José Manuel Campa interview with El Mundo: For Member States to be the worst enemy of the single market is unacceptable

José Manuel Campa (EBA): ‘For Member States to be the worst enemy of the single market is unacceptable’

The former Secretary of State under the Spanish Socialist party calls on the European Commission for a ‘firm’ decision on the Government’s interventionism in BBVA’s Sabadell takeover bid. He acknowledges his concern about cyberattacks from foreign governments and thinks there may be a ‘reputational’ risk in banks selling cryptocurrencies.

José Manuel Campa is already counting down his last two months as Chairperson of the EBA (the European Banking Authority). He has revealed that he will be returning to Madrid with his family three years before his term expires in 2029, citing personal reasons. He has not disclosed any more than that. From his office in Paris, the former Secretary of State for the Economy under Rodríguez Zapatero’s socialist Government defends the need for a banking union above all else, even above the individual discretion of Member States such as Spain, where the executive power led by Pedro Sánchez did everything possible to block BBVA’s attempted merger with Banco Sabadell. With that episode now over, Campa points out that Spain is a ‘hostage’ of its history of brutal consolidating its savings banks; consolidation is a job already done and means that further mergers between banks in the future are not necessary.

QUESTION. This coming January will mark one year after the entry into force of the European Digital Operational Resilience Act (DORA), which focuses on tackling potential operational failures of financial institutions by investing in technology. Would you say that DORA has now been fully implemented?

ANSWER. DORA has two components: firstly, how banks manage the procurement of new technologies internally, a component which has been operational since January; and secondly, the supervision of providers considered critical to the financial industry. This week we have just named the operators we consider critical in the European Union. We have designated 19 providers. The process of directly supervising these critical providers is starting now. This involves technology companies, cloud service providers, data storage providers or telecommunications companies which provide the software that communicates with the financial companies.

Q. Are those suppliers European or are they also American?

A. No. In fact, the vast majority of them are not European. They are major global providers, either American or from other countries such as Japan. Some of them have operational subsidiaries in Europe and others do not, and we designate the parent company as the critical operator. This rule was put in place firstly precisely because there were providers which had so much power that individual financial operators were not in a position to negotiate with them if they wanted to make any adjustments to the service. These operators have a very high relative market power and certain critical services are also highly concentrated between two or three providers, this being the case for cloud services and for data storage.

Q. This leads me to two more questions, questions that were being asked a couple of weeks ago after the fall of Redsys in Spain. One: is Spanish bank customers’ data at risk because it is ultimately in the hands of the Americans? And two: is it necessary to create a European provider to ensure that this data complies with European regulations?

A. It is precisely DORA that delivers this. One of the requirements imposed on these critical providers is that they must have an entity or representative in Europe against which we can take action if any measures need to be taken under European Union law. And as for customers’ data, this is not something specific to the financial sector. There are two levels at which this should be corrected and assessed. First, each bank must do so individually (some have private clouds, others have shared clouds); it is up to each institution to assess whether or not their data is secure. And then, indeed, there is a strategic dependence on Europe for many of these services. That is a fact.

Q. There has been a noticeable effort by national banks to run awareness-raising campaigns about the ever-more-frequent scams targeting their customers through their mobile phones. What level of risk of cyberattack is the financial system in Europe facing?

A. We distinguish between three types of risks. One is what we call an operational risk, which is basically the threat of something going wrong in the system. For example, similar to what happened with the ‘blackout’ in Spain, if we can compare that. Another risk is ‘cybercrime’, carried out either against customers or against institutions directly. And a third one, which we are now quite concerned about, is a ‘cyberwar’ or ‘cyberwarfare’ in the current tense geopolitical context, potentially carried out by a foreign government or foreign entity. Even though the attacks have increased, both in terms of operational risk and attacks on institutions, their economic impact nevertheless remains small. Institutions have the ability to defend themselves against these, or at least they have been lucky in the sense that these attacks have not been very effective. But to answer your other question, fraud against end customers (such as phishing or identity theft) has increased and is becoming more sophisticated, and this is worrying. It is a continuous struggle, and institutions actually spend a very significant amount on preventing such attacks. However, on our map of general risks, the greatest risk is the geopolitical one.

Q. Are there more attacks from this geopolitical profile than from others?

A. In Europe, there has been a higher prevalence or greater perception of institutional attacks or attacks related to geopolitical tensions, particularly in the Nordic countries and in Eastern Europe.

A. What about in Spain?

A. In Spain, operational risks are most prominent.

Q. Digitalisation is key for banks, but will they be able to undertake the large investments in technology that are yet to come alone, without resorting to further consolidation?

A. It is true that these technologies require economies of scale. We have long believed that some degree of consolidation at European level would be good for strengthening the single market. We have quite a few very small banks.

