The Sad State of BCP and Cyber Risk Planning at Financial Market Infrastructure Institutions

Nine Years Thundering Toward the Station
Alas, Yet to Arrive

Here I am again making what no doubt could be labeled as an “overdue wake up call” by the chronically somnolent or perhaps as a “sobering fact” by the habitually intoxicated.

On 21 July the BIS Committee on Payment and Market Infrastructures published a joint report with the Board of International Organization of Securities Commissions on a level 3 evaluation of implementation of Principles for Financial Market Infrastructures (PFMI).

Before beginning my rant, a couple of notes.

The PFMI were issued in 2012, which would appear to be some nine years ago, if my arithmetic is correct.

The PFMI were issued to set standards for Business Continuity Planning (BCP) and Recovery of Operations for systemically important and therefore critical financial market infrastructure institutions:

• payment systems (PS)

• central securities depositories (CSD)

• central counterparties (CCP),

• securities settlement systems (SSS) and

• trade repositories (TR).

To be clear we’re talking about payment systems, e.g., CHIPS, CHAPS, Fedwire not individual banks. For the other categories, some US examples: DTCC, NSCC, FICC, etc.

The rationale is to require these critical market infrastructure institution to have effective BCPs to restore service in the event of disruptions. In that regard think of power blackouts, 9-11, and yes cyber attacks.

Here is the link to the BIS CPMI page on the PFMI which contains additional details.

In addition to the PFMI, you will notice that there are also an additional eight guidance papers on implementation of the PFMI.

Among those there is a 2016 guidance paper on cyber risks. Applying the same arithmetic as above, that would appear to be five years ago.

The July joint BIS CPMI/IOSCO-OICU IMSG (Implementation Monitoring Standing Group) reviewed the business continuity planning practices at a sample of 38 FMIs from 29 jurisdictions during 2019-2020.

The sample comprised 14 PSs, 15 CSDs/SSSs, five CCPs and four TRs.

The study was conducted by reviewing responses to a questionnaire.

That is, based on assertions made by the respondents rather than an on site investigation.

If you’re like me, you might find that a bit chilling given the results. 

If you're willing to self-certify to failure, isn't it likely the the failure is even more egregious?

So what were the findings?

1.2.1 Timely recovery in the event of a wide-scale or major disruption

The IMSG has identified one serious issue of concern, which is that the business continuity management of some, and potentially many, FMIs does not seem to “aim for timely recovery of operations and fulfilment of the FMI’s obligations, including in the event of a wide-scale or major disruption”, as expected by the Operational Risk Principle (Principle 17). Furthermore, based on the information provided by the participating FMIs, there are doubts about whether their business continuity plans are designed to “ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events” and “enable the FMI to complete settlement by the end of the day of the disruption, even in case of extreme circumstances” as expected by KC6. [That’s Key Consideration 6 in Principle 17]. Given this is a serious area of concern, the CPMI and IOSCO expect the relevant FMIs and their supervisors to address this as a matter of the highest priority.

Given that the PFMI were issued some 9 years ago and implementation is still deficient, the use of the term “highest priority” is perhaps both an indication of importance as well as a bit of sarcasm. That being said, the IMSG only “expects” this to be done. No doubt as they have expected implementation over the past nine year.

The IMSG’s findings continue:

While almost all of the surveyed FMIs indicated that they have business continuity plans (BCPs) designed to meet this requirement, there is evidence that leads the IMSG to question this. In terms of specific evidence:

• A few of the surveyed FMIs do not explicitly aim for the 2hRTO, even for wide-scale physical (noncyber) disruptions.

• One of the surveyed FMIs acknowledges that its secondary site does not have a distinct risk profile from that of its primary site.

• A small number of FMIs stated that they did not have alternative arrangements to allow for the processing of time-critical transactions. Of those that did have such arrangements, some relied solely on manual and paper-based alternative arrangements.

• A few FMIs indicated that they do not have specific plans to mitigate potential widespread staff unavailability. This suggests that these FMIs may have difficulty completing settlement if this were to occur.

“Mighty disappointing” to use a technical financial market term.

Inverse kudos to the respondent that apparently will rely on manual paper-based systems. Systemically important FMIs are likely to be ones that process “lots” (that’s another technical financial term) of transactions.

But you ask what about cyber attacks?

