CHAPTER 15
Reputational Risk and Operational Risk
In this chapter we look more closely at reputational risk and the ways that an operational risk framework can be leveraged to help identify, assess, control, and mitigate reputational risk. Examples from recent headlines are used to highlight the significant reputational impact of most operational risk events, which often cause severe damage over and above the direct costs of the event. We explore the causes of reputational risk and the long-term effects that it can have on a firm.
Reputational risk is a critical concern for both fintechs and banks. Losing the trust of your customers can be a fatal blow to a firm's strategic plan, its growth trajectory, and investor confidence.
WHAT IS REPUTATIONAL RISK?
Regulatory guidance on the definition of reputational risk was fairly slim until the impact of the 2007 financial crisis made it clear that banks needed to do more to ensure that this risk type was well managed. The Bank of International Settlements (BIS) published comprehensive guidance on this area that became effective in December 2019. In this guidance they provided a definition for reputation risk:
Reputational risk can be defined as the risk arising from negative perception on the part of customers, counterparties, shareholders, investors, debt-holders, market analysts, other relevant parties or regulators that can adversely affect a bank's ability to maintain existing, or establish new, business relationships and continued access to sources of funding (e.g. through the interbank or securitisation markets).
Reputational risk is multidimensional and reflects the perception of other market participants. Furthermore, it exists throughout the organisation and exposure to reputational risk is essentially a function of the adequacy of the bank's internal risk management processes, as well as the manner and efficiency with which management responds to external influences on bank-related transactions.1
Reputational risk may be a misnomer, as it may be more practical to consider reputational impact. Any risk event—market, credit, operational, or strategic—can have a reputational impact. For this reason, some firms consider reputational impact in the other aspects of their risk management programs rather than managing a separate reputational risk activity. Others do consider reputational risk as its own category and manage it using the same tools that are available for operational and strategic risk.
Fintechs are particularly exposed to reputational risk, as many of them are still in the early growth stages of their strategic plan and a loss of reputation can deal a severe blow to their growth strategies.
First, let us consider whether there really is such a thing as reputational, or reputation, risk. Is this really a risk category, or is it simply a type of impact? In Chapter 10, we looked at the different potential impacts that might occur when an operational risk is identified and assessed in RCSA. There are direct and indirect financial costs, but there also may be client, regulatory, life safety, or reputation impacts.
As discussed in Chapter 1, and shown again in Figure 15.1, reputation risk sits at the heart of the risk wheel. If a risk event occurs in any risk category on the outside spokes of the wheel, it can give rise to reputational risk.
FIGURE 15.1 The Enterprise Risk Management Wheel
A market risk event, a credit risk event, a strategic risk event, a liquidity risk event, and, of course, an operational risk event can have severe reputational consequences.
It might be better, then, to think of reputational impact rather than reputational risk. Whatever terminology we adopt, there is no doubt that damage to reputation can have serious consequences.
REPUTATIONAL IMPACT
We can easily identify reputational impacts by looking at two operational risk events that have occurred in recent years: the global COVID-19 pandemic and the London Interbank Offered Rate (LIBOR) scandal.
Global COVID-19 Pandemic
Late in 2019 the global pandemic emerged and quickly spread across the globe. This was (and at the time of this writing, still is) a catastrophic operational risk event that has led to tragic loss of life. This continuing operational risk event has cost many billions of dollars in economic impacts to businesses, governments, and individuals and is also fraught with reputational impacts for many companies, including fintechs and banks.
Companies quickly faced public and local government criticism for not moving quickly enough to protect their employees. Similarly, providers of basic supplies were vulnerable to reputational damage if they were perceived to be reacting too slowly to the event, leading to massive shortages at the outset and continuing supply chain issues over a year later. The quality of customer service in all organizations and the efficiency of their services during this crisis quickly became a hot topic. Those companies that treated their employees well and succeeded in continuing to supply good service fared better reputationally than those that did not.
Politicians faced the ire of their constituents as they struggled to maintain their base while also ensuring that the pandemic could be tackled effectively, and political careers were made and broken during the pandemic.
This is an operational risk event that was caused by natural disaster, and yet the reputational fallout was severe for all who were impacted.
