Managing operational risk in African nations

Operational risk management in Africa demands a specific set of models and practices, tailored for the unique demands of the region. Banks that try and shoehorn their global risk procedures into a localised context are encountering difficulties. Gail Mwamba reports

Risk officers at global banks are increasingly adding visits to African cities to their travel plans, as banks search for ways to tap into the continent's growth. After years of being referred to as the ‘dark continent', Africa is now seen as one of the last frontiers for generating returns, particularly as a large part of the western world is weighed down by lacklustre growth thanks to the credit woes affecting the eurozone.
Since 2001, Africa's gross domestic product has grown by an average of 5.4% per annum, against 1.6% in western economies, according to the International Monetary Fund (IMF). The IMF expects current growth rates to continue until 2015, with seven of the world's 10 fastest-growing economies based on the continent.
As banks look to set up in Africa, questions arise as to whether the risks of operating in the region are being identified and analysed adequately. Some experts say the established frameworks of risk identification at global banks are ill-suited to business operations in Africa, raising additional risks for those who seek to adapt existing approaches when setting up in the region.
"You cannot just apply global models to get risk management right in Africa," says Brian Lawson, chief economist at London-based risk advisory firm Exclusive Analysis and former chief operating officer in Nomura's global markets division. "I am not convinced that a lot of the global banks are using the right models to assess risks in Africa."
Taking a local view, South Africa, Kenya and Nigeria lead the way in the development of operational risk management across sub-Saharan Africa, with Angola, Botswana, Malawi, Mozambique, Uganda and Zambia also making progress. The Institute of Operational Risk (IOR) set up a local chapter in Nigeria in 2011 after seeing a surge in membership applications from the region.
Meanwhile, 95% of financial institutions in east Africa surveyed by Deloitte in a recent report said operational risk management has become a key area of focus. Institutions are looking mainly at business continuity, IT security, human capital and data integrity. However, less than a third of those surveyed had implemented operational risk models already.
Only banks in South Africa are close to adopting the advanced measurement approach (AMA) for operational risk capital under Basel II.

Conflicting views
The potential impact of operational risks in Africa was brought to the fore in 2011 when a number of global banks had to shut their operations in Côte d'Ivoire following post-election violence between two political factions. Laurent Gbagbo, the incumbent president, was proclaimed the winner of the 2010 election, which was disputed by opposition candidate Alassane Ouattara and a number of world leaders.
The ensuing civil war brought the country's financial system to a halt, with a number of global banks shutting operations and the stock market suspended. Standard Chartered, Citi, BNP Paribas and Société Générale, were among the banks forced to cease operations in the country.
BNP Paribas' affiliate, BICICI, cited "judicial and regulatory confusion" as the reason behind its closure, and added it was unable to ensure the physical security of its employees. The regulatory confusion came about as the regional financial regulatory body, the Central Bank of West African States, which was backing the opposition leader, demanded that banks halt all transactions with its agencies in Côte d'Ivoire. Meanwhile, the incumbent president threatened legal action against the banks that were closing doors to customers.
Banks also suffered liquidity constraints as customers rushed to withdraw cash. Société Générale and BNP Paribas together held about a third of all deposits in Côte d'Ivoire, according to data from the Professional Association of Banks and Financial Institutions of Côte d'Ivoire.
But some regional banks seem to have been prepared for these events. After years of operating in the region, they had learnt the hard way to put in place a robust system of information-gathering to keep a step ahead of developments. According to Dayo Orimoloye, group head of risk management at Ecobank in Togo, the likelihood of political chaos and its effect on operations had arisen in the bank's scenario analysis, and the bank had made contingency plans for such events.
"In a conflict situation, we have an information process in place and we assess the situation through scenario analysis," explains Orimoloye. "We have an escalation process that helps us decide where to move our operations - for instance meeting the needs of customers from Côte d'Ivoire in Ghana during the crisis in that country."
Ecobank, which has operations in 32 countries across Africa, has an established data centre in Ghana, which backs up all of the bank's data from individual subsidiaries. The centre is further supported by a backup centre in London. During the Ivorian crisis, the bank was able to move operations to Ghana, enabling customers to continue some level of service.
Preparing for such events, however, comes at a cost. For private institutions, operational losses due to political exposures are difficult to insure. It is for this reason that Ecobank has recently started internal discussions to set aside a budget to provide contingency funding in times of trouble. However, keeping one's ear to the ground remains the surest way of protecting operations.
"Internally we have researchers that provide information but we also subscribe to a number of intelligence research companies that are able to provide us with the information we need," says Thomas Somiah, Ecobank's group head of operational risks.
Having a strong network of informers and forecasters is fundamental to creating a robust risk assessment framework, according to Lawson at Exclusive Analysis. He adds that this goes beyond political forecasting to finding out who are the key players in the country. This, he says, is an important factor across most emerging markets.
"The only prudent analysis is one that is extremely thorough on the ground, that understands what people are saying in the local marketplace and the local cafes," explains Lawson. "It is important to understand the history of problems."
As part of the assessment, banks should be prepared to drill deep into issues such as the robustness of a country's legal framework, including whether or not individual judges and regulators are considered corrupt. This determines to what extent business should expect to get a fair judgment, in case of trouble.
"It is prudent to know which individuals in the country have strong connections and who has the corruption and bribery power to sway decisions," adds Lawson. "As a foreign institution, you need to know whether if you go to court, you will have a chance of winning a case."
Experts say this due diligence should include industry figures and potential key employees. With the bulk of sub-Saharan Africa still suffering from the constraints of underdeveloped infrastructure, standard background checks can be a challenge. "Local banks already focused on the region can acquire this level of intelligence, but the larger international firms may find this challenging," says Lawson.
Historically, banks and other corporations looking to branch into new areas in Africa have relied on bringing in expatriates to do the job. A number of banks, however, report that cultural integration can be a challenge, which may be a hindrance to building local relationships that are essential to the growth of the bank.
"When we acquire new banks, staffing has to be a mix of expatriates and locals, which requires strong support from the group to ensure teams work efficiently together," says Ecobank's Orimoloye. "Key operational risks include culture integration, particularly risk culture."
On the other hand, governments are increasingly pushing for top jobs to go to locals - a growing trend across the region. As such, obtaining expatriate permits in some countries can be hard.
"Work permits are becoming problematic," says Paul Rew, group head of operational risk at Standard Bank, based in London. "Most governments are promoting skills transfers and limit the number of expatriates allowed to a country. Quotas for foreigners are being reduced and work permits take longer to obtain."

