Operational Risk Management with Derivatives

Oggetto: Lavoro finale. Matricola: 1259910 Cognome: Vecchio Nome: Giovanni Gabriele Corso di laurea: CLEF – Corso di Laurea in Economia e Finanza. Titolo: Operational risk management with derivatives. Tutor: Professor Giampaolo Gabbi. [page intentionally left blank] 1 OPERATIONAL RISK MANAGEMENT WITH DERIVATIVES Giovanni Gabriele Vecchio† 20th July 2010 † Bocconi University Economics and Finance Graduate 2010. E:mail: [email protected] 2 [page intentionally left blank] 3 To my Parents For their continuous unconditional support 4 [page intentionally left blank] 5 Table of contents 1. Operational risk and its measurement. 1.1. What is operational risk? 1.2. Regulatory definitions. 1.3. Quantitative measurement. 2. Current regulation. 2.1. An introduction to operational risk in Basel II. 2.2. European regulation. 2.3. British regulation. 2.4. Italian regulation. 3. Operational risk transfer with insurance. 3.1. Risk aversion. 3.2. The economics of insurance markets. 4. Operational risk transfer with derivative contracts. 4.1. Introduction: a model for operational risk. 4.2. Catastrophe derivatives. 4.3. First:Loss:to:Happen Put Option. 4.4. Operational risk swaps and Insurance Linked Warranties (ILWs). 4.5. Operational risk market: players and limits. 10 10 11 12 14 14 16 17 18 19 19 20 23 23 30 35 36 36 5. Pricing. 41 Conclusions 45 6 [page intentionally left blank] 7 Abstract Operational risk is one of the less known yet one of the most important risks in the banking industry. Growing attention on operational risk management has been showed both by regulators and banks. This thesis will investigate Alternative Risk transfer mechanisms for operational risk. Insurance is nowadays the main way of transfering operational risk. Nevertheless, risk may as well be transfered using derivative contracts. Operational risk derivatives such as swaps and options have not yet been very succesfull in the industry but their adoption would open up the operational risk market to the whole set of capital markets' players such as hedge funds, other banks, etc thus allowing a more ample risk dispersion, a lower cost of hedging and a more liquid market for such contracts. Plan of the work In Chapter One we will define operational risk in its economical terms. We will also see how operational risk is defined by the industry and by regulators. We will then explain how operational risk can be quantitatively measured and managed. In Chapter Two the current main regulations concerning operational risk are presented for the main economical regions of interest. Chapter Three deals with the economics of insurance markets, how they can provide coverage for certain risks and why they may fail. Chapter Four may be considered the main part of the thesis. We explore the different derivative contracts that can be implemented to transfer operational risk. We start from the basics of modelling operational risk where a simple model is used to explain the benefits of transferring risk. We then analyse the sector of catastrophic derivatives as the most mature subset of operational risk derivative market. We explore both CAT bonds and CAT options. We then present the market for Industry Loss Warranties and compare it with a basic swap transaction. Next, after presenting the main market participants in operational risk derivatives, we analyse the problems of hedging with standardized contracts for example the issue of basis risk. In Chapter Five we explain why pricing an operational risk derivative might be complex if not impossible. We then suggest some methods to price many derivatives such as CAT bonds, CAT Options, Swaps. At the end we present a model that may help to solve some of the many problems in operational risk derivative pricing. Keywords: operational risk, derivatives. 8 [page intentionally left blank] 9 1. Operational risk and its measurement. 1.1 What is operational risk? During its business, a bank is constantly exposed to risks. If the bank runs a trading book it will be exposed to market risk, if it has leant money it will be exposed to credit risk, the bank might retain some further exposure to interest rate risk and so on. The nature of the banking business is that of being constantly exposed to risks so the presence of so many threats to the banks stability shouldn’t worry us. In fact, banks derive their social justification, and a big slice of their profits, from assuming risks in a controlled manner and from managing them more effectively than their clients. Most of the risks to which a bank is exposed are therefore double:faced: on one side they represent a threat to the bank; on the other side they represent a source of profits. In these situations, the bank appears to be handling a trade:off between stability and profitability and it’s up to the institutions top management to decide where to find the right balance. Nevertheless, the bank may well be exposed to one:faced risks. This means that the exposure to such risk just generates a potential loss or a null value. The bank will not earn any excess profit from gaining exposure to such risks. These types of risk are called pure or absolute risks. They represent an almost sure damage to the bank and the management of the bank will only try to reduce them until it is economically convenient to do so. There are many examples of pure risks in common life. Is there any gain in having exposure to fire risk? Or to the risk of being robbed? Does it payoff to live in a seismic region, being thus exposed to the risk of an earthquake? It is clear everyone has interest in reducing these pure risks as much as it economically can. During their day to day business, banks face a very particular pure risk called operational risk. Intuitively, it is the risk of incurring in a loss due to daily operations. It is a very broad category of risk and it is therefore very difficult to define precisely. I’m sure some examples will help. Amaranth Advisors LLC, In 2005 the hedge fund Amaranth Advisors LLC started focusing its business on natural gas futures trading. Brian Hunter, head of the fund’s energy desk, started building up a spread trading position between natural gas futures with different maturities. Flawed internal control systems failed to detect the massive exposure the fund had acquired. In 2006, the fund ultimately lost $ 6.6 billion on the trade and was forced to close. Societe Generale, In 2008, Jerome Kerviel, an arbitrageur trader at the French bank Societe Generale, started placing huge trades on equity markets without executive authorization. The 10 situation degenerated and Mr. Kerviel was later arrested by French authorities. Societe Generale was later forced to close those positions, realizing a loss of almost € 5 billion. All these examples confirm how important operational risk has become in the modern financial industry. In the course of the last two decades, the global financial system has been characterized by deregulation and globalization, accelerated technological innovation and revolutionary advances in the information network. For example, in October 1986 during Margaret Thatcher’s government, the London Stock Exchange was radically reformed by the so called Big Bang. Fixed commissions where eliminated from securities trades and automated screen based trading was allowed. As for the United States, the Financial Services Act of 1999 repealed the Glass:Steagall Act, thus abandoning the historical division between commercial and investment banks. In Japan in 1998 Prime Minister Ryutaro Hashimoto reformed the financial industry by boosting competition among banks, funds, stock exchanges and insurance. Financial deregulation has triggered a number of remarkable technological innovations such as Internet, e:banking, e:commerce, web based trading, etc. These marvelous breakthroughs led inevitably to a higher speed at which financial information is exchanged, the expansion of financial services and large scale international deals. This obviously increased the banks’ exposure to various sources of risk. For example, increased use of e:banking increased the number of web based frauds or credit card frauds. When business units expand, additional employees are required and this may increase the number of errors committed and increase the hazard of fraudulent activities. In such a changing environment, operational risk has risen to be one of the most important sources of risk. While products have been developed to hedge against market risk or credit risk, operational risk remains the biggest unhedged source of risk and that’s why it has been raising growing concerns among regulators. As Roger W. Ferguson, Vice Chairman of the Board of Governors of the Federal Reserve System, stated “In an increasingly technologically driven banking system, operational risks have become an even larger share of total risk. Frankly, at some banks, they are probably the dominant risk.” Furthermore in 1999 the Basel Committee pointed out “the growing realization of risks other than credit and market risks which have been at the heart of some important banking problems in recent years.” 1.2 Regulatory definition. As the reader has surely already understood, defining operational risk and its boundaries with other risks is a quite complex task. The very same definition of risk is still controversial. As we have already seen, operational risk belongs to the category of the so called “pure risks”, thus a bank will not gain any return from exposing itself to such risk. It appears then natural to define operational risk as the risk of incurring in pure losses. To comprehend how difficult it is to find a clear consensus on how to define precisely operational risk, here a brief list of the definitions some international banks gave of the risk: • “The potential of any activity to damage the organization, including physical, financial, legal risks and risks to business relationships.” 