Banking and Fintech Scandals
An operational risk event, where the cause is attributed to the internal actions of a bank, often gives rise to high levels of reputational damage. The LIBOR scandals of 2012 and 2013 tarnished the reputations of many banks.
It was alleged that several major banks had manipulated the LIBOR rate over an extended period, in order to benefit financially from the altered rate. The brush was quickly used to also tarnish other benchmark rates globally and regulators from many nations became engaged in uncovering the breadth and depth of the bad behavior.
Headlines from this period show the reputational wounds that were inflicted on those involved, above and beyond the direct operational risk losses that they suffered in direct fines.
Rigged Rates, Rigged Markets
Marcus Agius, the chairman of Barclays, resigned on Monday, saying “the buck stops with me.” His was the first departure since the British bank agreed last week to pay $450 million to settle findings that, from 2005 to 2009, it had tried to rig benchmark interest rates to benefit its own bottom line.
New York Times, July 2, 20122
RBS Managers Condoned Libor Manipulation
Royal Bank of Scotland Group Plc managers condoned and participated in the manipulation of global interest rates.
Bloomberg Business Week, September 25, 20123
UBS and LIBOR
Horribly rotten, comically stupid.
The Economist, December 19, 20124
As a result of its role in the alleged LIBOR manipulation, Barclays paid out $450 million in a settlement with British and U.S. regulators and lost its chief executive officer, Robert E. Diamond Jr.; its chairman, Marcus Agius; and its chief operating officer, Jerry del Missier, along with many other key senior managers.
Barclays then suffered a ratings hit as both Standard & Poor's (S&P) and Moody's rating agencies placed the firm on negative watch:
The abrupt changes alarmed the ratings agencies. Standard & Poor's said in its statement that “the negative outlook reflects our view of the current management flux and near-term strategic uncertainty.”
In a separate statement, Moody's said: “The senior resignations at the bank and the consequent uncertainty surrounding the firm's direction are negative for bondholders.”5
In addition, Barclays, along with many other alleged participants, faced multiple lawsuits from firms and individuals who alleged that the LIBOR manipulation impacted them adversely.
Charles Schwab Sues Banks Over Rate Manipulation
Charles Schwab is seeking unspecified compensatory and punitive damages from the banks. Other defendants include foreign banks like Barclays, Credit Suisse, Deutsche Bank, HSBC Holdings, Royal Bank of Scotland, Lloyds, WestLB and UBS.
New York Times, August 25, 20126
Banks Rigged Libor to Inflate Adjustable-Rate Mortgages: Lawsuit
Homeowners in the U.S. are suing some of the world's biggest banks for fraud—not over any foreclosure issues but over the alleged Libor manipulation scam that they say sparked increases on their adjustable rate mortgages, and resulted in unlawful profits for the banks.
Forbes, October 15, 20127
Finally, the threat of fines and lawsuits across the industry pushed stock prices down.
Barclays Libor Fine Sends Stocks Lower as Probes Widen
Barclays Plc (BARC)'s record $451 million fines for interest rate manipulation sent bank shares plunging as U.S. and U.K. authorities pursue sanctions in a global investigation of more than a dozen lenders.
Bloomberg.com, June 28, 20128
The scandal eventually spread to other banks involved in LIBOR, and the New York and Connecticut attorneys general had 16 banks under investigation on this issue: Bank of America, Bank of Tokyo Mitsubishi UFJ, Barclays, Citigroup, Credit Suisse, Deutsche Bank, HSBC, JPMorgan Chase, Lloyds Banking Group, Norinchukin Bank, Rabobank, Royal Bank of Canada, Royal Bank of Scotland, Société Générale, UBS, and West LB. In December 2012, UBS agreed to settle with regulators for a huge $1.5 billion in total fines.
All of these banks faced the same reputational damage above and beyond the regulatory dollar fines that they were likely to pay. They faced the loss of key personnel (who might also face jail time), credit downgrading, litigation, and stock price devaluation.
While this might suggest that banks would become more attuned to the potential impact of reputational risk events that span the whole industry, unfortunately a similar scandal occurred more recently in Australia. The Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry was established on December 14, 2017, to investigate multiple scandals that had rocked the Australian banking industry over prior years. The final report was published in 2019 and included a scathing executive summary that spoke to the tarnished reputation of Australian banks and suggested that their multiple failings had being motivated by greed:
Why did it happen? Too often, the answer seems to be greed—the pursuit of short term profit at the expense of basic standards of honesty.9
The headlines picked up on this theme, and it was widely reported that every Australian bank (except Westpac) had been censured in the report. Several CEOs left their jobs, and the Australian regulators were ordered to pursue action against the banks.
