Ten Issues for Supervisors During Crises
Thursday, Apr 30, 2020

Ten Issues for Supervisors During Crises


The COVID-19 crisis is creating unprecedented pressures on both supervisory authorities and supervised firms. Supervisors everywhere are being forced to adapt their working practices and, in some cases, their supervisory approaches in order to cope.[2]

Some of the financial effects of the current crisis are already clear. There have been major disruptions to asset markets, some of which will prove permanent as industries fail to recover. Notwithstanding the support of central banks, market liquidity is likely to remain under strain for some time. Credit risks have heightened though the full extent and duration of these, along with the mitigating effect of government bail outs and loan guarantees, is impossible to know at the moment. Loan delinquencies also typically lag other developments in downturns. Firms’ operational resilience is being tested so that their ability to carry out critical business activities may be compromised.

There are other, less obvious sources of risk to supervisory objectives. Consumers could become the victims of financial crime or misconduct as unscrupulous players identify opportunities for fraud or other wrongdoing. This comes at a time when firms’ controls are under strain along with supervisors’ ability to monitor these. Other, so far unsuspected risks will certainly arise before the crisis is over. The pervasive nature of the COVID-19 emergency means that the consequences of actions taken by supervisory authorities, central banks, and governments are more than usually interdependent.

Levels of risk have increased and will remain elevated for some time. This has coincided with constraints on supervisors’ capacity for addressing these. There is however a great deal that supervisory authorities can do to address heightened risk using appropriate processes and drawing on established practice.

The key strategic objectives for supervisors in the current crisis – and in crises generally – are to maintain current and future financial stability and to minimize the impact of the crisis on users of financial services. A pre-requisite for this is that supervisory bodies and the firms they supervise are themselves able to function. In conjunction with central banks, finance ministries, and other bodies, supervisors need to fully understand and take the necessary prioritized measures to mitigate the short-, medium-, and long-term effects of what will prove a protracted period of stress.

This Toronto Centre Note sets out the main issues that supervisors need to consider in a crisis and offers suggestions for how these might be addressed, both generally and in the current crisis. Most supervisory authorities will already be doing much of this in response to the COVID-19 outbreak. The Note aims to provide a reference point that can be used when taking stock of whether supervisory authorities are doing all the right things, whether they need to do more, or to do some things differently.

Ten Issues: Summary and Action Points



Action point

1. Supervisory authorities are key players in a crisis and their operational resilience is a paramount concern

  • If you have a Business Continuity Plan (BCP), implement it and monitor your performance
  • If you do not have a plan already, introduce the key elements of one now

2. It is essential to maintain effective channels of communication with other key stakeholders that are involved in managing the crisis

  • Communicate continuously with high-focus firms
  • Coordinate with other official players in the financial sector (central banks, finance ministries)

3. Supervisors should ruthlessly prioritize supervisory activities

  • Identify firms and issues that are key to achieving strategic objectives


4. Ensure channels of communication with the highest-impact firms and those involved in highest-impact issues. Develop or modify a strategy for lower-impact ones.

  • Triage firms and issues
  • Use whatever means are available to understand and address the risks they are facing
  • Review recovery and resolution plans
  • Monitor lower-impact risks even if these are given less priority

5. Ensure proper management, governance and reporting of important supervisory processes and decisions

  • Engage the board
  • Modify internal decision-making procedures
  • Ensure key decisions are documented

6. Put in place a measured and rational basis for regulatory forbearance

  • Separate simple, blanket low-impact changes from potentially high-impact ones.
  • Don’t rush to the latter but consider in the context of scenario testing and analysis
  • Coordinate on high-impact decisions with the macroprudential authority

7. Base your planning on a coherent view of how risk tolerances have changed

  • Accept that risks have increased across the board
  • Consider what this means for what remains unacceptable and what you may have (temporarily) to accept


8. Scenario test the possibility that the crisis may be deeper or more protracted than currently expected

  • Assess how market conditions may deteriorate further or persist for longer
  • Assess potential new risks and how to address them
  • Assess the impact on the supervisors’ and supervised firms’ operational capacity

9. Be alert to unexpected consequences of the crisis and their implications

  • Look out for unexpected but serious emerging risks
  • Have in place channels to communicate these to others who may have a more direct responsibility for them

10. Do not lose sight of wider issues

  • Monitor implications for climate change, financial inclusion, gender equality
  • Don’t drop important initiatives in a crisis

The Ten Issues in Detail

1. Supervisory authorities are key players in the crisis and their operational resilience is a paramount concern. If you have a Business Continuity Plan (BCP), implement it and monitor performance under it. If you do not have a plan already, introduce key elements of one now.

