Thematic review of compliance with liquidity policy

Ref #9982029 v1.2 Liquidity Thematic Review. Banks’ compliance with our Liquidity Policy Industry Insights and Thematics 08 September 2021 Liquidity Thematic Review Contents Executive Summary____________________________________________________________________________ 2 Background 2 Purpose of the review 3 What we reviewed 3 What we found 4 Next steps 7 Introduction ___________________________________________________________________________________ 9 Liquidity Policy background 9 Purpose of the review 11 Good practice examples and recommendations for banks _________________________________ 11 Good practice examples 11 Recommendations 14 Detailed findings _____________________________________________________________________________ 19 Current levels of bank liquidity 19 Good practices in liquidity risk management 20 Overview of compliance with the Policy 22 Compliance with the quantitative requirements 23 Qualitative areas for improvement 29 Appendix 1 – Scope and Methodology ______________________________________________________36 Appendix 2 – Quantitative and qualitative requirements and guidelines___________________40 Appendix 3 – Key website references ________________________________________________________43

2 2 Liquidity Thematic Review Executive Summary Background To understand why the Thematic Review on compliance with the Reserve Bank of New Zealand’s Liquidity Policy1 (the Policy) is important, we need to look at what liquidity is, the risk that banks face and the role of the Policy in promoting financial stability. Liquidity and the risk banks face need to be managed Liquidity is the amount of money that is readily available to a business. This includes cash and assets that can be quickly sold at a reliable price. Liquidity risk crystallises when a business is unable to meet its financial obligations as they fall due. This can quickly lead to loss of confidence in a business, and in some cases, default. Retail banks play a crucial role in the financial system, taking in deposits, facilitating payments and lending to individuals and businesses. The majority of deposits are short-term, while a large proportion of lending is in long-term residential mortgages which can extend out to 30 years. This leaves banks vulnerable to liquidity risk which needs to be managed. The GFC highlighted the vulnerabilities that banks face During the global financial crisis (GFC) in 2007-2008, global short-term funding markets dried up for several months. At the time New Zealand banks were reliant on offshore funding so when these markets closed they faced a liquidity stress. There was also fear that declining confidence in banks could create widespread panic and lead to customers withdrawing their deposits en masse - known as a ‘bank run’ - putting the viability of banks at risk. In response, the Reserve Bank of New Zealand – Te Pūtea Matua acted quickly and introduced a wide range of emergency liquidity facilities to support and stabilise the local financial sector. Similar, although lesser, stresses were experienced in the early stages of the COVID-19 pandemic and again the Reserve Bank made special liquidity facilities available to the banking sector. The Liquidity Policy was introduced to promote financial stability Following the GFC, the Reserve Bank drafted the Policy in recognition that bank liquidity is essential to the smooth functioning of the financial system and to mitigate the risk of future liquidity problems disrupting the financial system. This was consulted on in 2009 and introduced on 1 April 2010. There are three key requirements of the Policy:  Quantitative requirements: banks are required to calculate three liquidity ratios; the one-week mismatch ratio, the one-month mismatch ratio and the one-year core funding ratio. The mismatch ratios are designed to calculate a bank’s liquidity position in the event of a short term stress or loss of confidence. The one year core funding ratio measures the level of a bank’s longer term stable funding sources as a proportion of their lending. These ratios must be maintained above minimum levels set by the Reserve Bank.

---

1 See appendix 3 for where to find the Liquidity Policy

3 3 Liquidity Thematic Review  Qualitative requirements and guidelines: requirements and guidelines that banks are expected to apply to their internal framework for managing liquidity risk.  Disclosures and reporting: there are requirements covering public disclosures for material breaches of the Policy and separate Reserve Bank disclosures for any other breaches of the Policy. Banks are also required to report data on their liquidity positions regularly to the Reserve Bank. Purpose of the review The purpose of this thematic review was to assess how banks are complying with the Policy. We were also keen to gain a deeper insight into banking industry practices relating to the management and monitoring of liquidity risk. This is the first time we have conducted a review into compliance with the Policy since it was introduced in 2010. What we reviewed There are 27 registered banks in New Zealand2 , 15 locally incorporated banks and 12 branches of overseas incorporated banks. Our review covered all of the locally incorporated banks. However, only the 10 largest were chosen for onsite interviews and this report highlights the findings from those interviews. Our analysis was based on documents provided to us by the banks and interviews with directors and key bank staff involved in management and calculation of liquidity risk. Sample testing of each bank’s liquidity calculations was also undertaken3 . The review initially started in July 2019, but was put on hold during much of 2020 due to the COVID-19 pandemic, and recommenced in October 2020. As a result, the review was extended to September 2021. We are grateful for all the time, energy and effort the banks and their staff put into working with us on this review. In particular, we would like to thank them for all the information provided and for their openness when engaging with us. It has been hugely valuable.

---

2 The list of registered banks can be found at rbnz.govt.nz/regulation-and-supervision/banks/register 3 See appendix 1 for more detail on scope and methodology

4 4 Liquidity Thematic Review What we found Banks’ liquidity ratios are above the minimum levels required Banks are currently maintaining liquidity ratio levels above the regulatory minimums and comfortably above their own internal risk tolerance limits. Figure 1: Quarterly average mismatch ratios for all locally incorporated banks at 31 March 2021 Source: https://bankdashboard.rbnz.govt.nz/liquidity Figure 2: Quarterly average one-year core funding ratios for all locally incorporated banks at 31 March 2021 Source: https://bankdashboard.rbnz.govt.nz/liquidity Since the policy was introduced, only one bank’s mismatch ratios have fallen below the minimum required level. All banks have maintained their one-year core funding ratio above the minimum required level. Good practices identified There were three areas where good practice was well embedded across the industry. These included:  having a clear organisational structure in place to support liquidity risk management;  employing a wide range of internal limits and measurements beyond the minimum requirements set out in the Policy; and  monitoring cash positions to understand intra-day liquidity needs. There were a number of good practices that we saw that were not industry wide. These have been highlighted in Table 1 on page 11. 0% 5% 10% 15% 20% 25% 30% Individual banks one-week mismatch ratios one-month mismatch ratios 0% 25% 50% 75% 100% 125% Individual banks one-year core funding ratios Regulatory minimum

5 5 Liquidity Thematic Review Findings of non-compliance and areas for improvement Banks’ level of compliance was wide-ranging We found a wide range in the level of compliance with the Policy across the banks. The difference between their compliance levels was not due to the size of the bank, but rather an indication of the maturity of internal risk management frameworks. The review identified 208 findings in total, covering both non-compliance and weaknesses in the underlying calculations for the liquidity ratios, as well as liquidity risk management frameworks. Given this was the first review we have undertaken on compliance with the Policy, we expected to uncover a number of findings. Strong liquidity buffers maintained by the banks reduced the likelihood that any of the findings from this review that impact the liquidity ratio calculations could result in a breach of the minimum levels required by the Policy. Banks need to resolve system limitations and enhance model risk frameworks The large number of findings highlights gaps in banks’ liquidity risk management frameworks. It suggests there is widespread underinvestment in systems and frameworks. There is a risk this extends beyond liquidity management. Banks must resolve system limitations and enhance model risk governance and management. Over time and as banks grow, their sources of funding and their lending products broaden and change. As a result, identifying, understanding and measuring current and future risks becomes increasingly complex. Demands on data and analysis from internal and external stakeholders has also continued to increase and evolve. We expect all banks to invest in their systems now and over time to meet these current and future challenges. Overview of findings by policy area Our findings covered three areas:

1. Quantitative requirements: there were a total of 86 findings relating to the calculation of the regulatory liquidity ratios. This included 62 instances of non-compliance and 24 weaknesses. Most of these findings were due to system limitations and weaknesses in model controls, oversight and review.
2. Qualitative requirements and guidelines: we discovered 112 weaknesses in governance, and in the framework for managing liquidity risk. These findings were largely related to the roles and responsibilities in liquidity risk management and model risk governance frameworks.
3. Reporting: there were 10 findings relating to not recording items correctly in liquidity return submissions. Areas of non-compliance exist where practices differ from the requirements in the Policy. The weaknesses identified were areas where improvements should be made to help ensure the Policy objectives are satisfied. The total number of findings per bank ranged between five and 33. In general, those banks with the largest number of findings had weaknesses in their liquidity risk frameworks that required significant improvement. Banks have started addressing the issues identified and many findings have already been remediated.