The negative headlines have lingered, and there is still reporting at the time of writing in 2021 that reminds banking customers of the reputational damage that was inflicted on the Australian banks:
“Worse than ever”: Australian bank culture has not improved since royal commission, staff say
Workers insist pay is still linked to hitting sales benchmarks and leaderboards to track sales are rife.
The Guardian, April 6, 202110
Fintechs have had their share of reputational risk in recent years, as their practices have come under scrutiny. Chime suffered from negative headlines in 2021 when they closed accounts as a result of their efforts to reduce fraud.
Backlash Over Chime Account Closings Highlights Risks in Fraud Detection
The neobank Chime is coping with growing pains, including a surge in customer complaints about suddenly closed accounts.
American Banker, July 7, 202111
Robinhood bore the brunt of negative headlines when it was fined by FINRA in 2021.
Robinhood to pay $70 million fine after causing “widespread and significant harm” to customers
Popular investing platform Robinhood has agreed to pay nearly $70 million to the financial industry regulatory authority (FINRA) to settle allegations that the brokerage caused customers “widespread and significant” harm on multiple different fronts over the past few years.
CNBC, June 30, 202112
A reputational risk event often results in multiple impacts, some of which are captured in the operational risk framework—but some might not be. Fines and litigation are captured in an operational risk framework, as they meet the definition of legal risk within the definition of operational risk:
Operational risk is defined as the risk of loss resulting from inadequate or failed processes, people and systems or from external events.
This definition includes legal risk, but excludes strategic and reputational risk.13
However, other impacts such as stock price losses, credit downgrades, and loss of key personnel are not generally considered financial losses within this definition, and reputational risk is expressly excluded.
While the preceding examples arose out of operational risk events, reputational damage can arise from other events such as market risk and credit risk. Significant losses in either area can lead to serious questions about the ability of the firm to operate effectively in the markets, and this can lead to the loss of both clients and share value.
In addition to reputational impact arising from other risk types, it can also arise out of activities that are not risky in any other sense. For example, banks are increasingly avoiding investments and funding for environmentally unpopular or social unacceptable practices. It is common today for banks to issue glowing corporate social responsibility reports that outline their fair, environmentally sound, and socially responsible values and practices. UK banks are now required to share their climate change activities with their regulators, and there is pressure globally for all companies to be transparent about their efforts.
UK Banks to Reveal Exposure to Climate Crisis for First Time
Bank of England to examine risks rising temperatures and sea levels could pose for financial system
The Bank of England will examine the risk of the climate crisis to financial institutions. UK banks will for the first time be forced to reveal their exposure to the climate crisis, highlighting the risks that rising temperatures and sea levels could pose for the financial system, as part of the Bank of England's climate stress tests this year.
The Guardian, June 8, 202114
These types of efforts can directly contribute to the reputation of a fintech or bank.
Stock Price Impacts
Financial losses as a result of a reputational event are generally captured in the operational risk framework, as they often stem from failed or inadequate people, systems, processes, or external events.
There are other impacts that are not captured in the operational risk framework, and these are drivers for strong reputational risk management.
One of these major drivers is the negative impact on share value that can result from a reputational event. As we saw earlier, the banking sector as a whole took a major stock hit as a result of the widespread LIBOR scandal. Barclays themselves saw an 18 percent slide during the early stages of the news breaking.
In 2005, Perry and de Fontnouvelle completed a study on the market reaction to operational risk announcements.15 They examined the difference between internal fraud events and other events, on the assumption that internal fraud events carry a much higher reputational impact than, for example, execution errors.
Their research found that losses from internal fraud events resulted in larger impacts to share value than those that were not internal fraud, suggesting that reputational impact had real cost.
A similar study was conducted in 2010 by Gillet, Hubner, and Plunus. The authors examined stock market reactions to the announcement of operational losses by financial companies and attempted to disentangle operational losses from reputational damage. Their results showed:
… significant, negative abnormal returns at the announcement date of the loss, along with an increase in the volumes of trade. In cases of internal fraud, the loss in market value is greater that the operational loss amount announced, which is interpreted as a sign of reputational damage.16
Robinhood recently experienced the negative impact of operational risk on its newly listed stock price. A concern around the compliance of its practices led to market concerns and shares tumbled quickly.
