Raphael Stevens

“Limited but intensive”. That is how a regulatory filing described, with something approaching wry understatement, the few days of due diligence before ubs announced its deal to rescue Credit Suisse on March 19th. The acquisition was the first ever tie-up between two “global systemically important banks”, a designation introduced after the global financial crisis of 2007-09. Since it was announced, the pace has barely slowed. In April Sergio Ermotti, a Swiss cost-cutter who ran ubs between 2011 and 2020, returned as the firm’s chief executive. The same month Credit Suisse’s results laid bare the brutal run it had suffered. Combined financial statements followed in May. The fine print of an agreement with Swiss authorities to absorb potential losses emerged in June. Scores of Credit Suisse bankers have rushed for the exit.ubs finally got the keys to the building on June 12th. The tie-up is the most watched deal in finance. It creates a giant with $5trn of invested assets and a balance-sheet twice the size of the Swiss economy. The acquisition’s outcome will say much about the future of global banking. Regulators are eyeing proceedings closely on account of the new institution’s size. Bank bosses, meanwhile, are watching the difficult strategic decisions faced by management for lessons applicable to their own firms. UBS shareholders, who did not vote for the deal, have traded a staid investment for something much riskier. Despite absorbing its risk-taking rival, bosses hope that the new ubs will be able to emerge as an enlarged version of the old ubs. European banks were slow to recapitalise after the global financial crisis; their profitability largely reflected ailing domestic economies. Amid this inauspicious crowd, ubs stood out. After being rescued in 2008, the bank focused on wealth management. It won enough wallets to be rewarded with one of the highest price-to-book multiples of any European bank, trading at an average of 1.1 times its book value last year. ubs’s focus on managing money will continue, but the shape and scale of its other banking businesses is still the subject of internal debate. Nobody expects a smooth ride in the years ahead.Since the deal was announced, shares in ubs have risen only a little. Yet the acquisition ought to be a boon, at least eventually. ubs bought Credit Suisse at a bargain: it will report an estimated $35bn of “negative goodwill”, the difference between what it paid and the higher book value of Credit Suisse’s equity. Turning this scale into profit hinges on the mammoth task of integrating the two institutions’ operations. All the usual post-merger headaches—combining it systems, aligning accounting standards, laying off staff and resolving culture clashes—are especially troublesome at a bank, let alone a failed one. Compared with ubs, Credit Suisse was appallingly inefficient: the bank had a higher ratio of costs to income in every one of its businesses. Its collapse was preceded by five consecutive quarters of losses and a stunning evaporation of confidence among clients and counterparties.When ubs unveils its plans and delayed quarterly results at the end of August, investors will scrutinise any outflow of assets managed by the bank. There is little to suggest a large exodus has taken place. Julius Baer, a Swiss outfit that is likely to benefit from any flight, reported only modest inflows at its quarterly results on July 24th. But investors should also focus on two strategic decisions—ones which will ultimately determine the success of the deal. Both require knife-edge calls and present enormous execution challenges.Credit Suisse’s domestic business is the first question mark. Bosses at ubs are debating whether to keep none, some or all of Credit Suisse Schweiz, which was established in 2016 as part of a plan, later shelved, to spin off the business. The Swiss bank was Credit Suisse’s only profitable division during the first quarter of 2023. Last year Schweiz’s equity had a book value of SFr13bn ($14bn). Selling the outfit at a valuation near this figure might be impossible given the speed with which clients fled before March. A shaky balance-sheet would hinder efforts to pick off better bits of the business, since the rump might struggle to support itself as a standalone operation. Taking the SwissAnger over the tie-up is still simmering in Switzerland. The fate of Credit Suisse’s domestic business could emerge as something of a political lightning rod. Shedding Schweiz might stave off demands for higher capital requirements in the future by calming worries about the