Business continuity planning (BCP) is distinct from other types of emergency planning such as crisis management. It is specifically about identifying the most important and time-critical activities undertaken by the supervisory authority and ensuring that these can be carried out.

Another 2020 TC Note covers BCP in detail.[3] For the purpose of this Note, the following points are the most important.

  • BCP plans should not attempt to set out detailed responses to specific anticipated events. They should provide a flexible, generic framework within which responses to specific events can be developed.
  • BCP plans should identify the supervisory authority’s most important/critical activities. These will typically derive from the authority’s statutory objectives, though the objectives themselves will usually be too high-level to be of practical use in day-to-day prioritization.
  • There is value in taking 24 hours at the onset of a crisis to identify priorities and plan, rather than rushing into full response mode straight away. A BCP team should be established.
  • It is necessary to identify the critical staff and other resources needed to carry out key supervisory activities.
  • It may also be necessary to consider whether there are legislative constraints to implementing a BCP – for example if legislation is highly prescriptive regarding supervisory processes.
  • In a business continuity context, there is likely to be a need for ruthless prioritization of supervisory activities.
  • There are several considerations involved in such prioritization:
    • What are the critical supervisory activities that need to be carried out continuously? These are likely to include activities to maintain the prudential soundness of potentially systemic firms in the financial system and the maintenance of conduct rules, which may be judged critically important.
    • What is the time dimension of such criticality? Some functions (authorizations or the analysis of returns for lower-impact firms) can probably be postponed. While a one-month postponement might be acceptable, a three- or six-month one might not be.
    • What does this prioritized activity imply for critical staffing and other resources?
    • What workarounds, in terms of staff and other resources and processes, may be needed to address the most important needs?
  • Ideally, most supervisory authorities will already have BCPs that have been extensively tested. Even where such plans are not in place, supervisors should implement the key elements of a BCP as a basis for their decision-making during the current emergency.
  • It is important to remember the ‘human’ dimension of operating in crisis mode. Some staff thrive in crises; others do not and may retreat into the comfort of business as usual – tendencies which may be heightened when they are working remotely. It is important to be aware of, and to work with this.
  • The development of BCPs is an iterative process that draws heavily on experience. Supervisory authorities should incorporate lessons into what should be a continually improving process.


Supervisory authority A is an exemplar of good practice in that it has an existing BCP that was developed in ‘normal’ times. It identifies critical supervisory activities and the staff and other resources required to undertake these (as well as backups). The BCP has been tested with both a desk-based ‘walkthrough’ and a full rehearsal with key staff working off-site. The BCP was triggered as the COVID-19 crisis developed, having first been reviewed at high level to check any aspects that needed modification given the specific circumstances. Since triggering the plan, a small group has been set up to oversee the operation of the BCP and to implement any necessary changes with the authority of the chief executive (which in turn is delegated from the board).

Supervisory authority B does not have an existing BCP. While this is not an optimal state of affairs, at the onset of the crisis management they nevertheless took time to identify:

  • Critical functions that needed to continue and the key staff to undertake them
  • Activities that could be postponed or deprioritized
  • The allocation of staff resources to achieve the new work pattern involving reallocation of some staff to ‘crisis’ tasks and others to continued business as usual and monitoring
  • Measures, such as extensive working from home, to ensure that staff health and safety was not impaired
  • Contingency measures in the event of staff resources being depleted through sickness
  • Communications channels internally and with supervised firms

A small group was established to oversee the operation of this basic BCP and to suggest potential changes to it in the light of experience.