6 6 Liquidity Thematic Review Figure 3: Number of total findings versus strength of liquidity risk frameworks Guidelines for internal liquidity risk management frameworks are detailed in the qualitative part of the Policy and cover the following aspects:  The organisational structure for liquidity risk management, including governance, responsibility for the management, implementation and application of the framework throughout the organisation.  Methods for measuring, monitoring and controlling liquidity risk. This includes identifying liquidity and funding risks, and the strategy and methods for managing and calculating these risks.  Planning for contingency management to ensure appropriate actions are understood and followed during a liquidity stress event. Key findings Tables outlining the full list of findings and recommendations for banks can be found on pages 11 to 19. We have summarised the key thematic findings below into good practices, non-compliance and areas for improvement. Non-compliance and areas for improvement Findings relating to the calculation of the liquidity ratios The key findings relating to the calculation of the liquidity ratios are summarised in the following areas:  Reasonable simplifying assumptions: if the liquidity ratio calculation requirements are unable to be met, a bank may need to apply an assumption. The Policy allows reasonable simplifying assumptions that have the effect (if any) of decreasing the liquidity ratios. Simplifying assumptions were being made that were not well substantiated and these were not always conservative.  Daily calculations: the liquidity ratio calculations were not always calculated daily. Many banks were only updating undrawn committed lines granted by the bank monthly. The mark-to￾market value or fair value measurement of liquid assets was not updated in daily calculations. 0 5 10 15 20 25 30 35 Total number of findings Liquidity risk management frameworks Weaker Stronger

7 7 Liquidity Thematic Review  Liquid Assets: the issuer rating was used to determine liquid asset haircuts instead of the issue rating. Credit rating changes were not always captured in calculations.  Market and non-market funding: most banks struggled to allocate funding between non￾market funding and market funding. Banks also had difficulty grouping customer deposits into the correct size bands for non-market funding.  Contractual cash-flows: approximations or simplifying assumptions used were not always conservative. Incorrect interest inclusions were also made. Some banks were unable to identify lending due to be drawn down where the draw-down date and principal amount were known.  Liquidity reporting: supplementary information provided in the monthly liquidity return to the Reserve Bank was not always accurate or complete. Resubmitted liquidity returns did not always include an explanation of revisions made. Some of the issues identified were due to weak internal controls and policy interpretation. A large number of issues arose due to system limitations, further supporting the overall conclusion that there is an industry-wide underinvestment in systems. Areas for improvement in liquidity risk management practices A large number of the findings from the review related to risk management and governance. We found significant weakness across the industry in model governance and model risk management. The majority of qualitative findings can be tied to four specific areas:  Roles and responsibilities in liquidity risk management: There were 34 findings in this area including weaknesses in information and challenge for decision making, oversight, review, key person risk and resourcing.  Internal strategy and communication of the strategy: there were 34 findings relating to model risk governance and management.  Scenario analysis: there were nine findings relating to the reporting of scenario analysis and use of those results in contingency planning.  Planning for contingency management: there were 15 findings of weaknesses in the documentation and testing of contingency funding plans. Next steps Feedback letters have been sent to the banks with a detailed list of their findings. All of the banks are taking the findings seriously and many of the findings in this review have already been addressed. The 10 largest locally incorporated banks have been required to:  develop a remediation plan to address all of the findings set out in their feedback letters; and  conduct a materiality assessment of the impacts of the quantitative findings on the liquidity ratios. Any material non-compliance with the Policy is subject to public disclosure.

8 8 Liquidity Thematic Review All 15 of the locally incorporated registered banks are required to undertake a self-assessment against the findings in this report. Reserve Bank supervisors will be monitoring the remediation plans and self-assessments. A review of the Policy will commence in the first half of 2022. The banks that participated in this thematic review have provided views on areas of the policy that they believe could be changed or given more guidance. This feedback and the findings from this review will be considered as part of the Policy review. There will be further opportunity to provide input during the Policy review consultation process.

9 9 Liquidity Thematic Review Introduction Liquidity Policy background What is liquidity and liquidity risk? Liquidity is the amount of money that is readily available. This includes cash and assets that can be quickly sold at a reliable price. Liquidity risk is the risk that a business will not be able to meet their financial obligations as they fall due. If liquidity risk crystallises, this can quickly lead to loss of confidence in a business, and in some cases, default. Liquidity risk in banking Banks play a key role in our financial system. Most lending to households and non-financial corporations in New Zealand is by registered banks. A large portion of this lending is in the form of residential mortgages, which are typically long-term loans that can extend out 30 years. Banks fund this lending by sourcing a mixture of short and long-term funding from both domestic and off-shore markets. The funding (liabilities) is usually of a much shorter duration than the lending (assets) and this creates liquidity risk. Liquidity risk can materialise if those that provide funding to the bank wish to withdraw their money and replacement sources of funding cannot be found (or are extremely expensive). Banks must carefully manage liquidity risk by:

1. ensuring adequate long-term funding;
2. having a diverse range of funding options;
3. holding a liquid asset portfolio which can be sold to raise cash in times of unexpected shortfalls; and
4. maintaining a strong internal risk management framework. The GFC highlighted the importance of sound liquidity risk management The global financial crisis (‘GFC’) that emerged in 2007-2008 highlighted the role liquidity plays in the smooth functioning of global and domestic financial markets. It also showed the importance of prudent liquidity risk management. New Zealand banks were particularly vulnerable The GFC was primarily triggered by a collapse in US house prices. This led to large credit losses in many global financial firms which caused funding from global markets to dry up. Globally bank funding is mostly from domestic deposits. However, New Zealand has a low domestic savings rate which creates a need for banks to obtain funding from offshore. When global markets were closed to them for a period of time, this put stress on their liquidity positions. There was also fear that declining confidence in banks could create wide-spread panic and lead to customers withdrawing their deposits en masse - known as a ‘bank run’ - putting the viability of the banks at risk.

10 10 Liquidity Thematic Review Central banks acted quickly to restore confidence and reduce the risk of bank failures The Reserve Bank acted swiftly in response, introducing a wide range of emergency liquidity facilities to support and stabilise the local financial sector. Similarly, other central banks around the world introduced emergency measures to restore confidence in domestic and global markets, and to reduce the risk of wide-spread bank failures. Similar, although lesser, stresses were experienced in the early stages of the COVID-19 pandemic. The Reserve Bank made special liquidity facilities available again to the banking sector. The Reserve Bank introduced the Liquidity Policy … One of our objectives is to promote the maintenance of a sound and efficient financial system. In the aftermath of the GFC, the Reserve Bank drafted the liquidity policy recognising that bank liquidity is essential to the smooth functioning of the financial system and to reduce the risk of liquidity stress disrupting the financial system. The objective of the Policy is to promote financial stability by lowering the likelihood of liquidity problems affecting banks, and promoting registered banks’ capability to manage such problems4 . After consulting with banks in 2009, the Policy was introduced on 1 April 2010. Key requirements and guidelines There are three main parts:

1. Quantitative requirements: Banks are required to calculate three ratios (liquidity ratios). These are the one-week and one-month mismatch ratios and the core funding ratio5 . The mismatch ratios are designed to calculate a bank’s liquidity position in the event of a short term stress or loss of confidence. The one year core funding ratio measures the level of a bank’s longer term stable funding sources as a proportion of their lending. The Policy sets out the method to calculate these ratios. Banks are required to maintain minimum levels specified in their conditions of registration.
2. Qualitative requirements and guidelines: the Policy provides requirements and guidelines6 that banks are expected to apply to their internal liquidity risk management processes. Guidelines cover governance, implementation and oversight, as well as how the risk will be measured and monitored.
3. Disclosure and Regulatory Reporting: registered banks have both public disclosure and separate Reserve Bank reporting requirements. They are also required to report data on their liquidity positions regularly to the Reserve Bank.

---

4 BS13 para.6 5 See appendix 2 for more detail on the liquidity ratios 6 See appendix 2 for more detail on the qualitative requirements and guidelines

11 11 Liquidity Thematic Review Purpose of the review The aim of our thematic reviews Thematic reviews are used to assess areas of specific risk that the sectors we regulate face. We aim to understand how our regulated entities are governing and managing risk. Some reviews assess compliance with our policies and adherence to our guidelines7 . These reviews:  help us and our regulated entities understand industry wide risks;  share our expectations and insights to raise governance, risk and compliance standards;  provide insights for policy development and reviews; and  support our progress towards a more intensive supervisory approach. The purpose of this thematic review The purpose of this thematic review was to assess how banks were complying with the Policy. We also looked to gain deeper insight into banking industry practices relating to the management and monitoring of liquidity risk. This is the first time we had conducted a review into compliance with the Policy.8 Good practice examples and recommendations for banks Good practice examples The table below summarises areas where we observed good practice by at least one bank. These practices were not industry-wide. We expect banks to reflect on these practices and consider any improvements that need to be made to strengthen their own liquidity risk management frameworks. Table 1: Good practices in liquidity risk management Policy reference Good practice D.2.1 (b) Roles and responsibilities in liquidity risk management Board education A bank’s Board of Directors participate in annual education sessions on liquidity risk. The sessions are conducted and attended by the bank’s Treasurer and senior management in charge of overseeing and implementing the liquidity risk management framework. Topics covered include complex areas such as scenario analysis and stress testing as well as contingency planning. These sessions are run as interactive discussions to aid effective governance and decision making. Extra sessions are run when the need arises.

