9.5 Why Regulatory Arbitrage Happens
Regulatory arbitrage means putting an activity where the rules are lightest, even though the economic risk is the same. It pays most with capital rules, because holding less capital frees up money to lend. Basel III answers with layered measures, each closing a known game: a 4.5% CET1 minimum plus a 2.5% buffer, a 100% liquidity coverage ratio and net stable funding ratio, a leverage ratio and a 72.5% output floor.
Why it matters: A rule is only as strong as its loopholes, so each new layer shuts a specific one.
Summary: Regulatory arbitrage is placing activity where rules are lightest for the same economic risk, and capital rules are where it pays most. Basel III answers with layered measures, a 4.5% CET1 minimum plus a 2.5% buffer, a 100% LCR and NSFR, a leverage ratio and a 72.5% output floor, each closing a known game.
- A bank under Basel rules as the EU applies them, with $12 billion of CET1 on $120 billion of modeled RWA, has a 10.0% ratio and $3.6 billion of loss before payout limits start.
- The minimum is breached at a $6.6 billion loss; at $4 billion, payouts are capped at 60%.
- If models cut RWA to $100 billion, the output floor resets it to $116 billion, adding $1.12 billion to required capital; US rules have no such floor and would rate this bank on standardized RWA at 12 ÷ 160 = 7.5%.
- The example bank’s LCR is 134.7% and its NSFR 134.1%.
- US calibration swung from a 16% CET1 increase (2023 proposal) to a 5.0% decrease for the largest holding companies (2026 re-proposal, with related proposals).
Regulatory arbitrage is the practice of structuring a business, a transaction, or an entire operation specifically to take advantage of differences between regulatory regimes — locating a trading desk, a legal entity, or a fund structure in whichever jurisdiction imposes the lightest capital, compliance, or tax burden for a given activity. This is a direct, largely unavoidable consequence of the absence of one single global financial regulator: as long as meaningfully different rules exist across borders for economically similar activity, some participants will rationally locate that activity where the rules are least burdensome.
Capital rules are where arbitrage pays most, so Basel III layers several measures. Common Equity Tier 1 (CET1), mainly common shares and retained earnings, must be at least 4.5% of risk-weighted assets (RWA) (Tier 1 6%, total capital 8%), plus a 2.5% capital conservation buffer that caps dividends, buybacks and bonuses when breached (for large US banks, a stress capital buffer). The liquidity coverage ratio (LCR), high-quality liquid assets (HQLA) divided by net cash outflows over 30 stressed days, must be at least 100%, as must the net stable funding ratio (NSFR), available stable funding divided by required stable funding. Each anticipates a game: a leverage ratio ignores risk weights, and the output floor stops RWA from internal models falling below 72.5% of the standardized figure (phased in to 2028).
A bank under the full Basel III standard, as the EU’s CRR3 applies it to banks that use internal models (USD billions for comparability): assets $200, CET1 $12, modeled RWA $120, standardized RWA $160; liquidity factors from the Basel standard, including its 3% rate for insured stable retail deposits, which US rules also use. Pillar 2 add-ons and other buffers are left out.
| Measure | Formula → substitution | Result |
|---|---|---|
| CET1 ratio | 12 ÷ 120 | 10.0% vs 7.0% (4.5% + 2.5%) |
| Output floor | max(120; 0.725 × 160 = 116) | Not binding: RWA stays 120 |
| HQLA | Reserves 20 + 85% × Level 2A bonds 5 | 24.25 |
| Stressed outflows | Stable retail 100 × 3% + other retail 40 × 10% + uninsured corporate 30 × 40% + financial 5 × 100% | 24.0 |
| LCR | Inflows 6 (below the cap of 75% × 24 = 18), so 24.25 ÷ (24 − 6) | 134.7% |
| NSFR | Stable funding 171 ÷ required 127.5 (qualifying mortgages 80 × 65% = 52 is the largest need) | 134.1% |
If the bank tunes its models to RWA of $100, the floor bites: RWA = max(100; 116) = 116, so CET1 is 12 ÷ 116 = 10.3%, not 12.0%, and required capital at 7% is $8.12, not $7.0.