11 • • “The risk that deficiencies in information systems or internal controls will result in financial loss, failure to meet regulatory requirements or an adverse impact on the banks reputation.” “All risks which are not banking (i.e. it excludes credit, market, and trading risks, and those arising from business decisions, etc.)”1 In 2004 the Bank of International Settlements issued the Basel II capital accord. In the accord, the Basel Committee defines operational risk as: “The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.”2 According to such definition, the Basel Committee defines four operational risk factors: processes, people, IT systems and external events. The definition appears to be too vague to be practically employed by banks to identify and manage operational risk. Basel thus supplies a more detailed list of operational risk causes. Event:Type Category Definition Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party. External fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party. Employee Practices and Workplace Safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity /discrimination events. Clients, Products & Business Practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Damage to Physical Assets Losses arising from loss or damage to physical assets from natural disaster or other events. Business disruption and system failures Losses arising from disruption of business or system failures Execution, Delivery & Process Management Losses from failed transaction processing or process management, from relations with trade counterparties and vendors 1.3. Quantitative Measurement In order to successfully manage operational risk, it is necessary to collect historical P&L data, to track down the risk sources, to map the business units and to estimate the banks constant exposure. (a) This first part of the process is to break down all risk sources per business unit/line and to collect data. The definition of which events must be included and which mustn’t is 1. G.Gabbi, M.Marsella, M.Massacesi, “Il rischio operative nelle banche”, Egea, 2005. 2. Basel Committee, 2004. 12 crucial: small changes in these parameters may well radically change the data collection system. Operational risk management (ORM) systems are a recent innovation so it is quite common in the industry not to be provided with long historical time series. As ORM becomes more widespread, historical data will be more available and ORM will be more statistically sound and effective. (b) Once the bank has a complete database of historical OR losses, it can start to research the risk sources of OR. The first step is to define some Key Exposure Indicators (KEIs) such as “Total Assets”, “Turnover”, etc. As Cruz (2002)3 suggests, casual modeling might then be applied: linear regression, multivariate regressions, Kalman filters, discriminant analysis, neural networks, Bayesian belief networks, data mining or fuzzy logic. Identifying statistically sound risk sources is crucial in building a model for forecasting operational risk. The main risk to such statistical soundness is the usually small number of historical observations. As the reader surely remembers, the variance of the estimation is inversely correlated with the number of available observations. This means that when forecasting future OR losses we will always have to keep in mind such estimations are highly unstable or might be subject to abrupt changes. (c.) Once a sound model has been built, some stress test analysis can be performed on the model. Monte Carlo analysis might be very useful during this step in order to generate an expected P&L distribution curve. It is interesting to notice here that operational losses do not follow a Gaussian distribution. In fact the distribution of losses often shows a positive skew: this means a long tail will appear towards the right of the graph. With such a peculiar distribution, the variance of operational losses might well be higher than the expected one, thus rendering extreme realizations more frequent than in a Gaussian context. (d) Prudent risk management practice would then require to calculate an Expected Loss (EL) equal to the mean loss of the distribution. This EL will then be factored in the prices the bank applies to its customers. The real operational risk though is the possibility that the actual operational loss might be different, in particular higher, than the expected one. By using the probability distribution and by setting a certain confidence interval (for example 99.9%), it is possible to calculate the Unexpected Loss (UL). This is the real measure of operational risk and it is called Operational Value at Risk (OpVaR). The main problem of measuring operational risk is that we have to find a probability distribution that best fits operational losses. It has been proved that operational losses present fat tails so that its variance is greater than normally distributed variables. Weibull distributions are usually employed. Tail events are particularly important so that Extreme Value theory finds many applications in operational risk modelling. 3. M. Cruz, “Modeling, measuring and hedging operational risk”, Wiley Finance, 2002. 13 2. Current regulation. 2.1. An introduction to Operational Risk in Basel II. The Basel Committee on Banking Supervision was created in 1974 by the central banks Governors of the G10 countries to issue non binding recommendations on banking supervision and to promote international convergence on common banking regulations and standards. Nowadays the Committee’s members are 274 and its Basel accords are employed all over the world. Even though the recommendations are not legally binding, they tend to be enforced with national or EU:wide laws or regulations. The Committee is responsible for issuing recommendations on a wide range of issues such as accounting, auditing, risk management, transparency, liquidity risk, market risk, credit risk and, of course, operational risk. All these subjects are covered in a pan: European accord on banking supervision, the Basel II Capital Accord, published in 2004 but continuously updated. The recent crisis has highlighted some of the flaws in the accord so a new Basel III accord is being discussed and might be published in the years ahead. Being the main banking regulation framework in Europe, most of the current regulation on operational risk and its management practices may be found in Basel II. First of all, in 2003 Basel published a paper called “Sound Practices for the Management and Supervision of Operational Risk”. At article 4 we may find the regulatory definition of operational risk: “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” The definition includes legal risk but excludes strategic and reputational risk. Article 5: The Committee recognizes that operational risk is a term that has a variety of meanings within the banking industry, and therefore for internal purposes (including in the application of the Sound Practices paper), banks may choose to adopt their own definitions of operational risk. The paper then offers a comprehensive list of sources of operational risk: internal and external fraud, employment practices and workplace safety, clients, products and business practices, damage to physical assets, business disruption and systems failure, execution, delivery and process management. After having clearly defined what has to be intended as operational risk, Basel II then outlines three alternative regulatory methods banks may adopt to manage operational risk. All three methods require the bank to set aside a certain amount of regulatory capital as a 4. Argentina, Australia, Belgium, Brazil, Canada, China, France, Germany, Hong Kong SAR, India, Indonesia, Italy, Japan, Korea, Luxembourg, Mexico, the Netherlands, Russia, Saudi Arabia, Singapore, South Africa, Spain, Sweden, Switzerland, Turkey, the United Kingdom and the United States. Source:Wikipedia. 14 function of its exposure to operational risk. Given the problems in defining operational risks, the regulation proposes some proxies of such exposure such as gross revenue or gross income. (a) Basic Indicator Approach – The Operational Risk capital requirement is 15% of gross income. Gross income is defined as the sum of Net interest income and non: interest income, net of every non recurrent item. (b) Standardized Approach – The Operational Risk capital requirement is calculated separately for every business line and then summed up. For every business line, Basel II identifies different coefficients, called Beta coefficients5. The capital requirement for each business line is equal to the product between the Beta coefficient and the average gross income from the unit over the last three years6. (c) Advanced Measurement Approach – Under this approach, if the bank proves to meet certain regulatory requirements, it is free to use whatever method it prefers. Basel II just suggests three main non mandatory approaches to operational risk. The first approach is the “Internal measurement approach”: the bank must cross each business line with certain risky event. For each cross, the bank must calculate the Expected Loss (EL) in case the risky event happens by estimating probability of event (PE), loss given event (LGE), exposure indicator (EI)7. Regulatory capital is then equal to the product of EL and a gamma coefficient. The second approach is the “Loss distribution approach”. Under this approach the bank will derive a probability distribution of the operational loss for every business line either by using know distributions either by using Monte Carlo simulation. The bank will then consider the operational losses with a certain degree of confidence (99.9%) at thus calculate operating VaR. The total capital can be the simple sum of all VaRs or it may consider the correlation among business lines8. The third approach is the “Scorecard approach”. The Operational Risk capital requirement is calculated at an aggregate level and then allocated among the 5. Here a list of all Beta coefficients: Corporate Finance 18%; Sales and Trading 18%; Retail Banking 12%; Commercial Banking 15%; Payment and Settlement 18%; Agency services 15%; Asset Management 12%; Retail Brokerage 12%. 6. It is interesting to note how this approach has a hidden hypothesis: all loss events are perfectly correlated so the bank must set aside enough capital to hedge all events at the same time. 7. Remember that EL = EI*PE*LGE. 8. Note than if the gamma coefficient under the “Internal measurement approach” is chosen as y = (k*st.dev) / EL, then the capital requirement is the same as in the “Loss distribution approach”. 15 different business units according to certain “scores”. These scores may vary with time and may include assumptions on the future evolution of the business. 