---

7 For more information see the Reserve Bank website rbnz.govt.nz/regulation-and-supervision/thematic-reviews 8 See appendix 1 for the scope and methodology used in the review

12 12 Liquidity Thematic Review Policy reference Good practice D.2.2 (a) Internal strategy and communication of the strategy Risk appetite A bank’s risk appetite statements are set by their Board and the liquidity risk appetite for the banking group includes all entities within the group. Tolerances around liquidity risk appetites are clear and aligned with those set out in the liquidity risk management policy and framework. The risk appetite is clearly communicated to those who are responsible for managing liquidity, including risk. Clear lines of communication Clear lines of communication exist throughout the organisation, including between those implementing the liquidity management strategy and those calculating the liquidity ratios and forecasting cashflows. Expected large transactions and cashflows are communicated through direct channels, such as written in e-mail, to those monitoring and calculating liquidity risk. This is supplemental to stand-up meetings where updates are given to wider groups. Spreadsheets are appropriately classified and rated Spreadsheets and other tools used in liquidity calculations are often complex. Updates and adjustments are made manually in many areas. These spreadsheets and tools are classified as models. Risk ratings are high to ensure an appropriate level of governance and review. This includes the models being subject to a two or three year audit and validation cycle. D.2.2 (c) Cashflow management and liquid-asset stocks Cashflow management and projections There is a formalised framework, methodology, reporting and governance for projecting/forecasting cashflows. Cashflows forecasts are run daily, with assumptions reviewed at least monthly. Forecasts include projections of cashflows, liquidity position and the regulatory ratios. Reporting on cashflow forecasts and the impacts on the internal limits and regulatory ratios is taken through the bank’s Asset and Liability Committee (ALCO) and the bank’s Board Risk Committee (or equivalent committee). ALCO actively requests and discusses information on cashflow projections and liquidity forecasting. D.2.2 (d) Internal limits and targets Management of additional limits and targets is supported by reporting The bank has a range of internal limits and targets used to measure, monitor and control liquidity risk in addition to the policy requirements. Management of these limits and targets are supported by comprehensive reporting to the bank’s ALCO and their Board of Directors.

13 13 Liquidity Thematic Review Policy reference Good practice Adequacy and appropriateness of limits Multiple internal limit levels and indicators are monitored regularly and reported on at least monthly. Volatility analysis is undertaken to determine the adequacy of liquidity buffers. Where an internal indicator or limit is breached frequently a review is undertaken to assess the appropriateness of the measure and if liquidity risk tolerances are being appropriately articulated and measured. D2.2 (e) Breaches of internal limits and targets Reporting material regulatory breaches On 1 January 2021 the Reserve Bank implemented a new approach to bank disclosures9 . Any material breach of the Policy requirements must be reported to the Reserve Bank as soon as practicable. Banks should consider what ‘as soon as practicable’ means. This could include an internal policy outlining the maximum length of time before reporting material breaches to the Reserve Bank. We expect this will be an ongoing/evolving assessment as the breach reporting regime continues to develop. D.2.2 (f) Scenario analysis Stress testing frequency and scenarios Stress testing is conducted at least monthly and the frequency increases as risks increase. Scenario analysis includes at least three scenarios covering a market wide shock, a crisis such as reputational risk that applies to the bank concerned and other specific concentration risks to the bank. The scenarios are not limited to those prescribed by regulators but are tailored to the business and its specific vulnerabilities. Stress testing includes the impact on overall liquidity and regulatory ratios Stress testing allows banks to understand the impact of a stress on their survival horizon, the impact on overall liquidity and the impact on the regulatory ratios. Stress testing results and information are used as an effective tool in liquidity risk management and decision making. The survival horizon limit is included as one of the trigger levels that may trigger the use of the contingency funding plan.

---

9 More information can be found on the Reserve Bank website rbnz.govt.nz/regulation-and-supervision/banks/consultations-and-policy-initiatives/completed-policy￾development/public-disclosure-of-bank-breaches

14 14 Liquidity Thematic Review Recommendations Quantitative and reporting requirements The table below summarises the areas where quantitative and reporting requirements were not met. The recommendations provided represent actions that would lead to greater accuracy when calculating the liquidity ratios. We expect registered banks to review their regulatory liquidity ratio calculations and pay particular attention to the treatment of the areas listed in Table 2. We recognise that the Policy allows banks to use any reasonable simplifying assumption which has the effect (if any) of decreasing the ratios. If an issue is identified and there is a reason that our recommendations are unable to be met, a bank may need to apply a reasonable simplifying assumption. We expect banks to follow the first recommendation in Table 2 when applying a reasonable simplifying assumption. Table 2: Quantitative findings and recommendations for banks Policy reference Finding and recommendation BS13 para.29 Reasonable simplifying assumptions Simplifying assumptions were not well substantiated and were not always conservative. Banks should review their liquidity calculations and identify areas where assumptions are being made. We expect all assumptions to be:  substantiated;  documented;  tested so their impact on liquidity ratios is clear; and  reviewed on an ongoing basis to ensure that they always lead to conservatively calculated liquidity ratios. BS13 para.30, para.33 and para.38 Liquidity ratios to be maintained at the end of each day Calculations were not always completed daily. Liquidity ratios should be calculated daily. Banks should review their systems and processes, identifying any limitations that affect the daily calculation of liquidity ratios. Time delays on daily calculations should be monitored and recorded to highlight patterns that may need addressing. Calculations not completed by the next business day are of particular concern. Undrawn committed lines granted by some banks were only updated monthly. They should be updated daily. BS13A para.8 The issuer rating was used to determine liquid asset haircuts. The issue rating should be used.

15 15 Liquidity Thematic Review Policy reference Finding and recommendation Primary and secondary liquid assets Credit rating changes were not always being captured in calculations. Processes and controls for monitoring credit ratings should be reviewed to ensure changes are captured. Banks should update daily liquidity ratio calculations from the date the rating change occurred. BS13 para.43 Primary and secondary liquid assets The mark-to-market value or fair value measurement was not updated in daily calculations. Processes for capturing liquid asset market values should be reviewed and improved to ensure that they are updated daily. BS13 para.48 and para.49 Contractual cash inflows and outflows Approximations or simplifying assumptions were being used which were not always conservative. Banks should review contractual cashflow calculations used in liquidity calculations and identify any approximations or assumptions used. Underlying reasons for any approximations or assumptions should be investigated and understood. Banks should address the limitations causing the need for such an approach. Where an assumption or approximation is required in the interim, banks should follow the recommendation for reasonable simplifying assumptions. Incorrect interest inclusions were being made. Banks should review their calculations to check whether interest inclusions and exclusions are being made in line with the Policy. Where issues are identified, systems and processes should be updated to address the issues. If there are constraints that require the use of an assumption, the most conservative assumption would be to exclude all interest inflows and include all interest outflows. BS13 para.49 Other contractual outflows Some banks were unable to identify lending due to be drawn down where the draw-down date and principal amount are known. Banks should identify these loans and treat them as expected contractual outflows rather than as undrawn committed lines. If banks wish to treat these loans as undrawn committed lines, analysis should be undertaken to substantiate this approach. BS13 para.53 (d) and para.54 Market funding Where there are blank or missing Australian and New Zealand Standard Industrial Classification (‘ANZSIC’) codes most banks were categorising the exposure as non-market funding instead of market funding. Banks should review their processes and controls to ensure that entities falling within the K62 subdivision of the 2006 ANZSIC codes are captured during the on-boarding of new customers to accurately identify market and non-market funding.

16 16 Liquidity Thematic Review Policy reference Finding and recommendation Deposits that are not able to be allocated to either market or non-market funding should be treated as market funding. BS13 para.54 Market funding Some banks were using the 1993 ANZSIC table and mapping this to the 2006 table. There was insufficient analysis to show that the mapping was accurate. The policy requires that the 2006 ANZSIC table (subdivision K62) is used to classify market funding. Banks using the old ANZSIC tables should upgrade as soon as possible. Where this can’t be done in the short term, an accurate mapping should be completed between the table being used and the 2006 table. Controls should be in place to give confidence that the classifications are complying with policy. BS13 para.59 Non-market funding The grouping of customer deposits into the correct size bands was not performed in line with the policy. Banks should review and improve their data capture systems to ensure deposit grouping can occur at multiple levels. For example, using multiple identifiers such as unique customer IDs and a group ID will help to identify deposits that should be grouped together. Where constraints exist, banks will need to apply a simplifying assumption to ensure a conservative approach is taken. Monthly liquidity return The information collected in the return is captured under s93 of The Reserve Bank Act 1989 Repo activity was reported incorrectly. The treatment of repo transactions should be reviewed to ensure it is in line with the instructions and definitions outlined in the liquidity return. In particular, banks should ensure that there is a process to correctly include the haircut on the securities leg where that haircut is not zero. Information provided in the monthly liquidity return that is not covered in the liquidity policy was not always accurate or complete. Banks should review their oversight and controls to ensure that information provided to the Reserve Bank is accurate and complete. Revision information is not always filled in the liquidity return template on resubmission of the return. Banks are advising the Reserve Bank of revisions, but not consistently providing the information in the liquidity return. It is best practice to fill in the information on revisions in the box required in the signoff worksheet in the monthly liquidity return. Qualitative requirements and guidelines Areas for improvement The areas for improvement below are reflective of the weaknesses found in liquidity risk management frameworks. These can be generalised into other areas of risk within the wider organisation to lift standards in risk management practices.

