Corporate Strategy Weekly Radar Update

Week ending Friday 14 Sept 2012 (Changing faces of Cybercrime + Bank Profitability)

Highlights and Insights Financial Services CBA took advantage of renewed optimism in credit markets to complete the largest raising of unsecured debt by a major lender this year. They sold $US3.25b of debt to US investors on the busiest day for global corporate bond sales in 3 years as companies and banks seized on a window of opportunity in markets created by the EU bond-buying plan. o An estimated $30b of global bond sales was executed on Monday following the ECBs announcement it would help finance the EUs over-indebted nations Superannuation: The debate on cutting tax concessions from the $440b selfmanaged super funds (SMSFs) to fund other projects is growing. o Those in favour of reforms flag that over the next 3 years those concessions will ramp up from $30b per year to $45b pa. In comparison funding Gonski's education recommendations = $5b pa, the National Disability Insurance Scheme = $8b-$10b pa. o The industry cautions that Super is a 'long term' scheme requiring stability to not undermine confidence: it is urging the govt to look at tax concessions on all savings products, including negative gearing and interest income, before it changes Super. SUN's Geoffrey Summerhayes articulated this week the opportunity to re-engage disengaged customers through the means they are already captivated by: ie. technology. o G Summerhayes argues that the introduction of low-cost and simplified MySuper products presents a once in a life time circuit breaker that could aid WM companies and Super Funds in reconnecting with customers. He also believes "gamification applying 'game' concepts to non-gaming processes can boost interest and participation in super. A 'serious' concept wildly acknowledged in sectors such as education, and likely to develop. An interesting application of Technology by the Telstra Super ($11b, 100,000 members) now using Tableau software to monitor members to pick those who are most likely to depart and set up their own self-managed funds, for an insight on why and where they are leaving to; o Prompt to investigate this type of analytics in our 'Data strategy' APRA could be provided new powers under new Treasury proposals, to step in and take control of Australias banks, insurers and superannuation funds in the event of a crisis and greater regulatory oversight of foreign banks. o Because of the Too-Big-To-Fail view, since the GFC when authorities believe a financial institution is threatened, a merger or takeover is hastily arranged behind the scenes (St Georges, BankWest, Wizard sold by GE to Aussie Home loans). o The recommendation is to ensure APRA can intervene before crises get out of control, allowing to stop foreign banks shifting assets out of Australia, if parents get into trouble. APRAs powers should also be extended to the super sector. APRA and RBA announced they will depart from Basel III recommendations to trigger higher ' counter-cyclical capital buffer' (hold more capital) if credit-to-GDP increases by more than 2%. Australian regulators think it's too simplistic: instead they will take into account numerous factors, including debt levels, asset prices, credit direction, bank behaviour etc. o A decision in line with Australia's long term goal to be seen as a good global citizen, whilst maintaining sovereignty of regulation. Notable launch of an insurance product (with services) against 'School Bullying' in France (translated: http://pear.ly/nJc2m ) o School Bullying is a visible issue in Australia: a prompt for an Australia insurer to look into it? Financial Services (continued) Tower NZs Bill Falconer stepped down as Chair of the insurer. Tower, which offers direct general, life and health insurance, and investment options, has been undertaking a strategic review of its business following poor market performance, including and considering proposals including operational alliances and divestment of assets." o Although shares gained +20% since the start of the year, Tower believes it does not reflect the true value of the company. Goldman Sachs has been appointed to help identify the best options, with a final proposal likely to be put before shareholders at its annual meeting early next year. o Tower is viewed as a likely target for consolidation in the NZ GI market. However, its diverse range of offerings mean a single natural buyer is not immediately obvious. Other industries Adding to the US drought and dry conditions in Russia putting pressure on food prices (The World Banks Food Price Index soared by 10% in July, Wheat prices by 44% since June) WA farmers face the lowest crops in decades if rain doesn't come (production forecast has been slashed by 39%) o A key environmental trend that could impact finance companies exposed to the Agri sector. Myer reported NPAT of $139.3M (-14.3% yoy), driven by higher wages, occupancy costs and utility bills. o Whilst this result was in line with analysts' forecasts (reflective of the difficulties faced by retailers in general) and despite sales improvement in the 2nd half, the market is concerned with the lack of future guidance or sales targets, which has been interpreted as a sign that Myer is not expecting sales growth to continue. Difficult not to mention the iPhone5: well follow the effect of the missed opportunity for incremental innovation (eg no NFC for peer-to-peer), but a 'visible indirect' cost to consumers due to new connector impacting accessories. Macro Economy, Politics and Regulation 1st Queensland budget of the Newman govt: increase of coal royalties and the deep cuts of public service (Health, Housing Public Works, and Transport) to restore AAA rating: impact of prolonged unrest and tensions in Qld to be monitored The German court approved the creation of the European Stability Mechanism (ESM), the permanent euro bailout fund: it comes with some conditions, including that Germany maintains a veto on all decisions taken by the fund. US QE3: the Fed committed to an open-ended spend US$40B/month to buy mortgage backed securities, with a plan to keep interest rates near zero until mid-2015. Key reasons behind QE3 are the US unemployment, which stuck above 8% for an extended period. o The ECB and Fed actions, by reducing global downside risks, diminish the case for further RBA easing in the short term. The probability of an Oct RBA rate cut declined this week from 50% to 40%. Whilst the market had an immediate positive reaction Dow Jones +240, increases in gold and oil prices the US$ fell and bond prices eased as investors worry that aggressive easing may trigger future inflation. o Another unintended consequence could be upward pressure on food prices already impacted by the droughts: QE puts downward pressure on the US$, and soft commodity prices tend to rise when this happens.