A US bank could not use this floor. US rules have no 72.5% output floor: a bank of this size computes its ratios on standardized RWA only, and the largest banks, which may use models, must report the lower of the standardized and modeled ratios (12 CFR 217.10(d)), in effect a 100% floor. Under US rules this bank’s CET1 ratio is 12 ÷ 160 = 7.5%, not 10.0%.
Same bank, RWA fixed at $120 billion, losses deducted from CET1; payout limits from the Basel capital conservation table (US rules, 12 CFR 217.11, use the same quartile limits).
| Scenario | Loss | CET1 ratio | Buffer left | Payouts allowed |
|---|---|---|---|---|
| Mild | $1.5bn | (12 − 1.5) ÷ 120 = 8.75% | 4.25% | Unrestricted |
| Moderate | $4.0bn | (12 − 4.0) ÷ 120 = 6.67% | 2.17% | Up to 60% of eligible income |
| Severe | $7.5bn | (12 − 7.5) ÷ 120 = 3.75% | Negative | None; below the 4.5% minimum |
Flip points: payout limits start at a loss of 12 − 0.07 × 120 = $3.6 billion and the minimum is breached at 12 − 0.045 × 120 = $6.6 billion. Losses that also raise RWA (downgraded borrowers) reach both points sooner.
That arbitrage happens is not disputed: Acharya, Schnabl and Suarez (NBER, 2010) found banks structured guarantees to asset-backed commercial paper conduits to minimize capital, and the 2007–09 losses stayed with the banks, securitization “without risk transfer.” The dispute is calibration. Implementing the same Basel text, the US agencies’ July 2023 proposal estimated a 16% rise in CET1 requirements for banks above $100 billion; their March 2026 re-proposal estimated a 5.0% decline for the largest holding companies, with related proposals, and dropped the output floor as unlikely to bind. One side holds that risk-sensitive rules allocate capital better and that higher requirements push lending outside banks; the other that models are the arbitrage channel. The evidence settles that gaming exists, not the right level of capital.
A reading rule for any structure sold on capital relief: if a guarantee, liquidity line or reputational promise keeps the loss with you, the risk has not moved, so hold capital as if the asset were still on the books. Read a CET1 ratio only with its RWA method, floor position and dollar headroom: in the example the real cushion is $3.6 billion of loss, not the 10% headline. The rule does not apply to sales without recourse, which move the risk itself.
Planning distributions on modeled RWA that the floor overrides. Under the Basel floor, a bank that tunes its models to $100 billion of RWA plans to hold 7% × 100 = $7.0 billion of CET1, but the floored requirement is 7% × 116 = $8.12 billion: a $1.12 billion gap that comes out of buybacks and dividends or forces new equity. Plan on the higher of modeled and floored RWA; in the US, plan on standardized RWA, because the reported ratio is the lower of the two.
What is the minimum CET1 ratio under Basel III?
4.5% of risk-weighted assets, plus a 2.5% conservation buffer, so 7.0% in practice before surcharges for systemic banks. A bank inside the buffer can operate but faces caps on dividends, buybacks and bonuses.
What is the difference between the LCR and the NSFR?
The LCR asks whether liquid assets cover 30 days of stressed outflows; the NSFR asks whether long-term assets are funded by stable liabilities over one year. Funding long mortgages with short wholesale money can pass the first and fail the second.
Is regulatory arbitrage illegal?
Usually not. Choosing a lighter-touch jurisdiction or structure is lawful; it becomes misconduct when the structure misstates risk to regulators or investors. Regulators respond by closing gaps, as the output floor did.
