Operations and Regulation of the Credit Rating Industry

1. Operations and Regulation of the Credit Rating Industry Dec 16th 2008, Sanya, Hainan Island, China Jorge Mina jorge.mina@riskmetrics.com Alan Laubsch alan.laubsch@riskmetrics.com

2. Agenda • Background • CRA’s and Structured Finance Markets • IOSCO’s Code of Conduct • European Commission Regulation • SEC Rules on NRSRO’s and Credit Ratings • Portfolio Perspective • Integral Risk Management • Final Observations and Recommendations

3. Brief History • Significant growth in subprime lending starting in 2000 • Home values started declining in the second half of 2006 leading to increased delinquencies and defaults • Losses on loans had a direct adverse impact on market values and liquidity of RMBS and CDO’s lined to subprime loans • The subprime crisis spread to the broader credit market first and then to the economy as a whole • Mortgage brokers, loan originators, underwriters, and credit rating agencies (CRA) involved in subprime deals have come under scrutiny for their role in the build up of this market

4. U.S. Housing Bubble Burst & MBS issuance Source: BBC News

5. $10,000 $9,000 300% $8,000 $7,000 $6,000 250% $5,000 Federal Debt ($ bil) $4,000 200% $3,000 $2,000 Percent of GDP 150% $1,000 $0 100% 1938 1942 1946 1950 1954 1958 1962 1966 1970 1974 1978 1982 1986 1990 1994 1998 2002 2006 50% 0% 1947 1963 1975 1991 1943 1955 1959 1967 1971 1979 1983 1987 1995 1999 2003 2007 1951 Total Consumer Debt Total Federal Debt Tremendous growth in private sector leverage Federal and Consumer Debt as % of GDP 2 • Government Debt 1 (1) Office of Management and Budget, Budget of the United States, FY 2007 (2) U.S. Chamber of Commerce as of 8/27/08 Source: P. Olivier Sarkozy, The Carlyle Group, “Overview: Financial Services Industry - What Went Wrong & What Does it Mean?”

6. Broad bank leverage globally

7. This cycle is unique with unprecedented leverage globally • Multi-reference structured credit products like CDO’s made it easy for investors to put on a huge amount of leverage • Basel 2 rules only require banks to put aside 0.56% regulatory capital for AAA securities… implies leverage of almost 200x. • $2.3 tril in “AAA” guarantees supported by six monoline insurers with less than $20 bil in equity (0.8%). Source: Pershing Square Capital Management. “How to Save the Bond Insurers,” 11/07

8. CRA’s and Structured Finance Markets -- Issues • Excessive Reliance on Ratings by Investors • In structured products ratings are often not only viewed as a CRA’s opinion on its creditworthiness, but also as a stamp of approval (despite CRAs disclaimers) • Lack of information on the structures makes it difficult to make an independent assessment • Non-sophisticated investors don’t have the capabilities to make an independent assessment of the credit risk inherent in these securities • Sophisticated investors might have the capabilities, but find it expensive to independently validate the CRA’s work • The “originate-to-distribute” model eliminates incentives for mortgage brokers, loan originators, issuers, and underwriters to perform an independent risk assessment • Investors do not seem (even now) very keen on taking more responsibility for the risk assessment of these securities

9. CRA’s and Structured Finance Markets -- Issues • Conflicts of Interest • A potential conflict of interest arises through the “issuer pays” model • The potential for conflict is greater in structured products • Concentration: the volume of deals from a single institution is often large and could result in a concentrated revenue stream from a single issuer • Advice to achieve a rating: CRAs provide information allowing arrangers to understand the link between model outputs and rating decisions with respect to the credit enhancement required to support a particular rating. Arrangers can consider the feedback and determine independently to make changes as long as the feedback process doesn’t turn into advise from CRA’s as to how to attain a desired rating • One alternative to the “issuer pays” business model is to have issuers pay, but investors select how to distribute rating fees across CRA’s (similar to equity research)

10. CRA’s and Structured Finance Markets -- Issues • Competition • Information on structured finance transactions is less transparent making unsolicited ratings more difficult to provide. The same information should be made available to all accredited CRAs • Without unsolicited ratings new entrants have no opportunity to establish a track record • “Rating shopping”: issuers often ask CRAs for prospective assessments on structures before hiring them. Since issuers have clear incentives to seek the highest rating, this practice leads to claims that competitive pressure leads to ratings inflation

11. CRA’s and Structured Finance Markets -- Issues • Transparency • Structured finance products are complex and they should be treated as such • Not differentiating between ratings of structured products and ratings of bonds can be confusing to investors • The risk profile of a structured product is very different from the risk profile of a plain vanilla bond • A bond either defaults or does not default so the credit loss profile can be reasonably well understood and distinguished from that of other bonds by a single number (or notch on a rating scale) • Losses on a structured product depend on how many of the individual underlying loans default over a particular period of time. This means that two structured products can have the same average losses, but very different loss distributions. • In other words, a single number (or notch on a rating scale) cannot capture the entire risk profile of a structured product making it difficult to compare similarly rated structured products and bonds • Model assumptions have to be disclosed and explained • Provide additional information to understand better the full risk profile. Some options are margin of error, volatility of ratings, and analysis of extreme scenarios