17 17 Liquidity Thematic Review Table 3: Recommendations for improvements BS13 reference Recommended improvements D.2.1 (b) Roles and responsibilities in liquidity risk management Board and committee information and challenge Differing views and opinions between first line staff responsible for the day-to-day management of liquidity risk and the risk representatives should be clearly documented and presented to committees and the Board of Directors. Boards and committees should be challenging the information they receive to ensure they are receiving a balanced view and are fully informed as part of the decision making process. Internal Audit and external review Banks should ensure periodic reviews of the liquidity risk framework and treasury functions are undertaken, either by internal or external audit and are mapped to compliance with the Policy. Oversight and review of the liquidity calculations Banks should clearly define the roles and responsibilities of the first and second lines of defence for those staff involved in the implementation and management of liquidity risk. The aim should be to improve the effectiveness in segregation of duties and adequacy of oversight. Key person risk and resourcing Banks should have in place well documented succession plans for key roles involved in the implementation and management of liquidity risk and effective mitigating strategies. Banks are encouraged to consider the following:  ensuring adequate resourcing of the treasury function, including support roles;  developing formal and documented succession plans for the Treasurer role in particular, including adequate and regular discussion at senior level (including board meetings);  having in place detailed process and procedure documentation for all aspects of treasury activities; and  undertaking regular cross-training to develop knowledge and awareness across roles. D.2.2 (a) Internal strategy and communication of the strategy Model risk governance frameworks Banks should review and enhance model risk governance frameworks and associated risk management processes and procedures. This includes:  ensuring adequate and complete model documentation;  incorporating all of the models and tools used in liquidity risk management in a model governance framework;

18 18 Liquidity Thematic Review BS13 reference Recommended improvements  capturing the models and tools in model/control/obligation registers;  ensuring registers have sufficient and relevant detail expected of a robust risk assessment approach;  reviewing and improving documentation, internal controls and communication on changes to tools, calculation methodologies and supporting assumptions;  reviewing and improving reconciliations of the data inputs/outputs for the both the daily and monthly liquidity ratio calculations; and  undertaking periodic independent validation of the models and tools used in measuring, monitoring and reporting on liquidity risk. D.2.2 (f) Scenario analysis Reporting to the Board Banks should develop comprehensive and meaningful reporting on scenario analysis/stress testing for senior management and the Board of Directors. The Board of Directors should ensure they are providing input into the reporting and information they want to see to support their governance role. This could be supported by Board training or education sessions. Linking to contingency funding plans Banks should ensure scenario analysis/stress testing is clearly linked to the development and ongoing review of contingency funding plans. D.2.3 Planning for contingency management Contingency funding plan documentation Contingency funding plans should be reviewed to ensure they are comprehensive and clearly linked to the over-arching liquidity risk framework. Improvements that should be made include:  clearly aligning triggers to internal monitoring measures and stress testing outcomes;  defining the steps to be followed and responsible person(s) for determining when the plan should be invoked;  ensuring that a ‘liquidity crisis team’ is listed by name and/or title, and alternates are identified in case members are unavailable;  listing emergency contact numbers for members and alternates; and  stating within the trigger levels mentioned in the plan, when the Reserve Bank will be contacted and who has the responsibility for this. Contingency funding plan testing Banks must ensure a full test of the contingency funding plan is undertaken on a regular basis and in line with approved internal policies.

19 19 Liquidity Thematic Review BS13 reference Recommended improvements Test outcomes should be subject to thorough post-test analysis and used in reviews of the plan to ensure it remains fit-for-purpose. Banks are encouraged to continue reflecting on their experience during COVID-19 level 4 lockdowns in New Zealand and any resulting lessons that can be utilised in the review of their contingency funding plans. Detailed findings Current levels of bank liquidity Current liquidity ratio levels are maintained above regulatory minimums Banks’ liquidity ratios are currently above the regulatory minimums and comfortably above their internal risk tolerances. This is good practice and allows banks headroom should a liquidity stress event occur. Figures 4 and 5: Quarterly average liquidity ratios for the 10 largest banks at 31 March 2021 Source: https://bankdashboard.rbnz.govt.nz/liquidity Only one bank’s mismatch ratios have fallen below the minimum level required since the Policy was implemented in 2010. All banks have maintained their one-year core funding ratio above the minimum level required. When looking at the locally incorporated banking system as a whole, the aggregate liquidity ratios have consistently stayed above the regulatory minimums. This indicates that the banking system is in a good position to withstand a liquidity stress event. The findings from this review indicate that bank liquidity ratios are likely to be overstated, largely due to the use of more favourable than justified assumptions. However, banks have been maintaining significant liquidity buffers, so the overall impact on the liquidity ratios is unlikely to result in a breach of minimum requirements. As such, the aggregate banking system liquidity ratios are also expected to remain above the regulatory minimum requirements. 0% 5% 10% 15% 20% 25% 1-week mismatch ratios 1-month mismatch ratios 0% 25% 50% 75% 100% 125% Core funding ratios Regulatory minimum

20 20 Liquidity Thematic Review Figure 6: Aggregate banking system mismatch ratios Source: https://www.rbnz.govt.nz/statistics Figure 7: Aggregate banking system one-year core funding ratio Source: https://www.rbnz.govt.nz/statistics Good practices in liquidity risk management All banks reviewed have generally demonstrated good practices in three areas:  Organisational structure for liquidity risk management: there are good organisational structures in place for managing liquidity risk, with responsibility starting with the Board of Directors.  Coverage of the bank’s operations: banks are monitoring intra-day liquidity positions.  Internal limits and targets: banks are using internal limits and additional measurements beyond the minimum requirements of the Policy, in order to operate within their own risk tolerances and objectives. Organisational structure for liquidity risk management Effective organisational structure depends on two elements. First, the application of the framework throughout the organisation. Second, roles and responsibilities for governance, oversight and implementation of the framework. The Policy requires banks to consider the nature and risks they face when creating their organisational structure. The overall responsibility for an effective liquidity risk management framework rests with the Board of Directors, while responsibility for implementation of the framework rests with senior management. 0% 2% 4% 6% 8% 10% Apr-10 Apr-11 Apr-12 Apr-13 Apr-14 Apr-15 Apr-16 Apr-17 Apr-18 Apr-19 Apr-20 Apr-21 one-week mismatch ratio one-month mismatch ratio regulatory minimum 0% 20% 40% 60% 80% 100% Apr-10 Apr-11 Apr-12 Apr-13 Apr-14 Apr-15 Apr-16 Apr-17 Apr-18 Apr-19 Apr-20 Apr-21 one-year core funding ratio regulatory minimum

21 21 Liquidity Thematic Review Responsibility starts with the Board of Directors Regardless of size, we found all banks to have good organisational structures in place for managing liquidity risk. This starts at the top, with the bank’s Board of Directors responsible for approval of the Risk Appetite Statement (‘RAS’) and the internal liquidity policy. The operational oversight is then delegated to the senior leadership team, often the Asset and Liability Committee (ALCO). The day-to-day implementation of the internal policy is delegated to the Treasurer, who has the expertise to run the day-to-day liquidity requirements of the bank, with support from Treasury analysts. The large number of findings, despite good practice in organisational structures, reflects weaknesses in systems and assurance processes that frameworks are fully compliant. Coverage of the banks’ operations The Policy provides guidance to banks on the approach to measuring, monitoring and controlling liquidity risk. Banks must understand and monitor liquidity needs over a range of time periods, including intra-day. Intra-day liquidity needs are being monitored All banks had ways of monitoring their intra-day cash position and liquidity needs, despite challenges with intra-day calculations. Banks monitor Exchange Settlement Account System (ESAS) balances and account balances held with other banks. In many cases this was supplemented with cashflow modelling. Internal limits and targets Banks are required to measure and monitor the three regulatory ratios daily. The Policy notes that banks should also set internal limits as well as other measures in order to operate within their own risk tolerances and objectives. All banks have done this to cater for their own, unique situation. All banks maintain internal buffer limits above regulatory minimums … All banks have internal buffer limits above the regulatory minimum for the three liquidity ratios. In most cases there were also management (ALCO) and Board of Director limits. This is a prudent approach designed to ensure banks stay within their own risk tolerances. It also allows time for actions to be taken to maintain adequate levels of liquidity at a time of stress. … and use a range of internal limits and early warning indicators to manage liquidity risk Banks also use a range of other measures, such as funding concentration limits, and early warning indicators as signals of possible liquidity stress. Combined together, these internal limits and early warning indicators are designed to give management the time to develop alternative funding sources or strategies if needed. For smaller banks, other objectives come into play when deciding on what other measures should be used to manage liquidity risk. Maintaining their credit rating is extremely important. Achieving this requires additional measures such as a liquidity buffer ratio (liquid assets/total funding) and a ‘deposits-to-loans’ ratio (retail deposits/total lending) which are closely watched by credit rating agencies.