Regulatory arbitrage follows differences in rules for the same risk, and Basel III answers with layered measures: a 4.5% CET1 minimum plus a 2.5% buffer, 100% LCR and NSFR, a leverage ratio and a 72.5% output floor on modeled RWA, which the US does not use: its rules apply the standardized ratio, or the lower of the two ratios at the largest banks. Read capital as dollars of loss before payout limits and the minimum bite; the evidence shows arbitrage exists, while the right level of capital remains disputed.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. A bank has CET1 of $9 billion and RWA of $100 billion, with a 4.5% minimum and a 2.5% buffer. Holding RWA fixed, at what loss do payout limits begin?
- $2.0 billion
- $4.5 billion
- $2.5 billion
- $7.0 billion
Reveal Answer
Answer: A. Payout limits start when CET1 falls below 7% × 100 = $7 billion, so at a loss of 9 − 7 = $2.0 billion. The minimum is breached at 9 − 4.5 = $4.5 billion.
2. A bank’s internal models give RWA of $80 billion; the standardized approach gives $120 billion. With the 72.5% output floor fully phased in, what RWA applies?
- $100 billion
- $80 billion
- $120 billion
- $87 billion
Reveal Answer
Answer: D. RWA = max(80; 0.725 × 120 = 87) = $87 billion, so the floor binds. US rules have no 72.5% floor: a US bank that models reports the lower of its standardized and modeled ratios, in effect using the $120 billion.
3. A bank holds $30 billion of HQLA, with stressed outflows of $40 billion and inflows of $35 billion. Applying the 75% inflow cap, what is its LCR?
- 86%
- 600%
- 300%
- 75%
Reveal Answer
Answer: C. Inflows are capped at 0.75 × 40 = $30 billion, so net outflows = 40 − 30 = $10 billion and LCR = 30 ÷ 10 = 300%. Without the cap it would wrongly be 30 ÷ 5 = 600%.
4. A bank funds 30-year mortgages with overnight wholesale borrowing but holds ample liquid assets today. Which Basel III measure is designed to catch this?
- The capital conservation buffer
- The net stable funding ratio
- The leverage ratio
- The liquidity coverage ratio
Reveal Answer
Answer: B. The NSFR compares stable funding with the stable funding long-term assets require over a one-year horizon; the LCR only tests 30 days of stressed outflows.
5. Worked problem: A bank has $15bn of CET1 and $150bn of risk-weighted assets. What is its CET1 ratio, and how much headroom is there above a 7% minimum plus buffer?
Reveal Answer
Answer: Ratio = 15 ÷ 150 = 10.0%. Headroom above 7% = $15bn − 0.07 × $150bn = $4.5 billion of loss capacity.
6. Worked problem: After a $2bn loss with RWA unchanged, what is the ratio?
Reveal Answer
Answer: (15 − 2) ÷ 150 = 8.67%.
9.6 The Three Lines of Defense & Risk Governance in Practice
The Three Lines of Defense divide the job of managing risk. The first line is the business, which owns the risk. The second line, risk and compliance, oversees and challenges it. The third line, internal audit, gives independent assurance. It works only when the second and third lines are truly independent in reporting line, pay and standing, and when a breach of limits forces action rather than another report.
Why it matters: A watchdog who reports to the person being watched is not much of a watchdog.
Summary: The Three Lines of Defense split risk ownership (the business), oversight and challenge (risk and compliance) and independent assurance (internal audit). It works only when the 2nd and 3rd lines are independent in reporting line, pay and standing, and when limit breaches force action rather than reports.
- The IIA renamed it the Three Lines Model in July 2020.
- US heightened standards give the chief risk executive unrestricted access to the board at banks of $50 billion or more.
- Credit Suisse saw Archegos at 26.5 times its limit ($530 million vs $20 million) in August 2020 and later lost about $5.5 billion.
- JPMorgan’s London Whale loss of at least $6.2 billion followed raised limits and a non-independent valuation group.