parent bank’s size. According to data from Switzerland’s central bank, last year ubs and Credit Suisse had combined domestic market shares of 26% in loans and deposits. In less dramatic circumstances, it would have been possible to imagine the deal falling foul of competition watchdogs.Yet whereas gains from second-guessing political currents are uncertain, gains from keeping the business and making cuts are almost guaranteed. Assuming ubs’s shears are sufficiently sharp, and 70% of Credit Suisse Schweiz’s costs can be chopped, separating the whole business would mean forgoing nearly a third of the deal’s total annual cost savings, according to Barclays, a bank. Lay-offs affecting Credit Suisse’s 16,700 employees in Switzerland, such as from shutting retail branches, would draw particular ire from politicians and the public. According to Jefferies, an investment bank, around 60% of UBS and Credit Suisse branches are located within a kilometre of each other.The second question mark concerns Credit Suisse’s investment bank, which accounted for a third of the institution’s costs last year, and will bear the brunt of the cuts. Mr Ermotti is no stranger to felling bankers: the number of people employed in ubs’s investment bank declined from about 17,000 in 2011 to 5,000 in 2019, leaving behind a leaner operation to play second fiddle to the bank’s elite wealth-management division. Credit Suisse failed to accomplish similar manoeuvres of its own. Therefore ubs last year generated nearly five times as much revenue per dollar of value at risk.Winding down these operations will be a slog. Much of Credit Suisse’s investment-banking operations will be shoved into a “non-core” unit, along with some small parts of Credit Suisse’s money-managing businesses. Modern “bad banks” do not contain masses of toxic derivatives, like an older generation did after the global financial crisis. But they are still hard to shutter without incurring significant losses.Protection against losses from selling some of Credit Suisse’s assets is provided by the Swiss government. As part of the acquisition agreement, the authorities committed themselves to absorbing up to SFr9bn of losses, so long as the first SFr5bn are shouldered by ubs. They are unlikely to have to cough up, however, given the relatively small pool of assets covered by the agreement. As a result, ubs could move to end the agreement before it has wound down the portfolio. The guarantee proved reassuring to investors during March’s turmoil. Today it carries a lot of political risk for not all that much financial gain.Moreover, the loss guarantee fails to insure against the greatest danger when it comes to winding down an investment bank: that revenues plummet faster than costs, creating uncomfortable losses. Even excluding the sizeable cost of employees and one-off items, outgoings in Credit Suisse’s investment bank last year amounted to more than 60% of revenue. Many of these costs, such as the technology systems required to run a trading floor, will remain high even as assets are sold off. Consider Credit Suisse’s own wind-down unit, which the bank created as part of its failed restructuring programme. The unit’s assets have fallen by almost half since 2021, to SFr98bn; its costs, at SFr3bn in 2022, have hardly changed.How quickly ubs is able to shutter this unit will be closely watched. So will what the bank’s bosses do with their remaining investment bank. European investment banks have retreated since the financial crisis, especially in America. Both Barclays and Deutsche Bank have struggled to convince investors their businesses are worth retaining. ubs’s investment bank is profitable, but would need a mighty boost to woo billionaires with its dealmaking advice. The prospect of building an elite, capital-light bank might be appealing in theory, and was the crux of Credit Suisse’s plan to spin out its own investment bank under the moniker of “First Boston”, a famous old institution that it acquired in 1990. But in practice this would require significant turnover among ubs’s own bankers, too. Put the axe awayIt is not clear that such bloodletting is required. In time, the success of the merger will be judged by ubs’s price-to-book multiple. Morgan Stanley, which has ridden its wealth-management success to a multiple of more than two, is a worthy target. After the deal, ubs will remain a measly competitor in investment banking, but growth in the money it manages means it will close the gap in wealth management and overtake its rival in asset management. A bigger bank means bigger ambitions. ■ More

