## INTRODUCTION — IMF FSAP Assessment (Content unit: _cr1589) ## Source details **Canonical URL:** [INTRODUCTION — IMF FSAP Assessment (Content unit: _cr1589)](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr1589.pdf) ## Other formats - [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr1589.pdf.md) - [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr1589.pdf.json) --- ### Overview and Methodology - Assessment unit: United States federal banking agencies (FBAs) defined for this assessment as the OCC, the Federal Reserve and the FDIC. - Assessment period: FSAP update undertaken by the IMF from 21 October to 10 November 2014; reflects framework in place as of date of completion. - Methodology: - Assessed against the Revised BCP Methodology (BCBS, September 2012). - Grading scale: compliant; largely compliant; materially noncompliant; noncompliant (four‑grade scale). - Agencies chose assessment against both Essential Criteria and Additional Criteria. - Document structure (major sections reproduced): Information and Methodology Used for Assessment; Institutional and Market Structure—Overview; Preconditions for Effective Banking Supervision; Detailed Assessment (A. Supervisory Powers, Responsibilities and Functions; B. Prudential Regulations and Requirements); Summary Compliance with the BCP; Recommended Actions and Authorities Comments. ### Executive summary and key findings (numbered paragraphs preserved) - 1. FBAs have improved considerably in effectiveness since previous FSAP; stepped up supervisory intensity, focusing on capital planning, stress testing and corporate governance; increased staffing and skills. - 2. High degree of compliance with the Basel Core Principles (BCP); shortcomings observed (notably concentration risk and large exposures) but not judged to undermine overall supervisory effectiveness. - 3. DFA reforms rationalized some supervisory responsibilities but did not resolve the fragmented, multi‑regulator structure; duplication and risk of inconsistent messages persist. - 4. Prudential regime complex with statutory tiers introduced by DFA; supervisory practice often principles‑based with informal corrective measures (e.g., OCC “Heightened Standards”); principles‑based approach can delay response absent specificity. - 5. Lack of specificity/supervisory “triggers” in some areas; greater specificity could (i) signal preventative supervisory intensity, (ii) articulate supervisors’ risk appetite and shorten response time, (iii) provide internal monitoring reference points. - 6. Marked improvement in banks’ risk management since crisis; work‑in‑progress on full implementation of OCC “Heightened Standards” and clearer delineation of board vs management roles in supervisory assessments. - 7. Multiple FBAs place premium on cooperation; supervisory colleges and CMGs strengthen information‑sharing; state agencies with FBO presence do not always coordinate enforcement actions with home supervisors. - 8. FBAs operationally independent with clear safety-and-soundness mandates but other objectives exist; primacy of safety-and-soundness should be better enshrined in legislation or mission statements. - 9. Dual banking structure with charter choice raises “regime shopping” concerns; DFA restricts conversions for weak/troubled banks but modest conversions of well‑rated banks continue. - 10. Resources and supervisory intensity increased for largest firms; tiered, asset‑based thresholds used for proportionality; shift towards stress testing, analysis, horizontal reviews. - 11. Regulatory reporting framework long‑established and flexible; lacuna: supervisory data not collected at bank “solo” level (no solo level reporting). - 12. Wide range of supervisory actions available; PCA framework main early intervention plank with clear triggers; follow‑up on MRAs/MRIAs needs strengthening. - 13. Improvements in consolidated supervision since 2010 but outstanding work on SLHCs: regulatory/supervisory rules, formal rating system, capital rule for corporate and insurance company SLHCs. - 14. Comprehensive framework for cooperation with foreign supervisors; supervisory colleges and CMGs improving arrangements; some rules still apply only to foreign institutions. - 15–16. Corporate governance and risk aggregation requirements raised substantially; stress testing materially improved aggregation but firm‑led stress testing and data granularity remain work‑in‑progress. ### Identified strengths - High degree of compliance with the BCP in this assessment. - Significant post‑crisis strengthening of supervisory intensity, staffing, skills, and board engagement. - Strong supervisor focus on capital planning, stress testing, corporate governance and resolution planning for larger firms. - Comprehensive framework for cooperation with foreign supervisors, supported by supervisory colleges and CMGs. ### Identified weaknesses and areas for improvement - Fragmented regulatory structure with overlapping mandates; duplication of supervisory effort and risk of inconsistent messages. - Shortcomings in treatment of concentration risk and large exposures; related party exposure framework gaps. - Principles‑based supervision often lacks specificity and supervisory “triggers”. - Primacy of safety and soundness not explicitly enshrined in mission statements or legislation. - No mandatory solo‑level supervisory reporting; consider introducing if group structures change. - Follow‑up on supervisory actions needs to be stricter; consider early action rules beyond capital triggers and processes to address ageing MRAs/MRIAs. - Outstanding SLHC work: regulatory rules, guidance, formal rating system, capital rule for corporate and insurance company SLHCs. - Risk aggregation across GSIBs and firm‑led stress testing remain work‑in‑progress. --- ### Recommended focus areas (implicit and explicit in source) - Address concentration risk and large exposure anomalies (including the 50 per cent corporate group exposure issue). - Sharpen supervisory mandates and reduce duplication; clarify division of responsibilities between FBAs and CFPB. - Increase specificity within the principles‑based approach via public agency statements and internal supervisory triggers. - Introduce solo‑level reporting if banking group subsidiary size or complexity grows materially. - Strengthen follow‑up on supervisory actions and expand early action frameworks beyond capital triggers. - Finalize SLHC frameworks and capital rules for corporate and insurance company SLHCs. - Improve data granularity and firm‑led stress testing to enhance risk aggregation. *Source: INTRODUCTION (pages and numbered paragraphs provided in the source PDF unit).* --- ### Capital adequacy, stress testing and related prudential rules (Principles 16, 22 and related) ### Capital adequacy regime and implementation status - Major elements of the Basel II advanced approaches implemented from 1 January, 2014. - U.S. standardized approach based on Basel II will begin to come into effect from 1 January, 2015. - Broad adoption of the Basel III definition of capital, when applicable to most banks from 1 January 2015, will improve capital quality by limiting certain intangibles. - Prescribed minimum consolidated risk‑based capital ratios under the new rule: - 4.5 per cent common equity tier 1 capital; - 6 per cent tier 1 capital; - 8 per cent total capital. - Capital buffers: - 2.5 per cent conservation buffer; both buffers are composed of common equity tier 1 capital. - Supplementary leverage ratio: - Core banking organizations defined: those with total consolidated assets of at least $250 billion or total consolidated on‑balance sheet foreign exposures of at least $10 billion required to meet a minimum “supplementary leverage ratio” of 3 per cent. - In April 2014 FBAs adopted an enhanced supplementary leverage ratio final rule for top‑tier bank holding companies and insured depository institution subsidiaries. ### Key thresholds and scope (preserved verbatim) - $250 billion (advanced approaches threshold for “core” banking organizations when combined with $10 billion foreign exposure). - $10 billion (multiple uses: DFA stress‑test thresholds, company‑run tests, FBO risk committee requirement). - $50bn (BHC and FHC asset threshold for CCAR and heightened standards). - $500 million and $1bn (reporting/audit thresholds described in other sections). - nine quarters (planning horizon used in stress tests). - three‑year projection (required in acquisition assessments). - 4.5 per cent; 6 per cent; 8 per cent (minimum capital ratios listed above). - 2.5 per cent (capital conservation buffer). ### Differences with Basel and assessor concerns - U.S. standardized approach excludes: - an explicit capital charge for operational risk; - an explicit capital charge for Credit Value Adjustment (CVA) risk. - The new capital rule makes an organization using advanced approaches compute ratios under both standardized and advanced approaches and use the lower (a “floor”). - Assessors could not quantify materiality of divergences; absence of operational risk and CVA charges makes it difficult to conclude the U.S. standardized approach is not lower than applicable Basel standards. ### Stress testing framework and requirements - DFA requires Federal Reserve supervisory stress tests for systemic nonbank firms and BHCs with $50 billion or more in assets (Section 165(i)(1) and (i)(2)). - Firms with more than $10 billion in assets required to conduct annual company‑run stress tests using FBAs’ scenarios. - CCAR: - Company‑run and supervisory runs use baseline, adverse and severely adverse scenarios over a nine‑quarter horizon. - Firms must demonstrate maintenance of a pro forma tier 1 common ratio above 5 per cent post‑stress in CCAR. - Assessment: Stress testing is embedding a forward‑looking approach to capital needs and engaging boards and senior management. ### Prompt Corrective Action (PCA) and capital classifications (numeric thresholds preserved) - PCA capital classification thresholds (as presented): - Total Capital: ≥10% (Well Capitalized) ; ≥8% (Adequately Capitalized) ; <8% (Undercapitalized) ; <6% (Significantly Undercapitalized) - Tier 1 Capital: ≥8% (Well Capitalized) ; ≥6% (Adequately Capitalized) ; <6% (Undercapitalized) ; <4% (Significantly Undercapitalized) - Common Equity Tier 1: ≥6.5% (Well Capitalized) ; ≥4.5% (Adequately Capitalized) ; <4.5% (Undercapitalized) ; <3% (Significantly Undercapitalized) - Leverage Ratio: ≥5% (Well Capitalized) ; ≥4% (Adequately Capitalized) ; <4% (Undercapitalized) ; <3% (Significantly Undercapitalized) - Supplementary Leverage Ratio: ≥3% (Adequately Capitalized) ; <3% (Undercapitalized) - Tangible Equity to Total Assets: ≤2% (Critically Undercapitalized) - PCA consequences escalate as capital deteriorates up to conservatorship/receivership for Critically Undercapitalized institutions. ### Assessment — Principle 16: Largely Compliant - Comments: - Robust framework overall; transition to Basel III and new rules underway. - Concerns remain on exclusion of operational risk and CVA in standardized approach and other implementation differences versus Basel. - Stress testing is resource‑intensive but central to forward‑looking capital planning. *Source: Capital adequacy regime and related chapters (excerpts from _cr1589).