 2. Maintain effective channels of communication with other key stakeholders involved in managing the crisis.

Where there exists a well-developed framework for macroprudential oversight and policy, there should already be extensive coordination among supervisory authorities, central banks, and finance ministries. The need for such coordination is particularly great during a crisis, especially one with market-wide implications such as the COVID-19 emergency. Not all countries have well-developed coordination frameworks and where this is the case it is important for supervisory authorities to establish collaboration with a wide range of potential stakeholders. A (non-exhaustive) list is as follows:

  • There should be a particularly close relationship with central banks (where these are separate from the supervisory authority). Central banks are providers of liquidity, facilitators of market operations, and often the macroprudential authority. They may also house the resolution authority. The day-to-day agendas of central banks and supervisory authorities may not always precisely correspond, and an open and reciprocal flow of information is essential to minimize the consequences of this. Where supervision is located within the central bank, there is a paramount need for effective internal coordination of functions.
  • Finance ministries do not typically involve themselves in supervisory issues but will have a close interest both in significant risks to the financial sector and in the implications of developments in that sector for the wider economy. In the COVID-19 crisis, decisions regarding economic support, guarantees, and other credit measures will profoundly affect the solvency of banks and insurers. Finance ministries will expect to be fully apprised of any situation that could threaten financial stability or result in a requirement to use public funds.
  • Crises may result in the closure of financial institutions. In the case of systemically important banks, this may result in the triggering of resolution powers exercised by a separate resolution authority. There should already be close cooperation between this body and the supervisory authority; the need for this is heightened during a crisis with market-wide consequences.
  • There is a need for close contact with the managers of banking, insurance, and any other compensation schemes. They should be apprised of emerging issues and prepared to activate schemes in the event that eligible insolvencies occur. They should have the relevant and up-to-date information to enable them to do so effectively.
  • It is also important to maintain close contact with other supervisory authorities. These will include other financial supervisory authorities in the same jurisdiction to the extent that these are functionally separate. They will also include overseas supervisors where financial firms are parents, branches, or subsidiaries of firms domiciled in other countries. Supervisory authorities should be involved in any wider international coordination of policy responses.


The supervisory authority is part of a newly convened crisis management group consisting of the central bank, finance ministry, and deposit guarantee scheme. There is already close collaboration with the resolution authority, which is housed in the central bank on recovery and resolution planning. The decision has been taken to step this up in light of the COVID-19 outbreak. The crisis management group meets (by phone) daily to exchange information and agree measures. External communications are fully coordinated.

Firms domiciled in the jurisdiction have branches and subsidiaries in a number of other countries and three firms are subsidiaries of overseas parents. An assessment has been made of the impact of these firms and contact has been made with the home/host supervisory authorities of those with the highest impact using contacts already established through supervisory colleges.

3. Ruthlessly prioritize supervisory activities. Decide which supervised firms and issues are key and focus most attention on those, while keeping other, lower sources of risk under review, particularly if the crisis is protracted. Consider whether low-value activities are still warranted. If not, postpone or stop them altogether.

Prioritization should be a central feature of supervision day-to-day and is described in detail in earlier TC Notes on Risk Based Supervision.[4] Supervised firms and issues should be classified according to the level of risk they pose to the achievement of the supervisor’s statutory objectives. The level and distribution of risk are then the key driver of the allocation of supervisory resources.

Prioritization is key in a crisis. In extreme circumstances like the COVID-19, crisis risks will increase across the financial system. The gap between the perceived importance of high-impact or systemic firms/issues and others may still widen however, at least in the short term if the first priority is to prevent a high-impact or systemic event. It makes sense in these circumstances to maintain or increase the focus on systemic or high-impact firms even at the expense of reducing the scrutiny of lower-impact ones (notwithstanding the fact that risks have increased there also) at least in the short term. The imperative here is to understand the highest risks and how these are evolving and being managed.

To emphasize: a rational response to a crisis may be to reduce scrutiny of some firms or issues even if they have also become riskier. This is because risks elsewhere are judged to have increased even more. Lower impact/risk issues cannot be ignored, however, even in extreme circumstances. These remain a source of potential detriment to consumers and the wider financial system, and as such warrant some supervisory attention. There is also a danger that a backlog of smaller issues (and the attendant risks) may build up if the crisis is protracted and prove overwhelming when business as usual returns.

Significant changes in priorities need to be the result of a rational decision-making process based on senior management’s understanding of risk. They should ideally be agreed by the board of the supervisory authority and communicated to the central bank and macroprudential authority.