22 22 Liquidity Thematic Review Overview of compliance with the Policy The review identified a total of 208 findings of non-compliance or weakness. This is a significant number but not unexpected given this is the first time compliance with the liquidity policy has been assessed as part of an in-depth review. Findings were identified as non-compliance or weaknesses. There were:  72 findings of non-compliance. This included 62 findings affecting the calculation of the liquidity ratios and 10 findings of not recording items correctly in liquidity data submissions;  24 weaknesses in the calculation of the liquidity ratios; and  112 weaknesses in applying the qualitative guidelines. The large number of findings highlighted gaps in liquidity risk management frameworks. Overall, banks had not adequately invested in their systems and frameworks. There is a risk this extends beyond liquidity management. We expect banks to resolve system limitations and enhance model risk governance and management. Figure 8: Number of findings Figure 9: Number of findings per bank There was a large range in the number of findings per bank, from five to 33, which can be seen in Figure 9. Banks with the highest number of quantitative findings, also had weakness in liquidity risk management and model governance frameworks that require significant improvement. The bank that had the lowest number of quantitative findings had the strongest risk management practices and had consistently been proactive in approaching us for guidance on policy interpretation and calculation assumptions. 72 35% 24 11% 112 54% Non-compliance Quantitative - weakness Qualitative - weakness 0 5 10 15 20 25 30 35 A B C D E F G H I J Non-compliance Quantitative - weakness Qualitative - weakness

23 23 Liquidity Thematic Review It was clear from our findings that effective governance and a strong liquidity risk management framework were key to supporting a bank’s ability to meet the standards required by the Policy and to manage and control liquidity risk. Compliance with the quantitative requirements A sample testing approach was taken to assess compliance with the quantitative requirements of the Policy10 . There were a large range of findings across the banks ….. Altogether, there were 96 findings across participating banks including:  72 that are non-compliant with our policy or data collections requirements; and  24 relating to weaknesses in the calculation of the liquidity ratios. Figure 10: Number of quantitative findings per bank Quantitative findings were driven by three factors Quantitative findings can generally be summarised into three main factors:  system limitations or constraints (45% of findings);  weaknesses in controls (39% of findings); and  policy interpretation (16% of findings). Most findings were due to system limitations and constraints Limitations or constraints relating to banks’ internal systems was the largest reason for non￾compliance with the Policy. This related to the inability to capture data, characterise information through data fields or constraints on analysis. These limitations were particularly apparent in the more complex areas of the Policy which involves the grouping and size banding of non-market deposits and the identification of market funding. The issues identified suggest that weaknesses in systems are likely to be widespread, affecting other areas of risk management. As banks grow and their operations become increasingly complex, greater system capability will be needed to understand, measure and monitor their business and the risks they face. The demands on data and analysis from internal and external stakeholders also continues to increase and evolve. We expect that investment in systems should continue to increase over time.

---

10 See appendix 1 for more detail. 0 5 10 15 20 A B C E D G J I F H Non-compliance Weakness

24 24 Liquidity Thematic Review Weaknesses in controls resulted in calculation and reporting errors Banks also had weaknesses in the control environment for the liquidity ratio calculations. This included weak processes, inadequate model controls and insufficient reviews of the calculation and reporting of the liquidity ratios. These weaknesses resulted in miscalculations, providing incomplete information and the incorrect mapping of data, such as credit ratings. These weaknesses align to overall weaknesses we saw in model risk governance and management. Weaknesses in liquidity ratio calculations were due to policy interpretation Some banks were interpreting the Policy differently to either industry standard practice or how we would expect. We have given banks specific feedback on these areas and where there is a theme, our expectation is outlined in this report. Findings related to interpretation of the policy were viewed as weaknesses in liquidity ratio calculations. One example is the treatment of lending due to be drawn down, where the draw-down date and principal amount are known. The Policy does not have a materiality threshold for non-compliance Some banks assumed that maintaining large liquidity buffers above regulatory limits meant minor compliance issues that were immaterial to the calculations didn’t matter. However, the Policy does not have a materiality threshold for non-compliance. So any failure to meet the requirements of the Policy was viewed as non-compliance. Common areas of quantitative findings Figure 11: Number of quantitative findings according to the area of policy Contractual cashflows Monitoring the amount of cash entering and leaving the bank is a key element of managing liquidity risk. 30 percent of our quantitative findings related to issues with banks calculating contractual cashflows. These findings affect the calculation of the mismatch ratios. Approximations and assumptions were not always conservative Contractual cash inflows and outflows include principal and interest due, and payments contractually due on derivative contracts. Some banks were using approximations or simplifying assumptions to calculate interest payments, and in some cases, principal payments. This often occurred where banks’ systems were unable to separate the expected contractual payment into principal and interest. These approaches would not always lead to conservatively calculated mismatch ratios. 0 5 10 15 20 25 30 Contractual cashflows Non-market Funding Market Funding Liquid Assets Liquidity return data Daily Calculations Other Non-compliance Weakness

25 25 Liquidity Thematic Review Cashflows were included in calculations that should be excluded The Policy requires banks to exclude from contractual inflows and outflows certain payments that are unlikely to be made to/from the bank11 . A number of banks did not comply with this part of the Policy. Cashflows that were not being excluded from calculations as required included:  Payments from credit cards.  Interest payments debited or credited to an account held by a borrower or depositor with the bank. This was largely due to bank systems being unable to accurately identify payments made to, or from, an internal versus an external account. The most conservative approach is to include all interest outflows and exclude all interest inflows. This was not always done.  Payments from customers facing repayment difficulties. In some cases this was because the loan data was not updated regularly enough or the bank’s arrears table was incorrect.  Accrued interest was sometimes used instead of the contractual interest flows. Some banks were unable to determine lending that was certain to draw down Lending due to be drawn down where the draw-down date and principal amount were known was excluded from other contractual cashflows. Some banks were unable to determine these ‘certain to draw-down’ loans and as such the lending was captured as undrawn committed lines. Again, this was largely due to system limitations when identifying these loans. Some banks interpreted certain to mean 100% certainty. These banks stated that the draw-down date was unlikely to ever be known with certainty and therefore defaulted these loans as undrawn committed lines. We expect banks to undertake analysis to determine the proportion of lending that is drawn down within the mismatch ratio time periods. This would give a greater understanding of what is certain to be drawn down for each bank, given their customer base. Non-market funding Non-market funding is mostly in the form of deposits from individuals and business customers. Deposits from these customers are generally considered to be stable and less likely to leave the bank during a liquidity stress. The Policy requires banks to group a customer’s deposits and place the total amount of their deposits into categories according to size. Each category has a haircut applied reflecting the likelihood of the deposit(s) being withdrawn from the bank in the event of a liquidity stress. Correct grouping of deposits is difficult for banks to achieve System limitations or constraints make the correct grouping of customers difficult to achieve for many banks. Most banks use a unique identifier when on-boarding a new customer, and will also have a group identifier that allows all related accounts of the customer to be linked together.

---

11 BS13 para.48

26 26 Liquidity Thematic Review Where this cannot be achieved the grouping and size banding requirements of the Policy are not able to be fully met. Some of the issues we identified were instances where:  Joint accounts were not correctly grouped with the individual’s separate accounts. A conservative approach would be to group the joint account deposit with the individual account with the highest deposit balance.  A number of banks were not grouping company accounts correctly with related party accounts.  Some banks were unable to identify deposit accounts where an individual had third-party control, for example escrow and custodial accounts. While many larger banks have systems that allow grouping customer deposits to a higher level, there were still assumptions being used and weaknesses in the grouping of deposits. Smaller banks (with less capital and fewer resources to invest in systems) have a reduced risk due to the more limited type of customers and accounts they accept. The differences in systems and processes used across banks make it hard to achieve consistency in the approach to grouping deposits. Interest is sometimes being included in funding We also found some banks included interest amounts (either accrued or expected contractual flows) in the totals that had been aggregated. Contractual interest payments are required to be shown separately in the calculations. Including accrued or expected interest flows with non-market funding balances will distort the mismatch and core funding ratios. Market funding Market funding is funding raised from issuing securities such as bonds, borrowings from financial institutions, or funding from related parties of the bank. The correct identification of market funding is an important aspect of the liquidity policy. Market funding is generally large in size, sensitive to movement in interest rates, and actively managed. Non-market funding is considered to be stable, may be less sensitive to movement in interest rates, and is passively managed. The liquidity ratios factor in the stability of non-market funding over market funding. This encourages banks to place more strategic emphasis on the balance between market and non￾market funding, thereby decreasing banks’ exposure to liquidity risk. Market funding was being incorrectly identified as non-market funding Classification of market funding is determined by the 2006 edition of the Australian and New Zealand Standard Industrial Classification (‘ANZSIC’) dataset. We identified instances where funding from financial institutions was incorrectly classified as non-market funding. We found that:  Some banks were still using the ANZSIC 1993 edition.  Where banks mapped the 2006 edition to the 1993 edition there was insufficient evidence that the mapping was always correct.

27 27 Liquidity Thematic Review  Deposits from trusts were allocated to non-market funding without confirming the correct industry classification. The Policy requires these deposits to be allocated to market funding until industry classification is confirmed.  Deposit accounts with blank or missing industry classification codes were allocated to non￾market funding instead of market funding.  Where manual processes were used to identify market funding there were weaknesses in the processes and controls. There is concern that in this case not all market funding is correctly identified. Funding unable to be allocated should be treated as market funding Where banks felt that they had strong internal controls in place to identify market funding it was suggested that it is unlikely that blank or missing ANZSIC codes would be market funding or that the amount would be immaterial. The Policy requires banks to treat any funding that is unable to be allocated between market and non-market funding as market funding. Unless it can be shown that deposits with blank or missing ANZSIC codes are always non-market funding then they must be treated as market funding. Primary and secondary liquid assets12 Liquid assets are those which can quickly and easily be converted into cash. These assets are separated into two types – primary and secondary.  Primary liquid assets are high quality, as they are the easiest to convert to cash. Cash itself is the highest quality primary liquid asset.  Secondary liquid assets are not as easy to convert to cash, but are still considered high grade assets (e.g. asset backed securities and investment grade corporate securities). Liquid assets play an important role by allowing banks to meet unexpected cash shortfalls when stressed events crystallise. If a bank’s cash position deteriorates, it may need to sell assets in a short amount of time to restore liquidity. Buyers may not be willing to pay the current market value for the securities, meaning the bank may need to sell at a discount to raise cash quickly. To safeguard against a drop in the value of a liquid asset, the Policy applies a discount or ‘haircut’ to its market value. Some banks were not calculating the mark-to-market value daily When calculating the liquidity ratios banks need to determine the current market value of its liquid assets and apply the correct haircut. Some banks were marking-to-market their liquid assets at month-end and holding these values constant for the following month’s daily calculations. In periods of low interest rate volatility this will have little impact on the ratios, however this could become material in periods of high volatility.