Robinhood Shares Tumble after Paypal News, SEC Scrutiny of Key Revenue Stream
New York, Aug 30 (Reuters) – Shares of Robinhood Markets Inc (HOOD.O), a popular gateway for trading meme stocks, tumbled nearly 7% on Monday on news that PayPal Holdings Inc (PYPL.O) may start an online brokerage and a report saying regulators were looking at a possible ban on a practice that accounts for the bulk of the company's revenue.17
Reuters, August 30, 2021
The apparent reputational impact on stock price can also be seen in the JPMorgan “Whale” case study in Chapter 18.
REGULATORY OVERSIGHT OF REPUTATIONAL RISKS
In December 2019, updated “Core Principles for Effective Banking Supervision” from the Basel Committee on Banking Supervision (BCBS) came into effect and listed the following essential criteria as guidance to banking regulators:
The supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the banking group and other entities in the wider group, in particular contagion and reputation risks, may jeopardize the safety and soundness of the bank and the banking system.18 [emphasis added]
The 2015 BCBS “Corporate Governance Principles for Banks” reinforced that the roles of the board, senior management, and the risk committee should include activities concerning reputational risk and that the risk management framework must include effective identification and measurement or reputation risk:
Risk identification and measurement should include both quantitative and qualitative elements. Risk measurements should also include qualitative, bank-wide views of risk relative to the bank's external operating environment. Banks should also consider and evaluate harder-to-quantify risks, such as reputation risk.19
So the BCBS rules expect a firm to have strategies around its reputational risk and to identify, measure, and manage reputational risks impacts to the firm. This sounds very like the requirements for operational risk.
In Basel II itself, although reputational risk is expressly excluded from the Pillar 1 requirements for operational risk, it reemerges in Pillar 2. In the 2019 Pillar 2 summary, BCBS outlines this requirement:
Some areas are particularly important for supervisory review under Pillar 2. One such area is an assessment of corporate governance, including misconduct risk and firm-wide risk management, as well as those risks that are considered under Pillar 1 but not fully captured by Pillar 1 capital requirements. Examples of these risks are interest rate risk in the banking book; non-financial risks such as strategic risk, business model risk and reputational risk; and aspects of credit concentration risk.20 [emphasis added]
National regulators implemented their local rules for the supervision of Pillar 2 under regulations known as the ICAAP (Internal Capital Adequacy Assessment Process). In these documents they have included reputational risks as one of the material other risks that need to be captured as part of the bank's exercise to demonstrate that it holds adequate capital overall under Basel II.
Therefore, banks that are under the Basel II rules need to be able to identify, assess, and mitigate reputational risk. Banks that are not under Basel II frequently find that their regulators nevertheless expect Basel II–type standards to be in place for risk management.
Apart from the regulatory pressures, it is good business sense to actively manage risks that can seriously harm the firm.
REPUTATIONAL RISK MANAGEMENT FRAMEWORK
Although the Basel II definition of operational risk explicitly excludes reputational risk, some firms adopt an internal definition that expressly includes operational risk. As we saw in Chapter 1, Citi includes reputational risk in their definition of operational risk:
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes.21
The operational risk framework is designed to identify, assess, control, and mitigate a risk that is difficult to quantify and that has a subjective and qualitative nature. The elements of the framework can also be effective in meeting the similar challenge of managing and measuring reputational risk. Indeed, several of the operational risk elements routinely consider the reputational impact of operational risks (although not of other risk types such as market, credit, or liquidity risks).
We can adapt the operational risk framework to meet reputational risk needs, and we can leverage existing operational risk activities to include the management and measurement of reputational risks. See Figure 15.2.
Drivers
The drivers for reputational risk management are very similar to the drivers of operational risk management:
- Managing all risks is sound business management.
- Excellence in reputation risk management provides transparency, foresight, and protection.