12. CRA’s and Structured Finance Markets -- Issues • Quality of Ratings • Rating structured finance products requires more sophisticated analysis than rating single name securities • In particular, one needs to model default correlations • Ex-post the assumed correlations turned out to be very low. The assumptions going into the models need to be refined and disseminated so market participants can understand them • Potential conflict issue? Issuers typically retain the equity tranche and sell the senior tranche. With lower assumed correlations senior tranches appear to be less risky and equity tranches appear to be riskier.

13. Regulatory Response • The regulatory response has been quick and informed by recommendations from IOSCO, CESR, ESME, Financial Stability Forum (FSF), and the President’s Working Group on Financial Markets • There are three main bodies of regulatory work so far: • May 2008 -- IOSCO publishes a revision to the Code of Conduct Fundamentals for Credit Rating Agencies (not strictly regulatory, but all rating agencies have pledged to follow the code of conduct) • Nov 2008 – European Commission publishes a final proposal for a Regulation of the European Parliament and of the Council on Credit Rating Agencies • Dec 2008 – SEC publishes amendments and new rules relating to Nationally Recognized Statistical Rating Organizations and Credit Ratings • The rules are not identical, but there is significant overlap in the three documents. • IOSCO’s Code of Conduct is widely considered the global benchmark, but the actual regulations are more specific in certain areas

14. IOSCO’s Code of Conduct – Highlights • Quality of the Rating Process • CRAs should adopt measures so that the information used to assign ratings is of sufficient quality • CRAs should review the feasibility of rating structures materially different from the ones they currently rate • CRAs should determine whether existing methodologies and models are appropriate for a certain type of structure product (including the underlying securities) • Integrity of the Rating Process • CRAs should prohibit analysts from making recommendations regarding the design of structured products they rate • CRAs Procedures and Policies • A CRA should disclose if it receives 10 percent or more of its annual revenue from a single client • CRAs as an industry should encourage structured finance issuers and originators to disclose all relevant information regarding those products so other parties can perform independent analyses

15. IOSCO’s Code of Conduct – Highlights • Transparency and Timeliness of Ratings Disclosure • CRAs of structured products should provide sufficient information about its loss and cash flow analysis to understand the basis for the CRA’s rating. Sensitivity analysis of rating assumptions should also be disclosed • CRAs should differentiate ratings of structured finance products from traditional corporate bond ratings • CRAs should assist investors in developing a better understanding of what a credit rating is (including its limitations)

16. European Commission Regulation – Highlights • Three main objectives. Ensure that: • Credit ratings are not affected by conflicts of interest • Credit ratings are of high quality • CRAs act in a transparent manner • Requirements are similar to (in fact based on) IOSCO’s Code of Conduct, but it provides an enforcement mechanism by establishing a registration and surveillance framework • CRA’s have to register so that their ratings can be used for regulatory purposes by credit institutions, investment firms, insurance companies, UCITS, and pension funds established in the European Union • Registration is separate from the existing process to be authorized as an External Credit Assessment Institution (ECAI) for the purposes of the Capital Requirements Directive (CRD) for banks

17. SEC Rules on NRSRO’s and Credit Ratings Highlights • Final Rules • New disclosure requirements to Form NRSRO • Transition statistics (including defaults) for 1, 3 , and 10 year periods • How much verification is performed on securities underlying structured finance products • How assessments of the quality of originators affect credit ratings • More detailed information on the surveillance process and differences vis-à-vis initial ratings • NRSRO’s have to make publicly available a random sample of 10% of their issuer-paid ratings and their histories in XBRL no later than six months after the rating is made • Recordkeeping: NRSRO’s need to maintain records of rating actions, the rationale for differences between a rating implied by a quantitative model and the final rating, and any complaint regarding the performance of a credit analyst in determining, maintaining, monitoring, changing, or withdrawing a rating • NRSRO’s are prohibited from issuing ratings where the NRSRO or an affiliate made a recommendation as to how to attain a specific rating

18. SEC Rules on NRSROs and Credit Ratings Highlights • Proposed Rules • NRSROs would have to disclose 100% of their current issuer-paid ratings in an XBRL format 12 months after the action is taken (to protect CRAs data businesses) • NRSROs would be prohibited from issuing a rating for a srtuctured finance product paid for by the issuer, sponsor, or underwriter unless the information provided to the NRSRO to determine the rating is available to other NRSROs • Proposals still under discussion • Differentiation of ratings for structured products from those for traditional bonds • Elimination of references to NRSROs from certain SEC’s rules and forms

