InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Bank regulators share living will expectations with foreign banks operating in the U.S.
On January 29, the Federal Reserve Board and the FDIC sent letters to 19 foreign banks operating in the United States to outline and clarify resolution plan expectations. According to a joint release issued by the regulators, Dodd-Frank-mandated resolution plans—commonly known as living wills—require certain foreign banks to detail strategic plans for their U.S. operations “for rapid and orderly resolution under bankruptcy” should the banks fail or fall under material financial distress. Requested in the letters, among other things, are specifics on resolution strategies, capital calculations, management of liquidity, stress testing, and organizational structures. Banks are required to submit 2018 resolution plans no later than December 31, 2018. Refer here to access a list of banks and letters.
Federal Reserve vice chairman evaluates post-crisis regulations
On January 19, Federal Reserve Vice Chairman for Supervision Randal Quarles spoke at the American Bar Association Banking Law Committee Annual Meeting to discuss his initial observations on the post-crisis regulation regime and provide a status update on the Fed’s key areas of focus for improving the “efficiency, transparency, and simplicity of regulation.” Quarles emphasized that there are a variety of means to improve efficiency, such as (i) addressing unintended adverse consequences of a regulation, or (ii) calibrating a regulation “more precisely to the risks in need of mitigation.” Transparency around rulemaking encourages a variety of perspectives, and simplifying regulations “promotes public understanding of regulation, promotes meaningful compliance by the industry with regulation, and reduces unexpected negative synergies among regulations,” he added.
According to Quarles, “small bank capital simplification, burden reduction in resolution planning, enhancements to stress testing, leverage ratio recalibration, and Volcker rule simplification” are common ground areas for improvement, efforts have progressed, and regulations have been proposed for changes, including extending the resolution planning cycle to reduce the reporting burden. Quarles also noted that the Fed expects to release a proposal on leverage ratio recalibration in the near future, and has started working with five banking agencies on a proposal to streamline the Volcker rule.
Another area of focus Quarles highlighted is the Fed’s plan to revisit the “advanced approaches” thresholds used to identify internationally active banks, including risk-based capital requirements as well as the supplementary leverage ratio. Quarles further noted that the current $250 billion-asset or $10 billion in on-balance-sheet foreign exposures thresholds were formulated more than a decade ago “and have not been refined since then.” Additionally, Quarles announced plans to work with his Fed colleagues to simplify the framework for loss absorbency requirements. According to Quarles, candidates for simplification include (i) eliminating the advanced approaches risk-based capital requirements; (ii) eliminating one or more stress testing ratios; and (iii) modifying the total loss-absorbing capacity requirements. The framework for making determinations of control under the Bank Holding Company Act—while not a post-crisis regulation—could also be improved to be less “burdensome and time-consuming,” Quarles added.
Finally, as previously covered in InfoBytes, Quarles commented on the Fed’s requests for comments issued last December on three proposals designed to increase stress testing transparency while also testing the resiliency of large, complex banks. “I believe that the disclosure we have provided does not go far enough to provide visibility into the supervisory models that often deliver a firm's binding capital constraint,” Quarles noted.
OCC highlights supervisory priorities in fall 2017 semiannual risk report
On January 18, the OCC announced the release of its Semiannual Risk Perspective for Fall 2017, identifying key risk areas for national banks and federal savings associations. Top supervisory priorities will focus on credit, operational, and compliance risk. As previously discussed in the spring 2017 semiannual report, compliance risk continues to be an ongoing concern, particularly as banks continue to adopt new technologies to help them comply with anti-money laundering rules and the Bank Secrecy Act (BSA), in addition to addressing increased cybersecurity challenges and new consumer protection laws. (See previous InfoBytes coverage here.) The OCC commented that these types of risks can be mitigated by banks with “appropriate due diligence and ongoing oversight.”