* --- ### Supervisory structure, independence, cooperation and tools (Principles 1–3, 8–12) ### Structure, mandates and independence - Dual banking system: federal or state charters; each bank subject to a primary federal banking supervisor (OCC, Federal Reserve, or FDIC) irrespective of charter. - Key arrangements: - OCC: national banks and federal savings associations; federal branches/agencies of foreign banks. - Federal Reserve: state member banks; consolidated supervision of BHCs and FHCs; regulation/supervision of SLHCs. - FDIC: state nonmember banks and state savings associations that are non‑Federal Reserve members; operates federal deposit insurance program; backup enforcement authority. - FBAs operationally independent, self‑funding, statutory safeguards and legal protections; assessors found no evidence of direct interference by industry or government. ### Cooperation, colleges and cross‑border frameworks - Formal forum: FFIEC prescribes uniform federal principles and standards; FFIEC includes FBAs and CFPB representation. - FSOC created by DFA to identify systemic risks and designate nonbank SIFIs; FSOC voting membership includes Treasury Secretary, heads of FBAs, heads of CFPB, SEC, CFTC, FHFA, NCUA, and an independent insurance expert. - Supervisory colleges and Crisis Management Groups (CMGs) established for G‑SIFIs and large cross‑border groups; cooperation improving but coordination with state banking agencies is uneven. ### Supervisory approach, tools and intensity - Risk‑based, tiered supervisory intensity using asset thresholds: - Banks with at least $10bn of assets: continuous assessment and resident teams; annual company stress testing requirement. - Banks with at least $50bn of assets: most intensive supervision; subject to CCAR, enhanced prudential standards and heightened expectations. - Advanced approaches and market risk thresholds apply at $250bn or $10bn on‑balance foreign exposure. - Mix of on‑site and off‑site tools: CAMELS/UFIRS, RFI for BHCs, ROCA for FBOs, horizontal reviews, stress testing, supervisory letters, MRAs/MRBAs/MRIAs. - On‑site cycle: full‑scope on‑site required at least once every twelve months (may be lengthened to 18 months for qualifying banks); risk‑based cycle adjustments. - Supervisory resource increases post‑crisis, especially for large banking organizations; 70 (approximate number) reported in OCC’s Special Supervision function (preserved text), over 100 matters requiring attention seen for some firms. ### Supervisory reporting and data infrastructure (Principle 10) - Regulatory reporting: - Quarterly Call Reports for federal banks and savings associations (FFIEC 031/041). - FR‑Y9 consolidated reports for holding companies with consolidated assets of $500 million or more. - BHCs below $500 million submit parent‑only reports semi‑annually. - Data systems and tools: Federal Reserve NIC; C‑SCAPE; OCC SAT, Examiner View, LBID, Canary ratios, Tableau visualizations; FDIC LIDI program. - Key omission: no mandatory solo‑level reporting (no bank‑stand‑alone data); assessors judged omission not materially significant at assessment time given small scale of subsidiaries, but recommended monitoring and possible future introduction of solo reporting if structures change. ### Follow‑up, MRAs and enforcement (Principle 11) - Supervisors use informal and formal corrective measures; PCA statutory triggers provide objective capital thresholds. - Observed weaknesses: - MRAs/MRIAs sometimes aged beyond expected timelines; follow‑up needs to be stricter. - Recommendation: consider rules promoting early action for triggers other than capital and explicit processes for ageing MRAs/MRIAs. - Enforcement tools: written agreements, cease and desist orders, civil money penalties, removal/prohibition of IAPs (12 U.S.C. 1818), conservatorship/receivership (FDIC jurisdiction for insured banks). ### Assessment snapshots - Principle 1 (Responsibilities): Largely Compliant. - Principle 2 (Independence/resourcing): Compliant. - Principle 3 (Cooperation/collaboration): Compliant. - Principle 8 (Supervisory approach): Compliant. - Principle 9 (Supervisory techniques and tools): Largely Compliant. - Principle 10 (Supervisory reporting): Compliant. - Principle 11 (Corrective powers): Compliant. - Principle 12 (Consolidated supervision): Largely Compliant (outstanding SLHC rules and capital treatment). *Source: Supervisory powers, responsibilities and functions excerpts (from _cr1589).* --- ### Concentration risk, large exposures and related‑party transactions (Principles 17–20) ### Financial sector size & systemic context (numeric facts preserved) - Financial sector assets stabilized at about 480 percent of GDP since the crisis. - Depository institutions, pension funds, mutual funds and insurance companies account for around 70 percent of financial sector assets. - Financial system contributes about 20 percent to U.S. GDP and around 25 percent of U.S. corporate profits. - Banks hold 16 percent of all assets held by financial institutions. - Five largest banks account for about 45 percent of U.S. banking system total assets and around 40 percent of GDP. - Eight large banks are designated as G‑SIBs. - Outstanding debt securities at end‑2013: nominal value about $39 trillion (230 percent of GDP). - U.S. derivatives market outstanding notional: $237.0 trillion (1400 percent of GDP); four large banks represent 93 percent of banking industry notional amounts; interest rate products comprise 82 percent of notionals. ### Concentration risk and large exposures (Principle 19) - Supervisory framework effective for credit concentration; guidance exists for specific concentration areas and is followed in reviews. - Gaps noted: - Detailed supervisory framework and guidance for market and other non‑credit concentrations (asset classes, products, collateral, currencies) is not well developed. - Separate limits for money market investments and securities holdings continue and may leave possibilities of excessive concentrations; assessors note DAR recommendation to include these exposures in 15+10 limits not adopted. - 50 per cent limit on corporate group exposures identified as problematic and potentially out of line with AC1. - FBAs encouraged to finalize large exposures framework, with legal limits, for large BHCs and FBOs. - Stress testing linkage: concentration risk beyond credit concentration not routinely embedded in stress tests; recommended to incorporate such scenarios. ### Related party exposures and insider limits (Principle 20) - Gaps in related party regime: - No formal requirement for prior board approval of transactions with affiliated parties or for write‑offs exceeding specified amounts. - No formal requirement for ongoing board oversight of related party transactions and exceptions. - No formal limit framework for holding company transactions with affiliates or insiders. - Aggregate lending to insiders limit: 100 per cent of a bank’s capital and surplus (and 200 per cent for smaller banks) — assessors consider this higher than prudent practice and a potential risk. - “Related party” regime narrower than CP definitions (exclusions for certain contracts and affiliates). - Assessment: Principle 20 rated Largely Compliant. - Recommendations: - Broaden legal/regulatory definition of “related party” to align with CP. - Introduce formal board approval and ongoing oversight requirements for related party transactions and write‑offs above thresholds. - Reassess aggregate limits for insider lending; establish regulated limits or oversight for holding company transactions. *Source: Concentration risk, large exposures and related party sections (excerpts from _cr1589).* --- ### Risk management, governance, operational risk and AML/CFT (Principles 14–15, 23–29) ### Corporate governance and board responsibilities (Principle 14) - Strengthened supervisory expectations: SR 12‑17 and OCC “Heightened Standards” promote greater board engagement, risk committees and enhanced board skills. - Board expectations include: clear strategy and risk appetite, senior management expertise, independent internal audit and risk functions, MIS support for oversight, alignment of compensation with risk appetite. - Assessment: Principle 14 rated Largely Compliant; further progress needed, particularly delineation of board vs management roles and implementation across smaller firms. ### Risk management (Principle 15) - Tiered expectations by asset size: - ≥$10bn: company‑run annual stress tests and risk committee requirements. - ≥$50bn: enhanced Prudential standards, Federal Reserve Capital Plan Rule, CCAR, CLAR. - Advanced approaches threshold: $250bn or $10bn foreign exposure. - Risk management components: board and senior management oversight, policies/limits, MIS, validation, model governance, independent validation, CRO arrangements. - Assessment: Principle 15 rated Largely Compliant; implementation remains work‑in‑progress especially for smaller banks and full aggregation across GSIBs. ### Interest rate risk in the banking book (IRRBB, Principle 23) - IRRBB framework is principles‑based with no tiering; no specific capital requirement or supervisory limits set. - Guidance: 1996 policy and recent interagency advisories; recommendation to update 1996 guidance to include more quantitative guidance due to elevated interest rate exposure and concentration in small bank sector. - Assessment: Principle 23 rated Compliant. ### Operational risk and IT resilience (Principle 25 and related) - Operational risk regime outside AMA banks not fully mature; no overall operational risk definition or standardized capital charge for non‑AMA banks. - AMA banks (at time of assessment, only 8 banks) have well‑specified guidance and explicit operational risk capital. - Agencies increasing emphasis on operational risk and coordinating inter‑agency guidance; cyber risk identified as top priority. - Supervisory programs for IT, outsourcing and third‑party resilience in place (FFIEC, OCC Bulletins, MDPS Program). - Assessment: Principle 25 overall Largely Compliant; authorities encouraged to develop more comprehensive reporting and standardized regimes. ### Internal controls, audit and external audit (Principles 26–27) - Internal audit function subject to higher supervisory attention; OCC Heightened Standards specify phased QAIP and internal audit expectations by asset thresholds (detailed compliance dates preserved in source). - Section 404 Sarbanes‑Oxley and FDICIA requirements apply at various asset thresholds ($1bn, $500 million). - External auditors: - No statutory requirement for immediate direct reporting to supervisors when auditors identify matters of significant importance; mitigated by frequent contact between supervisors and auditors. - Section 203 SOX rotation requirement enforces five‑year lead partner rotation and five‑year timeout. - Agencies may require access to external auditor work papers (12 U.S.C. §1831m(g)(3)(A)). - Assessment: Principle 26 Compliant; Principle 27 Largely Compliant. ### Disclosure, transparency and market discipline (Principle 28) - Extensive public and supervisory disclosure framework: call reports, FR‑Y series, UBPR, QBP, SDI; Basel III Pillar 3 disclosure to apply from 1 January, 2015 for adopting banks. - No mandatory ongoing intra‑period public disclosures beyond standard reporting cadence (quarterly). - Assessment: Principle 28 Compliant. ### Abuse of financial services, BSA/AML (Principle 29) - Strong regulatory and supervisory focus on BSA/AML; thousands of AML inspection actions and hundreds of enforcement actions in recent years. - Gaps identified: - No explicit requirement to identify ultimate beneficial owner (UBO) of legal entity clients at time of assessment; proposed amendments under public consultation expected to address this. - Supervisory expectation rather than explicit requirement that decisions to accept high‑risk accounts (including PEPs) be escalated to senior management. - Domestic PEPs not explicitly encompassed in U.S. PEP definition (foreign nationals only). - Assessment: Principle 29 Largely Compliant. - Recommendations: - Explicitly require escalation to senior management for high‑risk relationships (including foreign and domestic PEPs). - Approve and implement UBO identification amendments. *Source: Risk management, governance, operational risk and AML/CFT sections (excerpts from _cr1589).