- KRIs warn before KPIs move; a breach needs an owner, a deadline and automatic escalation.
Every regulatory framework covered so far in this Part is implemented, day to day, through one near-universal internal structure: the Three Lines of Defense. Volume I (Parts 8.5 and 11.4) introduced it, together with risk and control self-assessment (RCSA) and key risk indicators (KRIs); this chapter covers what makes it hold under pressure and how it fails. The Institute of Internal Auditors restated it in July 2020 as the Three Lines Model, dropping “defense” to stress that the governing body owns the system and that risk work also enables decisions, not only blocks them.
| Line | Who | Role |
|---|---|---|
| 1st Line | Business operations — the people actually doing the day-to-day work | Owns and manages risk directly, as a natural part of running the business |
| 2nd Line | Risk and Compliance functions | Sets policy, independently monitors the 1st line, and challenges its risk-taking decisions |
| 3rd Line | Internal Audit | Independently assures that the whole system — including whether the 2nd line’s own oversight is effective — is actually working as designed |
Underneath the lines, each business unit runs an RCSA (rating its own risks and how well its controls work, with the 2nd line challenging the scores), and the firm watches two kinds of dials: key performance indicators (KPIs), which report how the business is doing now, and KRIs, which warn that risk is building before any KPI moves, such as rising aged reconciliation breaks, limit excesses or attrition in a control team.
Independence is engineered through three levers: reporting line (who can fire the risk officer), pay (whether it depends on the desk’s revenue) and standing (whether an escalation reaches people who can stop the business). US rules write the third lever down: under the OCC’s heightened standards for banks with $50 billion or more of assets, the chief risk executive must have “unrestricted access” to the board and its committees, and the chief audit executive to the audit committee (12 CFR Part 30, Appendix D). The 2nd line’s own tool is effective challenge, which the Federal Reserve’s 2026 model-risk guidance (SR 26-2) describes as critical analysis by objective experts with sufficient independence and “the organizational standing and influence to effect any change.”
Worked example of a KRI that was seen and not acted on. In August 2020 Credit Suisse calculated its potential exposure to the family office Archegos at $530 million against a limit of $20 million: 530 ÷ 20 = 26.5 times the limit. Prime-services risk, risk management and counterparty credit risk all saw the excess; none forced the margin increase that would have cured it. When Archegos defaulted in March 2021 the bank lost about $5.5 billion; the external review called the risks “identified and … conspicuous” and the loss “the result of a fundamental failure of management and controls.” In July 2023 the Federal Reserve and the UK’s Prudential Regulation Authority fined UBS, Credit Suisse’s new owner, about $387 million combined. JPMorgan’s 2012 “London Whale” loss of at least $6.2 billion followed the same script: limits breached and then raised rather than enforced, and a valuation control group the SEC called “woefully ineffective and insufficiently independent from the traders it was supposed to police” (about $920 million of penalties, September 2013).
A mature risk function is judged specifically on whether it watches KRIs, not just KPIs — because by the time a problem shows up in a KPI, the risk has typically already crystallized into an actual loss or control failure. Naming a real KRI, rather than only citing current performance metrics, is one of the clearest markers distinguishing a sophisticated operational-risk practitioner from someone who only monitors business-as-usual output.
Treat any limit excess as an event with an owner and a deadline, not a number in a report. If exposure exceeds a limit and is not back inside it, or covered by a documented, time-bound approval from the 2nd line, within the period your policy sets (days, not months), escalate to the chief risk officer; if it persists, to the board risk committee. Never cure a breach by raising the limit without a fresh, independent risk assessment. Judge independence by the three levers: if the risk officer’s pay or job depends on the desk, the line is decorative. Small firms may combine roles, but not the trader and the person who values or limits the trader.