2.2. European regulation. The 14th of June 2006 the European Parliament enacted the pan European Capital Requirements Directive (CRD)9 that lays out the European normative framework for all financial institutions. Among all the rules, Annex X specifically deals with operational risk. After outlying the main operational risk measurement approaches I just talked about in the previous chapter, from articles 25 to 29 the Directive specifically deals operational risk transfer mechanisms. Other forms of risk transfer are explicitly allowed sub art 25 as long as the contract and the protection seller meet certain regulatory requirements and the contract achieves a noticeable risk mitigation effect. The original text of the directive is reasonably clear so I will directly report it. 2. IMPACT OF INSURANCE AND OTHER RISK TRANSFER MECHANISMS 25. Credit institutions shall be able to recognise the impact of insurance subject to the conditions set out in points 26 to 29 and other risk transfer mechanisms where the credit institution can demonstrate to the satisfaction of the competent authorities that a noticeable risk mitigating effect is achieved. 26. The provider is authorised to provide insurance or re:insurance and the provider has a minimum claims paying ability rating by an eligible ECAI which has been determined by the competent authority to be associated with credit quality step 3 or above under the rules for the risk weighting of exposures to credit institutions under Articles 78 to 83. 27. The insurance and the credit institutions' insurance framework shall meet the following conditions: (a) the insurance policy must have an initial term of no less than one year. For policies with a residual term of less than one year, the credit institution must make appropriate haircuts reflecting the declining residual term of the policy, up to a full 100 % haircut for policies with a residual term of 90 days or less; (b) the insurance policy has a minimum notice period for cancellation of the contract of 90 days; (c) the insurance policy has no exclusions or limitations triggered by supervisory actions or, in the case of a failed credit institution, that preclude the credit 9. Directive 2006/48/EC. The full text of the directive is available here: http://eur: lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:177:0001:0200:EN:PDF 16 institution receiver or liquidator, from recovering for damages suffered or expenses incurred by the credit institution, except in respect of events occurring after the initiation of receivership or liquidation proceedings in respect of the credit institution; provided that the insurance policy may exclude any fine, penalty, or punitive damages resulting from actions by the competent authorities; (d) the risk mitigation calculations must reflect the insurance coverage in a manner that is transparent in its relationship to, and consistent with, the actual likelihood and impact of loss used in the overall determination of operational risk capital; (e) the insurance is provided by a third party entity. In the case of insurance through captives and affiliates, the exposure has to be laid off to an independent third party entity, for example through re:insurance, that meets the eligibility criteria; and (f) the framework for recognising insurance is well reasoned and documented. 28. The methodology for recognising insurance shall capture the following elements through discounts or haircuts in the amount of insurance recognition: (a) the residual term of an insurance policy, where less than one year, as noted above; (b) a policy's cancellation terms, where less than one year; and (c) the uncertainty of payment as well as mismatches in coverage of insurance policies. 29. The capital alleviation arising from the recognition of insurance shall not exceed 20% of the capital requirement for operational risk before the recognition of risk mitigation techniques. 2.3. British regulation. Since 1985, the United Kingdom has attributed the role of financial watchdog to the Financial Services Authority (FSA). Its competences are set by the Financial Services and Markets Act of 2000. The FSA is therefore in charge of regulating banks and their operational risk management systems. The relevant regulation may be found in “The prudential sourcebook for banks, building societies and investment firms instrument” (also known as the BIPRU Handbook) published by the FSA in 200610. Section 6 is dedicated to operational risk. The handbook basically replicates the European regulation for the operational risk measurement approaches word by word. Insurance and other risk transfer mechanisms are covered 10. FSA 2006/41. The full text of the handbook is available here: http://fsahandbook.info/FSA/handbook/LI/2006/2006_41.pdf 17 from art. 6.5.26 to art. 6.5.30. Art. 6.5.30 explicitly deals with alternative risk transfer mechanisms. 6.5.30: A firm may recognise a risk transfer mechanism other than insurance to the extent that a noticeable risk mitigating effect is achieved and the risk transfer mechanism is included in the firm's AMA permission. In order for a firm to obtain AMA permission, the firm must meet a wide set of regulatory requirements listed from art 6.5.3 to 6.5.25. 2.4. Italian regulation. Italy has enforced the European CRD with its Circular n.26311 of the 27th December 2006, modified the 15th January 2009. Operational risk is covered in Title II, Chapter 5. The Italian regulation is exactly the same as the CR Directive. In section IV, part 1.3 “Operational Risk Transfer”, the circular explicitly says12 “Mitigation from other operational risk transfer mechanisms are allowed as long as they show high quality standards, as high as those required for insurance policies, and as long as the bank is able to demonstrate a significant operational risk reduction effect.” 11. Circolare della Banca d'Italia n. 263 del 27 dicembre 2006. The full text of the circular is avaiable here: http://www.bancaditalia.it/vigilanza/banche/normativa/disposizioni/vigprud 12. “E’ riconosciuta l’attenuazione derivante da altri meccanismi di trasferimento dei rischi operativi a condizione che questi presentino elevati standard di qualità, comparabili a quelli previsti per le coperture assicurative, e che la banca sia in grado di dimostrare il conseguimento di un significativo effetto di riduzione del rischio”. 18 3. Operational Risk Transfer with Insurance. 3.1. Risk aversion. Social sciences like economics always start from modelling the psychological behaviour of market participants. A common feature of every rational individual is risk aversion. Imagine you have two lotteries: lottery A pays X with probability 100%. You are sure you are obtaining X. Lottery B pays 2X with probability 50% and zero otherwise. The expected value of lottery B is therefore X. A risk adverse individual will always chose lottery A because for him U [A] > U [B] i.e. U[X] > U[ E(X)]. At this point one may ask: how much should I pay the individual in order for being U[A] = U [B]? This amount is called “certain equivalent”. The amount E(X) – CE is the excess return we have to hand out to the risk taker in order for him to be indifferent between lottery A and lottery B. It varies according to the shape of the curve i.e. how much risk adverse the individual is. Nevertheless, it will always be possible to make someone take greater risk if we promise adequate compensation. 19 3.2. The economics of insurance markets. As we have just seen, regulation mainly focuses on regulating operational risk transfer with insurance contracts. Insurance is indeed the most widespread method for hedging against operational risk for its simplicity. Hereafter I will explain what is an insurance contract, I will outline an economical model for insurance markets and I’ll then explain why insurance coverage may well be incomplete. Imagine an individual in state A. You have a net wealth of w and imagine you are facing a risk that will occur with probability π. If the event happens, you end up in state B and you will incur in a loss d so that your net wealth is now w – d. Lets furthermore imagine the risk is a pure risk (as outlined at the beginning) so that no payoff is earned if the event doesn’t happen. Your expected loss is therefore πd. Now imagine an insurance contract that provides you with the payment q in the event of loss. In order to enter such contract, you need to pay a premium pq. The net payoffs in the two scenarios are: Scenario A (probability 1 : π): Scenario B (probability π) WA= w – pq WB= w – pq – d + q If this market is perfectly efficient, p = π, and the premium is said to be “actuarially fair”. Every individual will maximize its utility: max E[U(w)] = πU[WB] + (1 – π)U[WA] = πU[w – pq – d + q] + (1 – π)U[w – pq]. First Order Condition: ∂E[U ] = π U’[WB](1 – p) + (1 – π) U’[WA](:p) = 0 ∂q π U '[WB ] p = 1 − p 1 − π U ' [W A ] If p = π, U’[WA] = U’[WB]. This means WA = WB, q = d. If the premiums are actually fair, every individual will be completely insured against risk, asking for complete coverage. The premium paid is then pq = πd13. This very brief model explains the basic mechanics of insurance markets. As often happens, reality is far from theoretical models. Insurance markets may fail to supply 13Artoni, Elementi di Scienza delle Finanze, Il mulino 1999. 20 complete coverage leaving policyholders exposed to a certain amount of risk. This happens for a number of reasons: 1. The existence of administrative costs or other fixed costs prevent the insurance industry to offer actuarially fair premiums. This means p is not going to be equal to π but less. Lets imagine p = απ with α < 1. The utility maximizing F.O.C. changes in: απ π U '[WB ] = 1 − απ 1 − π U ' [W A ] U '[WB ] = α − απ U ' [W A ] 1 − απ If we assume a lognormal functional form for utility, U = log (W), 1 α − απ 1 = WB 1 − απ W A WA = α − απ WB 1 − απ Substituting: WA= w – pq WB= w – pq – d + q α − απ γ = 1 − απ Solving for q: q= (1 − γ )ϖ + γd α The premium is therefore π[(1: γ) w + γd]. If we assume w > d, this premium is higher than in the efficient market hypothesis. At the same time, the policy holder will not be completely covered by the insurance policy. The percentage of coverage is the ratio between d and q. It is always < 1. 