Licence to operate
Other local regulations present less of an obstacle, with few banks highlighting permits to operate as a main challenge in the region. However, sporadic cases have been reported where banks have had assets seized due to alleged breach of local regulations.
One such case involved Zambia's Finance Bank, which was seized by the central bank in December 2010 for alleged illegal activity by the bank's shareholders, directors, management and senior staff. Credit Suisse was the single largest shareholder, with a 40% stake in Finance Bank. The central bank subsequently sold select assets of the bank to South Africa's First National Bank (FNB) in 2011, just before the country's general elections which saw President Michael Sata ascend to power.
The new president reversed the sale barely a week after coming into power, reportedly saying he had not seen any "document of sale". This incident in part led to Fitch downgrading the country's economic outlook from stable to negative.
Although outright bank permit cancellations are rare, regulatory and compliance risks have also grown due to regulators adopting risk-based supervision models. New regulations have been introduced following the global banking crisis, which saw countries such as Nigeria having to inject $4 billion into ailing banks.
International banks operating in Nigeria, for example, now require minimum capital of 50 billion naira ($320 million). Nigeria also recently forced banks to re-apply for permits. Previously all banks had the right to operate across the nation, but the new permits now limit some banks to operating within certain regions.
Under the new rules, local national banks have been given a minimum capital requirement of 25 billion naira, while regional banks, which can operate in only six to 12 of Nigeria's 36 states, are required to have 10 billion naira.
Meanwhile, Ghana recently raised its minimum capital requirements to 60 million cedi ($38 million). Zambia set a minimum capital requirement of $100 million in the face of resistance from banks who considered this amount too high, having been raised from $2 million. Some banks in Zambia have been able to engage with regulators to have the requirement reduced, with the central bank granting petitions on a case-by-case basis.
"We felt the capital requirement in Zambia was quite high. But because of our relationship with regulators, we were able to engage with the regulators, and convince them to consider a lower figure," says Orimoloye. "The new capital requirements did not hinder us in operating in Zambia."
Elsewhere banks face risks for which there is no regulator to approach to alleviate their difficulty. Electricity power outages, for example, are increasingly commonplace across a number of countries in sub-Saharan Africa.

Power struggle
Domestic and industrial demand for power has risen as Africa's middle class has grown, putting strain on Africa's electricity infrastructure. The underlying causes of power shortages and regular interruptions vary from failures to meet the demands of economic growth to low infrastructure investment and reduced hydropower capacity, due to droughts.
Sudden power outages in Nigeria and even South Africa are not uncommon. This year, Kenya, Uganda and Tanzania have had to introduce power rationing, with business areas losing power intermittently for a day or a few hours at a time and residential areas losing power for up to three days in a week.
South Africa, which is more developed, has been suffering power outages across a good number of its major cities. According to a recent World Bank report, companies operating across Africa experience power outages on average 56 days per year. Banks have had to install backup generators to keep their branches running, which pushes up the cost of doing business on the continent.
"Insufficient and badly functioning infrastructure is an operational challenge," says Standard Bank's Rew. "In most of our countries we are forced to supply these services ourselves. This can be particularly costly."
For a bank, an electricity outage brings additional risks, meaning for example that transactions have to be taken offline. This can expose banks to an increased risk of fraud. In its report, Deloitte says east African banks lost $48.3 million to fraud in the 18 months ended June this year, 25% higher than a similar period two years ago.
Deloitte's survey reveals that about 50% of total fraud was carried out by insiders, with the use of technology that is poorly matched to the needs of the business a contributing factor.
"There is an increasing threat of fraud, both internal and external," says Rew. "This is exacerbated by a poor legal system in most of our countries. Consequently, legal redress for fraud can take years to be resolved and the enforcement of court rulings can be problematic."
Mitigating such operational risks remains a challenge for both local and global players. Insurance is seen as the best option for most, but there is a limit to what can be insured. Global bodies such as the World Bank have begun to sell political risk insurance, but this tends to cover mainly investment transactions. Provision of insurance beyond that covering regular hazards such as robbery and fire, particularly in high-risk areas, has been limited.
"The insurance industry was very buoyant up to 2008 - indeed, too buoyant. They were insuring more and more risks with overoptimistic assumptions," says Lawson. "The insurance industry today is in a much more conservative frame of mind."
It seems the best insurance is to have a strong information network, which at the very least, helps institutions prepare contingencies for the risks they face. Meanwhile, it is clear that to prosper, global banks must look beyond simply adapting their global models to the African setting.