Recording a breach instead of resolving it. Credit Suisse’s own systems showed Archegos at 26.5 times its limit seven months before the default; the cost of not acting was about $5.5 billion of loss plus about $387 million of fines, paid after UBS had taken the bank over in 2023. The fix is mechanical: every excess generates a ticket with an owner, a cure date and automatic escalation when the date passes.
Is the three lines of defense model still used?
Yes. The Institute of Internal Auditors renamed it the Three Lines Model in July 2020 and made it principles-based, but the split of roles (business, risk and compliance, internal audit) is unchanged and banking supervisors still expect it.
What is the fourth line of defense?
It is the proposal, in a 2015 Bank for International Settlements paper by Arndorfer and Minto, to treat external auditors and supervisors as a fourth line for banks and insurers, formally linked to the internal three. The paper itself warned that poor information flows among those actors could create new gaps.
Can the chief risk officer stop a trade?
It depends on the firm’s charter, but the principle is that the 2nd line must be able to escalate past the business to the board without obstruction. US heightened standards require unrestricted board access for the chief risk executive; a veto that can be overruled by the desk head is not independence.
The Three Lines split risk ownership, independent oversight and assurance, and they work only when reporting line, pay and standing make the 2nd and 3rd lines independent. Archegos and the London Whale show the failure mode: KRIs and limit breaches seen but not acted on, so every excess needs an owner, a deadline and automatic escalation.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. A desk’s exposure to a client is $90 million against a $12 million limit. How many times the limit is it?
- 7.5 times
- 6.5 times
- 78 times
- 0.13 times
Reveal Answer
Answer: A. 90 ÷ 12 = 7.5. At Credit Suisse the equivalent figure for Archegos in August 2020 was 530 ÷ 20 = 26.5 times.
2. What did the Institute of Internal Auditors change in its July 2020 update?
- It merged the first and second lines into one
- It made regulators the third line of the model
- It renamed it and made it principles-based
- It abolished internal audit as a separate line
Reveal Answer
Answer: C. The update became the Three Lines Model, dropping “defense” and stressing the governing body’s role and value creation, while keeping the roles.
3. Under the OCC’s heightened standards, which banks must give the chief risk executive unrestricted access to the board?
- Those with $250 billion or more of assets
- Those with $50 billion or more of assets
- Only globally systemic banks
- Those with $10 billion or more of assets
Reveal Answer
Answer: B. The guidelines apply to banks with average total consolidated assets of $50 billion or more.
4. A trader’s limit is breached for three weeks, and the desk head raises the limit to make the breach disappear. Which response fits the chapter’s decision rule?
- Log it in the next quarterly risk report
- Accept it, since the breach has now been cured
- Ask the trader to confirm the new limit
- Escalate it for an independent risk review
Reveal Answer
Answer: D. A limit raised to cure a breach without independent assessment is the London Whale pattern; the breach must be escalated with an owner and deadline.
5. Worked problem: A trader approves his own trade and books it. Which line of defense should have prevented that, and which tests it afterward?
Reveal Answer
Answer: The first line (the business, with maker-checker) should prevent it; the second line challenges the control and internal audit, the third, tests it independently.
6. Worked problem: An audit finds 3 control failures in a sample of 60 trades. What is the failure rate, and across 4,000 trades how many failures are implied?
Reveal Answer
Answer: 3 ÷ 60 = 5%; × 4,000 = 200 trades.
- 12 CFR 217.10 and 217.11, US capital rule — Minimum ratios and payout limits
- 12 CFR Part 249, liquidity coverage and net stable funding — LCR outflow rates; NSFR factors
- Federal Register, US capital re-proposal (March 27, 2026) — Calibration debate; no output floor
- Regulation (EU) 2024/1623 (CRR3)
- Basel Framework, RBC (minimums, conservation buffer, output floor)
- Basel Framework, LCR
- Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026) — Effective challenge; AI scope
- Federal Reserve, Credit Suisse/Archegos enforcement (July 24, 2023) — Archegos loss and penalties