Snapshots of the week - A: The changing face of Cybercrime (Norton Symantec 2012 Cybercrime Study) The scale of Cybercrime has been revised down but remains significant The Global scale of Cybercrime (USD) The scale of consumer cybercrime is hard to estimate and in the past has often been over-estimated: o In 2009 AT&T testified before the US Congress that global cybercrime topped $1 T. That would be 1.6% of world GDP o BAE Detica estimated $27b in the UK: 2% of UK GDP o Norton Symatec itself in 2011 put the total 'at an annual price of $388 billion (direct cash $114b + time lost $274b) which was more than the estimated value of the global black market in marijuana, cocaine and heroin combined ($288b), and cause controversy. In 2012 they revised their methodology and... o In 2012 Symantc settle for a cybercrime cost of $110b (the cost Americans spend annually on fast food) o 556 million victims per year (more than the entire population of the european union) o 1.5+ million victims per day o 18 victims per second At $2b cybercrime already costs Australians more than burglary, and is bound to increase as more people conduct their daily lives through relatively insecure and easily lost smartphones and other mobile devices.

Traditional Crime Fraud Burglary / damage Child Sex Offences Money laundering Theft Stalking

Cyber Crime Equivalent Online fraud, auction fraud, advance fee fraud Online hacking, denial of service attacks, viruses Online child grooming, child pornography websites Online payment systems, e-cash ID Crime, onlien banking phishing, movie, music and software piracy Cyber stalking, cyber bullying

Compared to overall Fraud & Crime in Australia: Serious organised crime costs between $1015b every year (conservative estimates from the Australian Crime Commission): This includes loss of business revenue and taxes, law enforcement and regulatory efforts, and social impacts of crime. Insurance fraud in represents just over $2.2b or around 10% of all claims (source: Insurance Council of Australia (ICA) Insurance Fraud Bureau) The 11th Workshop on the Economics of Information Security held in Berlin in June 2012 tabled a new framework to analyse those costs Decomposing the cost of Cybercrime Direct losses: money withdrawn from victim accounts; effort to reset account credentials, distress suffered by victims; secondary costs of overdrawn accounts: deferred purchases Defence costs Indirect losses: loss of trust in online banking, leading to reduced revenues from electronic transaction fees, and higher costs for maintaining branch staff; missed business opportunity Cost to for banks to communicate with their customers by email; reduced uptake by citizens of Indirect losses society electronic services as a result of lessened trust in online transactions Defence costs: security systems, fraud detection , recuperation effort, law enforcement Criminal Direct losses o Consumer loss of confidence is an indirect cost: A Eurostat ICT survey showed that 14% of UK revenue consumers avoided online purchases due to security concerns. Minus those who simply Cybercrimes Supporting purchased goods offline instead, but at higher search and distribution costs, this gives 10% of infrastructure online purchases is foregone (indirect costs of $700m due to UK consumer loss of condence) o Merchants also lose condence by refusing 1% of legitimate transactions: $1.6bn in lost sales The WEIS study also reveals that genuine cybercrimes (virus, scams - as opposed to 'Traditional crime becoming cyber' such as extortion, Welfare or Tax fraud) don't yield much revenue for criminals: each category earns a few tens of cents per citizen However, indirect and defence costs are roughly 10 times the sum of losses due to all new online scams This asymmetry is not found in traditional crimes A key trend is that the face of Cybercrime is changing rapidly, requiring a constant re-education about the risks Security fundamentals are followed, which shows that security Cybercrime goes mobile: education work... however the spread of new media has made o 2/3 of adults use a mobile device to access the internet it more complex (not just email any more) o 44% of adults access emails via unsecured wi-fi - 24% access their bank account Cybercrime goes social: 36% of social network users check their social network as soon as they can after waking up. 27% admit that, upon getting to work, they are more likely to check their main social network account than work emails: o 4/10 social network users have fallen victim to cybercrime on social networking platforms o 1/6 social network users report that someone has hacked into their profile and pretended to be them o 36% have accepted friend requests from people they do not know