1.2.2 Cyber risk

Principle 17 states that “[a]n FMI should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls…” The IMSG has identified one issue of concern, which is that a few FMIs in the sample did not provide specific BCP objectives with respect to cyber risk. Among the FMIs that have specific BCP objectives with respect to cyber risk, only a few explicitly acknowledged the breadth and depth of potential cyber attacks and the complexities of cyber risks that their BCPs may not be able to cover.

While not as serious as the previous risk in the assessment of the IMSG, I think this qualifies as very serious.

• The probability of a cyber attack may be higher than some of the other risks of disruption and the impact much greater.

• If computer networks are hacked, critical information even that at backup sites may be unavailable or destroyed.

Particularly, if the attack is the work of a state actor.

That would be a different kettle of fish than a natural disaster. Or even a 9-11 style attack.

Analyzing GFH's 1Q2021 “Incredible” Performance

Whether It is Counting or acCounting
AA Helps You Keep the Numbers Straight
(Professional Actor - Not AA)

According to the headline numbers from GFH’s short form press release on its 1Q2021 performance, GFH had an “incredible” quarter.

Net profit including Non Controlling Interests (NCI) share was some US$ 19.3 million compared to US$ 6.8 million for the comparable period last year.

Profit attributable to GFH’s shareholders (excluding NCI) was some US$ 16.1 million versus US$ 5.1 million the year earlier.

That’s 3.2x last year!

Wow!

But strangely GFH’s equity attributable to its shareholders only increased US$ 4 million from FYE 2020.

Similarly total equity including NCI was up US$ 8 million from FYE 2020.

What happened?

What accounts for the “missing” US$ 11 to 12 million?

Normally we would begin by looking at the Statement of Comprehensive Net Income which usually follows the Statement of Net Income.

Examples from Conventional Banks in Bahrain.

BBK 1Q2021. 

Investcorp 3Q2021. (Recall the Investcorp’s FYE is June for no doubt some excellent reason which I was told was to prevent having to issue audited financials some years back when the results would have been “mighty disappointing” to use a technical financial term.)

But it seems that Islamic Banks in Bahrain are not obligated to provide a separate Comprehensive Income statement.

See Al Baraka’s 1Q2021 report here. And note their auditors are a different firm than GFH’s.

So what to do?

Off we go to the Consolidated Statement of Changes in Shareholders Equity where those sort of entries would be recorded.

There you will notice two amounts US$ 4.479 million (fair value changes) and US$ 8.280 million (disposal of sukuk) for a total of $12.759 million being deducted from net income.

You will notice that after these transactions there is a line labeled “Total recognized income and expense”.

This is the equivalent of “comprehensive income”. But “buried” where you might miss it.

That is why as I have argued before it is critically important to look at Consolidated Statement of Changes in Shareholders’ Equity. 

Not only to catch “comprehensive income” when there is no separate income statement for that. But also to see what other entries are affecting equity which are the economic equivalent of “income” and “expense”.

What’s behind these entries?

For those assets that are carried on the balance sheet at “fair value” as opposed to historic cost, accounting standards allow banks to recognize changes in fair value of those assets in two ways:

• The first is to recognize the change in value (whether plus or minus) in the income statement (FVTIS)

• The second is to recognize the change directly in equity (FVTE). So the change does not appear in the income statement.

In 1Q2021, the assets that GFH holds as FVTE had an aggregate net “loss” of fair value prompting a US$ 4.479 million charge to equity. This charge is non discretionary. It is an “expense” in "comprehensive income".

However, the US$ 8.280 million was discretionary.

GFH decided to sell the sukuk

When a FVTE asset is sold, the profit or loss on the sale must be recognized in the income statement.

In order to prevent “double counting” of profit or loss already recorded in the fair value reserve when an asset is sold, the previously recorded profit or loss must be subtracted from the fair value reserve.  

As hopefully is clear from these entries, the impact on shareholders' equity is nil when those two amounts are equal.

When the profit or loss on sale differs from that already recorded in the fair value reserve, then the impact on equity will reflect that difference. 

For example, let's suppose GFH sells an asset for a US$ 8 million profit but has (already) recorded only US$ 7 million increase in the fair value reserve.  

In this case, GFH's equity will increase by US$ 1 million.  If the situation is reversed, GFH's equity will decrease by US$ 1 million.

To be fair by selling the asset, GFH has “locked in” the profit on the sale.

Removing the US$ 8.280 million from the reported US$ 16.1 million in net income lowers net income attributable to GFH shareholders to some US$ 7.8 million.

But what’s the point of all this?

Income is income, isn’t it?

Yes, but.

As noted above, GFH has the “discretion” to decide when to sell an asset. And thus when to declare a profit.