* --- ### Financial sector structure, market roles and systemic vulnerabilities ### Size and composition (key figures preserved) - Financial sector assets: about 480 percent of GDP. - Pension funds: about 20 percent of total financial sector assets; defined benefit plans represent 45 percent of pension funds’ liabilities; 70 percent of defined benefit schemes funded at end‑2013. - Banking sector: - Banks hold 16 percent of financial institutions’ assets. - Number of banks declined to an all‑time low in 2014q1. - Problem banks decreased from around 500 at peak in 2010 to around 200 by assessment time. - Five largest banks: about 45 percent of banking system assets. - HHI for banking system: 0.045. - Shadow banking estimated at 90 percent of GDP; ABS issuer balance sheets contracted; GSEs’ proportion of credit market debt increased. - Outstanding debt securities at end‑2013: nominal value about $39 trillion (230 percent of GDP). - Derivatives: notional $237.0 trillion (1400 percent of GDP); four banks hold 93 percent of notional amounts. ### Market roles and vulnerabilities - Mortgage market: GSEs and banks main providers. - Securities repo market: dominated by broker‑dealers. - Corporate debt financing: insurance and mutual funds important. - Funding vulnerabilities: - Investment banks depend on wholesale funding. - CCAR stress tests show capital ratios would fall significantly under severe market shock with sizable trading losses. *Source: Financial sector size and composition section (excerpts from _cr1589 — 34. The U.S. has a large, diverse financial sector).* --- *Source: IMF — United States: Financial Sector Assessment Program update (content unit _cr1589; excerpts and numbered paragraphs reproduced from the supplied PDF).* ### INTRODUCTION ________________________________________________________________________________ 12 ### INTRODUCTION ### Overview and Methodology - Assessment unit: United States federal banking agencies (FBAs) defined for this assessment as the OCC, the Federal Reserve and the FDIC. - Document structure (major sections listed in the source): Information and Methodology Used for Assessment; Institutional and Market Structure—Overview; Preconditions for Effective Banking Supervision; Detailed Assessment (A. Supervisory Powers, Responsibilities and Functions; B. Prudential Regulations and Requirements); Summary Compliance with the BCP; Recommended Actions and Authorities Comments (A. Summary of Recommended Actions; B. Authorities’ Response to the Assessment). ### Summary and Key Findings (numbered paragraphs reproduced from source) - 1. The U.S. federal banking agencies (FBAs) have improved considerably in effectiveness since the previous FSAP. In response to global and domestic reforms, particularly the Dodd-Frank Act (DFA), the FBAs have stepped up their supervisory intensity, especially of large banking organizations, putting emphasis on banks’ capital planning, stress testing and corporate governance. To match, the FBAs have also enhanced their supervisory capacity, adding significantly to their staffing numbers and skills base. - 2. These improvements are reflected in the high degree of compliance with the Basel Core Principles for Effective Banking Supervision (BCP) in this current assessment. Shortcomings have been observed, particularly in the treatment of concentration risk and large exposures, but they do not raise concerns overall about the authorities’ ability to undertake effective supervision. These shortcomings should, however, be addressed if the United States is to achieve the standards of supervisory effectiveness expected of one of the most systemically important financial systems in the world. - 3. The Dodd-Frank reforms have resulted in some rationalization of supervisory responsibilities but they did not address, fundamentally, the fragmented nature of the U.S. financial regulatory structure. This was an opportunity lost. The problems inherent in multiple regulators with distinct but overlapping mandates remain, with the new challenge of delineating responsibilities with a stand-alone consumer protection agency. The FBAs are committed to making the revised arrangements work and cooperation has clearly improved. Nonetheless, there is substantial duplication of supervisory effort, particularly in respect of entities in major banking groups, and the ongoing risk of inconsistent messages from the agencies. Against this background, the assessors saw scope to sharpen supervisory mandates and opportunities for a more targeted allocation and commitment of resources to the supervision of smaller banking institutions. - 4. The U.S. prudential regulatory regime is a complex structure of federal statutes, regulations and reporting requirements, and policy statements and supervisory guidance. Since the crisis, the DFA and other initiatives have introduced various “tiers” of prudential requirements for banks and bank holding companies, which underpin the heightened supervisory focus on large banking organizations but have added to the complexity of the regime. Many requirements of the BCP are in practice, however, determined by the supervisor under a principles-based approach. Such an approach provides flexibility for supervisors to tailor their actions to each individual situation and be more nuanced in their response. Under the Office of the Comptroller of the Currency (OCC)’s new “Heightened Standards”, for example, the supervisor has a range of informal and formal corrective responses that can be pursued before formal enforcement actions—which, in the U.S., are published—are taken. Of course in benign circumstances, when the financial situation of a bank is still satisfactory, a principles-based approach may encourage a delayed supervisory response. However, the assessors observed that banks were responsive to informal guidance and “best practice” recommendations from the FBAs and that supervisory oversight based on that guidance has stepped up in intensity. In the upturn of the cycle, it is important that good supervisory practice established under crisis conditions be maintained. - 5. In many cases, this principles-based approach is reflected in a lack of specificity in the regime, for example, the absence of guidelines or supervisory “triggers” for various risks. A greater degree of specificity would be consistent with the principles-based approach and would have three potential benefits: (i) the agencies would have an opportunity to make a preventative statement on risks that signals to banks where greater intensity of supervision can be expected; (ii) greater specificity would be a useful way to articulate the supervisors’ risk appetite and hence shorten the time gap between the build-up of risks and a supervisory response; and (iii) greater specificity would provide a useful (internal) reference point for offsite and continuous monitoring and an indicator of when a bank’s risk profile might need to be escalated up the supervisory management chain. There are a number of ways this greater level of specificity can be achieved within a principles-based approach, starting with agency statements to banks of areas that merit greater supervisory intensity and moving to more formal (internal) triggers for supervisory action. - 6. Since the crisis, there has also been a marked improvement in the risk management practices of banking organizations, an area identified to have material shortcomings in the previous FSAP. Consistent with global initiatives to “raise the bar” in risk management, the improvements are apparent in the greater engagement and skill levels of many boards, the strengthening of the risk management function itself, and in the aggregation of risk data. Nonetheless, these efforts are best described as “work-in-progress” from what was, in many cases, a lower starting point than in some major jurisdictions. The full implementation of the OCC’s “Heightened Standards” will add impetus to these efforts, as would a clearer delineation of the contribution of boards and senior management in supervisory assessments. - 7. The U.S. system of multiple FBAs with distinct but overlapping responsibilities continues to put an absolute premium on effective cooperation and collaboration. The FBAs will need to ensure that the significant improvements in collaboration in recent years become fully engrained in the modus operandi of each agency. Internationally, the establishment of supervisory colleges and crisis management groups (CMGs) has given greater urgency to information-sharing arrangements and there are no legal or other impediments to the ability and willingness of the FBAs to cooperate and collaborate with foreign supervisors. The dual banking structure does pose a challenge for international cooperation, and state banking agencies with Foreign Banking Organization (FBO) presence do not always inform or coordinate enforcement actions with home supervisors. - 8. The FBAs are operationally independent, and have clear mandates for safety and soundness of the banking system. However, the FBAs also have other objectives, and the primacy of the safety and soundness objective needs to be better enshrined in legislation or mission statements to ensure a clear focus on this objective in different phases of the business cycle. In principle, the creation of a stand-alone Consumer Financial Protection Bureau (CFPB) should help establish a greater delineation between individual consumer issues and prudential issues and give the FBAs a clearer sense of purpose, but the delineation is not yet sharp. There is no evidence of direct interference by industry and government in supervisory priorities or decisions. The high level of public and congressional scrutiny and resulting sentiment may have an indirect effect in creating a perception of “cyclical” supervisory responses. - 9. The dual banking structure with charter choice adds to the challenge of cooperation and collaboration across multiple agencies. Banks may in principle choose to operate under a federal or state charter that best accommodates their business or strategic needs. Further, state-chartered banks may choose between being supervised primarily by the FDIC or primarily by the Federal Reserve as a member bank, in addition to the supervision of their state supervisory authority. Concerns have been raised that this choice can give rise to “regime shopping” that can undermine the integrity of U.S. regulatory arrangements. The DFA has restricted the ability of weak and