Q. The sector's clear criticism of such consolidation is that it is difficult for pan-European mergers to be profitable and achieve synergies.

A. This is a comment we hear from banks, and obviously for us I don't know if it's a source of frustration or encouragement, but we have to make the single market work, to lay the foundations for that market to be truly integrated and for institutions to see those benefits.

Q. But how can this be achieved?

A. Much has already been done in the banking sector, starting with uniform regulations. We also have the supervision of the European Central Bank (ECB). And then there are certain segments where there is much more integration, as can clearly be seen in corporate banking and business banking – high-level investment, let’s say – where there is a lot of cross-border lending and companies are able to access providers from other countries. Furthermore, as a result of Brexit , we can observe that banks that came from the United Kingdom and established themselves in Europe have pan-European strategies. The consumer finance segment also stands out, where we see large operators, including Spanish ones such as Banco Santander, in practically every country in Europe. Where this consolidation is not taking place is in retail banking, in the mortgages and savings sector, or for SMEs. More than 90% of deposits are still located in banks in each country and there we see little fluctuation. We are seeing a little more consolidation through digital banks, neobanks, although this movement remains rather stagnant nationally.

Q. On this subject, do you think that the growth of neobanks, with strategies that are shared between different European countries, is very high?

A. The reality is that the market penetration rate is relatively very small and it is not that easy. Three years ago, when interest rates started to rise, the pass-through to the remuneration on deposits varied widely across different markets, but Spain was one of the countries where there was the least pass-through of interest rates to the remuneration on deposits. Despite this there was not much penetration either. We thought that with digitalisation there would be more competition, but the evidence suggests there has been little change.

Q. At national level, what interpretation could be drawn from a hostile takeover bid in the banking sector, such as we have seen here in Spain or in Italy?

A. That it is more difficult for hostile takeover bids to succeed. Frankly, what was most important was the validity of the proposed project and that the banks, which are carrying on their operations separately, continue to have attractive and stable projects. What is most important from our perspective is that the system is robust. From a system-wide perspective, such a move was ‘good to have’, but not ‘need to have’; in other words it was positive, but not necessary.

Q. Now that the BBVA-SabadelI takeover bid is done with, the market is already looking at mergers between medium-sized institutions. Do you think this is necessary?

A. In Spain, we are hostages of our past and we have experienced a huge process of market concentration since 2o1o. This process has had two positive outcomes: firstly, the best have triumphed over the worst, meaning that the resulting entities were better than those that existed before. That is the first thing you should wish for from a consolidation process. Secondly, this concentration process has generated stability and competition. Therefore, I do not agree with this idea that mergers should happen just for the sake of it. Spain already has a fairly concentrated sector, above the European average.

Q. The European Commission brought infringement proceedings against Spain for its excessive interventionism in somehow sabotaging the takeover bid launched by BBVA. What outcome do you expect from this?

A. From our point of view, what is key is that we need to work towards an integrated market in Europe. This market has to be compatible with there being sufficient guarantees of financial stability and competition in the different markets in each country, and here the national authorities have an important role to play. But for Member States to be the worst enemy of the single market is unacceptable. In other words, if actions are taken to try to put barriers in the way of single market integration, this cannot be allowed. I believe that this is where the European Commission must be very firm; if there are no legitimate concerns about financial stability or competition, governments should not be able to block the market.

Q. Europe, including Spain, is experiencing a real ‘boom’ in house prices. Banks in our country have decided, in some cases, to compete on price; and many are experiencing a significant upturn in lending volumes. Does this worry you?

A. Spain is not the country in Europe where the market has grown the most, either in terms of volume or price. There is the example of the Nordic countries. In the last year, mortgage lending has grown by 2% in Europe, in line with economic growth, so it has happened in a rational way. In countries such as Austria they have implemented macroprudential measures.

Q. The Bank of Spain has already launched a debate on how to implement these measures, known as ‘borrower-based measures’ (BBM). What kind of limits might we be talking about in the granting of mortgages?

A. In many countries, limits have been placed on the loan-to-value ratio (the amount of the loan relative to the value of the property), fixing it at no more than 80%, for example. This is already common practice in Spain.

Q. Cryptocurrencies. Now that banks are starting to offer them, do you think this is something that will become widespread?

A. We distinguish clearly between two types of products: cryptocurrencies and cryptoassets. The former are 100% backed by a reserve (in a currency, etc.), while the latter have no underlying foundation. This means that we still believe that investing in cryptoassets is very risky. There are two projects in Europe involving large banking consortia which are going to move forward with creating cryptocurrencies. But with regard to cryptoassets, we remain quite sceptical about banks advising on the purchase of these products, because we believe that they are products where you can lose all your money and that they could have a reputational cost for banks. Frankly, we have seen little activity in this area. There is no mass commercialisation of such products.

The interview was conducted by Laura de la Quintana

El Mundo (Spain)