Specific areas of particular concern include the following:
- easing of commercial credit underwriting practices;
- increasing complexity and severity of cybersecurity threats, including phishing scams that are the primary method of breaching bank data systems;
- using limited third-party service providers for critical operations, which can create “concentrated points of failure resulting in systemic risk to the financial services sector”;
- compliance challenges under the BSA; and
- challenges in risk management involving consumer compliance regulations.
The report also raises concerns about new requirements under the Military Lending Act along with pending changes to data collection under the Home Mortgage Disclosure Act, which could pose compliance challenges. It further discusses a new standard taking effect in 2020 for measuring expected credit losses, which “may pose operational and strategic risk to some banks when measuring and assessing the collectability of financial assets.”
The data relied on in the report was effective as of June 30, 2017.
Buckley Sandler Insights: Fed's LFI Risk Management Principles Open for Comments
On January 4, the Federal Reserve (Fed) issued for public comment proposed guidance setting forth core principles of effective risk management for Large Financial Institutions (“LFI”s) (“Risk Management proposal”). Given that it is increasingly likely that Congress will release financial institutions with assets below $250 billion from “SIFI” designation, the Fed’s guidance yesterday is a further effort to ensure that risk at LFIs will continue to be managed well even after many of them are no longer subject to other SIFI obligations. The proposal would apply to domestic bank holding companies and savings and loan holding companies with total consolidated assets of $50 billion or more; the U.S. operations of foreign banking organizations (“FBOs”) with combined U.S. assets of $50 billion or more; and any state member bank subsidiary of these institutions. The proposal would also apply to any systemically important nonbank financial company designated by the Financial Stability Oversight Council (“FSOC”) for Fed supervision. The proposed guidance clarifies the Fed’s supervisory expectations of these institutions’ core principals with respect to effective senior management; the management of business lines; and independent risk management (“IRM”) and controls.
The Risk Management proposal is part of the Fed’s broader initiative to develop a supervisory rating system and related guidance that would align its consolidated supervisory framework for LFIs. Last August, the Fed issued for public comment two related proposals: a new rating system for LFIs (“proposed LFI rating system”) and guidance addressing supervisory expectations for board directors (“Board Expectations proposal”). (See previous InfoBytes coverage on the proposals.) The proposed LFI rating system is designed to evaluate LFIs on whether they possess sufficient financial and operational strength and resilience to maintain safe and sound operations through a range of conditions. With regard to the Board Expectations proposal, the January 4 proposal establishes supervisory expectations relevant to the assessment of a firm’s governance and controls, which consists of three chief components: (i) effectiveness of a firm’s board of directors, (ii) management of business lines, independent risk management and controls, and (iii) recovery planning. This guidance sets forth the Fed’s expectations for LFIs with respect to the second component—the management of business lines and IRM and controls, and builds on previous supervisory guidance. In general, the proposal “is intended to consolidate and clarify the [Fed’s] existing supervisory expectations regarding risk management.”
The January 4 release delineates the roles and responsibilities for individuals and functions related to risk management. Accordingly, it is organized in three parts: (i) core principals of effective senior management; (ii) core principals of the management of business lines; and (iii) core principles of IRM and controls.
Senior Management
The Risk Management proposal defines senior management as “the core group of individuals directly accountable to the board of directors for the sound and prudent day-to-day management of the firm.” Two key responsibilities of senior management are overseeing the activities of the firm’s business lines and the firm’s IRM and system of internal control. The proposed guidance highlights the principle that: Senior management is responsible for managing the day-to-day operations of the firm and ensuring safety and soundness and compliance with internal policies and procedures, laws and regulations, including those related to consumer protection.
Management of Business Lines
The proposal refers to “business line management” as the core group of individuals responsible for prudent day-to-day management of a business line and accountable to senior management for that responsibility. For LFIs that are not subject to supervision by the Large Institution Supervision Coordinating Committee (“LISCC”) these expectations would apply to any business line where a significant control disruption, failure, or loss event could result in a material loss of revenue, profit, or franchise value, or result in significant consumer harm.
A firm’s business line management should:
- Execute business line activities consistent with the firm’s strategy and risk tolerance.