FIGURE 15.2 The Operational Risk Framework Structure Can Simply Be Renamed and Reused as a Reputational Risk Framework
- Strong reputational risk management can:
- Lead to potentially fewer (bad) surprises
- Allow for quicker recovery from events
- Ensure that adequate capital is held to protect the firm from reputation risk events
- Allow for full assessment of reputation risks prior to business decision making
- Lead to increased investor/shareholder confidence
Governance
The same governance questions apply as for operational risk management: who owns the function, and what should the function own?
Some firms have an individual who is responsible for reputational risk across the firm. That person often resides in the legal department, but it could be argued that they should sit in the risk function in order to ensure that they have the appropriate independence.
There is often a franchise risk or reputation risk committee to which reputational risk issues are escalated. These issues might be raised from the operational risk area, or from other areas where no operational risks are anticipated and yet reputational risk remains.
For example, if a deal is being considered with a counterparty who has a less than stellar reputation or in an industry where there is strong public protest, such as some mining techniques, then there may be associated reputational risk.
In such cases, the deal can be brought to the franchise committee for consideration. There may be a single global committee, several independent regional committees, or a hierarchy of local and global committees.
The membership of such a committee should probably include:
- Head of corporate social responsibility
- Head of legal
- Head of compliance
- Head of human resources
- Head of risk
- Head of investor relations
- Business heads
- Chief operating officer (COO)
- Chief financial officer (CFO)
Event Data Collection
In the same way that operational risk losses are captured in a database for management and mitigation of the risks, reputational risk events could be captured in a database for the same purpose.
It may be more efficient to leverage the existing operational risk event database for this purpose. It is certainly fairly simple to add a reputational impact field to an operational risk event database to ensure that for all operational risk events, the reputational impact is being captured.
RCSA
As we saw in Chapter 10, it is possible to capture the reputational impact of an operational risk during the RCSA process. The sample reputational risk scale is shown again in Table 15.1.
The RCSA could also be leveraged to capture all reputational risks, including those not arising from operational risk, simply by expanding the scope of the RCSA. For example, once all operational risks have been identified, further questions could be asked concerning what reputational risks could also arise in other ways. The reputational impact scoring method could be used to assess the relative priority of those risks.
The use of the RCSA for this purpose would allow for reputational risks that have not yet occurred to be identified, assessed, and controlled and decisions made on whether they need to be mitigated.
An example of such a risk could be, “We invest in a company that has environmentally damaging practices.”
Key Risk Indicators
In the same way that metrics can be used to help monitor whether operational risks are becoming more or less elevated, metrics can be used to monitor reputational impacts of operational risks. Metrics could also be established to monitor reputational risk indicators that are unique to reputational risk.
TABLE 15.1 Possible Reputational Impact Scoring Method for RCSA
| Impact Type | Low | Medium | High |
|---|---|---|---|
| Reputational | Negative reputational impact is local. | Negative reputational impact is regional. | Negative reputational impact is global. |
For example, how many NGO protest letters has the firm received? How many of the firm's clients are currently under investigation for employing sweatshop labor? What percentage of U.S. mountaintop removal mining is funded by the firm?
The corporate social responsibility department could design and develop these types of metrics for review by the franchise or risk committee on a periodic basis.
Scenario Analysis
The scenario analysis program can be leveraged to ensure that reputational risk has been adequately captured for Pillar 2 capital purposes. There is a regulatory expectation that reputational considerations are included in stress testing when assessing capital adequacy for the firm.
The operational risk function will already have a scenario analysis program that handles the collection of data in the difficult and subjective area of very large operational risk exposures. This program will be well suited to provide the same structured output for reputational risk scenarios.
A scenario analysis program could be run separately for reputational risk, or reputational risk scenarios could be added to the existing operational risk scenario analysis program to improve efficiency.
Reporting
As with operational risk reporting, senior management are likely to be seeking reporting on reputational risk that addresses the following concerns:
- Where is our risk?
- What action do we need to take?
- Who is under control?
- Who is not?
- Are we meeting our regulatory requirements?
Reporting might be designed to go to the risk committee, to the franchise committee, or to both. It is important that the risk committee and the chief risk officer are aware of all risks in the firm and so some summary and escalation reporting process should be put in place to facilitate that.
As reputational risk issues often arise in the operational risk reporting process, it may be most efficient to combine overall reputational risk reporting with operational risk reporting.
