Cyber risks may affect banks’ credit ratings — S&P

LENDERS across the region should be vigilant against rising digital risks as potential profit losses, poor risk management, and reputational damage could affect banks’ credit ratings, S&P Global Ratings said.

In a report dated Sept. 27, S&P Global Ratings said that as banking moves further into the digital space, threats of cyberattacks are rising in the Asia-Pacific (APAC) region.

“On top of creating direct monetary losses, data breaches can damage the reputation of a bank and can hit a bank’s credit profile. In jurisdictions where the entire industry incurs repeated, serious data breaches, or where regulators are particularly lax, we may downgrade our rating scores on all banks,” S&P said.

The debt watcher added that although they have yet to downgrade any APAC bank’s credit rating due to a cyberattack, a hit could cripple a financial institution, especially those that have not invested enough in their cybersecurity.

“Regulators are key to setting standards for banks, and guiding them toward collaboration. Such bodies are focusing on industry partnerships, pilot projects, sharing of best practices, and the like,” S&P said.

“This underscores how critical cybersecurity is to the smooth functioning of an economy and key services. Accordingly, it is helpful to see what regulators are doing in each market.”

In its report, the debt watcher cited how the Bangko Sentral ng Pilipinas (BSP) regulated Philippine banks in addressing threats to cybersecurity and managing risks, adding that it is helpful to see what regulators do to ensure the smooth functioning of the economy and key services.

“[The BSP] in 2017 issued a circular addressing internet threats. This circular highlight the role of the board and senior management to create sound information-security governance, including a strong security culture,” S&P said.

It also cited how the BSP tightened the reporting regime of its supervised institutions, in which banks need to disclose cyber incidents within two hours from a prior standard of 10 days.

“Faster reporting aims to enhance the industry responsiveness. The central bank has also fine-tuned its policies to promote automated, real-time systems to detect fraud,” S&P said.

Issued in November 2017, BSP Circular 982 requires all financial players to set up internal systems to identify and counter a wide array of digital attacks through an information security program “commensurate” to the complexity of a firm’s reliance on digital tools.

In 2018, the central bank also implemented new rules requiring supervised firms to report digital breaches and cyberattacks within two hours from discovery.

“Cyberattacks have the potential to harm credit ratings through reputational damage as well as monetary loss,” S&P Global Ratings Criteria and Methodologies Managing Director Nik Khakee said in a conference on Wednesday.

“If we look at the entity-specific factors, we could reflect cyber risk in business position if business stability could be impaired by loss of customer confidence. We also consider the ability of the bank to manage and prevent cyber risk,” Mr. Khakee said.

He added that cyber incidents could hurt banks’ capitalization and if the cyber risk is poorly managed, a bank is likely to be exposed to structural weakness.

“Finally, if you look at funding and liquidity, a cyber event could actually result in severe reputational damage, and a severe cyber event could actually lead to sudden outflows of client funds and create liquidity pressure for the bank,” Mr. Khakee said.

Meanwhile, aside from digital risks, S&P Global Ratings Financial Institutions Ratings Director Gavin Gunning said higher-for-longer inflation and weaker growth could also affect banks’ credit ratings.

“Persistent or material weaker economic prospects outside of base case including much weaker growth still, or a sharp or higher-than-anticipated inflation and borrowing costs, will eventually hurt corporates and in turn household,” Mr. Gunning said.

“This of course will hit banks’ asset quality and potentially bank ratings or outlooks,” he added.

S&P Global Ratings earlier lowered its growth forecast for the Philippines to 6.3% from its 6.5% estimate in June, citing rising interest rates meant to curb inflation that could temper expansion.

Headline inflation climbed to 6.3% year on year in August, exceeding the BSP’s 2-4% target this year for a fifth straight month. — Keisha B. Ta-asan