troubled banks to change charters, but charter conversions of (well-rated) banks and savings associations continue on a modest scale. The FBAs need to guard against perceptions of differences in supervisory style or treatment in their regional offices that could sway the choices made by banks in charter conversions. - 10. The FBAs have significantly increased their level of resources and intensity of supervision of the largest firms, and have articulated a tiered approach built on asset-based thresholds to achieve the desired proportionality. The traditional focus on on-site examinations has changed a little as there has been a shift towards more stress testing, analysis and horizontal reviews. Overall, the supervisory regime is effective and risk-based. There is an increasing focus on resolution (for the larger firms). There remains scope for better prioritization of matters requiring attention and their communication to banks and for aligning supervisory planning cycles across agencies. - 11. The FBAs have a long-established and effective regulatory reporting framework, with the flexibility to expand reporting requirements in response to pressing supervisory needs. There are safeguards built in to guard against redundant data items and information overreach. A lacuna is that supervisory data is not collected from banks at the solo level (i.e. at the level of the bank excluding its subsidiaries), which means supervisors and market participants may not have the information to test whether a bank is adequately capitalized on a stand-alone basis. In practice this omission has little prudential significance under current circumstances as bank subsidiaries tend to be small relative to the parent bank and can only undertake limited activities that the bank itself could undertake in its own name, but supervisors should closely monitor the development of banking groups and consider introducing solo level reporting if the number or size of bank subsidiaries were to expand or banking groups become less transparent. - 12. The FBAs have a wide range of supervisory actions available to address safety and soundness concerns and do not hesitate to use them, although follow-up needs to be stricter. The PCA framework is the main plank of the early intervention framework and has clear triggers. The authorities could consider implementing rules for promoting early action for other triggers than bank capital as well as introduce more explicit rules and processes to deal with ageing of MRAs/MRIAs. - 13. Following up on the 2010 FSAP, there have been major improvements in the ability of the FBAs to implement a comprehensive framework for consolidated supervision. Work still remains outstanding, though, on developing regulatory and supervisory rules, guidance, and a formal rating system for SLHCs, as well as on developing a capital rule for corporate and insurance company SLHCs. - 14. Reflecting the large cross-border activities of U.S. banks and of foreign banking groups in the U.S., there is a comprehensive framework of policies and processes for co-operation and exchange of information between the FBAs and foreign supervisory authorities. As noted above, this is currently being strengthened by the work in supervisory colleges and in CMGs. The authorities should continue their efforts to establish agreements with their foreign counterparts on a framework of communication strategies, especially for crisis situations. While national treatment is the underlying principle, there remain some instances in which specific rules apply only to foreign institutions, such as the shorter run-off period for foreign branches in liquid asset requirements and requirements on FBOs to set up intermediate U.S. holding companies. - 15. Reflecting the global learnings from the crisis, major changes have taken place in supervisorś demands on banks’ corporate governance and in the banks’ own approaches. Laws and regulations have gradually raised the requirements and there is clearly heightened focus by boards and management on corporate governance issues. The demands on board involvement and skills have increased substantially and this has, in many instances, led to changes in board composition and calls for wider skill sets of directors. In general, supervisory expectations are tailored to be less strict for smaller, non-systemic banks. This means that there is a shortfall from the criteria, but the assessors judged that this was not sufficiently material to alter their overall conclusions. The assessors welcome that supervisors are encouraging medium and small banks with higher risk activities to adopt better practices in corporate governance and risk management that are appropriate for the risk profile of these firms, moving them closer to the criteria and some of the principles outlined in the requirements for the larger banks. - 16. There have been substantial improvements in the risk management processes of banks, and risk aggregation has been greatly facilitated by the stress testing requirements. Given the enormity of the task of achieving and sustaining meaningful risk aggregation across the Global Systemically Important Banks (GSIBs), this remains very much work in progress and may take years to complete. Other areas in which progress needs to be made are a better delineation in supervisory guidance of the responsibilities of the board and management and more emphasis on contingency planning, particularly at the smaller end of the banking sector. The level of commitment to stress testing is substantial and there is considerable consensus that the outputs and outcomes of that process were significant in improving risk aggregation. Supervisors and firms were becoming more efficient with each iteration and standards required were also increasing, although there is some way to go before supervisory led stress tests achieve an optimum state of data granularity. There is still room for improvement in firm-led stress testing, where firms seem to be struggling to determine the appropriate severity, whilst maintaining a scenario that remains business relevant. ### Identified Strengths - High degree of compliance with the Basel Core Principles for Effective Banking Supervision (BCP) in this assessment. - Marked improvements since the previous FSAP in supervisory intensity, staffing, skills, and board engagement. - Strong supervisory focus on capital planning, stress testing, corporate governance, and resolution planning for larger firms. - Comprehensive framework for cooperation with foreign supervisors, supported by supervisory colleges and crisis management groups (CMGs). ### Identified Weaknesses and Areas for Improvement - Fragmented regulatory structure with multiple agencies and overlapping mandates; risk of duplication and inconsistent messages. - Shortcomings in treatment of concentration risk and large exposures. - Complexity added by “tiers” of prudential requirements and a principles-based approach that often lacks specificity and supervisory “triggers.” - Need to better enshrine the primacy of safety and soundness in legislation or mission statements. - Lack of solo-level supervisory reporting from banks (no solo level data collection). - Follow-up to supervisory actions needs to be stricter; consider early action rules beyond bank capital triggers and processes to address ageing MRAs/MRIAs. - Outstanding work on SLHCs: regulatory and supervisory rules, guidance, formal rating system, and capital rule for corporate and insurance company SLHCs. - Continued work-in-progress on risk aggregation across GSIBs and improvements required in firm-led stress testing and contingency planning for smaller banks. ### Recommended Focus Areas (implicit in source findings) - Address shortcomings in concentration risk and large exposures to meet standards expected of a systemically important financial system. - Sharpen supervisory mandates and reduce duplication by clarifying roles across FBAs and with the CFPB where appropriate. - Increase specificity within the principles-based supervisory approach via agency statements and internal triggers to improve preventative supervision and risk escalation. - Consider introducing solo-level reporting if banking group structures change materially. - Strengthen follow-up on supervisory actions and expand early action frameworks beyond capital triggers. - Complete regulatory and supervisory frameworks for SLHCs, including a capital rule for corporate and insurance company SLHCs. - Enhance data granularity and firm-led stress testing practices to improve risk aggregation and scenario relevance. *Source: INTRODUCTION (pages and numbered paragraphs provided in the source PDF unit).* ### 17. There is a robust and comprehensive approach to setting prudent and adequate ### 17. There is a robust and comprehensive approach to setting prudent and adequate ### Capital adequacy regime and reforms - The FBAs have implemented major elements of the Basel II advanced approaches from I January, 2014. - The U.S. standardized approach based on Basel II will begin to come into effect from 1 January, 2015. - The broad adoption of the Basel III definition of capital, when applicable to most banks from 1 January 2015, will improve the quality of bank capital by limiting the extent to which certain intangibles can be included in capital. - Stress testing is entrenching a forward-looking approach to capital needs and engaging boards and senior management more fully in the capital planning process. - Introduction of risk-based capital rules based on Basel standards for most savings and loan holding companies removes an anomaly created by the previous case-by-case determination of capital requirements, although a comprehensive capital framework for all savings and loan holding companies is not in place. - Differences between the new U.S. capital regime and the relevant Basel framework include: - Absence of a capital charge for operational risk in the U.S. standardized approach. - Absence of a capital charge for Credit Value Adjustment (CVA) risk in the U.S. standardized approach, which provides the “floor” for the advanced approach banking organizations and applies to all other banking organizations. ### Provisions, reserves, and accounting changes - The long-established and rigorous process for evaluating banks’ approaches to problem assets and the maintenance of adequate provisions and reserves will be bolstered by accounting changes currently on the anvil. - The FBAs have shown a consistent willingness to challenge unrealistic bank estimates of provisions and reserves and to secure increases they judge necessary. - Supervisory judgments have been constrained by the “incurred loss” approach of U.S. GAAP. - The introduction of the FASB’s proposed Current Expected Loss Model (CELM) will permit more forward-looking provisioning. ### Concentration risk and large exposures - The supervisory framework for credit concentration risk is effective; guidance has been issued on specific areas of concentration of credit risk and is followed up in supervisory reviews. - Supervisors are increasingly attentive to concentration risk in counterparty credit risk management and stress testing frameworks. - The new BCP methodology has expanded this Core Principle to include market and other risk concentrations “where a bank is overly exposed to particular asset classes, products, collateral, or