- Identify, measure, and manage the risks associated with the business activities under a broad range of conditions, incorporating input from IRM.
- Provide a business line with the resources and infrastructure sufficient to manage the business line’s activities in a safe and sound manner, and in compliance with applicable laws and regulations, including those related to consumer protection, as well as policies, procedures, and limits.
- Ensure that the internal control system is effective for the business line operations.
- Be held accountable, with business line staff, for operating within established policies and guidelines, and acting in accordance with applicable laws, regulations, and supervisory guidance, including those related to consumer protection.
Independent Risk Management and Controls
The Risk Management proposal describes core principles of a firm’s independent risk management function, system of internal control, and internal audit function. The guidance does not prescribe in detail the governance structure for a firm’s IRM and controls. While the guidance does not dictate specifics regarding governance structure, it does set forth requirements with respect to the roles of the Chief Risk Officer and Chief Audit Executive:
- The CRO should establish and maintain IRM that is appropriate for the size, complexity, and risk profile of the firm.
- The Chief Audit Executive should have clear roles and responsibilities to establish and maintain an internal audit function that is appropriate for the size, complexity and risk profile of the firm.
The proposal requires that a firm’s IRM function be sufficient to provide an objective, critical assessment of risks and evaluates whether a firm remains aligned with its stated risk tolerance. Specifically, a firm’s IRM function should:
- Evaluate whether the firm’s risk tolerance appropriately captures the firm’s material risks and confirm that the risk tolerance is consistent with the capacity of the risk management framework.
- Establish enterprise-wide risk limits consistent with the firm’s risk tolerance and monitor adherence to such limits.
- Identify and measure the firm’s risks.
- Aggregate risks and provide an independent assessment of the firm’s risk profile.
- Provide the board and senior management with risk reports that accurately and concisely convey relevant, material risk data and assessments in a timely manner.
With regard to internal controls, the proposed guidance builds upon the expectations described in the Fed’s Supervisory Letter 12-17. A firm should have a system of internal control to guide practices, provide appropriate checks and balances, and confirm quality of operations. In particular, the guidance states that a firm should:
- Identify its system of internal control and demonstrate that it is commensurate with the firm’s size, scope of operations, activities, risk profile, strategy, and risk tolerance, and consistent with all applicable laws and regulations, including those related to consumer protection.
- Regularly evaluate and test the effectiveness of internal controls, and monitor functioning of controls so that deficiencies are identified and communicated in a timely manner.
With respect to internal audit, the proposed guidance does not expand upon the Fed’s expectations; rather it references existing supervisory expectations. The proposed guidance highlights that a firm should adhere to the underlying principle that its internal audit function should examine, evaluate, and perform independent assessments of the firm’s risk management and internal control systems and report findings to senior management and the firm’s audit committee.
Comments on the Fed’s proposed guidance are due by March 15.
House Passes Legislation Modifying Systemic Risk Designation Requirements
The House voted 288-130 on December 19 to pass legislation modifying Dodd-Frank Act asset requirements for systemic risk designations of bank holding companies. Under H.R. 3312, the Systemic Risk Designation Improvement Act of 2017, bank holding companies that are subject to increased capital requirements and heightened supervision by the Federal Reserve (Fed) will no longer be automatically designated as systemically important financial institutions (SIFIs) if their asset threshold is $50 billion or greater. Instead, the Fed will review a bank holding company’s size, interconnectedness, infrastructure, “global cross-jurisdictional activity,” and complexity to determine whether it should be designated as a SIFI. Relatedly, the Senate Banking Committee is currently considering a separate measure, S. 2155, which would, among other things, increase the SIFI asset threshold to $250 billion.
Continuing Resolution Extends National Flood Insurance Program Deadline to December 22
As previously reported in InfoBytes, the House voted 237-189 on November 14 to pass legislation reforming and reauthorizing the National Flood Insurance Program (NFIP) for five years before it expired at the beginning of December. A continuing resolution (H.J. Res. 123), passed by both the Senate and House and signed into law by President Trump on December 8, amended the expiration date of Fiscal Year 2018 appropriations to December 22, and extended the NFIP another two weeks. The Senate Banking Committee is still waiting to act on a flood insurance bill.