Example (much simplified)

It is apparent to supervisory authority A that the COVID crisis, which has triggered the BCP, has resulted in higher risk across the wider financial system. For a period of at least one month, it will implement the following measures consistent with its risk tolerance:

  • Maintain close and continuous oversight of systemically important firms. This is intended to ensure that it is aware of all significant risks they face, albeit using work-arounds where usual communication channels are not available or because of operational stretch in the supervisor and/or the firms as a result of sickness.
  • Maintain all anti-money laundering reporting requirements, albeit with some modifications to allow for expedited reporting.
  • Postpone a number of thematic reviews, mostly involving groups of smaller firms that were due to begin within the next three months.
  • Continue with a small number of enforcement cases that are judged to be particularly important and which it would be disproportionately damaging to drop or suspend.
  • Relax its service standards for new authorizations.
  • Confine vetting arrangements for proposed appointments in firms to where new staff are critical to the firms’ functioning.
  • Postpone the analysis of returns for a group of very low-impact firms for up to two months.

The operation of all of these changes will be subject to continuous oversight and formal review after one month to determine whether they remain appropriate.

4. Ensure that there are channels of communication, however unconventional, with the highest-impact firms and those involved in market-wide issues. Develop a strategy (or amend an existing one) to deal with lower-impact firms and issues. Focus on the risks that matter most while not losing sight of others that apparently warrant less attention.

Having identified the highest-priority firms and activities, it is essential to maintain information channels that enable supervisors to understand the risks being faced and how these are evolving and being managed. Many supervisors maintain a marked formal separation between on- and off-site activity. In some crises, on-site work may not be possible, requiring significant work-arounds in terms of the amount and nature of work that is undertaken off site. This will require more extensive contact by phone, e-mail, or other virtual channels. This may create heightened risks for supervisors that traditionally place heavy reliance on on-site activities such as physical file checking. As with all remote working, issues of data and information security may arise that need to be considered though they may be unavoidable and, on a balance of risks, judged acceptable.

There should be an initial contact with each high-impact institution to discuss its operational resilience, review its recovery plans, and to agree communication and reporting arrangements during the crisis. It is likely that there will be a need for (at least) daily contact thereafter, as well as various forms of enhanced monitoring – for example of liquidity, bank capital, insurers’ solvency, and securities firms’ position taking and valuations. It may be necessary to make greater than usual use of firms’ own management or ‘pre-packaged’ information as well as the results of firms’ own internal reviews and risk assessments (ICAAP, ILAAP, and ORSA-like assessments) to keep a grip on existing and emerging risks.

In normal times, supervisors’ willingness to place reliance on unverified information from firms tends to be conditional on them having demonstrated that they are open and trustworthy. In a crisis, there may need to be a greater willingness to place reliance on firms’ own assessments and accept information in unconventional forms without the same scope for establishing or checking track records. This does not preclude general reminders to firms that a high-level of reliance is being placed on them and that there will be serious consequences if this proves to be misplaced.


Institutions that are judged to be the highest-impact should already have established a key individual as the contact point for the supervisory authority. Face-to-face meetings have been suspended as a result of the outbreak so this individual is in daily communication by phone to report on business activities, operational issues in the firm, the operation of controls, actual and potential risks to the business, and any industry-wide intelligence. In addition, the supervisor has a program of discussions, also by phone, with heads of control functions or their appointed alternates.

The supervisor is asking for twice-weekly reporting on liquidity, asset valuations, and loss experience. The firm already produces daily internal reports on these and the supervisor has agreed that these can be submitted to meet the new requirements. The firm is also providing its own internal capital and liquidity adequacy assessments incorporating estimates of the effect of further stresses.

It is understood that the firm will actively report any serious emerging risks or other issues of significant concern. The supervisor is placing more reliance on this process than would normally be the case, but on balance this is judged to be an acceptable way of identifying risks and ensuring they are addressed where there are limited other channels available.

Whilst large and high-impact firms and issues may attract proportionately more supervisory attention and resource than under business as usual, smaller firms should not be ignored. There may be a large number of these, each of which individually has low impact, but which collectively may be a significant source of risk that may be heightened during a crisis. Small firms may also make a contribution to the effective working of the financial system that is disproportionate to their size.