currencies”. - Evidence of punctual supervisory action exists (for instance, funding concentration), but a detailed supervisory framework and supervisory guidance for market and other risk concentrations is not well developed. - The widening of the definition of large exposures under the DFA has brought large exposure thresholds more into line with the requirements of the BCP, but some anomalies and omissions remain. - Separate and additional limits available to banks for money market investments and security holdings continue to leave open the possibility of excessive risk concentrations. - The 50 per cent limit on exposures to a corporate group is identified as problematic. - Authorities are encouraged to finalize the large exposures framework, with legal limits, for large bank holding companies and foreign banking organizations. ### Related party exposures - Gaps remain in the related party exposure framework that may heighten concentration risk. - There are no formal requirements for: - Prior board approval of transactions with affiliated parties or the write-off of related party exposures exceeding specified amounts. - Board oversight of related party transactions and exceptions to policies, processes and limits on an ongoing basis. - In practice, the FBAs expect banks to apply a high degree of board oversight and monitoring of affiliate and insider transactions and review this as a matter of practice on offsite and onsite examinations. - Statutes impose limits on a bank’s exposures to affiliates and insiders that, with one exception, are at least as strict as those for single counterparties or groups of counterparties. - The exception is the aggregate limit for lending to insiders of 100 per cent of a bank’s capital and surplus (and 200 per cent for smaller banks); this limit is higher than prudent practices and creates the risk that a small group of insiders could deplete the own funds of a bank. - There is no formal limit framework for holding company transactions with their affiliates or insiders, which is needed for a comprehensive framework for transactions with related parties. - The “related party” regime in the U.S. regulatory framework does not appear as broad as required by this CP. ### Interest rate risk in the banking book (IRRBB) - The approach to IRRBB contrasts with other key risks and could be usefully updated. - Market and liquidity risk regimes are tiered to support a risk-based approach and are comprehensive and robust; market risk would benefit from introduction of a de-minimis regime for all banks and liquidity risk from more granular and frequent reporting. - The IRRBB framework has no tiering (although supervisory practice seems proportionate to the risk) and is firmly principles-based. - No specific capital is being set aside against a change in interest rates, nor are any supervisory limits set. - Given the stage of the U.S. economic cycle, the inherent interest rate exposure is high and there are particular concentrations in the small bank sector. - Updating the 1996 guidance to include more quantitative guidance is merited to reduce inconsistency across the sector and across time. ### Operational risk and controls (CP 26-29) - The overall regime for operational risk outside the AMA banks has not reached a sufficient level of maturity. - There is no overall definition of operational risk, or structured guidance on identification, management and mitigation of operational risks for non-AMA banks. - Guidance for banks under AMA (at the time of this assessment, only 8 banks) is well specified; for all other banks operational risk management falls within “general” risk management and guidance is disparate. - Weaknesses are compounded by the absence of a comprehensive reporting regime. - There is not a standardized capital charge for operational risk. - Several initiatives were underway at the time of the assessment: - FBAs are placing increasing emphasis on operational risk issues. - FBAs are coordinating on the production of additional inter-agency guidance. - FBAs are identifying and seeking mitigation of a number of issues in their vertical and horizontal reviews. - Authorities are alert to the changing threat landscape, including escalation of fines and penalties from litigation and cyber risks. - Dealing with cyber risk is a top priority across all agencies and will pose coordination and operational challenges given the nature of the risk and the need to collaborate with other arms of government. ### Audit, controls, disclosure, and abuse of financial services - Internal audit function is subject to greater supervisory attention and expectations have been significantly raised. - There is little mention of the compliance function except with reference to the regime of the Bank Secrecy Act and Anti-Money Laundering (BSA/AML). - Significant resources are deployed by authorities and firms to meet BSA/AML standards, but attention to vulnerabilities to other forms of criminal abuse (e.g. theft, burglary) is more disparate. - At the time of the assessment, the regulatory framework did not include: - Adequate identification of the ultimate beneficiary owner of legal entity clients. - Processes for dealing with domestic Politically Exposed Persons (PEPs). - On external audit, there is no requirement for an external auditor to report immediately directly to the supervisor should they identify matters of significant importance; this gap is mitigated by frequent contact between supervisors and auditors in the course of planning and examinations. - The disclosure regime represents best practice in some respects: public disclosure of supervisory call reports promotes market discipline. - Gaps remain: not all banks are required to issue full financial statements reviewed by an independent accountant in accordance with independent audit requirements. - The U.S. definition of “reporting on a solo basis” differs in that it does not collect or disclose data on a “bank stand-alone basis.” ### Assessment context and methodology (introductory points) - The assessment was completed as part of an FSAP update undertaken by the IMF from 21 October to 10 November 2014 and reflects the regulatory and supervisory framework in place as of the date of completion of the assessment. - The assessment focused on the three FBAs as the main supervisors of the banking system and did not cover State regulators, supervision of credit unions, or activities of the CFPB. - The U.S. authorities agreed to be assessed according to the Revised BCP Methodology issued by the BCBS in September 2012 and chose to be assessed against both Essential Criteria and Additional Criteria. - A four-part grading system is used: compliant; largely compliant; materially noncompliant; and noncompliant. *UNITED STATES INTERNATIONAL MONETARY FUND* ### 34. The U.S. has a large, diverse financial sector, with assets stabilizing at about ### _cr1589 - 34. The U.S. has a large, diverse financial sector, with assets stabilizing at about ### Financial sector size and composition - Financial sector assets stabilized at about 480 percent of GDP since the crisis. - Depository institutions (mostly banks), pension funds, mutual funds and insurance companies account for around 70 percent of the financial sector assets. - The U.S. financial system contributes about 20 percent to the U.S. GDP and around 25 percent of U.S. corporate profits. - Structural changes since the last FSAP: - Mutual funds’ assets have increased. - Asset Backed Securities (ABS) issuers have continued to reduce their balance sheets. - The proportion of credit market debt owed by Government-Sponsored Enterprises (GSEs) has increased. - Corporate equities’ market has grown in size and the mortgage market has shrunk. - Financial sector’s share of corporate profits reached a record high in early 2000s, dipped to a record low in 2008, and returned to its longer-term trend by 2013; contribution to gross value added has remained relatively stable. ### Credit intermediation and market roles - Credit intermediation is decentralized; no single sector dominates the overall credit market. - Mortgage credit providers: - GSEs and banks are the main providers of mortgage credit (the largest credit market). - Consumer credit market: - Banks play an important role together with finance companies. - Market for agency and GSE-backed securities: - Banks, the Fed and mutual funds play important roles. - Securities repos market: - Broker-dealers are the main players. - Corporate debt securities financing: - Insurance sector and mutual funds are the main source of financing. ### Pension funds - Pension funds sector is the largest financial sector, accounting for about 20 percent of total financial sector assets. - Private pension funds account for one half of pension funds’ assets and the other half pertains to federal, state and local government retirement funds. - The pension system structure has been stable since 2010, with defined benefit plans representing 45 percent of pension funds’ liabilities. - Only 70 percent of defined benefit schemes are funded at the end of 2013. - Pension sector asset allocation: diversified across debt securities and shares, remainder across investments in MMF and mutual funds shares and private equity. ### Banking sector - Banks hold 16 percent of all assets held by financial institutions. - Banks are the second largest financial sector after pension funds. - Number of banks has been on a downward trend since early 1990s and fell to an all time low level in 2014q1. - Problem banks: - Decreased from around 500 at the peak in 2010 to around 200, but still above the number before the crisis. - Bank balance sheet and income developments: - Banks now hold more liquid assets, grant less loans and hold less trading account assets (both in absolute and relative terms). - Banks have attracted more deposits, hold more capital, rely less on credit borrowing and are less leveraged. - Profits have reached pre-crisis levels (in nominal terms) mainly due to lower provisions and lower interest expenses. - Coverage ratio stabilized since 2009; net charge off rate is slightly above the level before the crisis. - Stress test and funding vulnerabilities: - CCAR stress tests show that, if hit by a severe global market shock, banks’ capital ratios would fall significantly and banks would face sizable losses from trading activities. - Investment banks have non-trivial dependence on wholesale funding, a source of vulnerability in periods of severe financial market distress. - Concentration: - The five largest banks account for about 45 percent of the U.S. banking system’s total assets (which is twice the share 10 years ago) and around 40 percent of GDP. - Eight large banks are designated as G-SIBs. - While the proportion of the largest five banks has stabilized over the last four year, the share of banks with asset size larger than $10 bn has continued to increase since 2009. - Herfindahl–Hirschman index (HHI) for the banking system is equal to 0.045. ### Insurance sector - Insurance sector assets correspond to a half of the banking sector assets. - Life insurers account for the largest part of insurance sector assets. - Three U.S. insurers, AIG, Prudential and MetLife have been designated as G-SIIs. - AIG and Prudential have been designated by the Financial Stability Oversight Council (FSOC) as non-bank SIFIs; MetLife is