Bank of Valletta downgraded by S&P over cyberattack and international litigation

Standard & Poor’s lowers BOV’s ratings over cyberattack event and various litigation cases

Standard & Poors has downgraded Bank of Valletta’s credit rating to BBB-/A-3 from BBB/A-2, due to regulatory observations and a cyber-attack which increased doubts regarding the robustness of BOV’s operational risk management.

These events added to material litigation risks to which the bank is exposed in the Deiulemar, Swedish pensions agency, and La Valette property fund cases.

“All these events lead to uncertainty regarding the effectiveness of BOV’s risk oversight and management’s ability to control the complexities of the bank’s business model, which we consider relatively higher than similarly sized banks,” S&P said.

S&P said the European Central Bank and Malta Financial Service Authority (MFSA) had encouraged the bank to take some actions to strengthen its internal controls and risk oversight, notably regarding the due diligence and onboarding processes of new clients.

In February, BOV suffered from a cyber-attack that forced it to shut down its internet access, as well as its branches and cashpoints, for several hours.

“The cyber-attack brings into question whether the effectiveness of the bank’s IT and compliance monitoring tools is in line with best practices,” S&P said.

Following the regulators’ recommendations, BOV said it is striving to strengthen its internal control procedures and adapt its business model to focus more on its domestic operations and traditional business activities.

“However, as is usually the case in such situations, we think it will take time and strong commitment from BOV’s senior management to implement these changes and truly transform its risk governance before yielding significant results.

“In addition, the abovementioned negative events specific to BOV, as well as Maltese financial institutions more generally, may have increased reputational risk for the bank. For example, BOV’s U.S. dollar correspondent bank announced in June that it will terminate its correspondence relationship with BOV in December.

“We anticipate that the transformation plan the bank is implementing to address the operational challenges is likely to result in a material increase in its operating expenses. This will put pressure on its profitability, and, in turn, its internal capital generation. In addition, we anticipate that some litigation cases still pending against the bank might require further


However, there remains a significant downside risk to S&P’s projection from ongoing litigation exposure. Specifically, BOV allocated €75 million to precautionary litigation provisions in the first half of 2018. The main litigation began in April 2015. This regarded shares held in a trust at BOV by owners of the collapsed shipping company Deiulemar, which entered bankruptcy in 2012. In 2018, the Italian court requested that BOV seize a precautionary warrant €363 million. This is substantial relative to BOV’s total equity of €994 million.

BOV is now planning to issue a €150 million Additional Tier 1 instrument in the second half of 2019, targeting institutional investors. This could cushion the potential burden on the bank’s capitalization that the litigation cases and other challenges might generate. However, bank has already delayed its issuance.

S&P however said it sees no immediate deterioration of the bank’s franchise following the court’s precautionary warrant, the cyber-attack, and regulatory reports.

“BOV’s dominant market position, with a market share of 46% in loans and deposits, and sound retail franchise continue to support the ratings on the bank, in our view. In addition, the 25.23% ownership by the Maltese government should enhance depositors’ confidence in

BOV and contribute to its stability.”

S&P said the possibility of an upgrade was unlikely at this stage because it will take time for the bank’s remedial actions on its internal controls and operational risk management to prove their effectiveness. The lawsuits on the pending litigation cases could also last several years before concluding.