Supervisors who do not have a comprehensive small firms strategy that recognizes these complexities need to implement the key elements of one in a crisis. Those that do already have such a strategy may find that it is necessary to adjust it and perhaps create a team specifically to maintain oversight of the risks arising out of lower-impact firms and issues. Adjustments to existing strategies are likely to involve two broad elements:

  • Postponement of some activities. This may be a necessity for activities involving on-site work. This includes horizontal or thematic work, which may be postponed to free resources in the short-term.[5]
  • A greater than usual reliance on routine reporting and monitoring. This may be supplemented with an open-ended invitation to smaller firms or groups representing them to draw supervisors’ attention to generic or industry-wide issues that may be giving rise to new, unexpected, or heightened risks.


The supervisory authority already has a small firms strategy according to which firms below a given impact threshold are visited no more than once every three years. They are required to submit quite extensive returns electronically and the supervisory authority is working on technology to enable these to be processed semi-automatically. This is not fully up and running however, and a proportion of returns are still submitted manually. All returns are still subject to manual scrutiny. The supervisory authority also places considerable reliance on horizontal and thematic work, which aims to identify generic areas of weakness in industry sectors and to feed back strong messages regarding improved practice.

As a result of the re-prioritization following the COVID-19 outbreak, the following has been agreed:

  • Electronic reporting requirements will continue unchanged.
  • Internal service standards for dealing with and signing off returns are being relaxed from five working days to fifteen.
  • Most horizontal and thematic projects (involving visits and written returns from firms) planned for this quarter are being pushed back into the next with a small number being repurposed to address crisis-related concerns (involving off-site work only).
  • A small team has been established specifically to monitor ‘low-impact’ firms and issues. Its task is to ensure that risks currently judged as low remain so and that significant emerging risks are identified and acted upon.

All of these arrangements will be reviewed after one month. Staff working in the relevant areas have been asked to remain alert to emerging risks and to draw these to the attention of the newly-established monitoring team and senior management.

5. Ensure that there is proper management, and governance and recording of important supervisory decisions. The board of the supervisory authority should be aware of, and ideally sign off, changes in policies and priorities as well as significant management issues.

Most supervisory bodies derive their powers from legislation. These are delegated by the governing board of the supervisory authority, which retains overall responsibility for the supervisor’s actions and for the achievement of its statutory objectives.

The board should be fully apprised of the supervisor’s response to any crisis, including any changes in delegated authority or the use of powers. It should constructively challenge the executive to explain key decisions that have been made and the analysis done to support them, while taking care to not add to the burden on the executive at what is certain to be a busy time. Some form of ‘light touch’ monitoring mechanism, potentially involving board committees, may need to be put in place in between scheduled board meetings.

It is also important that significant decisions and changes in procedures are properly documented. It is easy to lose sight of this in the heat of a crisis, but some measures will have long-lasting effects and supervisors may be held to account for their decisions and actions once the crisis is past. They will need to provide documentary evidence of their decisions and the rationale for them.


As the result of the COVID outbreak, the management of supervisory authority A decided to:

  • Introduce extensive home working.
  • Set up two teams (inward and outward focused) to oversee the BCP arrangements.
  • Introduce revised delegations to cover the possibility that some staff may not be available.
  • Focus its attention on 3-4 specific areas judged to be high risk and for which there is low or zero tolerance.
  • Establish a team responsible for oversight of firms and issues judged to be of lower immediate risk.
  • Postpone activity and temporarily relax formal reporting and other requirements in some other, lower-risk/moderate-tolerance areas.

The board of the supervisory authority was notified of these changes and asked to approve those (such as delegations) for which it has formal responsibility. The executive has undertaken to provide a full account of how the changes are functioning and the attendant risks at subsequent board meetings with updates provided in a phone meeting every two weeks in between. Proportionate arrangements were put in place to ensure that these changes of focus and the supervisory actions and decisions stemming from them were properly recorded.

6. Put in place a rational approach to regulatory forbearance. Balance the need for forbearance to allow business to continue to function against the risks in exercising it.

A crisis affecting a significant part of the financial sector will inevitably create strains resulting in requests for regulatory forbearance. Firms may ask for certain reporting requirements to be relaxed, for supervisors to acquiesce in looser standards (for provisioning or internal controls for example), or to be allowed temporarily to breach capital, solvency, or liquidity requirements.

The responses to some of these requests will be more straightforward than others. It is possible for example to weigh the benefit to a firm of postponing reporting on some required metric for, say, one month against the risk of serious problem not being identified. Similarly, the potential (non-negligible) consequences of relaxing some forms of signing-off procedures, for example for AML, can be discerned relatively readily. In some cases, it will be expedient and appropriate to provide blanket exemptions in the case of ‘lower-order’ forbearance decisions – that is to say those with potentially modest impact. These decisions and the rationale for them need to be fully documented.