in the process of designation. - Insurance sector concentration (top 10 insurers): - Life insurance: 58 percent - Health insurance: 71 percent - P&C: 46 percent ### Shadow banking and debt securities market - Financial intermediation outside the traditional banking system is estimated at 90 percent of GDP. - The debt securities market is dominated by corporate debt securities, treasury securities and GSE backed securities. - Shadow banking: - The size of the shadow banking system has contracted substantially since the peak in 2007 mainly due to lower borrowing of ABS issuers. - GSEs are the only segment of the shadow banking system that is now larger than before the crisis. - The definition of “shadow banking” is based on Pozsar and others (2010) and includes open market papers, overnight repos, net securities lending, liabilities of GSEs and ABS issuers and total shares outstanding of MMFs. - Outstanding debt securities at end-2013: - Nominal value about $39 trillion (230 percent of GDP). - Corporate bonds, including ABS securities, accounted for a third of this: - Half of corporate bonds issued by non-financial corporations. - 10 percent by ABS issuers (down from 30 percent before the crisis). - Proportion of treasury securities almost doubled since 2007 (from 17 percent to 32 percent). ### Derivatives market - The U.S. derivatives market represents 1/3 of the world market. - Notional amount of outstanding contracts totaled $237.0 trillion (1400 percent of GDP) and has been relatively stable since 2010. - Market concentration: - Four large commercial banks (JPMorgan Chase, Citibank, Bank of America and Goldman Sachs) represent 93 percent of the total banking industry notional amounts. - Product composition: - Interest rate products comprise 82 percent of total derivative notional amounts. - Foreign exchange contracts represent 12 percent of the derivatives market. - Credit derivatives (mostly Credit Default Swaps) represent 5 percent of total derivatives notionals. - Swap contracts represent 64 percent of all notionals; futures and forwards 18 percent; options 14 percent. - Based on reports of derivatives activities of 1,383 insured U.S. commercial banks and savings associations at the end of the fourth quarter 2013. - Most of the contracts are held for trading purposes. ### Structure for banking supervision - The United States operates under a “dual banking system” (federal or state charters). - Primary federal banking supervisors (each U.S. bank is subject to a primary federal banking supervisor irrespective of charter): - For national banks and federal savings associations: OCC. - For state banks that choose to be members of the Federal Reserve System (state member banks): Federal Reserve. - For state banks that choose not to become members of the Federal Reserve System (nonmember banks) and state savings associations: FDIC. - FDIC: - Operates the federal deposit insurance program. - Has authority to examine state nonmember banks and to examine any bank for insurance purposes directly or in cooperation with state or other federal supervisory authorities. - Has backup enforcement authority over all banks. - OCC: - Responsible for chartering, regulating, and supervising all national banks and federal savings associations and for supervising federal branches and agencies of foreign banks. - Federal Reserve: - Supervises holding companies (including financial holding companies) and nonbank subsidiaries of holding companies (Federal Reserve/Functional Regulator). - Consolidated supervisor of all BHCs and FHCs on a worldwide consolidated basis. - Regulates and supervises SLHCs. - Foreign Banking Organizations (FBOs): - May do business under a policy of “national treatment.” - No FBO may establish a branch or agency, or acquire ownership or control of a commercial lending company, without prior approval of the Federal Reserve. - Supervisory arrangements vary depending on federal or state licensing and charter. - Table 2. Supervised Institutions (As of June 30, 2014) — summary figures: - OCC: Number 1,628 Total Assets $10,408 (billions) - FDIC: Number 4,131 Total Assets $2,536 (billions) - Federal Reserve System: - State Member Banks: Number 860 Total Assets $2,188 (billions) - Bank Holding Companies: Number 4,452 Total Assets $17,429 (billions) - Savings and Loan Holding Companies: Number 314 Total Assets $2,230 (billions) - Foreign Banking Organizations (Program FBOs): Number 165 Total Assets $5,337 (billions) - Source: Federal Reserve Board ### Legal and regulatory reforms since the last FSAP - Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act or DFA) enacted in response to the crisis. Key features: - Creates an interagency council to monitor and coordinate responses to emerging threats to the financial system (FSOC). - Requires that large bank holding companies and systemically designated nonbank financial firms be subject to enhanced prudential standards. - Provides for consolidated supervision of all systemically important financial institutions. - Gives the government an additional tool to safely wind down financial firms whose failure could pose a threat to U.S. financial stability. - Strengthens supervision of systemically important payment, settlement, and clearing utilities. - Specific changes introduced by the DFA: - Enhances limitations on transactions among a BHC, a subsidiary bank, and its affiliates. - Incorporates a financial stability factor into statutory analysis of transactions governed by the BHC Act and the Bank Merger Act. - Incorporates financial stability considerations into supervision of holding companies. - Enhances requirements for holding companies to be eligible to engage in expanded activities. - Generally eliminates limitations under the Gramm-Leach-Bliley Act that restricted the Federal Reserve's ability to examine, obtain reports from, or take enforcement action against a functionally regulated subsidiary of a BHC. - Authorizes the Federal Reserve to examine the activities of nonbank subsidiaries of holding companies (other than functionally regulated subsidiaries) in the same manner, subject to the same standards, and with the same frequency as if such activities were conducted in the organization's lead subsidiary depository institution. - Prohibits a depository institution subject to a formal enforcement order or memorandum of understanding with respect to a significant supervisory matter from converting its charter unless supervisors establish a remediation plan. - Applies national bank and savings association loans-to-one borrower limitation to credit exposures arising from derivative transactions and securities financing transactions. - FSOC (Financial Stability Oversight Council): - Charged with monitoring and identifying emerging risks to financial stability across the entire financial system, identifying potential regulatory gaps, and coordinating agencies' responses to potential systemic risks. - Voting membership: Treasury Secretary (chair), heads of the three FBAs, heads of CFPB, SEC, CFTC, FHFA, NCUA, and an independent member with insurance expertise appointed by the President and confirmed by the Senate. - FSOC designations: - Tasked to designate systemically important large, interconnected nonbank financial firms; designated companies include American International Group, Inc., General Electric Capital Corporation, Inc., and Prudential Financial, Inc. - Authorized to designate financial market utilities (FMUs) as systemically important; in 2012 FSOC designated eight FMUs as systemically important: The Clearing House Payments Company L.L.C., CLS Bank International, Chicago Mercantile Exchange, Inc., The Depository Trust Company, Fixed Income Clearing Corporation, ICE Clear Credit LLC, National Securities Clearing Corporation (NSCC), and The Options Clearing Corporation. *Source: _cr1589 - 34. The U.S. has a large, diverse financial sector, with assets stabilizing at about* ### 52. The DFA also requires the Federal Reserve to conduct and publish summary results of ### _cr1589 - 52. The DFA also requires the Federal Reserve to conduct and publish summary results of ### Stress testing requirements and scope - The DFA requires the Federal Reserve to conduct and publish summary results of annual stress tests of systemic nonbank financial firms and BHCs with $50 billion or more in assets. - Such firms also are required to conduct their own stress tests on a semiannual basis. - The DFA requires financial firms with more than $10 billion in assets to conduct annual stress tests in accordance with regulations established by the respective primary federal financial regulatory agency. ### Foreign banking organizations (FBOs) and U.S. intermediate holding companies - New legislation requires foreign banking organizations with U.S. non-branch assets of $50 billion or more to establish a U.S. intermediate holding company over their U.S. subsidiaries. - The foreign-owned U.S. intermediate holding company generally will be subject to the same risk-based and leverage capital standards applicable to U.S. bank holding companies. - Intermediate holding companies will be subject to the Federal Reserve's rules requiring regular capital plans and stress tests. - FBOs with combined U.S. assets of $50 billion or more will be required to: - establish a U.S. risk committee; - employ a U.S. chief risk officer; - meet enhanced liquidity risk-management standards. - FBOs with total consolidated assets of $50 billion or more, but combined U.S. assets of less than $50 billion, are subject to enhanced prudential standards. - The capital, liquidity, risk-management, and stress testing requirements applicable to these foreign banking organizations are substantially less than those applicable to foreign banking organizations with a larger U.S. presence. ### Regulatory reorganization: dissolution of the OTS - The DFA dissolved the Office of Thrift Supervision (OTS). - Plenary regulatory and supervisory authority over SLHCs and savings associations was transferred to the FBAs as follows: - The Federal Reserve regulates SLHCs. - The OCC regulates federally chartered savings associations. - The FDIC regulates state-chartered savings associations. - Authorities transferred include the authority to supervise, issue rules, and take enforcement actions with respect to SLHCs and savings associations. ### Macroprudential framework and coordination bodies - The FFIEC (Federal Financial Institutions Examination Council) plays an important role in developing uniform approaches among the FBAs and acts as a forum for sharing technical information. - The FFIEC was created in 1978 to: - prescribe uniform federal principles and standards for the examination of depository institutions; - promote coordination of bank supervision among the U.S. FBAs; - encourage better coordination of federal and state regulatory activities. - FFIEC composition includes: - chairpersons of the FDIC and the National Credit Union Administration; - the Comptroller of the Currency; - the Director of the CFPB; - a governor of the Federal Reserve; - following 2006 legislation, the Chair of the FFIEC State Liaison Committee serves as a sixth member. - The FFIEC has developed uniform financial reports for federally supervised banks and facilitates exchange of views between state and U.S. FBAs. - FSOC was created to provide a central body for coordinating federal