---

12 Refer to the Policy Annex, BS13A

28 28 Liquidity Thematic Review The incorrect credit rating has been used in calculations Haircuts are defined by credit ratings and remaining time to maturity. The higher the credit rating, the lower the risk of default and the smaller the haircut. The Policy states that the credit rating used to determine the haircut must be the rating of the issue itself, not the rating of the issuer. Some banks were incorrectly using the issuer credit rating. Banks were also relying on a manual process to update credit ratings in their liquidity models. Changes were not always identified and as a result the wrong haircut was applied. Automation and improvements in internal controls, such as checks and reviews, would reduce the potential for these errors to occur. Liquidity return data Locally incorporated banks are required to submit a monthly liquidity return to the Reserve Bank. The information in the return covers the components in the liquidity ratio calculations as well as supplementary information relating to liquidity risk. Repo activity is not being recorded correctly in the liquidity return The monthly liquidity return instructions and definitions worksheet addresses how repo transactions should be treated in the liquidity calculations. Many of the banks were not reporting the securities leg correctly. The mismatch ratios assume a stressed environment. This means the value of the security to be re-purchased must be the market value less the applicable haircut shown in the Policy. Supplementary information in the liquidity return was not always accurate or complete In the liquidity returns we reviewed, half of the banks had either misclassified an item, or not provided some of the supplementary information requested. These included areas such as companies included in consolidation and memo items. We ask that banks strengthen their review processes to ensure the information provided in the liquidity return is accurate and complete. Revision information was not always completed in the liquidity return When resubmissions had been made, the information on why the revision was made was often not entered into the liquidity return. Where information had been provided this was not always detailed or accurate. We recognise that banks do notify the Reserve Bank of resubmissions via e-mail and phone calls. However, best practice would also be to also include this information in the liquidity return in the sign-off area. Daily liquidity calculations Banks are required to maintain the liquidity ratios above their regulatory minimum at the end of each day. We expect banks to be able to calculate their end of day position within one business day.

29 29 Liquidity Thematic Review Some banks were not completing daily calculations within one business day Most banks interviewed were able to calculate daily ratios in a timely manner. However, three banks had weaknesses which affected their ability to calculate the liquidity ratios within one business day. Two of the banks had challenges with data and systems that are being addressed. One bank did not undertake the calculations when the person responsible for daily calculations was away. Undrawn committed lines were only being updated monthly Half of the banks were unable to update the value of undrawn but committed lending on a daily basis (in particular, signed mortgage agreements that have yet to be drawn). All banks were able to update this data at month-end. Reasonable simplifying assumptions Banks may use any reasonable simplifying assumption in the calculation of the liquidity ratios, as long as the effect (if any) is to decrease the value of that ratio. This is then a conservative assumption. All banks are using simplifying assumptions All banks applied at least one simplifying assumption. Many of these were:  not properly documented,  did not have any accompanying evidence or analysis to demonstrate they were conservative; and  were not subject to periodic review ensuring they remain fit for purpose. Assumptions must be substantiated and reviewed Throughout the review we heard statements that the outcome of an error in the calculations was a decrease in the applicable liquidity ratio and therefore was conservative and in-line with the Policy. The use of reasonable simplifying assumptions is not intended to encompass miscalculations or errors in the liquidity calculation that happen to result in a conservative outcome. An assumption must be a conscious decision, overcoming an obstacle to calculating in line with the Policy and must be supported by evidence and analysis. We also expect steps be taken to overcome any obstacles over time. In the interim, we expect banks to periodically review whether assumptions remain necessary and still provide an appropriate outcome. Qualitative areas for improvement The findings below focus on the areas where banks require improvement. Areas for improvement There were 112 findings that related to weaknesses in applying the Policy guidelines. The number of findings at each bank varied from three to 21. More than half of the findings related to methods for measuring, monitoring and controlling liquidity risk.

30 30 Liquidity Thematic Review Figure 12: Number of qualitative findings per bank Figure 13: Number of qualitative findings according to the area of policy guidance Figure 14: Number of findings according to the sub-areas of policy guidance Most of the areas for improvement related to four areas of policy guidance The majority of qualitative findings could be tied to four specific areas:  Roles and responsibilities in liquidity risk management: 34 findings (30%).  Internal strategy and communication of the strategy: 34 findings (30%).  Scenario analysis: nine findings (8%).  Planning for contingency management: 15 findings (13%). Roles and responsibilities in liquidity risk management Policy guidelines relating to roles and responsibilities is broad based and encompasses the governance framework which includes policies, procedures, oversight, monitoring and reporting. Also included in this part are guidelines for a level of independent challenge and oversight, and internal and external review. 0 3 6 9 12 15 18 21 A D B C F H E I G J 34% 53% 13% Organisational structure for liquidity risk management Methods for measuring, monitoring and controlling liquidity risk Planning for contingency management 0 5 10 15 20 25 30 35 Planning for contingency management Other risks Management of funding and liquid assets Coverage of operations Internal limits and targets Cashflow management and liquid-asset stocks Breaches of internal limits and targets Scenario analysis Internal strategy and communication of strategy Application through the organisation Roles and responsibilities in liquidity risk management

31 31 Liquidity Thematic Review Board and committee information and challenge For all banks, the key controlling body for the management and monitoring of liquidity risk is ALCO. The members of ALCO usually include senior management, key treasury staff and risk representatives. Differing opinions are not always presented to decision makers We found that different opinions or opposing views were not always well documented. This lack of evidence of alternative views extended right through the liquidity management process. Indeed, there was little evidence that captured differing opinions and views from: first line staff; risk teams; ALCO; and even the Board of Directors and its sub-committees. This lack of challenge can result in reporting of liquidity ratios and calculations without the supporting context needed to understand liquidity risk. The validity of, and reliance on, the numbers was not documented or could not be easily evidenced. Failure to communicate a balanced view from all stakeholders involved in liquidity risk management and execution of liquidity risk strategies weakens the overall governance and control framework. Visibility of different and objective views, particularly to the Board of Directors and board committees, gives key decision makers the opportunity for meaningful discussion and debate on a fully informed basis. This leads to increased levels of assurance that the liquidity risk management framework is robust, operating as intended, and that liquidity risk is being managed prudently. Internal audit and external review Audits rarely included compliance with the Policy All banks periodically undertake internal audits of their treasury function. However, the scope of reviews tended to be operational in nature, focusing on control design and operating effectiveness. The audit reviews rarely included evaluation of compliance with the obligations of the Policy. Frequency of reviews by internal audit is determined by an evaluation of residual risk with most treasury functions assigned a rating of medium. That means audits were on a 2-3 year review cycle. Audit outcomes across most of the banks we reviewed were rated satisfactory. Only two banks received an audit outcome of ‘needs improvement’. Many banks had not had independent external reviews of compliance with the Policy Most banks had not undertaken a comprehensive independent external review of compliance with the Policy. Where banks had engaged an external review, these focused on either quantitative or qualitative requirements, not both. External reviews that have been undertaken have only occurred in the past 2-3 years. Banks are encouraged to undertake periodic reviews of liquidity risk management and the liquidity risk framework, either by internal audit or by an external party. This will ensure adequate and independent scrutiny is presented to those responsible for implementing liquidity risk management and executing funding plans. This will also provide assurance to senior management and the Board of Directors that liquidity management and the liquidity risk framework is prudent and that the bank’s compliance obligations are being met.