Even though moving the profit to income has no real impact on shareholders’ equity. The needle doesn’t move as they say.

Having that option can be quite handy.  Particularly if one expects that one's shareholders aren't bright or industrious enough to see that the "profit" has already been booked.

To be fair, we don’t know if GFH was taking advantage of particularly favorable market circumstances that might not occur again to sell the sukuk.

Or if it was seeking to manage its earnings upwards.

If we then remove the US$ 4.479 million change in fair value from reported income, that further lowers  income to US$ 3.321 million.

As you will notice, there were no items in comprehensive income in GFH’s 1Q2020 financials.

On this basis 1Q2021 wasn’t “incredible” at least in the positive sense of that word.

Based on Comprehensive Income, it was actually lower than the previous year.

However, we're not done yet with the analysis.  

If we look beyond “Comprehensive Income” to other items that I have argued are economically income and expense. we will see additional entries in both periods which further affect economic income.

1Q2020 was particularly brutal – net charges of US$ 25.8 million. 

1Q2021 had a gain of US $ 4.8 million.

On that basis, 1Q2021’s positive result looks much better compared to a rather disappointing 1Q2020 negative performance.

“ كل لبيب بالإشارة يفهم “

Why Hasn’t GFH “Grown” Its Equity Since FYE 2016?

Sometime it's the quality of the soil
Sometimes the climate or lack of water
And sometimes the farmer himself

 Key Points

• GFH’s equity has “grown” a mere US$ 5 million between FYE 2016 and FYE 2020, despite GFH having earned US$ 90 million net of cash dividends. US$ 292 million in net income less US$ 202 million (cash dividends).

• Market making activity and Treasury Share Accumulation cost GFH’s shareholders US$ 146 million.

• GFH also canceled US$ 50.5 million in Treasury Shares leading to another economic loss not captured in its financials though the vagaries of accounting.

• Beyond that, other transactions, largely related to losses incurred on acquisitions totaled US$ 88.5 million, not including the US$ 60 million charge related to KHCB’s BD 60 million AT1.

On 22 May GFH announced that its live webcast on 20 May on 1Q2021 results had been successful.

During the Q&A session the moderator read a question from an unnamed shareholder.

The next question is, while the group has managed to increase its assets, liabilities, and AUM, but not its equity, could you shed some light on the declining equity? 

Suryanarayanan Hariharan, GFH’s CFO responded:

There has been a marginal increase in the equity as of 31st March 2021. Despite the profit, there’s also a fair value movement of our treasury portfolio, which is captured on the equity, and for Q1 2021, there was a drop in the fair value movement, and that touched on the equity for the group. 

That didn’t seem like a completely satisfactory answer to me.

It omits the fact that the US$ 8.280 million in profit on the disposal of a sukuk was already reflected in equity. And, so, even though it appeared on the income statement, it did not increase equity. 

And also that the shareholder seemed to be asking a question about more than the change in equity from FYE 2020 which as noted by GFH’s CFO was positive..

But I didn’t “attend” the webcast so perhaps this is summary of a longer exposition with details “lost in condensation”.

In any case, I thought it would be an interesting topic to look at the “evolution” of GFH Group Shareholders’ Equity.

I chose the period 2017 through 2020.

Some methodological notes:

1. GFH’s Consolidated Statements of Changes in Shareholders’ Equity is the primary source document for information.

2. The focus is on changes in the equity belonging to shareholders of GFH Financial Group. To be clear that excludes the NCI.

3. Calculations reconcile to the changes in that equity. And so as outlined below miss one rather large economic loss

So let’s start with an overview of changes in Group shareholders’ equity over the period.

There really has not been much of a change over the period. US$ 5 million only.

Over the four year period, GFH has declared US$ 292 million in comprehensive income and has paid cash dividends of US$ 202 million.

That should lead to a US$ 90 million increase in equity.

From the chart above it clearly has not.

GFH is ’“short” some US$ 85 million.

So what accounts for the difference? 

Let’s go through the categories starting from the bottom.

TS Loss – Is the loss incurred on selling Treasury Shares.

Note this does NOT include the economic loss on GFH’s cancellation of some US$ 50.5 million of Treasury Shares in 2019.

Why not, after all my ranting and raving about this being a totally incomprehensible act that was to the detriment of the shareholders?

It’s not included because this transaction was netted against outstanding shares so the effect on shareholders’ equity was nil. In a master stroke of financial skill, GFH then issued US$ 55 million in bonus shares so that paid in capital remained unchanged. And I am reconciling to the equity as presented.

