlation is achieved, the increase in value of banking transactions through Internet Banking application will reduce the events that increase specific operational risk losses. The bank will reduce the operational risk capital needed, especially for standard approaches and approaches based on internal models for operational risk assessment (according to Basel II).

6. Future Research

The developing research that is to be done on this issue aims to achieve, through the development of an econometric model based on specific statistics of the two variables (operational risk and internet banking), a substantiation of the survey content.

This would generate extra knowledge of the area studied by both researchers and practitioners and anyone interested in the issues examined.

7. Conclusions

The banking environment during the economic crisis attaches more importance to risk management. In this context various actions are taken in order to realize the importance of assessing operational risk.

At the same time, factors such as development and technological progress, increased competition, changes in customer behavior, cause banks to launch innovative products to support the bank's profitability. Also these products that are offered can generate cost savings for banks (eg the specific operational risk) and customers (eg, reducing bank fees).

Finally, we consider that using e-banking is a part of these goals - both of customers and of banks.

References

References

1. Badea, L., Socol, A.: Specificul administrarii riscului operational bancar. In: Revista Economie - teoretica Si aplicata, iunie 2008 Anul XV, pp. 3-24.

2. Comptroller's handbook: Internet Banking. Comptroller of the Currency Administration of National Banks, October, 1999, p. 2.

3. Capgemini, UniCredit Group, EFMA: World Retail Banking Report. 2009, Available at: http://www.capgemini. com/insights-and-resources/bypublication/ world_retail_banking_repo rt_2009/. Accessed: 16.11.2009.

4. Georgescu, F.: Piata creditului din România Si Reglementarile noului Acord de Capital - Basel II. Conferinta - Activitatile De creditare Si management a riscurilorÎn contextual Basel II, BucureSti, 4 decembrie 2007, Available at: www.bnro.ro. Accessed: 10.07.2008.

5. Greuning, H., Brajovic Bratanovic, S.: Analizyng and managing banking risk. A framework for Assesing Corporate Governance and Financial Risk. Editie bilingva româna-engleza, Institutul IRECSON, BucureSti. 2004, p. 75.

6. Hoogduin, L.: Payment innovation in a European landscape. In: DNB-ECB conference "Retail payments: integration and innovation. ECB, Frakfurt. 26 May, 2009.

7. Jarrow, R. A.: Operational Risk. Journal of Banking & Finance 32 2008, pp. 870-879, www.science direct.com

8. Predescu, I.: Activitatea bancara Între performanta Si risc. Editura Expert, BucureSti. 2005, pp. 65-71.

9. Roman, M: Information Tehnology and Banking Services. Revista Informatica Economica, nr. 4 (36) 2005, p. 61.

10. Spulbar, C.: Management bancar. Editia a II-a, Editura Sitech, Craiova. 2008, pp. 316-319.

11. Tinca, A.: Riscul operational În perspective implementarii Acordului Basel II. In: Revista Economie - teoretica Si aplicata, mai 2007 Anul XIV, nr. 5 (510), p. 31.

12. BIS (Committee on Payment and Settlement Systems): Survey of developments in electronic money and internet and mobile payments. Available at: Survey of developments in electronic money and internet and mobile payments Accessed: 05.02.2008.

13. BIS (Basel Committee on Banking Supervision): Risk Management. Principles for Electronic Banking. Available at: http://www.bis.org/publ/ bcbs82.pdf?noframes=1. Accessed: 09.02.2008.

14. BNR: Regulamentul nr. 6 din 11 octombrie 2006 privind emiterea Si utilizarea instrumentelor de plata electronic Si relatiile dintre principalii participanti la tranzactiile cu aceste instrumente. http://www.bnro.ro. Accessed: 20.01.2010

15. BNR - CNVM: Regulament nr. 24 din 14.dec.2006 privind determinarea cerintelor minime de capital ale institutiilor de credit Si ale firmelor de investitii pentru riscul operational. Available at: http://www.bnro.ro/apage. aspx?pid=404&actId=66. Accessed: 15.02.2008

16. BNR: Regulament nr. 5 din 18.feb.2008 privind aprobarea utilizarii abordarii standard ori a abordarii standard alternative, pentru riscul operational. Available at: http://www.bnro.ro/apage.aspx?pid=40 4&actId=67. Accessed: 27.02.2008.

17. BNR: Regulament nr. 25 din 15.dec.2009 privind utilizarea abordarii avansate de evaluare Si aprobarea utilizarii acestei abordari de catre institutiile de credit, pentru riscul operational. Available at: http://www.bnro.ro/apage.aspx?pid=404 &actId=323170. Accessed: 20.01.2010

18. ECB (Eurosystem): Zona Unica de Plati În Euro (SEPA). Available at: http://www.ecb.int/pub/pdf/other/sepa_ brochure_2009ro.pdf. Accessed: 03-02- 2010.

19. MCTI: Ordinul nr. 389 din 27 iunie 2007 privind procedura de avizare a instrumentelor de plata cu acces la distanta, de tipul aplicatiilor internet banking, home banking sau mobile banking. Available at: http://www. mcsi.ro/Minister/Domenii-de-activitateale- MCSI/Tehnologia-Informatiei/ Servicii-electronice/internet-banking/ Ordin-389-2007. Accessed: 05.02.2010.

20. MCTI: Situatie centralizatoare privind utilizarea instrumentelor de plata cu acces la distanta. Available at: http://www.mcsi.ro/Minister/Domeniide- activitate-ale-MCSI/Tehnologia- Informatiei/Servicii-electronice/ internetbanking/ SITUATIECENTRALIZATOARE. Accessed: 10.03.2010.

21. http://www.internetworldstats.com/stat. htm. Accessed: 11.03.2010 utilizarea instrumentelor de plata electronic Si relatiile dintre principalii participanti la tranzactiile cu aceste instrumente. http://www.bnro.ro. Accessed: 20.01.2010