Whatever approach is taken, the owner of reputational risk management at the firm should consider taking a risk analysis approach, and not just a data gathering approach. In other words, they should undertake to provide the following for reputational risk:
- Analyze raw data.
- Analyze trends and predictors (KRIs).
- Follow news articles.
- Present opinions.
- Present capital at risk and stress-testing impacts.
- Recommend action and mitigating strategies.
KEY POINTS
- Reputational risk is excluded from the Basel definition of operational risk. However, many firms include it in their internal definition of operational risk.
- The impact of reputational risk on capital occurs through its inclusion as a “material risk” under Pillar 2 of Basel II.
- Events that have a reputational impact often result in many knock-on negative impacts, including:
- Litigation
- Regulatory fines
- Loss of key personnel
- Stock price devaluation
- Studies have shown that operational risk events that have a higher reputational impact result in a more pronounced loss in share value.
- The operational risk framework can be leveraged for the effective management of reputational risk.
REVIEW QUESTION
- Which of the following statements is true?
- The Basel II definition of operational risk includes reputational risk.
- Reputational risk is captured under Pillar 1 of Basel II.
- There is no reputational impact in operational risk.
- The impact of reputational risk is captured under Pillar 2 of Basel II.
NOTES
- 1 Bank for International Settlements, Basel Committee for Banking Supervision, “Supervisory Review Program, Risk Management,” SRP 30, section 30.29, https://www.bis.org/basel_framework/chapter/SRP/30.htm.
- 2 www.nytimes.com/2012/07/03/opinion/rigged-rates-rigged-markets.html.
- 3 www.businessweek.com/news/2012-09-24/rbs-managers-said-to-condone-manipulation-of-libor-rates.
- 4 www.economist.com/blogs/schumpeter/2012/12/ubs-and-libor.
- 5 dealbook.nytimes.com/2012/07/05/attention-turns-to-barclays-future/.
- 6 dealbook.nytimes.com/2011/08/25/charles-schwab-sues-banks-over-rate-manipulation/.
- 7 www.forbes.com/sites/halahtouryalai/2012/10/15/banks-rigged-libor-to-inflate-adjustable-rate-mortgages-lawsuit/.
- 8 www.bloomberg.com/news/2012-06-28/barclays-451-million-libor-fine-paves-the-way-for-competitors.html.
- 9 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry, Executive Summary, 2019.
- 10 https://www.theguardian.com/australia-news/2021/apr/07/worse-than-ever-australian-bank-culture-has-not-improved-since-royal-commission-staff-say.
- 11 https://www.americanbanker.com/payments/news/backlash-over-chime-account-closings-highlights-risks-in-fraud-detection.
- 12 https://www.cnbc.com/2021/06/30/robinhood-to-pay-70-million-dollars-after-causing-users-significant-harm.html.
- 13 Bank for International Settlements, “International Convergence of Capital Measurement and Capital Standards: A Revised Framework,” 2004, section 644.
- 14 https://www.theguardian.com/business/2021/jun/08/uk-banks-climate-crisis-bank-of-england.
- 15 Jason Perry and Patrick de Fontnouvelle, “Measuring Reputational Risk: The Market Reaction to Operational Loss Announcements,” Federal Reserve Bank of Boston, 2005.
- 16 R. Gillet, G. Hubner, and S. Plunus, “Operational Risk and Reputation in the Financial Industry,” Journal of Banking & Finance 34, no. 1 (2010), http://dx.doi.org/10.1016/j.jbankfin.2009.07.020.
- 17 https://www.reuters.com/business/finance/robinhood-shares-tumble-after-paypal-news-sec-scrutiny-key-revenue-stream-2021-08-30/.
- 18 Bank for International Settlements, Basel Committee on Banking Supervision, “BCP Core Principles for Effective Banking Supervision,” effective December 2019, https://www.bis.org/basel_framework/standard/BCP.htm.
- 19 Bank for International Settlements, Basel Committee on Banking Supervision, “Guidelines: Corporate Governance Principles for Banks,” July 2015, https://www.bis.org/bcbs/publ/d328.htm.
- 20 Bank for International Settlements, Basel Committee on Banking Supervision, “Pillar 2 Framework: Executive Summary,” October 2019, https://www.bis.org/fsi/fsisummaries/pillar2.htm.
- 21 Citi Annual Report 2020, 64.