19. A Portfolio Based Perspective of Credit Risk is Essential 18 18.5 19 19.5 20 This simulation output shows the distribution of credit portfolio 99.5% VaR Expected loss 99.5%Exp. Shortfall One standard deviation Horizon value if norating changes Expected horizon value Portfolio value at 1 year horizon High chance of small gain with a small chance of catastrophic loss

20. Correlations are primary drivers of systemic risk • Higher correlations increase systemic (non-diversifiable) risk

21. Correlations & loss distribution • Higher correlations increase capital requirements, since more counterparties tend to default at together

22. Did VaR forecast the U.S. Subprime crisis?

23. Responsive VaR estimators provided ample time to hedge…

24. An Integral Approach to Risk Management • It’s clear we need more than quantitative models to manage risk “We will never have a perfect model of risk. “ Alan Greenspan “Risk Management is a combination of art and science.” Stephen Thieke • "Integral" means “balanced, comprehensive, interconnected, and whole” • We will apply Ken Wilber’s Integral AQAL (All Quadrant All Levels and Lines) approach to highlight essential components of a strong risk management process • Quadrants • Lines • Levels

25. Integral Risk Management: All Quadrants “I” Individual “It” Objective/Exterior Subjective/Interior Collective “We” “Its” • Ratings • Measures • Data • Integrity • Ability to question • Regulations • Systems • Processes • Policies • Organization • Culture of risk management • See Ken Wilber, “A Theory of Everything”

26. 1. Pre-conventional: Primal Emphasis on return Risk taking driven by gut instinct and emotions: subjective view of risk Actions and thinking dominated by principals Focused on pieces (positions), not the whole (portfolio) 2. Conventional: Rules Based Classification of risks (operational, market, credit, liquidity, etc.) Implementation of standardized risk measures Risk controlled with policies, procedures, and limits Hierarchical organization with clearly defined roles, including risk management function Focus on quantifying, controlling, and minimizing risk: objective view of risk 3. Post Conventional: Integral Proactive culture of risk management throughout the organization Constant engagement and discussion about risk Harness intelligence both within and outside the organization Risk viewed as both danger and opportunity Enterprise & portfolio perspective, not just position level Flex flow, constantly evolving and improving Blend of art and science: subjective + objective Levels: 3 Stages of Risk Management

27. The Cycle Of Risk Management Identify Manage Measure • Risk management is a continuous process of identifying, measuring & monitoring, and managing risk. • The process begins with risk identification • One of the most crucial targets is the identification of hidden risk concentrations… Risk managers need to be perceived like good goalkeepers: always in the game and occasionally absolutely at the heart of it, like in a penalty shoot-out. Source: Economist.com, Confessions of a Risk Manager

28. Final Observations and Recommendations • Structured products are very complex and additional information is required to understand their credit risk profile • Portfolio effects (correlations) are very important. Correlation assumptions need to be disclosed together with sensitivity analysis • Embedded leverage in the structure has to be well understood by investors • Sensitivity of ratings changes with respect to model assumptions and credit scenarios would be helpful • Credit ratings only measure risk due to credit events, investors also need measures of mark-to-market and liquidity risk • Understanding the underlying securities is critical since securitization markets face information asymmetries that encourage lax lending • Originators often don’t have incentives to perform strong due diligence on the underlying loans • Loans with FICO scores of 620 or above were highly likely to be securitized. It has been shown1 that subsequent loan performance was worse for loans slightly above the 620 threshold compared with loans where the score was slightly below 620 1Keys, B J, T K Mukherjee, A Seru and V Vig (2008)

29. Final Observations and Recommendations • Sponsors of structured products should disclose all relevant information to CRAs and as much information as possible to investors • All CRAs should have access to the same information regardless of whether they are retained to rate a specific product • Information about the structure and the pool of underlying assets should be made available in machine readable format • Disclaimer: The views in this presentation are that of the authors and may not necessarily reflect those of RiskMetrics Group.

30. Questions? www.riskmetrics.com asia@riskmetrics.com Tel. +65 6826 9333

31. RiskMetrics Group: One Company/Multiple Capabilities • We help investors better understand and manage risk across a broad spectrum • RiskMetrics Group offers industry-leading products and services in the disciplines of risk management, corporate governance and financial research & analysis • RiskMetrics – a leading provider of quantitative risk management and portfolio analytics • ISS Governance Services – a leading provider of corporate governance and proxy voting services • Financial Research & Analysis – a leading provider of forensic accounting, legal and regulatory research

32. Addressing a Broad Spectrum of Risk • Proxy Analysis • Proxy Voting • RREV • Global Proxy Distribution • Securities Class Action Services • RiskManager • CreditManager • Risk Measurement • Data Services • Portfolio Reporting • Accounting Research • Legal Research • M&A Research • ES&G Research • Data & Analytics RiskMetrics Group views risk through a wide lens, enabling clients to make more informed decisions based upon multiple points of risk insight and a more complete risk management solution. RiskMetrics Group