2. Another typical problem in the insurance markets is information asymmetry. In contract theory, we have asymmetrical information every time a party has a considerable informative advantage against the other party. This implies the terms of the contract are not going to be neutral or impartial but they might be skewed in favour of the party with 21 the informative advantage. In the previous example, lets imagine the policyholder knows better than the insurance company the probability of the risky event to happen. If the customer declares a lower probability, this will lead to lower premiums thus ultimately creating solvency issues for the insurance company. Information asymmetry is therefore a very important factor that could prevent insurance markets not only from working properly but also from being solvent in the long run. Information asymmetry leads to a new set of problems. The first is called adverse selection, the second moral hazard. 3. If an insurance company is mispricing its premiums, for example by overpricing risk, then the customers’ willingness to enter in such a contract is going to be skewed. If risk is overpriced, only the risky customers will find it convenient to buy the insurance policy. The median customer will find the policy overpriced and will not enter the transaction. This will lead the insurance company to handle a pool of unexpectedly risky customers and therefore to increase the risk of insolvency. The process for which a company attracts the worst customers due to mispricing is called “adverse selection”. Adverse selection is a problem of asymmetrical information that arises before the transaction is made. 4. As we have seen, if a market is perfectly efficient, individuals will choose complete coverage. Once an individual is covered, his or her attention on mitigating or preventing the risk to happen may decrease. Imagine you have just perfectly hedged the risk of car theft: your attention on preventing your car from being stolen might well decrease. You might park in areas where you usually preferred not to park in, you might remember less frequently to turn on your anti:theft alarm and so on. Some might also tend to fraud the insurance company by arranging fake robberies, just for the purpose of cashing in the insurance payment. Overall, insurance companies risk exposure usually grows after the transaction is made: this is called “moral hazard”. As we have seen, insurance doesn’t always work effectively. Risk transfer may not be complete or it may be transferred at inefficient prices. Moreover, the insurance industry might be affected by a latent, yet present, industry:wide solvency risk so that you have just exchanged exposure to a particular risk with exposure to the insurance industry’s credit risk. 22 4. Operational Risk Transfer with derivative contracts. 4.1. Introduction: a model for operational risk. Insurance is not the only way to transfer risk. Capital markets have developed a wide range of derivative products aimed at managing risk in a more efficient way than the solutions available outside capital markets. Swaps, options, forwards and futures are just one of the many solutions that financial innovation has produced over the last two decades. Some of these instruments were invented centuries ago, others are more recent: all of them were created to manage market, credit, interest rate risks or other type of risks more effectively than with insurance. Operational risk theoretically is no exception: swaps or options may be structured to hedge operational risk just as any other risk factor. Unfortunately, these products haven’t yet been developed by financial institutions so nowadays a market for operational risk derivatives doesn’t exist. I really hope my work and others’ will contribute to the creation and the expansion of such market. On the sell side (protection buyers), there are several advantages for managing operational risk through derivatives and not through insurance: 1. Cost efficiency: it is more likely that the cost of managing operational risk through derivatives will be sensibly lower than the cost with insurance. This because competition between buyers and sellers will reduce bid:ask spreads to the minimum no arbitrage level. 2. Flexibility: each company may sell exactly the right amount of derivative contracts to hedge their operational risk. This might provide complete coverage against operational risk. 3. Liquidity: the potential buyers of these products may not only be existing insurance companies but also other players in the capital markets industry such as hedge funds, private investors, other banks, etc. 4. Business valuation: a company would always be able to monitor the cost of its operational risk exposure, thus making more accurate business valuations. 5. Transparent information: every market player would be aware of the operational risk of every issuer just by looking at the price of these products quoted on the market. There are quite a few advantages for the buy side (protection sellers) too: correlation between operational risk events and market returns is very low14. Asset managers might 14. See “Catastrophe Insurance Options: are they zero:beta assets?”, Hoyt and McCullough 23 then find it profitable to invest a portion of their portfolio in operational risk assets, thus increasing diversification and lowering the overall risk of managed funds. Cat losses and market returns from 1970 to 1995. A proxy of operational losses might be considered losses from catastrophic events. This type of data is collected by Property Claims Service and published in an index PCS Index. As shown by Hoyt and McCullough, correlation between market returns and PCS Index returns is not statistically significant with a confidence level of 10%. Operational losses can then be considered uncorrelated with market returns and including an exposure in such asset class may benefit asset of hedge fund managers. As in every economical phenomenon, the first step is to create a model for operational risk. Operational risk practically can be measured as the standard deviation of operating losses recorded in a banks income statement during a certain year t. It is therefore an income data, not a stock data exactly like market returns are income data while the trading book or portfolio is a stock data. This difference is very important when trying to model operational risk and its derivatives. In maths, this means that operational losses are the variation over t of a certain stock value than might be called “Cumulative Operational Losses” (COL). In maths: OL(t) = COL(t) – COL(t:1) = ^COL(t). With: OL(t): Operational Loss for year t. COL(t): Cumulative Operational Loss at the end of year t. In a continuum environment: OL(t) = dCOL(t). Now lets try to model a banks’ asset side balance sheet i.e. what a bank owns. All these values will therefore be stock values. A bank will typically hold two types of assets: “market assets” (M) that yields a return rm determined by the CAPM model and other operating assets that the bank uses to carry on its commercial activity (C). These 24 commercial assets allow the bank to obtain a further profit from the equilibrium CAPM return. This commercial profit might be considered a premium p over the equilibrium return rm. Operational losses may also arise during a bank’s activity. As we have just seen, Operational Losses are income data. We therefore need to add the stock data Cumulative Operational Losses to our model. Translating these concepts in formulas let A(t) be the total assets of a bank at time t. A(t) = M(t) + C(t) – COL(t) With: M(t): market assets at time t. C(t): commercial assets at time t. COL(t): cumulative operational loss at time t. It is plausible that at time t = 0, COL(0) = 0. For each year, income data can be derived as the variation of stock data in the following way: A(t) – A(t:1) = [M(t) – M(t:1)] + [C(t) – C(t:1)] – [COL(t) : COL(t:1)] ^A(t) = ^M(t) + ^C(t) – ^COL(t) = ^M(t) + ^C(t) – OL(t) In a continuum environment: dA(t) = dM(t) + dC(t) – OL(t) A numerical example Lets imagine a banks has just been started with total assets of $100 MLN. The retail banking ATM infrastructure costs $70MLN. The remaining cash is invested in marketable securities. No Operational Loss has been recorded yet so COL(0) = 0. At time t = 0, the bank’s assets will be: M(0) = 30; C(0) = 70; COL(0) = 0; A(0) = 30 + 70 – 0 = 100 During year 1, the bank earns a profit of $7MLN from its commercial assets and earns $6MLN on its market portfolio. It also records an operational loss of $2MLN. All earning are in cash or invested in marketable securities. Income data may be expressed as follows: M(1) – M(0) = 6; C(1) – C(0) = 7; COL(1) – COL(0) = 2; Total income = 6 + 7 : 2 = 11 25 At time t = 1, the bank’s assets will be: A(1) = 36 + 77 – 2 = 111. During year 2, the bank earns a profit of $11MLN from its commercial assets and earns $3MLN on its market portfolio. A system disruption results in an operational loss of $10MLN. M(2) – M(1) = 3; C(2) – C(1) = 11; COL(2) – COL(1) = 10; Total income = 3 + 11 : 10 = 4 At time t = 2, the bank’s assets will be: A(2) = 39 + 88 – 12 = 115. This model allows us to break up a bank’s assets in its main components. In such way, we can analyse the dynamics of COL(t) and its variations i.e. operational losses. Components M(t), C(t) and COL(t) of A(t) over time. Operational Losses of the bank over time. 26 As we can see, total assets grew during the eleven years. The bank registered a number of operational losses during the time being. These losses, cumulated, decreased the value of total assets in time. OL(t) data can also be analyzed to determine several statistical features such as average, standard deviation, correlation with other market variables, etc. The next step is to model operational risk transfer. Operational risk may be defined as the standard deviation of Operational losses. The exposure to such risk increases the overall risk of a bank and thus the capital providers of the bank (stock and bond holders) require a higher expected return. These economical features of operational risk may be modelled as follows: We have already modelled the income of a bank as: ^A(t) = ^M(t) + ^C(t) – OL(t) Dividing by A(t:1): A(t ) M (t ) C (t ) OL(t ) − = + A(t − 1) A(t − 1) A(t − 1) A(t − 1) A(t ) M (t ) M (t − 1) C (t ) C (t − 1) OL(t ) − = + A(t − 1) M (t − 1) A(t − 1) C (t − 1) A(t − 1) A(t − 1) Let define the following new variables: Return on Assets (ROA) = Market return (rm) = A(t ) ; A(t − 1) M (t ) ; M (t − 1) Percentage weight of assets invested in market portfolio a = Commercial premium p = M (t − 1) ; A(t − 1) C (t ) ; C (t − 1) Percentage weight of assets invested in commercial assets c = Operational Loss Rate (OLR) = C (t − 1) ; A(t − 1) OL(t ) A(t − 1) 27 The equation may then be rewritten as follows: ROA = a*rm + c*p – OLR For an unlevered bank, its Return on Assets is a function of market returns, commercial returns and operational losses rates. Imagine you are an investor and you are deciding how much return you want in order to invest in a company. First of all you analyse the risk of the investment defined as standard deviation of past returns. Then you require an expected return in proportion of the risk you are undertaking. How much return should you require? The answer to this question is not simple. Adopting an equilibrium approach, the Capital Asset Pricing Model answers exactly this question. Without entering the details of CAPM15, we can imagine the investor is facing a certain capital market line as in figure 1. The capital market line sets the so called “market price of risk”, m, in other words the additional marginal unit of return for each additional unit of risk you are undertaking. It is mathematically equal to the slope of the capital market line. For example, a security with a risk of 14% should have an equilibrium return of 18%. Another security with 16% of risk should yield 20%. The market price of risk is therefore constantly equal to 1%. What happens if returns are not as the ones predicted by the capital market line of figure 1? Arbitrage opportunities may occur: investors will short the underperforming assets and buy the over performing assets. This will lead the price of the former to fall and the price of the latter to rise. This will quickly bring the market in equilibrium again. Capital Market Line with risk:free rate of 4% and price of risk of 1%. Returning back to our bank, the return required by investors will be proportional to the risk of the bank in other words to the standard deviation of ROA. We make just one hypothesis: correlation between rm, p and OLR is zero. 15. See Markowitz, H.M. (March 1952). “Portfolio Selection”. The Journal of Finance 7 (1): 77–91. 28 ROA = a*rm + c*p – OLR St.dev.(ROA) = St.dev.(a*rm + c*p – OLR) = a*st.dev.(rm) + c*st.dev.(p) + st.dev.(OLR) Investors will therefore require an expected ROA, E[ROA], proportional to st.dev.(ROA) = a*st.dev.(rm) + c*st.dev.(p) + st.dev.(OLR). Now imagine the bank is able to transfer operational risk through insurance or through derivative contracts. Mathematically this means that OLR is not a variable anymore but it becomes a fixed constant equal to u, probably equal to the average operational loss rate u= E(OLR). Imagine also that the bank has to pay a marginal price g to enter such contract. Both u and g are constant so their standard deviations are null. The equations change in the following: ROA = a*rm + c*p – u – g. St.dev.(ROA) = St.dev.(a*rm + c*p – u) = a*st.dev.(rm) + c*st.dev.(p) It is clear that the overall risk in the second case is lower than in the first case. Risk transfer has reduced the overall risk of the bank so investors will be satisfied by requiring a lower expected ROA. Lets now shift to analyse the problem from the protection seller’s point of view. Under the risk transfer contract, he or she receives an upfront premium payment of g. He then has to pay the company the amount u every year and receive in exchange exactly OLR. The first hypothesis might evaluate g as the discounted value of all future payments: n g =∑ t =1 OLR − u (1 + r ) t No arbitrage arguments suggests so that g = 0. Nevertheless, this approach is wrong. As we have seen in chapter 3.1., investors are risk adverse. This means that from a risk adverse perspective U[E(OLR)] < U[u]. In order for the two utilities to be the same, the risk taking protection seller investor will have to receive remuneration for its risk. How much remuneration? Again we can use the concept of market price of risk to calculate it. The investor is adding st.dev.(OLR) to its portfolio. Since the capital market line is linear, the additional remuneration required by investors for that risk must exactly be equal to the difference between the expected returns required by the bank’s investors before and after insurance, as seen before. Imagine the expected return required by investors is rA in the first case and rB in the second case with rA > rB. Imagine also the market price of risk is m. Return for protection sellers must be = rA : rB = m*st.dev.(OLR). It necessarily follows that g = m*st.dev.(OLR). 29 The more volatile the OLR, the more expensive it will be to hedge such risk. Substituting g in rb: ra = a*E[rm] + c*E[p] – E[OLR] rb = a*E[rm] + c*E[p] – u – m*st.dev.(OLR) The return g = m*st.dev.(OLR) is therefore the equilibrium return required by investors to purchase operational risk derivatives. 4.2. Catastrophe Derivatives. Operational Losses are sometimes classified according to their frequency and their severity. In this way, operational losses are often divided into High Frequency:Low Impact (HFLI) and Low Frequency:High Impact (LFHI) losses. The first type of loss is easily manageable: due to its high frequency, such losses may be predicted with a very high accuracy and can be included in the cost structure of a bank. The second type of loss is more difficult to manage: its low frequency increases the variance of the estimate. This means that it is very difficult to include an adequate expectation of loss in the cost structure of the bank. The risk deriving from LFHI losses is therefore the type of risk which is more likely to be transferred with alternative risk transfer mechanisms. Widespread types of operational LFHI losses are catastrophic losses. These are losses occurring from natural events such as hurricanes or earthquakes. CAT Bonds A big market has been developing around catastrophic events mainly through so called Cat bonds. A Cat bond’s yield may vary according to the occurrence of a catastrophic event. In concrete, usually an index is chosen to represent a benchmark of catastrophic losses and the interest paid on the bond is reduced when a trigger event happens or when the index reaches a trigger level. Imagine a property and casualty insurance company has a big insurance exposure to Florida’s housing market. If a hurricane occurs, the company may be forced to pay a great number of policyholders endangering the solvability of the business. In case of hurricane, the insurance estimates it will incur extra losses for $1million. The company then strikes a deal by issuing a Cat bond with a face value of $100 million and a yield of 4% with the following clause: in event of hurricane, the nominal interest paid on the issue will decrease to 3%, leading to a cost saving of exactly $1million. The company is therefore perfectly hedged against the catastrophic event of a hurricane hitting Florida’s housing market. In practice, the yield on Cat bonds is linked to an index issued by a division of American Insurance Services Group Inc., Property Claims Service, called PCS index. 30 PCS indices are daily estimated and published16. They reflect the dollar cumulative amounts of catastrophe claims in a specified US region and time. By PCS definition, a catastrophe means an event that leads to more than $5million of insured property damages and affects a significant number of insurance companies and policy holders. The PCS loss indices track insured loss estimates identified by PCS at a national level (all 50 states plus Washington D.C.) at a regional level (Easter, Northeastern, Southeastern, Midwestern, Western) and at State level (Florida, Texas, California). The loss period is the time during which a catastrophic event occures. Most of these indices refer to loss periods as the calendar quarters. The March contract refers the first quarter, the June the second, September the third and December contracts the fourth quarter. Only the Western index and the California index refer to the whole calendar year (annual contracts). PCS provides loss estimates as catastrophes occur. The daily PCS insured loss estimates are based on both the expected dollar loss and the projected number of claims to be filed. It is intended to estimate the total industry net insurance payment for personal and commercial property lines. PCS uses a combination of different methods for estimation catastrophe damage. First of all, PCS takes a confidential general survey of almost 70% (based on written premium) of the whole US insurance industry (agents, companies and adjusters) by composing the reported individual losses and claim estimates. Second, PCS relies on its National Insurance Risk Profile (NIRP), where in more than 3.100 counties potential risk affectness of objects like buildings or vehicles are carefully regarded. The dollar value of the PCS Index doesn’t exactly match the aggregate industry loss. In order to make the index more manageable, the following formula is applied:  L(t )  1 + 0 .5  Li (t ) =  10 M ln  10 where: Li (t) = index value. L (t) = industry aggregate loss value. A typical Cat bond payment is usually triggered by an event. There are four main trigger types, according to the correlation with actual losses: 1. Indemnity: triggered by the issuer's actual losses, so the sponsor is indemnified, as if they had purchased traditional catastrophe reinsurance. If the layer specified in the cat bond is $100 million excess of $500 million, and the total claims add up to more than $500 million, then the bond is triggered. 2. Modelled loss: instead of dealing with the company's actual claims, an exposure portfolio is constructed for use with catastrophe modelling software, and then when there is a large event, the event parameters are run against the exposure 16. See “PCS Catastrophe Insurance Options – A new way of managing catastrophe risk”, Schradin. 31 database in the cat model. If the modelled losses are above a specified threshold, the bond is triggered. 3. Indexed to industry loss: instead of adding up the insurer's claims, the cat bond is triggered when the insurance industry loss from a certain peril reaches a specified threshold, say $30 billion. The cat bond will specify who determines the industry loss; typically it is a recognized agency like PCS. "Modified index" linked securities customize the index to a company's own book of business by weighting the index results for various territories and business lines. 