For other decisions however, the issues are much more complex. Should firms suffering mark-to-market losses on tradable assets be required to take precipitate action such as increasing reserves or liquidating positions in weak and illiquid markets? Supervisors need to consider whether the losses are likely to be reversed, and over what time period, and whether a requirement to liquidate would exacerbate industry-wide pressures. Should banks be required immediately to raise provisions against deterioration in their loan books? The scale and duration of the deterioration is hard to forecast, as is the likely impact on losses given default of various government guarantee schemes. In the light of such uncertainties, immediate blanket forbearance measures may not be optimal.

One approach to such a dilemma is to require the firms involved to undertake scenario testing. The supervisory authority could specify certain parameters concerning future prices or credit losses over differing time scales to assess what these would mean for profitability, reserving, and solvency. Such exercises, while likely to be far from perfect, can at least give the supervisory authority some indication of the possible limits of forbearance. Large firms should also be undertaking, as a matter of course, internal ICAAP, ILAAP, and ORSA-like processes designed to identify heightened risks and understand their implications, including in scenarios where stresses escalate further still. Supervisory authorities should stand ready to assist or advise in such exercises, and firms should communicate the results in support of any requests for forbearance.

Overall, supervisors should not rush to introduce blanket exemptions on major issues without having undertaken as detailed an assessment as possible of the need and the likely consequences. There should also be extensive coordination on such matters with the macroprudential authority.


There is a formal requirement that insurers are required to increase their holdings of liquid assets in the event of falls in the value of their marketable assets below a prescribed level. This level has been reached given the asset price falls following the COVID-19 outbreak, but several firms have asked for this requirement to be relaxed because: a) some recovery in asset prices is thought likely in coming months, though the extent and timing remain uncertain; and b) selling assets now would amount to a fire sale in which firms would incur losses and exacerbate market pressures.

This issue, along with all other potential instances of forbearance in the current crisis, are the subject of continuous discussion by senior management in the supervisory authority. The following was decided:

  • The requirement would be temporarily suspended (for ten working days).
  • The firms seeking exemption from the requirement would meanwhile be asked to provide best estimates of the impacts on their liquidity and profitability of selling or retaining assets under a range of prescribed scenarios – no asset price recovery; partial recovery in one month; partial recovery in three months and so on.
  • On this basis, a measured decision will be made balancing the need to maintain liquidity against the need to avoid the adverse consequences of sticking to the policy.
 7. Base your planning and actions on a coherent view of how risks and risk tolerances have changed. It is inevitable that some risks to supervisory objectives will have increased and this needs to be accepted. These increases in risk should be identified and monitored.

Supervisors cannot, and should not aim to, remove all risk. There will always be risks to the achievement of their objectives.[6] These need to be managed using the limited resources available to the supervisory authority and recognizing that while the crystallization of any risk is unwelcome, tolerances for them will differ. There will be a lower tolerance for the failure of a systemically important institution than, for example, a modest incidence of late reporting of returns by a group of small investment companies. A supervisory authority’s tolerance for risk should have been considered in ‘normal’ times and risks classified, perhaps as zero, low, or moderate.

During a crisis, risk tolerances need to be revisited for two reasons:

  • If the crisis is confined to the supervisory authority, there may be less resource available. So, while underlying attitudes to risk may remain unchanged, tolerances (or strictly attitudes to these) need to be reconsidered to make the most effective use of the depleted resource.
  • If the crisis extends beyond the supervisory authority, the nature or distribution of the risks themselves may have changed. In the current COVID-19 crisis, there are already significantly-heightened levels of credit, market, liquidity, and operational risk. There is greater risk of systemic disturbance and certain types of financial crime. Here too, while underlying tolerances to different risks may not have changed fundamentally, reprioritization will be warranted.

It is likely that with a combination of heightened risk and depleted resource, there will be a greater willingness, at least temporarily, by a supervisory authority to countenance low or moderate risks. This is a rational response by a supervisor with stretched capacity.

While re-assessment of risk tolerances sounds like a theoretical exercise and a distraction, it is something that all supervisors under pressure will find themselves doing de facto. Using a coherent framework allows a more thorough and rigorous process and provides staff with a clear rationale for what they are being asked to do.