Despite that, it is still a loss to shareholders because GFH could have sold those shares in the market. It probably wouldn’t have recovered all of the US$ 50.5 million. But it would have recouped a good portion. That would have been of more benefit to shareholders than canceling the shares.

Or alternatively, it could have foregone issuing bonus shares by just distributing the Treasury Shares to its shareholders.

Net +/- TS – Is the net change in the US$ value of Treasury Shares, that is, purchases (a negative) against sales (a positive). Again this doesn’t include the share cancellation mentioned above for the same reconciliation reasons.

Emp Shares – Are purchases of Treasury Shares for GFH’s employee stock incentive program. A negative number is an acquisition of shares, a positive number the issuance of shares to employees.

Other – Is a collection of all other entries to Group Shareholders’ Equity.

As you’d expect this includes recurring items such as zakat and charity contributions. But there are some one-off items.

Let’s step through each year looking at major entries in the Other category to see if anything else catches our eye.

Each year’s total for Other is given should you want to explore for more detail on your own.

2017 (Total for the Year US$ 252 million)

• US$ 293 million in new stock issued. Some shareholders in GFH projects (Tunis Bay and India) gave GFH their shares in those assets in exchange for equally good GFH shares. This is a non cash transaction.

• US$ 37.5 million charge related to acquisition of increased share of the projects acquired in the stock exchange. Not broken down. KHCB and MGIC (Morocco) appear to be responsible. Probably primarily MGIC.

2018 (Total for the Year US$ 20 million charge)

• US$ 17 million in charges (via restatement) for adoption of FAS 30.

2019 (Total for the Year US$ 39 million charge)

• US$51 million charge for acquisition of additional interests in pre-existing investment with no change of control. Related to Tunis Bay and Residential South Real Estate Development Company (RSRED).

• US$ 14 million credit related to FX rate changes.

2020 (Total for the Year US$ 89 million charge)

• US$ 60 million charge related to KHCB AT1 purchase.

• US$ 14 million charge related to revision of financing terms. Likely KHCB related.

• US$ 18 million charge related to FX rate changes.

• US$ 4 million grant from Govt of Bahrain related to Covid and probably to KHCB.

Looking at items in Other, the US$ 88.5 million in charges related to Tunis Bay, RSRED, KHCB, and MGIC have yet to prove their value.

Some general observations;

• It’s not generally considered a sign of success when you wind up buying an incomplete project investment back from a client at a higher price than you sold it. Particularly when there’s no real “market” price.

• If the project has really increased in value since the initial sale, why would the investor want to sell now? Presumably that value will continue to increase as the project completes.

• If the seller is motivated to sell for liquidity or other reasons, wouldn’t that tend to decrease its pricing “power” in negotiations?

• If the buyer alone can unlock the value of the asset, then shouldn’t he or she have some leverage over the purchase price? After all, the buyer hopefully intends to make a profit on the project. If the re-acquisition price is too high, then the profit will be smaller than envisioned.

• The identity of the investor can also play a role in the price negotiations. Big fish or VIS, whatever you might like to call them, probably have more leverage.

• As I’ve noted before when a sale is concluded via the exchange of boot (non cash items), value can be rather hard to “pin down”. But perhaps easier to manage.

• GFH shares are no doubt more liquid that TBC, RSRED, MGIC. Thus, offering an investor a much easier way to exit. Particularly, if attempts were made to keep the share price “stable”. That might also explain why GFH “experienced” a persistent considerable and uncharacteristic loss on its “market making” activities.

Among the remaining items only the US$ 60 million charge related to the KHCB AT1 sticks out. This was probably unavoidable. GFH didn’t have any good options in the situation.

Summary

If we assume that the employee stock incentive is a worthwhile endeavour and not just another way to accumulate Treasury Shares, then the loss on market making of US$81 million and US$ 65 million in net TS purchases—totaling US$ 146 million—were probably not in the best interests of shareholders in general. Though perhaps some big fish may have benefited.

When the 2019 cancellation of the US$ 51 million in Treasury Shares is added in, we’re talking about some real money. Roughly equal to the cash dividends GFH paid over the period.

Adding the items from Other, particularly the US$ 88.5 million that I’ve flagged above, and it’s not a “pretty picture” to use a financial term of art as well as an homage of sorts for a former GFH senior officer.

All that said, the question for shareholders is how they evaluate GFH’s management’s performance.

C'est bien dit, mais il faut cultiver leur jardin.