4. Parametric: instead of being based on any claims (the insurer's actual claims, the modelled claims, or the industry's claims), the trigger is indexed to the natural hazard caused by nature. So the parameter would be the wind speed (for a hurricane bond), the ground acceleration (for an earthquake bond), or whatever is appropriate for the peril. Data for this parameter is collected at multiple reporting stations and then entered into specified formulae. For example, if a typhoon generates wind speeds greater than X meters per second at 50 of the 150 weather observation stations of the Japanese Meteorological Agency, the cat bond is triggered. 5. Parametric Index: Many firms are uncomfortable with pure parametric bonds due to the lack of correlation with actual loss. For instance, a bond may pay out based on the wind speed at 50 of the 150 stations mentioned above, but the insurer loses very little money because a majority of their exposure is concentrated in other locations. Models can give an approximation of loss as a function of the speed at differing locations, which are then used to give a payout function for the bond. These function as hybrid Parametric:Modeled loss bonds, and have lowered basis risk as well as more transparency. CAT Options The real advantages of PCS Options are, that they might open the private capital market for to sustain the traditional catastrophe (re:)insurance markets and that they might add flexibility to insurers' and reinsures' risk management. But on the other hand, there are several critical aspects of the PCS market that may change this optimistic view, e.g. PCS contracts are less customized as traditional reinsurance programs are and the liquidity and stability of the PCS market are not yet really proved. The clearing process at the CBOT is organized and ensured by a clearing house which is named BOTCC (Board of Trade Clearing Corporation). Beside the CBOT itself the BOTCC is a separate entity that works as a third:party guarantor to every option contract as well as it takes an integral part in market transactions: customers place orders through their brokerage firm. The broker which should be a clearing member of the BOTCC fills orders through the open outcry system on the CBOT trading floor and transmits trade information to the BOTCC. After that the BOTCC matches the trade information, guarantees performance and requires to settle gain or loss from the transactions. 32 The margin account system at the CBOT does not much differ from those of other futures exchanges. Beneath the margin system the BOTCC disposes over additional resources, such as a reserve capital amount of currently more than $140 million and $300 million committed credit facilities available to provide temporary liquidity. PCS Options are European style, which means that an exercise is possible only at maturity. At this time all positions in:the:money will be equalized automatically. For example, the holder of an option call (put) receives a cash payment equal to the positive (negative) difference between the PCS index value at maturity and the exercise price. Without regarding the settlement date, all PCS Options can be traded all over the trading period. To limit the amount of losses that can be included under a PCS contract which means to improve the flexibility of PCS contracts as a risk management instrument, PCS Options are available both as small cap (aggregate insured industry losses from 0 USD to 20 billion USD which means an index value from 0 to 200 points) and large cap (aggregate insured industry losses from 20 billion USD to 50 billion USD which means an index value from 200.1 to 500 points). The strike or exercise values are listed in integral multiples of five points (5 to 195 for small caps, 200 to 495 for large caps). Moreover each index point has a dollar value of $200. In order to understand how PCS Options work and which benefits they might give to an insurance company managing catastrophe risks one should look in a first step at the fundamental position of a PCS long call. The pay:off of a PCS long call large cap with strike price K is: c(t ) = max[( Li (t ) − K ),0] Substituting Li(t) with its industry loss expression see above: L(t ) 1 c(t ) = max[((( + 0.5) ) − K ),0] 10 M ln 10 Taking into account the cap of 500 points and the dollar amount of $200: L(t ) 1 c(t ) = 200 min{max[((( + 0.5) ) − K ),0],500 − K } 10 M ln 10 Specularly the pay:off of a long put option must then be: L(t ) 1 p (t ) = 200 min{max[( K − (( + 0.5) )),0],500 − K } 10 M ln 10 33 The interesting aspect of PCS Options is that they can be employed to build up strategies such as bull and bear spreads to hedge a company's exposure to catastrophe risk. I will now briefly illustrate a hedging bull spread strategy realized by buying a PCS call option with strike KL and selling another PCS call option with strike KH > KL. The first step is to determine the two relevant strikes. Lets denote with OL(t) the operational catastrophe loss of the company at time t. Lets also denote D the amount of operational catastrophe loss that we want to transfer to the market. We then obtain:  OL(t ) − D 1 + 0 .5  KL =   10 M ln  10  OL(t ) 1 + 0 .5  KH =   10 M ln  10 Hence, the number of contracts k that must be purchased is:  D k =   KH − KL  1   200 In figure 7 we can see the original exposure of the company in red and the pay:off of the strategy in blue. If correlation between the company's OL(t) and the PCS Index is perfect, the strategy provides a perfect hedge. The final pay:off is the black thick line. As we can see, the pay:off between KL and KH is flat or, in other words, perfectly hedged. Figure 7: Spread pay:off in blue, underlying exposure in red and net pay:off in black. 34 CAT Futures Insurance Catastrophe Futures Contracts began trading on December 11, 1992 on the Chicago Board of Trade (CBOT). As in all commodity futures contract trading, a key objective is to increase liquidity of a market by bringing in new participants. These new participants, who are not professional consumers or producers of a commodity, increase liquidity of a market with their shorter term investment time horizon. For Insurance Catastrophe Futures the attraction of capital from non:traditional sources for insurance risk can create increased catastrophe capacity that is sorely needed in today’s insurance market. In traditional insurance or reinsurance, the process of insuring against catastrophes is tedious requiring months of negotiations to conclude a sound agreement, In addition, the reversal of such agreements through commutation negotiations is equally tedious. Through the design of uniform insurance agreements, the CBOT attempts to develop a liquid market in which catastrophe risks can be easily assumed or transferred and in which non:traditional capital is attracted to insurance. Unfortunately trading volume was anaemic and CBOT decided to discontinue the product, relying only on PCS options. Nevertheless, please note that a synthetic future position is replicable by selling a PCS put option and buying a PCS call option with the same strike prices. 4.3. “First:Loss:To:Happen” Put Option. Another totally different approach to operational risk transfer with derivatives may be represented by the so called “First:Loss:To:Happen” put option. As the name suggests, the contract is a put option purchased by the company. The option's strike may be calibrated on the company's equity or on other technical indicators such as its COL(t). The company that wishes to hedge its operational risk exposure purchases the option. If a loss event occurs, the seller of the option must then provide money for the difference between the strike and the actual loss. In this way, the seller cashes in the premiums. If nothing happens, the seller earns money. If a loss event occurs, the buyer of the option will be hedged and will receive payment. The premium is usually defined as x basis point over the risk free rate. Lets now examine what “First:Loss:To:Happen” actually means. In order for the contract to be clear, it is necessary to precisely determine which loss must be paid out. Given a certain period, the option pays out the first loss event. If more loss events occur during the period, the option covers the greatest. 35 4.4 Operational Risk Swap – Industry Loss Warranties. Another way operational risk may be transferred is a swap. A swap is nothing more than a contract between two parties that agree to exchange cash flows at certain future dates. Cash flows may be fixed, floating or indexed. Swaps may provide flexible operational risk transfer mechanisms to banks due to their versatility. Imagine you are a bank and you will migrate your electronic payment system in the next 4 months. You don't want to incur in more than $10 Mln losses. To hedge your operational risk exposure, you could issue an OR Swap were the buyer agrees to pay the potential excess loss over ten million dollars and you pay monthly payments in exchange. This basic and simple idea may be applied to all areas of operational risk transfer. As already seen, the catastrophe derivatives industry is usually the one that pioneers the most innovative products. OR Swaps have been already implemented in the CAT context since the 1980s. They trade under the name of Industry Loss Warranties or ILWs. Under a ILW agreement, the buyer accepts to cover up all excess losses over a certain trigger level and for certain events such as quakes, hurricanes, etc. The seller agrees to pay a certain amount over a notional value. For example a $20bln US Wind and Quake ILW buyer will have to cover up the issuers losses if the total industry loss exceeds $20bln in the US for damages caused by wind or quakes. The market for these products is quite liquid with many brokers and dealers. Among all the dealers, Access Reinsurance Inc. agreed to disclose its pricing: a $20bln California Quake ILW with first event covered June 20 2010 was pricing at 7%. This means that the protection buyer had to pay $140mln of annual payments to hedge its catastrophe risk. ILWs are also provided on the so called “second events”. These are ILWs that cover the losses that arise after the catastrophic event took place. In the appendix at the end of this