It is important that changed tolerances and priorities are discussed with, and agreed by, key stakeholders such as the central bank and perhaps the finance ministry. Significant changes need to be approved by the supervisory authority’s governing board and to be documented. Tolerances for risk are unlikely to be time invariant. In the event that the situation triggering the BCP remains in place for any significant period of time, tolerances need to be monitored and where appropriate, re-evaluated.


Supervisor A is facing a heightened risk of failures of one or more systemically important institution as a result of the effect of the COVID-19 outbreak at a time when its own staff resources are also depleted through sickness and may become more so.

In these circumstances, it may decide that it continues to have zero tolerance for: a) the systemic consequences of the failure of high-impact firms; and b) systematic and significant financial crime (which could flourish in the current climate). It is, however, willing temporarily to countenance a change in its tolerance of a number of issues – minor conduct infringements; failure to submit certain returns on time; failure by licensed institutions fully to meet training and competence requirements for staff; and a failure by firms to meet certain aspects of the corporate governance code. The tolerances for all these are reclassified from low to moderate with a corresponding adjustment to resource allocations.

These explicit changes in tolerance and the consequent change in the supervisor’s stance are a rational response to the need to prioritize in the light of the virus-related pressures it is facing. The changes are monitored closely with a formal review at least monthly.

8. Scenario test the possibility that the crisis will deepen or be more protracted than expected with further impacts on risks and the availability of resources. Consider how prioritization would need to be adjusted in that event.

Once the supervisory authority has established its agreed modus operandi to deal with the crisis, there remains the possibility that it may intensify in severity or duration. Market conditions, in terms of asset prices, liquidity, and potential credit delinquencies may deteriorate. Operational strains may mean that regulated firms are still less able to function and/or the supervisory authority itself may come under further operational strain. Unscrupulous market participants who have previously been regarded as being low risk may see opportunities to take advantage of disruption to create detriment to consumers.

While it is clearly not possible to anticipate all possibilities, a high-level scenario-based exercise should be undertaken to address the questions:

  • How might existing risks intensify as the crisis evolves?
  • What new risks might emerge? Are there any that we are already starting to see?
  • Are supervisory measures already undertaken having the desired effect?
  • How would we respond if our operational capacity was reduced by a further, say, 10%?
  • How would we respond if one or two major firms ran into serious solvency or liquidity issues?
  • What would we do if a group of the firms or activities to which we are now devoting less resource emerged as a major source of risk to our objectives during the crisis?
  • How would we respond if the crisis lasted for lasted for six months, possibly morphing into other forms?


The executive of a supervisory authority brainstormed these issues, considering the implications of having 10% and 25% fewer staff resources at any given time in the next two months as a result of the COVID-19 outbreak. Their conclusion was that the highest-impact firms remain the top priority and that in any current foreseeable circumstances, available resources would continue to be diverted from lower-impact ones and lower-priority tasks. The high-impact firms would be asked to share the results of their own planning for similar contingencies as well as the possibility that the effects of the virus could still be present in three and six months. A team was meanwhile created within the supervisory body to oversee smaller firms and issues and to monitor the risks arising from these.

This strategy was developed with the following caveats however:

  • Any such solution would be strictly temporary and subject to a formal regular review.
  • One of the BCP team will be asked to undertake a weekly roundup of changes to major firms’ financial strength and resilience, and the measures being taken in the face of any deterioration in these.
  • In the event that groups of lower-impact firms or issues began (collectively) to pose risks comparable to those of systemic ones, the comparative risks would be weighed with the possibility of re-diverting resources if necessary.
  • A commitment was made to undertake a fundamental review of the revised arrangements in one month to take stock. At that time, the crisis will be abating, remain unchanged, or be set to continue. In any of these cases, the amended arrangements would need to be reviewed thoroughly.
 9. Be alert to unexpected consequences of the crisis and their implications for the wider economy and financial system, as well as for your statutory objectives, and inform those that need to know.