Otting Sworn in as Comptroller of the Currency; Pushes for Regulation Review
On November 27, Joseph M. Otting was sworn in as the next Comptroller of the Currency following Senate confirmation on November 16. Otting commented in a statement prepared for his swearing-in that he understands “as a career banker” the value and importance of “effective supervision” as well as “the challenges bankers face as they work to meet customer needs while coping with unnecessary regulatory burden that makes it more difficult and complicated than necessary.” Otting asserted that in order for regulations to be effective, modifications must be made as the nation’s needs change. Otting’s stated priorities include “enhancing the value of national bank and federal savings association charters, reducing unnecessary burden, and promoting economic opportunity while maintaining the safety and soundness of the federal banking system.”
OCC Presents First National Bank Charter Since the Financial Crisis
On October 27, Acting Comptroller of Currency, Keith A. Noreika, issued the first full-service national bank charter since the financial crisis to a banking institution in Florida. The institution is also the first de novo national bank and de novo approved for federal deposit insurance in Florida since the financial crisis. While presenting the charter, Noreika commented on the rarity of de novo banks and encouraged better efficiency in the process for their establishment in order to, “create more economic opportunity for consumers, businesses, and communities across the nation.”
As previously covered by InfoBytes, the House Financial Services Committee held a hearing in March related to the “de novo drought” and to examine the impact the Dodd-Frank Act has had on the creation of new financial institutions.
Federal Banking Regulatory Agencies Issue Proposed Rulemaking to Simplify Regulatory Capital Rule
On September 27, the Federal Reserve Board, the FDIC, and the OCC (agencies) issued a joint notice of proposed rulemaking to simplify capital rule compliance requirements and reduce the regulatory burden in accordance with the Economic Growth and Regulatory Paperwork Reduction Act (EGRPRA). Among other things, the proposed rule will “apply a simpler regulatory capital treatment” for mortgage servicing assets, certain deferred tax assets, investments in unconsolidated financial institutions, and capital issued by a consolidated subsidiary of a banking organization and held by third parties, or minority interest. To assist banks in evaluating the potential impact of the proposal, the agencies provided an estimation tool template and summary of the proposal. As previously discussed in InfoBytes, the agencies—all members of the Federal Financial Institutions Examination Council (FFIEC)—issued a report in March following an EGRPRA review, in which the agencies outlined initiatives designed to reduce regulatory burdens, particularly on community banks and savings associations. In a statement issued by FDIC Chairman Martin J. Gruenberg, commenters are encouraged to also consider methods for simplifying existing regulatory capital rules impacting community banks. Comments on the joint proposed rule are due 60 days after publication in the Federal Register.
NYDFS Issues Reminder on Cybersecurity Regulation Compliance Effective August 28
On August 28, the New York Department of Financial Services (NYDFS) issued an announcement reminding all NYDFS-regulated banks, insurance companies, and other financial services institutions that they must now begin complying with the state’s “first-in-nation cybersecurity regulation.” As previously covered in Infobytes, the regulation took effect March 1, 2017, but August 28 was the first compliance date. Covered entities are now required to implement the following: (i) a cybersecurity program designed to protect consumers’ private data; (ii) board/senior officer-approved written policy or policies; (iii) a designated Chief Information Security Officer to help protect an entity’s data and systems; and (iv) “controls and plans in place to help ensure the safety and soundness of New York’s financial services industry.” Furthermore, covered entities must begin reporting cybersecurity events through NYDFS’ online cybersecurity portal. (See previous InfoBytes coverage here.) Notices of exemption may be filed within “30 days of the determination that the covered entity is exempt,” and covered entities must file a certificate of compliance confirming compliance for the previous calendar year no later than February 15, 2018. NYDFS also released a series of frequently asked questions to provide assistance to institutions when complying with the regulation’s requirements.