Sources: under 'Cybercrime' http://pear.ly/bDmQX

The need to address Frauds and raise consumers cybersecurity IQ is a prolonged effort Insurance Industry initiatives: Specific focus on Cybercrime: On the traditional Fraud front the Insurance Council of Australia launched in 2011 Comprehensive information is available on the Crime http://www.insurancefraudhotline.com.au which claims saved the industry $700,000 Commission website: in its first 6 months. http://www.crimecommission.gov.au/publications/cri me-profile-series-fact-sheet/cyber-crime and on the Attorney-General's Department http://www.ag.gov.au/Cybersecurity/ The hotline has been collecting reports from the public about suspected fraud including: organised car accidents, car theft and arson, people deliberately leaving cars in flooded areas. It is planing to act as a deterrent so that likely fraudsters understand their credit rating and ability to obtain insurance in future could be damaged. Since members of the public who become aware of fraud typically do not know the insurance company involved, the information is filtered and limited detail is provided to insurers likely to be carrying the policy. In June 2012 the ICA nsurance Fraud Bureau declared it was set to move to the next stage of its development with a plan to tackle organised insurance fraud, including an operating model to allow it to begin detecting and pursuing prosecutions for complex organised insurance fraud, rather than just one-off cases. The bureau wants to be able to share information across insurance companies to detect patterns, which it is now negociating with the Privacy Commissioner. In the UK, the industry has already established an Insurance Fraud Register a central database of people who have committed insurance fraud. The Government response to cybercrime is via 2 specific organisations: o AusCERT: Australias national computer emergency response team https://www.cert.gov.au o Cyber Security Operations Centre (CSOC): established as an initiative of the Defence White Paper, it provides the Government with strategic advice and situational awareness http://www.dsd.gov.au Public awereness initiatives such as: http://www.staysmartonline.gov.au/

This means that addressing fraud and particularly using analytics to tap into Big Data to detect patterns of fraud is a high potential avenue, which we ought to investigate as part of our 'Data Strategy'

Snapshots of the week - B: The changing face of bank profitability (UBS Study, August 2012 : http://pear.ly/nFGDi ) Australian Banking is going through many structural changes post GFC: One of the most significant is the changing source of bank profitability Deposit gathering and Wealth are now a much more Prior to 2008, when funding was cheap the bank that could lend out the important component of the Finance industry profit pools most, made the most money. Post 2008 it all changed, with the key driver of bank profitability being Net Australian Financial Services Profit Pools by Segment & Product Interest Margin (NIM). Banks accessing the cheapest, most stable pools of funding have a material advantage. One of the most significant implications of the new environment is the inversion of the customer base that produces the profit for banks. o Prior to the GFC the main profit driver was mortgage lending to "GenX&Y" o Now however, the profit pool now driving bank profitability is deposit gathering from older customers, and small lending. o Eg, CBA estimates ~85% of Retail profit now comes from transaction deposit accounts (~74% of deposits are held by people aged 45+) and borrowers with low levels of net assets (<$100k) ie credit card revolvers or lower property value mortgagors with little discount steadily meeting repayments Note: No axis is provided for this chart. It is illustrative only In other words this situation presents a problem of fair value for those customers and lack of opportunity for the banks who mis- or underservice both quintiles: Indeed, UBS believes that these 'more profitable' customers are likely to be less financially literate and are more likely to come from the lower income quintiles: o They do not optimise their deposits which are lazy sitting in low interest rate transaction/cheque accounts; o They are credit card revolvers paying higher levels of interest; or o Mortgagors with lower-value properties and higher LVR, who have either no or little discount off the Standard Variable Rate and repay their loan on schedule. By comparison, the study shows that wealthier customers (higher levels of income or net assets) are much less profitable for retail banks. They often have large heavily discounted mortgages and manage to minimise interest and fees they are charged. Some of these customers also have substantial deposit balances but manage to maximise interest earned through term deposits, online savings accounts or offset accounts. CBA: dominates the Youth (~40%), Young Adults (aged 25-34) high 30%; Main Financial Institution Customer Socio-Economic Distribution and retirees. NAB: business owners, professionals, wealthy In stark contrast NAB dominates business owners and professionals. In CBA : Youth, young clients through brokers addition, its more aggressive push into the mortgage market (especially adults, retirees via the broker channel) is likely to help explain its increasing exposure to higher income individuals in recent years. WBC is pushing in Wealth Management which it believes will make up ~34% of the mass market financial services profit pools in the future. This compares to ~54% for lending and deposits. However, WM's proportion of the industry profit pool rises to 47% for Affluent customers > 45 years, even greater than from deposits and lending at 45%. Banks have been relatively poor at cross-selling WM product and accessing these profit pools. Roy Morgan estimates WM penetration of CBA excludes BankWest; WBC excludes St George, BankSA, Bank of Melbourne the banks client bases ranges from just 13.6% to 20.3%. A similar exercise on SUN's profile and the ability to cross-sell between Bank, GI and Life would be a worthwhile exercise
3