chapter, I provide the pricing grid released by Access reinsurance Inc. 4.5. Operational risk derivative market: players and limits. The market for operational risk derivatives is growing fast. The notional amount of Cat bonds issued in the second quarter of 2007 was $4.3 billion, more than quadrupled in six years. The notional amount of ILWs outstanding in 2007 exceeded $10 billion, more than 36 quintupling in a matter of three years. The recent financial crisis has dried up a lot of liquidity but the market is set to rebound as liquidity starts flowing back in the business. The market participants may be divided in three main groups: 1. Protection buyers: Every player that wishes to transfer risk is essentially buying protection against such risk. Right now these players are mainly big reinsurance companies but as time passes and as a liquid operational risk derivative market develops protection buyers may directly be commercial and investment banks willing to transfer such risk. A new market practice for protection buyers is that of pooling together insurance policies in a Special Purpose Vehicle (SPV) called “Sidecar” and then use such collateralized assets to back an issue of Insurance Linked Securities (ILSs), such as Cat Bonds. For tax purposes, such vehicles are often set up in business friendly nations such as the Cayman Islands, Virgin Islands, Bermuda or Ireland. These issues may be divided into senior, mezzanine, junior and equity tranches, each bearing an increasing risk and thus an increasing return. These securities are usually rated as “junk” (BB or lower) due to their high risk profile. In 2005, capital raised with “Sidecars” was $1.745billion. In 2006, capital raised topped over $4billion (+150%). In 2007 the market softened probably due to the financial crisis. Operational risk and catastrophe derivatives may then be purchased, repackaged and sold by other financial intermediaries, creating an “Operational CDO”. It is nevertheless important to remind that these types of securities are not very liquid so excessive financial engineering and structuring may create extremely illiquid assets. This type of problems has arisen during the 2007 subprime mortgage financial meltdown. Main market participants are: Munich Re, Swiss Re, Validus, Hannover Re, White Mountains Re, Harbour Point, Reinassance Re, Tower Group, Flagstone Re, Lancashire Re, AIG, Marsh, USAA, Hatford, Liberty Mutual, SCOR, Allianz, Tokyo Marine & Fire, XL Capital. 2. Protection sellers: On the other side of each purchase there is a seller. This fundamental statement is true also for operational risk protection. Main sellers nowadays are other reinsurance companies, investment banks, mutual funds, pension funds and, particularly, hedge funds. Hedge funds have been playing a vital role in trading and dealing such securities, providing capital and liquidity to the market. Main market investors are: Aon Benfield Securities, Swiss Re Capital Markets, Barclays Capital, Deutsche Bank, BNP Paribas, Goldman Sachs, Merrill Lynch, GC Securities, JP Morgan, Willis Capital Markets, J.C. Flowers, First Reserves, Golden Tree, Highfields, Farallon. 3. Dealers, brokers and traders: Many market participants support the buying and selling activity by providing brokerage services or by posting bid:ask prices for each product. In many cases, a secondary OTC market for such products has been created even though 37 liquidity remains small. For example, Access Reinsurance Ltd. provides quotes and pricing for ILWs and market info. Other main players are: Goldman Sachs, Barclays Capital, Deutsche Bank, BNP Paribas, JP Morgan, Merrill Lynch Willis, Access Re, Artex Risk Solutions, Marsh, Aon Corporation, Aon Benfield, BB&T Insurance Services, RK Carvill, Guy Carpenter. 4. Consultants and legal: Issuing operational risk derivatives, setting up all the adequate corporate legal structures, making contracts, etc. requires deep strategic and legal expertise. For such reasons, issuers are usually advised by a number of strategic and legal consultants. World renown consultants are: AIR Worldwide Corp, EQECAT, Milliman International, Patterson Martin, Planalytics Inc., Risk Management Solutions Inc., Tillinghast, Lane Financial, Navigation Advisors LLC, BB&T Assurance Company Ltd., ABS Consulting, Belmont Risk Solutions Ltd., The Taft Companies, Capstone Associated, Mercer, Watson Wyatt, Capstone Associated Services Ltd., Cadwalader, Wickersham & Taft, Conyers Dill & Pearman, Fried Frank, Wilkie Farr, Dewey & LeBoeuf, Debevoise & Plimpton. Several problems may prevent an operational risk derivatives market from functioning well. The first set of problems has already been outlined in the previous chapters: information asymmetry. When an investor is selling protection, it must be careful who he sells it. Information asymmetries on the protection buyer’s real operational risk data might be so deep no investor will trust to enter the market. To avoid this type of problem, two solutions are making their way. The first is to organize public operational risk databases. Companies or consortia like ORX, ORIC, OpRisk Analytics and OpVantage collect and sell operational risk data to the market or, for consortia, to its own members. This will not eliminate information asymmetry but it will likely reduce it. The second solution is regulatory intervention: Basel III might force every firm that has to comply with its operational risk regulation to thoroughly disclose its operational losses data. The second solution is the easiest and probably the more effective nevertheless regulators should also consider regulation has a cost and there should be now need to force firms to do what they are partially heading to do themselves. Another problem that may arise is “adverse selection”: those providers that require protection are exactly those with an exposure above the average or those with the poorest operational risk management and mitigation framework. Only with deep pre:trade compliance this risk is nullified. But compliance has a cost: the liquidity of the market may be hurt by long and extensive pre:trade compliance procedures. Furthermore, if a trigger event is defined as “indemnity”, in other words it’s triggered by the issuer’s internal data, the chance the issuer might modify the data becomes significant. Issuers may fake excessive losses just to trigger the event and receive operational risk insurance payments. This is a practical example of “moral hazard”. 38 These problems already exist in traditional insurance markets. They are hard to solve because they deal with the most precious good on the market: information. This means that also operational risk derivatives market will probably be affected by these problems. Nevertheless, if a bank is discovered providing false data, the bank would immediately lose its credibility and its access to the market. Its cost of borrowing would sky rocket and it will soon be out of business. Trust and reputation has always a key element in the way markets work. A way to try to solve such problems is to link triggers to publicly available data, for example by linking cat bond’s payments to the PCS Index instead of the issuer’s internal data. This is the solution that the market seems to appreciate the most. In this way the risk that losses are above or under the index remain on the issuer’s balance sheet and he has all the interest to reduce such risk with adequate risk management and mitigation frameworks. This residual risk that remains on the protection buyer’s balance sheet is usually referred to as “basis risk”. Basis Risk The term “basis risk” is used to describe the residual risk baring by a an institution that is hedging a risk with exposure to a different asset. A perfect example might be an airline trying to hedge jet fuel risk taking exposure to oil futures. Since the correlation between jet fuel and oil is not 1, the airline is baring the risk that the two prices might differ substantially. This risk is then called “basis risk”. In our case, we are hedging our internal losses with an exposure to and industry loss index and the correlation between the two assets is not 1. This is exposing us to the risk that the values of the two assets may differ substantially. If, for example, we recorded a loss of $1.5MLN, mostly concentrated in Florida, the broad USA PCS Index would underestimate our loss and we would not be perfectly hedged. Obviously there are ways of managing, but not neutralizing, basis risk. Basis risk can me measured as the R:squared of a regression between index returns and loss data17. It can be shown that the optimal hedge ratio h with basis risk can be computed as follows: h = ρ S ;F So that: NF = h NA, where: σS σF S = the bank’s loss data F = the derivative on operational risk N = the number of contracts ρS;F = correlation between S and F σ = standard deviations h = optimal ratio of derivative contracts to buy. 17“Options, Futures and other derivatives” J.C. Hull 39 Appendix: Access Re indicative pricing grid at June 30, 2010. # ++ % !" #$% .&& /( (& % & !" #$% 1 ' & '( 1 ' !" #$% 2 (3 (& ) ( 2 (3 * + ( ( 1 ' , &) #- . / 0 1 ' 2 (3 (' ' 4 5 && /6. /6. /6. 7 7 7 7 4 5 && /6. /6. 7 7 7 7 7 7 4 7 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 7 7 7 4 5 && 7 7 7 7 7 4 5 && 7 7 7 7 7 4 5 && 7 7 7 7 4 5 && 7 7 7 (8( # ++ % (8( 2 (3 #98: (8( .&& /( (& % & 8 .&& /( (& % & 8 $ (8( .&& /( (& % & 4 5 && 7 7 7 7 4 5 && 7 7 7 7 4 7 5 && 7 7 7 7 7 4 5 && 7 7 7 7 7 4 7 5 && 7 7 7 7 7 4 5 && 7 7 7 7 7 4 5 && 7 4 5 && 7 4 5 && 7 " ; 7 /6. 7 ' # ++ % !" #$% .&& /( (& % & 8 .&& /( (& % & 8 $ (8( .&& /( (& % & 4 5 && /6. 7 /6. 4 5 && /6. 7 7 4 7 5 && /6. 7 7 7 7 4 5 && 7 4 5 && 7 4 5 && 7 40 5. Pricing Every day brokers, dealers and traders buy and sell derivative contracts at ask and bid prices. Having a model to find the correct no:arbitrage price for a derivative is absolutely indispensable for the derivative’s market to develop. Robust pricing models have already been developed for plain vanilla derivatives as well as complex structured contracts. Nevertheless, operational derivatives present some features that make them hard to price with traditional pricing models. 