All crises have unanticipated consequences, some of which will extend beyond the immediate remit of supervisors. Some firms may become excessively risk averse with consequences for the wider financial system and perhaps for financial inclusion to the extent that some groups are unable to access their services. Or there may be an interface between developments in the financial sector and other statutory requirements. Disruptions in the insurance sector may make it impossible for drivers or employers to obtain or keep statutory insurance cover, with potentially serious social and economic consequences. Financial firms themselves may be unable to secure or maintain necessary professional indemnity cover. Interactions among various authorities involved in financial stability making decisions on matters such as loan guarantees, macroprudential buffers, and provision of central bank liquidity, may not be perfectly coordinated, leading to unexpected consequences or conflicts.

Such unexpected outcomes may be helpful or unhelpful from a supervisor’s perspective. An increase in risk aversion by supervised firms for example may, in a narrow sense, be a welcome development to a supervisor who does not have financial inclusion within their formal remit. The release of capital buffers by macroprudential authorities on the other hand may be justified on systemic grounds but will have the effect of eroding some individual firms’ capital positions. Unanticipated or unintended outcomes should not be ignored. There should be effective communication channels with other stakeholders whose remits extend to the wider economy or macroprudential stability. This will enable supervisors, who will often be the first recipients of intelligence regarding market-wide trends, to pass information on even if it does not relate directly to their responsibilities. Such communication should contribute to better coordinated policy actions.


In the course of daily conversations with high-impact banks during the COVID-19 crisis, it became apparent to the supervisory authority that they are rapidly ‘de-risking’ in responses to the outbreak, and this includes withdrawing facilities from a number of smaller financial service providers. Similar stories have been heard, albeit in a fragmentary way, from individual providers themselves. This development could prove quite detrimental to a number of smaller market participants who rely on the services of small local firms.

The supervisory authority does not have a formal remit for financial inclusion or access and the behaviour of the banks is, from a narrow risk perspective, quite rational. There is however a mechanism in which market intelligence of this kind (‘straws in the wind’) can be reported upwards within the supervisory authority and thence to a wider coordinating authority that includes the macroprudential authority and finance ministry.

10. Do not lose sight of wider issues such as climate change, financial inclusion, and gender equality.

In dealing with a crisis, supervisors will rightly be focused on very immediate issues concerning the ability of firms to continue to operate and the ability of consumers to reliably access financial services. It is important to bear in mind however that decisions made in crisis mode may have wide and long-term implications that may impact on matters that are important in the long term if not immediate to the crisis itself. There is a risk that other such matters will be ignored during a crisis. This is likely to become more of a problem as any crisis or episode requiring the use of BCP becomes more protracted. Supervisory authorities should take the opportunity of their regular reviews of how their BCP and crisis management are functioning to take stock of these wider issues. Important initiatives should not be abandoned because of a crisis even if they are subject to wider prioritization.


Prior to the onset of the COVID-19 crisis, supervisory body A was working with a group of financial institutions to develop a set of disclosures that would provide customers and investors with meaningful information about climate change-related financial risks.

Despite the importance of this project, it was decided to put it, along with a number of other projects, on hold from the onset of the crisis. It was formally recorded, as part of the general prioritization strategy agreed with the board that the project would be resumed if possible two months after the onset of the crisis and that this would certainly take place within four months.



Bank for International Settlements. Measures to Reflect the Impact of COVID-19. April 2020.


European Banking Authority. EBA Provides Additional Clarity on Measures to Mitigate the Impact of COVID-19. April 2020.


International Monetary Fund. Maintaining Banking System Safety Amid the COVID-19 Crisis. April 2020.


Toronto Centre. Risk-Based Supervision. March 2018.


Toronto Centre. Implementing Risk-Based Supervision – a Guide for Senior Managers. July 2018.


Toronto Centre. The Development and Use of Risk-Based Assessment Frameworks. January 2019.


Toronto Centre. Turning Risk Assessments into Supervisory Actions. August 2019.


Toronto Centre. Business Continuity Planning for a Supervisory Authority. April 2020. https://www.torontocentre.org/index.php?option=com_content&view=article&id=100:usiness-continuity-planning-for-a-supervisory-authority&catid=11&Itemid=99



[1] This Note was prepared by Paul Wright.

[2] A number of global bodies have issued guidance and other notes concerning policy responses to the COVID-19 crisis. See references at the end of the document.

[3] See Toronto Centre (2020).

[4] See for example Toronto Centre (2018a)

[5] For a discussion of thematic and horizontal work see Toronto Centre (2018a).

[6] See for example. Toronto Centre (2018b).