Stress testing for banks has become an important element of the preparatory work to ensure their resilience

In its recent report, the National Bank of Ukraine says that the Ukrainian banking sector survived the first months of the war with only modest losses. This resulted from timely actions taken by the NBU and other Ukrainian banks to ensure the smooth operation of financial institutions. We talked to Sergiy Nikolaychuk, Deputy Governor of the National Bank of Ukraine, in early May about how the banking system reacted to a full-scale Russian invasion of Ukraine, what preparatory work had been done in anticipation of the conflict, and what lessons have been learned that can applied after Ukraine wins.

This discussion was chaired by Dmytro Romanovych, Associate Director, Consulting, Government Projects and International Development Projects, KPMG in Ukraine.

The war with Russia has been going on since 2014 so we always anticipated the danger of a full-scale invasion. We prepared in advance and worked jointly with domestic banks to discuss plans for non-stop operation. After the risk of full-scale war increased last autumn, we updated our plans accordingly. We had regular meetings with commercial banks, discussed potential scenarios, and agreed upon potential steps to mitigate issues. However, we never believed that we would have to make those plans a reality.

In the end, sadly, there was a need to put these plans into action and, on 24 February, we started implementing the scenarios we had been working on. That day saw most board members, department directors, and key employees already at work at the bank at 07:00. Owing to the experience we had gained from the events of 2014, we clearly understood what needed to be done in those first days to stop any panic in the foreign exchange market and among depositors, while simultaneously organising the non-stop functioning of the Ukrainian banking system.

Here, we would like to name three main factors. The first is the plans we had available for uninterrupted operations and the effectiveness with which they were implemented, which I have already mentioned.

The second factor was reform of the banking system, something that has already been taking place since 2014. Despite the crisis, Ukrainian banks met the war in a good financial shape: prior to renewed hostilities, local banks demonstrated an all-time high in terms of profit margin and had satisfactory liquidity and capital ratios.

The NBU conducted regular stress testing for domestic banks; an important element of preparatory work to ensure their resilience. Banks worked out different scenarios, both base-line and conservative. They reviewed their weak points and learned the necessary lessons in advance.

The third factor was the regulatory efforts undertaken by the National Bank of Ukraine. On the one hand, the NBU imposed limitations on the national banking system to lessen the probability and that scale of funds and capital outflow from the country, though no market mechanisms could entirely prevent this. On the other hand, the NBU provided total support to banks to help them survive this initial phase.

On 15 February, hackers carried out a powerful DDoS attack against the web portals of several Ukrainian governmental institutions, including the official websites of the Ministry of Defense and the Armed Forces, and the online services of two major state banks: Privatbank and Oschadbank. However, services were almost 100% restored by 19:00 of the same day. These DDoS attacks continued the next morning but by noon both Privatbank and Oschadbank had fully resumed their operations. There were also several waves of attacks against the online services of other banks but none of them lost operability. In less than a day, all Ukrainian banks’ systems had recovered and were running normally, even in the face of continuing DDoS attacks.

Hackers also attacked the National Bank of Ukraine but their attack was neutralised with no extra effort. I would not say that we feel safer now, since attempts to destroy NBU systems and the systems of other banks are still ongoing. However, those attacks have been and continue to be successfully repulsed. All the National Bank’s information systems keep on operating normally, including our official website, our internal network, and the electronic payment system used by other banks.

Since 2014, our crisis plan has included scenarios for mitigating risk and protecting the banking system from DDoS attacks, as well as using the most advanced technologies and cybersecurity solutions to ensure the resilience of the Ukrainian banking system against other cyber risks. The NBU also has a mechanism for exchanging information about cyberattacks between the cyber defence centre of the National Bank and other agencies, banks, financial institutions, etc.

It makes no sense comparing these two situations. In 2014, the Ukrainian banking system was weak and this eventually resulted in a lot of bankruptcy cases. Conversely, the banking system today is strong and well-prepared. Obviously, the situation for Ukrainian banks has deteriorated somewhat since 24 February but we cannot quantify that right now as the situation varies from bank to bank.

The National Bank of Ukraine has initiated amendments to laws that make it impossible to apply measures to punish banks for non-compliance with standards like capital adequacy and liquidity. In this way, we have made it possible for Ukrainian banks to continue their operations even if their standards are lower than regulatory values. It is therefore possible for the banks to keep on lending, even if they suffer losses.

As for liquidity, during the first weeks of the war we had some pressure on the liquidity of banks, primarily because Ukrainians were actively withdrawing cash. However, this trend ended as a result of robust and relatively uninterrupted online banking services. Now, we see individuals’ deposits in hryvnia have increased by about 20% since the start of the war, while corporate deposits began to grow as soon as economic activity started increasing in mid-April.

We are not concerned about the level of liquidity in the banking system, this has actually increased since the beginning of the war. For example, in recent weeks the amount of deposit certificates in commercial bank portfolios has been steady, amounting to around UAH180 billion.

On the first day of the war, the members of the National Bank Board had the idea to open an ear-marked account so that everyone who wanted could transfer funds to support the Armed Forces of Ukraine. We understood that there would be many people who wish to do so, and the NBU has the advantage of a level of associated trust that many fundraising organisations lack.

Since the start of the war, we have accumulated over UAH16.5 billion which we transferred to meet the relevant requests of the National Guard, the National Police, the Ministry of Defense of Ukraine, and the State Border Guard Service. The lion's share of these funds came from common citizens of Ukraine. About UAH5 billion in equivalent came in foreign currencies from abroad.

The first lesson is that banking reforms are working. If you do things that are in line with global practices and expert recommendations, you can make the system much stronger. The reforms that have taken place in the banking system confirm this. After the war, we will continue to implement them.

The second lesson is risk management. You need to be well-prepared for the harshest scenarios. Stress testing banks, which we did every year before the war, proved to be a useful exercise that allowed banks to prepare for renewed conflict.

The third lesson is that the role of digital technologies in our lives is on the rise, and the latest trend towards digitalisation of the banking system over the latest 10–20 years will only intensify. In this context, the matter of cybersecurity is becoming increasingly important.