Leon Neal | Getty Images News | Getty Images

The Securities and Exchange Commission wants corporate America to tell investors more about cybersecurity breaches and what’s being done to fight them. Much more. 
The SEC has voted 3-2 to adopt new rules on cybersecurity disclosure. It will require public companies to disclose “material” cybersecurity breaches within 4 days after a determination that an incident was material. 

The SEC says it is necessary to collect the data to protect investors. Corporate America is pushing back, claiming that the short announcement period is unreasonable, and that it would require public disclosure that could harm corporations and be exploited by cybercriminals. 
The final rules will become effective 30 days following publication of the release in the Federal Register. 
Current cybersecurity rules are fuzzy 
Current rules on when a company needs to report a cybersecurity event are fuzzy. Companies have to file an 8-K report to announce major events to shareholders, but the SEC believes that the reporting requirements for reporting a cybersecurity event are “inconsistent.” 
In addition to requiring public companies to disclose cybersecurity breaches within four days, the SEC wants additional details to be disclosed, such as the timing of the incident and the material impact on the company. It will also require disclosure of management expertise on cybersecurity. 
The pushback from corporate America sounds strikingly similar to the pushback from many of the other rulemaking proposals SEC Chair Gary Gensler has made or proposed: too much. 

“The SEC is calling for public disclosure of considerably too much, too sensitive, highly subjective information, at premature points in time, without requisite deference to the prudential regulators of public companies or relevant cybersecurity specialist agencies,” the Securities Industry and Financial Markets Association (SIFMA), an industry trade group, said in a letter to the SEC. 
Industry objections
The most prominent industry concerns are: 

Four days is too short a period. SIFMA and others claim that four days denies companies time to first focus on remediating and mitigating the impacts of any incident. 
Premature public disclosure could harm companies. The NYSE, on behalf of its listed companies, has written to the SEC saying that corporations should be allowed to delay public disclosures in two circumstances: 1) pending remediation of the incident, and 2) if law enforcement determines that a disclosure will interfere with a civil or criminal investigation. 

The proposed rule allows the Attorney General to delay reporting if the AG determines that immediate disclosure would pose a substantial risk to national security. 
“Premature public disclosure of an incident without certainty that the threat has been extinguished could provide bad actors with useful information to expand an attack,” Hope Jarkowski, NYSE Group general counsel, said in the letter. 
Nasdaq, in a separate letter to the SEC, agrees, noting that “the obligation to disclose may reveal additional information to an unauthorized intruder who may still have access to the company’s information systems at the time the disclosure is made and potentially further harm the company.” 
Concerns about duplicate reporting 
Another concern is overlapping regulations. Many public companies already have procedures in place to share critical information about cyber incidents with other federal agencies, including the FBI. 
The lead agency that deals with cybersecurity is the Cybersecurity and Infrastructure Security Agency (CISA) in the Department of Homeland Security. Under legislation passed last year, CISA is adopting cybersecurity rules that require “critical infrastructure entities,” which would include financial institutions, to report cyberbreaches within three days to CISA. 
This would conflict with the SEC’s four-day rule, and would also create duplicate reporting requirements. 
All this goes to the central issue of who should be regulating cybersecurity. “The Commission is not a prudential cybersecurity regulator for all registrants,” SIFMA said. 
What is the SEC trying to accomplish? 
Cybersecurity is only a small part of the more than 50 proposed rules Gensler has out for consideration, nearly 40 of which are in the Final Rule stage. 
If there is an underlying theme behind much of Gensler’s extensive rulemaking agenda, it is “disclosure.”  More disclosure about cybersecurity, board diversity, climate change and dozens of other issues. 
“Gensler is claiming he wants more transparency and thinks that will protect investors,” Mahlet Makonnen, a principal at Williams & Jensen, told me. 
“The fear the industry has is that the data collected will put unnessary burdens on industry, does not actually protect investors, and that the data can be used to grow the aggressive enforcement tactics under Gensler,” she said. 
“The more information they have, the more the SEC can determine if there are any violations of rules and regulations. It allows them to expand enforcement actions. The SEC will say they have broad authority to protect investors, and the disclosures can be used to expand the enforcement actions.” 
Another long-time observer of the SEC, who asked to remain anonymous, agreed that the ultimate goal of stepped up disclosure is to expand the SEC’s enforcement power. 
“It will enable the SEC to claim they are protecting investors, and it will enable them to ask Congress for more money,” the observer told me. 
“You don’t get more money from Congress by asking for money for market structure. You get more money by claiming you are protecting grandma.” More