32 32 Liquidity Thematic Review Oversight and review of day-to-day liquidity risk We found limited day-to-day oversight of liquidity risk across almost all of the banks. Oversight of liquidity calculations needs to be strengthened All banks had a senior management committee with oversight for liquidity risk. Generally, there was no clear separation of responsibilities between those performing and reviewing liquidity calculations, including compliance with board and regulatory limits and reporting. Half of the banks demonstrated little oversight or review of the daily calculations and relied on the person calculating the ratios to notify management of issues. It was more difficult for smaller banks to truly segregate liquidity risk responsibilities due to their size and resource. While treasury staff are hired for their expertise and are trusted with highlighting issues arising with senior management, a different level of oversight is useful to ensure integrity in the process. A lack of robust internal oversight could lead to errors in the calculation of the liquidity ratios and completion of the liquidity return, and exposes banks to an increased risk of non-compliance with the Policy. Improved oversight provides senior management and the Board of Directors with greater confidence that liquidity risk is being appropriately managed and reported. To enhance oversight, banks should consider:  applying a stronger level of oversight across day-to-day liquidity calculations to provide comfort that no material errors have occurred; and  having a second accountability review and sign-off on the liquidity return by the risk team before submission to the Reserve Bank. Key-person risk and resourcing Significant key-person risk exists across the industry. This was predominantly related to the Treasurer where there was heavy reliance on their knowledge, skills and experience. Attracting and retaining Treasury staff is a challenge The ability to attract and retain quality staff for treasury related roles is a challenge for the wider New Zealand banking industry. Factors include: geographic location; a small domestic banking economy; a general skills shortage; and a limited number of treasury roles available (or that become available). The challenge is greater for smaller banks. Banks should ensure they have mitigating actions in place to address key-person risk Mitigating key-person risk is important to ultimately ensure that the roles and responsibilities in liquidity risk management can always be performed. We found limited mitigating actions. Banks are encouraged to consider the following:  ensuring adequate resourcing of the treasury function, including support roles;  developing formal and documented succession plans for the Treasurer role in particular, including adequate and regular discussion at senior level (including board meetings where appropriate);  having in place detailed process and procedure documentation for all aspects of treasury activities; and

33 33 Liquidity Thematic Review  undertaking regular cross-training to develop knowledge and awareness across roles. Internal strategy and communication of strategy This section of the Policy focuses on banks’ management of liquidity risk with regard to risk appetite and strategic objectives. This section also discusses what methods banks use in measuring, monitoring and controlling liquidity risk, including the models and tools, and how this is communicated to all those involved in these activities. There were significant weaknesses in model governance and model risk management Most banks did not have a robust model risk governance framework, internal controls were inadequate, and regular or periodic validation of liquidity models was not undertaken. Measurement, monitoring and reporting on liquidity risk was undertaken using bespoke models, tools or calculators, generally in excel spreadsheets. Weaknesses in the framework and tools used in liquidity risk management can be summarised as follows:  there was a lack of adequate and complete model documentation;  the tools used in liquidity risk management were not incorporated within a model governance framework (where one existed);  the tools were not captured in model/control/obligation registers;  the registers lacked sufficient and relevant detail expected of a robust risk assessment approach;  internal controls and communication around changes to tools, calculation methodologies and supporting assumptions were poorly documented, lacked sufficient detail or were inadequate;  reconciliations of the data inputs/outputs for both the daily and monthly liquidity ratio calculations were not robust; and  the tools were not subject to comprehensive periodic validation. Overall, we found this to be an area requiring significant improvement across the industry. However, we did find planning is taking place in a number of the banks to improve their model risk governance frameworks. The bespoke tools used in the management, control and reporting of liquidity risk were often complex, had multiple sources of data and required manual updates and adjustments in many areas. As such, a robust model governance framework is required to identify and manage model risk. A framework should include all critical tools used for liquidity risk management to support the completeness and accuracy of underlying data. It should also facilitate continuous improvement in controls, management, monitoring and oversight. This provides senior management and the Board of Directors with the assurance that liquidity risk is being managed prudently and is being measured and reported accurately. Scenario analysis The Policy expects banks to regularly undertake analysis of their liquidity risk position across a range of scenarios and over a range of time horizons. This is also referred to as stress testing.

34 34 Liquidity Thematic Review Stress testing results are supposed to inform management of the bank’s likely liquidity position in the event a shock materialises, so that any concerns identified can be mitigated. Scenario analysis is closely linked to banks’ planning for contingency funding. Reporting on stress testing needs improvement All banks undertook stress testing at varying frequencies and across various scenarios, but there was a general lack of visibility of stress testing outcomes made available to senior management and the Board of Directors. Stress test outcomes were generally incorporated in management and Board reporting by way of summary treasury reporting or via dashboard reporting, without the necessary depth of information and analysis to provide context and support to the metrics being reported on (e.g. the scenarios tested and the underlying assumptions used in the testing). Stress testing should be linked to contingency funding plans For some banks, there was no clear link between stress testing outcomes and the development and review of liquidity management and funding strategies, or contingency funding plans (CFP). Stress testing is an invaluable tool that can be used to inform senior management and the Board of Directors of deficiencies in liquidity risk management so that action can be taken before problems arise. Planning for contingency management The Policy requires banks to consider scenarios that may cause liquidity stress and prepare by putting in place a contingency funding plan (CFP). The CFP should outline clear warning indicators and trigger levels. There should be procedures for when it should be invoked, and clear actions to bring the bank back to a strong position in line with its risk appetite, as quickly as possible. The CFP policies and procedures should be clearly documented and communicated to all those involved in liquidity risk management. The CFP also needs to be periodically tested for effectiveness and operational feasibility. Contingency funding plans are largely stand-alone documents approved by the Board All banks have a documented CFP with the majority (80%) having this as a stand-alone document, rather than embedded within the bank’s own liquidity or treasury policy. Most of the banks review the CFP annually, with approval from the Board of Directors. Contingency funding plan documentation should be improved While generally complete, some banks should improve their plans by considering the following:  clearly aligning triggers to internal monitoring measures and stress testing outcomes;  defining the steps to be followed and responsible person(s) for determining when the plan should be invoked;  ensuring that a ‘liquidity crisis team’ is listed by name and/or title, and alternates are identified in case members are unavailable;  listing emergency contact numbers for members and alternates; and

35 35 Liquidity Thematic Review  stating within the trigger levels mentioned in the plan, when the Reserve Bank will be contacted and who has the responsibility for this. Half of the banks had not been testing their CFP We found that testing of the CFP was not always comprehensive or as robust as expected relative to the size and nature of individual bank operations. In fact, five banks had yet to test their CFP. Further, the frequency of testing is often misaligned to that required by a bank’s own policies and procedures, suggesting a weakness in the overall control environment. We also found that in one case, where testing of the CFP had not yet been undertaken, the Board of Directors had low awareness of the plan, how it would be invoked and what role they may be required to play. Given the Board of Directors have ultimate responsibility for liquidity risk management, and generally approve the CFP, this is a significant weakness in the governance framework. Testing the CFP ensures it remains fit-for–purpose Having a CFP increases the likelihood that during a liquidity stress, a bank is able to address challenges promptly by implementing a pre-determined plan, designed to return the bank to within normal liquidity risk operating tolerances as quickly as possible. Testing of the CFP will ensure that business decisions are co-ordinated, early warning indicators and trigger levels are likely to be effective and that proposed actions are operationally feasible during a liquidity stress scenario. This also supports an environment of continuous improvement and helps ensure the CFP remains current and fit-for-purpose. Banks should reflect on lessons from the COVID-19 alert level changes Although testing is not always done, banks either enacted their CFP or working groups similar to their CFP crisis team during the COVID-19 level 4 lockdowns in New Zealand. Banks are encouraged to continue reflecting on this experience and any lessons that can be drawn on when reviewing their contingency funding plans.

36 36 Liquidity Thematic Review Appendix 1 – Scope and Methodology The main objective of the review was to assess how banks are complying with our Liquidity Policy, BS13 and BS13A. There are 27 registered banks in New Zealand, 15 locally incorporated banks and 12 branches of overseas incorporated banks. Our review covered all the locally incorporated banks, however only the 10 largest were chosen for onsite interviews. Our review was conducted in three parts:

1. All banks submitted answers to two surveys covering the quantitative and qualitative requirements and guidelines of the Policy. A desk-based analysis was performed on the answers and supporting documentation provided by the banks.
2. Interviews were held with senior management, board members and employees responsible for the implementation, management and oversight of liquidity.
3. Sample testing of the 10 largest locally incorporated bank’s liquidity calculation data was undertaken while we were conducting interviews. To assist with the evaluation of compliance with the quantitative aspects of the Policy, we contracted an external independent party who had expertise in liquidity risk measurement and financial instruments. Limitations The scope of our review was to assess compliance with the Reserve Bank Liquidity Policy. This did not extend to a comparison of other regulatory approaches or jurisdictions. Our review was limited to the documents and information we collected directly from the banks, and from interviews with bank staff and directors. Sample testing was used to assess compliance with the Policy’s quantitative requirements. Although this approach gives a good picture of the areas of non-compliance, it was not a full in￾depth assessment of every calculation input or output. Desk-based review All 15 sampled banks were asked to fill in two questionnaires covering the Policy’s quantitative and qualitative requirements. The Policy is divided into a number of sections, and within each section a number of paragraphs outline the requirements and rules/guidelines expected to be followed. The questionnaires followed the same approach so that we could align individual bank responses to each section of the Policy. This approach formed the basis of our framework to assess banks’ compliance with the Policy. As part of this process, banks were also asked to provide a range of documents, polices and reports to support their written answers, as well as add further to our understanding of their liquidity risk management framework. The completed questionnaires along with the supporting information were then subjected to in￾depth desk top analysis. Where evidence could not be sighted or the responses did not provide the insight and understanding we were after, further questions were drafted for our onsite