1. Incomplete markets: the first and most difficult problem to solve is that operational risk markets are incomplete. In a complete market, a derivative position can be dynamically hedged with a portfolio made up of the underlying security and bonds. In OR markets, this is not possible because operational losses are not a liquid asset that can be traded. This means that dealers and traders will have to hedge their derivative positions using proxies of operational losses and this makes the pricing way less robust. In order to be compensated for this huge risk, market makers will probably keep very wide bid:ask spreads18. Some may then think that a feasible process to practically deal in these securities might be to price them as if the were normal derivatives and then just increase ask –bid spreads until the dealer is compensated for the risk. This is in fact what might happen but using classical derivative pricing instruments is wrong for a number of other limits of operational risk. 2. Non:normality: Operational losses usually occur with fat tails. This means that catastrophic events are by far more frequent than a Gaussian distribution may forecast. This then means that the volatility of the process is greater than expected and the prices should then be higher. 3. No: Brownian motion: The path of a stock for derivative pricing purposes is usually modelled as a stochastic Brownian motion: dS 0 = S 0 dt + σS 0 dWt Where c is called the drift and Wt is a Weiner Process with the following properties: (1) Normal distribution; (2) Mean = 0; (3) Variance = ^t. Operational losses OL(t) = dCOL(t) are not normally distributed and have a positive mean > 0. The variance is then also very large and difficult to model. This means that traditional stochastic calculus like Ito’s lemma cannot be used when pricing operational risk derivatives. 18. M.G. Cruz. (February 2002). “Modelling, measuring and hedging operational risk”. Wiley & Sons Inc. 6 (2): 233 – 251. 41 Given these theoretical restrictions to Operational risk derivatives pricing, some attempts to provide indicative pricing models have been advanced by many sides. The first way to try to find a price for a derivative is to use utility theory. As we have already seen in chapter 4.1., it is possible to define a certain equivalent an calculate the premium for the risk transfer as: g = m*st.dev.(OLR). where m is the market price of risk calculated with the CAPM and st.dev (OLR) is the standard deviation of the Operational Loss Rate. Some very interesting methods are then suggested by Cruz (2002) such as: a. Defining the premium as a Var measure: g = Q(1:α) with Q = quantile of a risk measure and α = confidence interval. b. Trying to define a martingale through the Essecher principle (Christensen, 1999): E ( Xe δx ) g= E (e δx ) Another very interesting utility based pricing formula has been advanced by Elliot and van der Hoek19. The bid price vb of a contingent claim G is expressed as follows: v b (G ) = ∑ q S {U −1 ( E[U (θ S0 + G AS ]) − θ S0 } S Where: G = contingent claim on a non:tradable asset Y. qs = probability of state S AS = Arrow:Debreu securities in state S. θ S0 + G AS = certain equivalent in state S. 19. Elliot, Van der Hoek. “Pricing claims on non tradable assets”. 42 Furthermore, with reference to CAT Bonds pricing, Cruz (2002) advances the following simple method to price the bond: 1. Estimate the parameters of the frequency and severity distributions. Using maximum likelihood methods we can estimate the parameters of the operational loss distribution. The decision of the distribution is very important. Cruz suggests using a Poisson but Weibull and Gamma distributions may as well be used20. 2. Analyze the sensitivity of the parameters using re:sampling techniques. We have now to test the robustness of tail events. Let Θ̂ n be the estimate of a parameter vector θ based on a sample of n operational losses. An approximation to the statistical properties of Θ̂ n can be obtained by studying a samble of bootstrap estimators Θ̂(b) m , b=1,…,B. The estimated asymptotic variance is therefore: 1 B ˆ ˆ ][Θ ˆ (b) − Θ ˆ ] [ Θ n ] = ∑ [Θ (b) m − Θ n m n B b =1 3. Find the aggregate distribution through simulation. This step is usually performed with Monte Carlo distributions. 4. Structure the OR Bond. This involves calculating the default probability due to an extreme event, calculating the return required by the market for such risk and then discount the nominal value with the overall return required by investors. Another useful tool provided by Cruz (2002) is the Gumbel method of exceedances. It yields the probability of an event to exceed a certain trigger t given the total number of events n, the number of event over the trigger j and the number of future observations r.  r + n − t + j  j + t − 1    1 n t t − −   where j = 1,2,…n. Pr( H = j ) =  r +n    n  In this way we can compute the probabilities of loss p and survival (1>p) and therefore adequately price an OR Bond or a OR Swap/ILWs. 20 Panjer (July 2006) “Operational risk: modelling analytics”. John Wiley & Sons Inc. 43 Some efforts have also been made to price PCS call and put options. Moller develops a model based on a process: L(t ) = L(0)e X (t ) ? (t ) With X (t ) = ∑Y n , t ∈ [0, u ) is a compound Poisson process with frequency λ and jumps n =1 exponentially distributed, Yn are i.i.d. random variables following an exponential distribution with parameter a and ?(t) is a homogeneous Poisson process with parameter λ. Moller then applies a Esscher transform to create a martingale and is therefore able to solve in a linear form and compute prices for call and put options. c(t ) = L(t ) ? (d 1 ) − Ke −δ ( v −t ) ? (d 2 ) ln( K L(t ) − (δ + With d1 = σ2 2 σ (v − t ) p (t ) = Ke −δ ( v −t ) ? (− d 2 ) − L(t ) ? (− d 1 ) ln( K L(t ) − (δ − )(v − t ) and d2 = σ2 2 σ (v − t ) )(v − t ) . We can end this chapter by suggesting a possible process for operational risk: dCOLt = COL0 dt + σCOL0 dz + JdL Where COL = Cumulative Operational Loss c = average increase in COL i.e. the Operational loss rate OLR OL(t ) A(t ) OL(t ) COL (t ) = = . divided by because COL (t ) A(t ) COL (t ) A(t ) σ = standard deviation. JdL = a jump diffusion component with an alpha stable Levy distribution with mean zero an infinite variance. This model might be successful in modelling operational risk due to its fat tails behaviour. Ito’s lemma for Levy distributed random variables has been provided by Kleinert (2004)21. 21. See Hagen Kleinert (2004). “Path Integrals in Quantum Mechanics, Statistics, Polymer Physics, and Financial Markets”, 4th edition, World Scientific (Singapore). 44 Conclusions In this thesis, we have seen what is operational risk,how it is legally defined and how it is currently hedged in insurance markets. After proving that it is legally possible to transfer operational risk with alternative risk transfer mechanisms such as derivatives, we have then researched all the possible ways of transferring such risk within capital markets. Catastrophe risk is an interesting subset of operational risk that helps to test ideas on how to transfer HFLI risks such as quake risks, hurricanes, etc. We have therefore analyzed the CAT market for bonds and options. Some other less known yet interesting products have been proposed such as OR Swaps and “First:Loss:to:Happen” (FTH) puts. We also analysed the liquid ILWs market for extreme events as a proxy for OR swaps dealing. We have then analyzed the pricing problems in an operational risk environment and suggested possible solutions. My hope is that this work might clarify how convenient it would be both for protection buyers and protection sellers to find alternative market solutions to their risk management needs and thus pushing forward financial innovation. 45 REFERENCES [1] G.N. Gregoriou (2009). “Operational Risk towards Basel III”. John Wiley & Sons Inc. [2] G. Gabbi, M. Marsella,M. Massacesi (2005). “Il rischio operativo nelle banche”. Egea. [3] Markowitz, H.M. (March 1952). “Portfolio Selection”. The Journal of Finance 7 (1): 77–91. [4] F. Black, M. Scholes (1973). "The Pricing of Options and Corporate Liabilities". Journal of Political Economy 81 (3): 637–654. [5] R.C. Merton (1973). "Theory of Rational Option Pricing". Bell Journal of Economics and Management Science (The RAND Corporation) 4 (1): 141–183. [6] The Financial Services Authority (2008). “Prudential sourcebook for Banks, Building Societies and Investment Firms – BIPRU 6 – Operational Risk”. [7] M.G. Cruz. (February 2002). “Modelling, measuring and hedging operational risk”. Wiley & Sons Inc. 6 (2): 233 – 251. [8] M.Moller. “Pricing PCS Options with the use of the Esscher Transform”. [9] Hagen Kleinert (2004). “Path Integrals in Quantum Mechanics, Statistics, Polymer Physics, and Financial Markets”, 4th edition, World Scientific (Singapore). [10] Benhamou (2007). “Global Derivatives”. World Scientific. [11] Birindelli, Ferretti (2010). “Il rischio operativo nelle banche italiane”. Bancaria editrice. [12] Artoni (1999). “Elementi di scienza delle finanze”. Il Mulino. [13] European Parliament and Council (2004). “DIRECTIVE 2004/39/EC” (Markets in Financial Instruments Directive). Official Journal of the European Union. [14] Schradin “PCS Catastrophe Insurance Options : A New Instrument for Managing Catastrophe Risk”. [15] D’Arcy, France (1992). “Catastrophe futures: a better hedge for insurers”. [16] Niehaus (1999). “Basis risk with PCS catastrophe insurance derivative contracts. Journal of Risk and Insurance”. [17] Robert P. Eramo. “Insurance Catastrophe Futures”. 46 [18] J.C. Hull. (2009) “Options future and other derivatives”. Seventh Edition. Pearson Prentice Hall. [19] Elliot, Van der Hoek. “Pricing claims on non tradable assets”. [20] Hulley, Mcwalter (2008). “Quadratic hedging of basis risk”. [21] Cummins, Lalonde, Phillips (2000). “The basis risk of catastrophic:loss index securities”. The Wharton School, University of Pennsylvania. [22] Dimitris, Chorafas (2001). “Managing operational risk”. Euromoney Books. [23] N. Misani. “Risk Management tra assicurazione e finanza”. Egea. [24] Basile, Schwizer, Anderloni (2001). “Nuove frontiere dei mercati finanziari della securities industry”. Bancaria editrice. [25] Chernobai, Rachev, Fabozzi (2007). “Operational Risk”. John Wiley & Sons Inc. [26] Panjer (July 2006) “Operational risk: modelling analytics”. John Wiley & Sons Inc. [27] Cosma (2007). “La misurazione del rischio operativo nelle banche”. Bancaria editrice. [28] Hussain. (2000). “Managing Operational risk in financial markets”. Butterworth Heinemann. 47