37 37 Liquidity Thematic Review interviews. For example, if a bank has a risk appetite statement that outlines the limits for liquidity risk, we expected to see the same limits in the internal liquidity policy and related procedural manuals or standards. If the Board of Directors was noted as the governing body approving the bank’s liquidity policy, then we expected to see clear evidence of this occurring in the board minutes. A large number of the questions that arose for the interviews related to the qualitative aspects of the Policy such as governance, oversight, scenario (stress) testing of the liquidity position, and having in place a contingency funding plan for times of liquidity stress. Interviews The 10 largest locally incorporated banks were chosen for onsite interviews. Typically a team of six from the Reserve Bank participated in the onsite interviews including:  three members of the Industry, Insights and Thematics team (leading the review);  the Reserve Bank Supervisor for the particular bank we were visiting; and  two external contractors. Interviews were held with bank leadership and staff listed in Table 4. Table 4: Interviewees Bank’s Function Role Board of Directors One member of either the:  Chair of the Risk Committee;  Chair of the Audit Committee;  Chair of the Board. Senior management CEO, CFO, CRO Treasury Treasurer and relevant treasury staff including:  Funding Manager;  Balance Sheet Manager; and  Treasury Analyst. Finance Relevant staff Risk Relevant staff Internal audit Relevant staff involved with most recent audit ALCO Secretary

38 38 Liquidity Thematic Review The interviews varied from anywhere between 30 minutes and two hours depending on that staff member’s level of responsibility for liquidity risk management. In total, we conducted 115 interviews. Questions were split into two categories:  General questions: those that would be asked of all banks (and to similar roles) to gauge the overall industry risk management practices.  Specific questions: bank-specific questions following the desk-based analysis. Sample testing In addition to undertaking interviews onsite, we also undertook sample testing. Prior to commencement of the onsite visits, banks were advised that sample testing would be performed. Compliance with the quantitative requirements was measured by the banks demonstrating how certain data items for the liquidity ratios are derived for the liquidity return. For example, a large component of the mismatch ratios is the primary and secondary liquid assets. The bank was asked to list all individual securities that make up one of the primary liquid asset categories (such as New Zealand Government bonds). The sum of these transactions (using market value less the applicable haircut) had to equal the figure shown in the liquidity return. Once this had been established, a single transaction would be chosen from the list and that would be tested against the information held by the bank in its source system, or in some cases by physical evidence like a copy of the data. This would be used to ensure the bank was using the correct maturity date, interest rate, credit rating etc., and that the data in the model used by the bank was accurate. This process was repeated for different products used in the calculation of the liquidity ratios. Given the amount of data to be reviewed, the onsite visit was used to identify the samples required for testing and the provision of data, and the analysis itself was undertaken in the following weeks. Individual bank feedback Once our analysis was complete, an initial feedback letter was drafted for all of the banks that participated in the review. The 10 banks that were included in interviews and sample testing received detailed specific findings outlined as either potentially non-compliant or an apparent weakness with the Policy. We allowed these banks a fact checking period, to ensure our findings were accurate. Following the fact checking period, a final feedback letter was sent to each bank concluding our list of findings as either compliant, non-compliant or a weakness. The 10 largest locally incorporated banks were required to create a remediation plan that addresses all of their specific findings, both non-compliance and weaknesses. All 15 locally incorporated banks were required to undertake a self-assessment against this thematic report. Reserve Bank Supervisors will be monitoring the remediation plans and self-assessments.

39 39 Liquidity Thematic Review Findings will be considered in the Policy review The Reserve Bank is commencing a review of the Policy in the first half of 2022. The banks that participated in this thematic review have provided views on areas of the policy that they believe could be changed or given more guidance. This feedback and the findings from this review will be considered as part of the Policy review. There will be further opportunity to provide input during the Policy review consultation process.

40 40 Liquidity Thematic Review Appendix 2 – Quantitative and qualitative requirements and guidelines Quantitative requirements Liquidity ratios Banks’ quarterly average liquidity ratios are published on the Bank Financial Strength Dashboard. The aggregate monthly ratios are published on our going back to 201013 . Details on the liquidity ratios are set out below. Mismatch ratios Mismatch ratio = 100x (mismatch dollar amount / total funding) The mismatch ratios are designed to calculate a bank’s liquidity position in the event of a short term stress or loss of confidence. The net expected cash position is called the mismatch dollar and is calculated over the time period of one week and one month. The result is given as a percentage of a bank’s total funding. The regulatory minimum is 0%, which effectively states that banks are expected to maintain enough cash and liquid assets to cover expected outflows over one week and one month. The difference between the two mismatch ratio calculations, apart from the timeframe being looked at, is that extra liquid assets (the secondary liquid asset portfolio) can be included in the one-month mismatch calculation. Table 5 below shows the six main components used to calculate the mismatch dollar amount. Table 5: Components of the mismatch dollar amounts Mismatch dollar amount components Expected inflows

• Liquid assets after haircuts.
• 75% of undrawn committed lines granted to the bank available within the mismatch ratio time period.
• Contractual inflows due within the mismatch ratio time period. Expected outflows

• Funding withdrawable at sight or maturing within the mismatch ratio time period, including:  100% of market funding; and  percentages of non-market funding applied according to the size of deposits.
• 15% of undrawn committed lines granted by the bank drawable within the mismatch ratio time period.
• Contractual outflows due within the mismatch ratio time period.

---

13 See appendix 3 for where to find this information

41 41 Liquidity Thematic Review One year core funding ratio One year core funding ratio = 100x (one year core funding dollar amount / total loans and advances) The one year core funding ratio measures the level of longer term stable funding sources as a proportion of total loans and advances. Currently, all registered banks must maintain a minimum one year core funding ratio of 50 percent. At the start of the thematic review the regulatory minimum was 75 percent, however this was reduced in April 2020 as part of the Covid-19 regulatory relief measures granted by the Reserve Bank. Most banks have continued to stay above 75 percent throughout this period and the Reserve Bank intends to move the regulatory minimum back to 75 percent on 1 January 2022. Table 6: Components of the one year core funding dollar amount One year core funding dollar amount components Funding sources

• All funding with residual maturity greater than one year.
• 50 percent of any tradeable debt issued by the bank or funding from Reserve Bank facilities, with residual maturity between six months and one year (and with original maturity greater than two years).
• Percentages of non-market funding with residual maturity less than one year. The percentages are applied according to the size of deposits.
• Tier 1 capital. Qualitative requirements and guidelines Internal liquidity risk management frameworks must be adequate The qualitative section of the Policy has few mandatory requirements, and these relate primarily to the framework for liquidity risk management. For example, banks are expected to show good governance, have clearly documented and communicated policies and procedures, identify methods for the measurement and monitoring of risk and undertake contingency planning. Qualitative guidelines support prudent risk management The Policy establishes a set of guidelines that banks should consider in their liquidity risk management framework to support prudent risk management and full compliance with policy requirements. Banks are encouraged to closely align these with the qualitative guidelines. The areas of guidance in the Policy are outlined in Table 7.

42 42 Liquidity Thematic Review Table 7: Areas of qualitative guidance in the Policy Area of guidance Subparts Organisational structure for liquidity risk management Application through the organisation Roles and responsibilities in liquidity risk management Methods for measuring, monitoring and controlling liquidity risk Internal strategy and communication of the strategy Coverage of the bank’s operations Cashflow management and liquid-asset stocks Internal limits and targets Breaches of internal limits and targets Scenario analysis Analysis of other types of risk Management of funding and liquid assets Planning for contingency management Planning, documenting, communicating and testing of a bank’s contingency funding plan.

43 43 Liquidity Thematic Review Appendix 3 – Key website references The table below lists the references to key information on our website that has been used in this report. Table 8: Key website references Topic Website reference Thematic reviews rbnz.govt.nz/regulation-and-supervision/thematic-reviews Financial stability rbnz.govt.nz/financial-stability The financial system rbnz.govt.nz/financial-stability/overview-of-the-new-zealand-financial-system The banking system rbnz.govt.nz/financial-stability/overview-of-the-new-zealand-financial￾system/the-banking-system Registered banks rbnz.govt.nz/regulation-and-supervision/banks/register The Liquidity Policy An overview of the policy can be found here: rbnz.govt.nz/regulation-and-supervision/banks/prudential￾requirements/liquidity-policy The Liquidity Policy is covered in BS13 and BS13A. These can be found here:  BS13 is here rbnz.govt.nz/-/media/ReserveBank/Files/regulation-and￾supervision/banks/banking-supervision-handbook/BS13-Liquidity-Policy.pdf  BS13A is here rbnz.govt.nz/-/media/ReserveBank/Files/regulation-and￾supervision/banks/banking-supervision-handbook/BS13A-Liquid-Assets￾Annex.pdf Liquidity return A copy of the template banks are required to submit to the Reserve Bank monthly can be found here: rbnz.govt.nz/statistics/surveys/liquidity Bank financial strength dashboard – liquidity section Quarterly average liquidity ratios can be found here: bankdashboard.rbnz.govt.nz/liquidity Liquidity statistics A history of the aggregate bank ratios can be found here:  Mismatch ratios rbnz.govt.nz/statistics/l1  Core funding ratio rbnz.govt.nz/statistics/l2  Face value of funding rbnz.govt.nz/statistics/l3 Public disclosure requirements rbnz.govt.nz/regulation-and-supervision/banks/consultations-and-policy￾initiatives/completed-policy-development/public-disclosure-of-bank-breaches