financial regulators; FSOC can issue nonbinding recommendations to member agencies. ### Financial safety nets and crisis management - Numerous liquidity back-stops were provided by the Fed during the crisis, but subsequent legislative changes appear to limit its ability to similarly respond in the future. - During the crisis, additional backstops mitigated specific risks, for example: - run risk in the money market funds sector; - collateral fire sale risk faced by primary dealers in TPR; - funding risk faced by depository institutions. - The DFA (section 214) and changes to the Federal Reserve Act (section 13.3) now seem to limit the provision of such assistance. - The Fed’s standing credit facilities (“discount window”) may benefit from reform: - The primary credit facility, for higher rated institutions, allows for borrowing on a ‘no questions asked’ basis. - Access to the secondary credit facility has conditions attached. - In both cases, activity must be disclosed under the Freedom of Information Act with a two year lag. - Separating the two more clearly might help reduce stigma associated with ‘normal’ use and reluctance to access the facility (this would focus stigma on the ‘emergency’ use facility). ### Resolution framework enhancements and the Orderly Liquidation Authority (OLA) - Title II (“Orderly Liquidation Authority”, OLA) of the DFA, enacted in July 2010, extended the FDIC’s resolution authority to “financial companies”. - OLA mandates appointment of the FDIC as receiver if the Secretary of the Treasury (in consultation with the President) determines that: - a financial company for which a systemic risk determination has been made is in default or in danger of default; - the failure would have a serious adverse effect on financial stability; and - no viable private sector alternative is available to prevent the default. ### Living wills and resolvability of large banking organizations - The DFA requires covered financial companies to prepare plans (“living wills”) for the orderly winding-up of such companies in the event of material financial distress or failure. - The Board of Governors of the Federal Reserve System and the FDIC concluded in August 2013 that plans submitted by the eleven largest banking organizations reflected important shortcomings, including failures to address structural and organizational impediments to orderly resolution. - The affected organizations were instructed to improve their resolvability and update their recovery plans accordingly by July 2015. ### Market discipline, business environment, accounting and auditing - Business laws in the United States, including contract, bankruptcy, and property law, are described as well-developed and reliable. - Contract law combines common law and state statute; enforceability of contracts is well-established and enforced by the courts. - Security interests are governed primarily under Article 9 of the Uniform Commercial Code; enforcement of mortgages of real property is upheld under (non-uniform) state laws. - Federal bankruptcy laws incorporate protections for both creditors and debtors. - Business law disputes are typically resolved in state trial courts of general jurisdiction; federal courts are available for federal law or diversity jurisdiction matters. - Contracts may provide for mandatory arbitration rather than court dispute resolution. - The United States has an independent judiciary and well-regulated accounting, auditing, and legal professions. - Federal judges are appointed by the President with the advice and consent of the Senate and receive lifetime appointments. - States vary in methods of judicial appointment; some use general election methods. - Lawyers must receive a license to practice law from a state or states; all states but one (Wisconsin) require applicants who are not already members of another state’s bar to pass a bar examination prior to receiving a license. - U.S. accounting standards (U.S. GAAP) are established by the Financial Accounting Standards Board (FASB); the FASB and IASB are working on a convergence program. - Financial statement audit requirements were considerably strengthened in 2002 with the passage of the Public Company Accounting Reform and Investor Protection Act (Sarbanes-Oxley Act), which: - enhanced audit scrutiny; - toughened auditor independence requirements; - required management attestations about reliability of financial accounts; - expanded disclosure requirements. *Source: UNITED STATES — INTERNATIONAL MONETARY FUND (excerpts from document sections 52–64).* ### 65. The assessment of compliance of each principle is made based on the following four-grade ### _cr1589 - 65. The assessment of compliance of each principle is made based on the following four-grade ### Assessment scale and grading definitions - The assessment of compliance of each principle is made based on the following four-grade scale: compliant, largely compliant, materially noncompliant, and noncompliant. A “not applicable” grading can be used under certain circumstances. - Compliant: - A country will be considered compliant with a Principle when all essential criteria applicable for this country are met without any significant deficiencies. - There may be instances where a country can demonstrate that the Principle has been achieved by other means. - Conversely, due to the specific conditions in individual countries, the essential criteria may not always be sufficient to achieve the objective of the Principle, and therefore other measures may also be needed. - Largely compliant: - A country will be considered largely compliant with a Principle whenever only minor shortcomings are observed that do not raise any concerns about the authority’s ability and clear intent to achieve full compliance with the Principle within a prescribed period of time. - The assessment “largely compliant” can be used when the system does not meet all essential criteria, but the overall effectiveness is sufficiently good, and no material risks are left unaddressed. - Materially non-compliant: - A country will be considered materially non-compliant with a Principle whenever there are severe shortcomings, despite the existence of formal rules, regulations and procedures, and there is evidence that supervision has clearly not been effective, that practical implementation is weak, or that the shortcomings are sufficient to raise doubts about the authority’s ability to achieve compliance. - It is acknowledged that the “gap” between “largely compliant” and “materially non-compliant” is wide, and that the choice may be difficult. The intention has been to force the assessors to make a clear statement. - Non-compliant: - A country will be considered non-compliant with a Principle whenever there has been no substantive implementation of the Principle, several essential criteria are not complied with, or supervision is manifestly ineffective. ### A. Supervisory Powers, Responsibilities and Functions — Overview for UNITED STATES - Principle 1: Responsibilities, objectives and powers. An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups. A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns. - Note references in text: 20, 21, 22. ### Essential Criteria — EC1 (Responsibilities and objectives are clearly defined) - EC1: The responsibilities and objectives of each of the authorities involved in banking supervision are clearly defined in legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a credible and publicly available framework is in place to avoid regulatory and supervisory gaps. - Description and findings re EC1: - The United States operates under a “dual banking system” under which a bank may choose to be chartered by the federal government or by a state. - Each U.S. bank, whether chartered under federal or state law, is subject to regulation, supervision and examination by a primary federal banking agency (FBA), irrespective of whether it is part of a broader organization. - Following the DFA reforms, the division of responsibilities for the FBAs are: - the OCC has responsibility for national banks and federal savings and loan associations (“savings associations”), and for supervising federal branches and agencies of foreign banks; - the Federal Reserve has responsibility for state banks that choose to be members of the Federal Reserve System; and - the FDIC has responsibility for state banks and savings associations that choose not to be members of the Federal Reserve System. - In addition, the FDIC has the authority to examine, for deposit insurance purposes, any bank, either directly or in cooperation with state banking agencies or other FBAs. - The Federal Reserve has responsibility for supervision of bank holding companies and savings and loan holding companies, as well as for certain nonbank financial companies designated by the FSOC. - The Federal Reserve also has broad supervisory oversight over the U.S. banking operations of foreign banking organizations, but relies on the OCC or state banking agencies, as appropriate, to conduct examinations and supervision. - In effect, each domestic bank has at least two regulators. Example: an insured national bank that is part of a Bank Holding Company (BHC) will be subject to supervision by the OCC, the Federal Reserve and the FDIC. - If the bank has assets above $10 billion, it and its affiliates will also by overseen by the Consumer Financial Protection Bureau (CFPB) with respect to compliance with certain consumer financial protection statutes. - Each FBA operates pursuant to an express statutory grant of authority. Agencies are mandated to administer various specific statutes that contain implicit or explicit goals (e.g., related to fair lending, community reinvestment, or bank secrecy and anti-money laundering/counter terrorist financing). - Legislation creating the agencies does not contain explicit and clear statements of mission or mandate; however, substantive statutory requirements provide the basis for agencies’ publicly reported objectives and responsibilities. - State supervisory agencies operate pursuant to an express statutory grant of authority; they are outside the scope of this BCP assessment (as is the CFPB), though assessors met with state agencies to understand coordination mechanisms. - The DFA resulted in dissolution of the Office of Thrift Supervision (OTS) and creation of: - an independent Consumer Financial Protection Bureau (CFPB) within and funded by the Federal Reserve, and - the Financial Stability Oversight Council (FSOC). - CFPB powers: - rulemaking authority for most federal consumer financial protection statutes, as defined in the DFA; - authority to conduct examinations, require reports and take enforcement actions with respect to these statutes for banking organizations with assets of more than $10 billion and their affiliates; - for smaller banking organizations, consumer compliance examination authority has remained with the applicable FBA. - FSOC mandate and composition: - Charged with monitoring and identifying risks to financial stability across the entire U.S. financial system; identifying regulatory gaps; promoting market discipline; and coordinating agencies’ responses to potential systemic risks. - FSOC has no formal responsibility for overseeing financial crises or for guiding development and implementation of consistent policy responses. - Voting membership: the Treasury Secretary (chairperson); the heads of the three FBAs; the heads of the CFPB, SEC, CFTC, FHFA, and NCUA; and an independent member with insurance expertise appointed by the President and confirmed by the Senate. - FSOC is instructed by the DFA to designate as “systemically important” large, interconnected nonbank financial firms to be subject to consolidated supervision by the Federal Reserve and enhanced prudential standards. - FSOC has no direct supervisory powers but may make recommendations to its member agencies on development of financial policies and rule making. - Formal and informal cooperation mechanisms: - Foremost formal mechanism: FFIEC, with representatives from the FBAs and CFPB at head-of-agency level and from regulators of state-chartered banks and credit unions. - FFIEC objectives: prescribe uniform federal principles and standards for examination of depository institutions; promote coordination among FBAs; encourage better coordination of federal and state regulatory agencies. ### Essential Criteria — EC2 (Primary objective of supervision) - EC2: The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not conflict with it. - Description and findings re EC2: - Each FBA has the objective of promoting safe and sound banking practices in the U.S. and maintaining stability and public confidence in the banking system. - FBAs have authority to issue regulations or guidelines as deemed necessary to ensure the safety and soundness of the banks under their jurisdiction. Examples cited: 12 U.S.C. § 93a (OCC); 12 U.S.C. § 1819 (FDIC); 12 U.S.C. §§ 248, 1844 (Federal Reserve); 12 U.S.C. § 1831p-1 (all FBAs). - Under the DFA, FBAs and other financial regulatory agencies are required to supplement traditional supervision with consideration of threats to the stability of the financial system as a whole. - FBAs also have other objectives they view as complementary rather than subordinate, including: - OCC: assuring fair access to financial services and fair treatment of customers. - Federal Reserve: maintaining stability of the financial system, containing systemic risk in financial markets, and influencing money and credit conditions in pursuit of full employment and stable prices. - FDIC: minimizing disruptive effects within the financial system when bank or nonbank financial firms fail. ### Essential Criteria — EC3 (Framework to set and enforce prudential standards) - EC3: Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks and banking groups. The supervisor has the power to increase the prudential requirements for individual banks and banking groups based on their risk profile and systemic importance. - Description and findings re EC3: - Under existing legislation, FBAs have delegated authority for imposition of prudential standards and issue guidance and manuals describing supervisory expectations. - Banking statutes, regulations and certain guidelines establish a framework of minimum prudential standards; policy statements, interpretations, supervisory guidance and manuals (including the Federal Reserve’s Supervision and Regulation (SR) Letters) establish best practices. - The regulatory framework addresses: capital adequacy, loan underwriting, single borrower and related party exposure limits, asset quality, loan losses and provisioning, risk management (including requirements for addressing specific types of risks), internal controls and audits, accounting standards, liquidity, Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) and anti-fraud measures. - Certain large bank holding companies, including foreign banking organizations and systemically significant nonbank financial companies, are subject to enhanced prudential standards. - The DFA requires enhanced prudential standards established by the Federal Reserve under section 165 to be more stringent than those applicable to other bank holding companies and nonbank financial companies that do not present similar risks to U.S. financial stability (12 U.S.C. § 5365(a)(1)(a)). - The standards must increase in stringency based on the systemic footprint and risk characteristics of companies subject to section 165 (12 U.S.C. 5365(a) (1) (B)). - Reference to related methodology: BCBS paper on Global systemically important banks: assessment methodology and the additional loss absorbency requirement, November 2011. *International Monetary Fund — UNITED STATES assessment excerpt* ### section 165 to tailor the application of the standards, including differentiating among ### _cr1589 - section 165 to tailor the application of the standards, including differentiating among ### Authority to examine affiliates and scope of supervisory powers - FBAs generally have the authority to examine affiliates of banks under their supervision. - The Federal Reserve generally has the authority to examine and obtain reports from a holding company and its affiliates to be informed of the companies’ conditions and stability of the U.S. financial system. - The DFA eliminated previous restrictions (imposed under the Gramm-Leach-Bliley Act) on the Federal Reserve’s ability to examine, obtain reports from, or take enforcement action against a functionally regulated subsidiary of a BHC, such as a broker-dealer or insurance company. ### EC4 — Laws, regulations and prudential standards are updated and publicly consulted - Findings: - Statutes require FBAs to review regulations at regular intervals to ensure relevance and to reduce burden on regulated entities. - Reviews allow for widespread public (including industry) participation. - Changes may be adopted by Congress in response to crises, market failures, industry concerns or judicial decisions. - FBAs have discretion to choose the form of promulgation (regulations, guidelines, supervisory guidance, interpretations). - Changes can be issued through periodic review or more quickly via policy statements or guidelines, depending on urgency. ### EC5 — Access to boards, management, records and consolidated supervision - Powers: - (a) Full access to banks’ and banking groups’ Boards, management, staff and records to review compliance with internal rules and external laws and regulations. - (b) Review overall activities of a banking group, both domestic and cross-border. - (c) Supervise activities of foreign banks incorporated in its jurisdiction. - Findings: - FBAs have broad statutory authority to obtain a broad array of information from supervised entities and affiliates in the form and frequency deemed necessary. - Banks and affiliates must provide full and complete access to books, records and employees; failure can result in administrative sanctions. - Duties extend to foreign operations, subject to foreign host country law restrictions on sharing certain information. - FBAs must have full access to external auditors’ work papers, reports and materials. - Institutions face potentially significant monetary penalties for failure to provide information, late reports, or false/misleading reports. - Federal Reserve maintains understanding of all material parts of banking groups and nonbank financial groups subject to its supervision, relying where possible on primary supervisors and functional regulators (see CP12). - Local operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to domestic banks, found in applicable statutes, regulations and the International Banking Act (see CP13). - Assessors saw supervisory material confirming FBAs’ access to boards, staff and records. ### EC6 — Powers to take corrective action, impose sanctions and resolve banks - Powers: - (a) Take or require timely corrective action. - (b) Impose a range of sanctions. - (c) Revoke a bank’s license. - (d) Cooperate and collaborate with relevant authorities to achieve an orderly resolution, including triggering resolution where appropriate. - Findings: - FBAs have broad authority to require remedial measures when a bank or holding company is non-compliant or engaging in unsafe or unsound practice. - Remedial measures include: restricting activities, requiring remedial activities, withholding/conditioning approvals, restricting/suspending shareholder payments or repurchases, restricting asset transfers, barring individuals from banking, replacing/restricting powers of managers/board/owners, facilitating takeovers or mergers, interim management, closing an institution, revoking license, and issuing monetary fines. - The Federal Reserve’s ability to appoint a conservator or receiver to close a bank is more limited by statute than the OCC’s or FDIC’s. - By statute, the FDIC is always appointed the receiver for closed insured banks. - Remedial measures are imposed according to extent and severity of the problem (see CP11). - Assessors reviewed examples of different remedial measures. ### EC7 — Power to review parent and affiliated companies’ activities - Findings: - Federal Reserve maintains understanding of all material parts of banking groups and nonbank financial groups subject to its supervision, including domestic and cross-border operations. - Federal Reserve has power to review activities of parent holding companies and affiliates to determine and ensure safety and soundness of bank subsidiaries. - OCC may examine affiliates of national banks (see 12 U.S.C. § 481). ### Assessment — Principle 1: Largely Compliant (comments and recommendations) - Assessment: Largely Compliant. - Key comments: - DFA reforms rationalized responsibilities (dissolution of OTS; OCC absorbed federal savings associations). - Specialized consumer protection regulator (CFPB) should provide greater clarity of purpose for FBAs. - Problems of multiple regulators with distinct but overlapping mandates persist: duplication, coordination burdens, and risk of inconsistent messages. - Recommendations: - FBAs should revisit “mission and vision” statements to ensure primacy to safety and soundness and clarify other objectives must be consistent with, and subordinate to, that goal (in absence of legislative change). - FBAs and CFPB should explore ways to reduce duplication of effort (e.g., risk reviews) and pursue opportunities for a more coherent division of responsibilities between safety and soundness and consumer protection. ### Principle 2 — Independence, accountability, resourcing and legal protection for supervisors - Principle summary: Supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy and adequate resources; accountable for discharge of duties; legal protection for supervisors. EC1 — Operational independence, accountability and governance prescribed and disclosed - Findings: - Each FBA operates pursuant to express statutory authority with clearly defined objectives and responsibilities. - Statutes/regulations provide broad authority to address compliance and safety and soundness. - Federal statutes provide for operational independence. - Additional safeguards: appointment/removal circumstances for agency heads; self-funding nature; accountability to Congress; external reviews and public reporting; judicial review; annual reporting on regulatory and supervisory actions; legal protection for staff; conflicts of interest and financial disclosure rules. - No evidence of government or industry constraints on operational independence; political scrutiny and expectations intensified post-crisis. EC2 — Appointment and removal processes - Findings: - Laws specify appointment process for agency heads (appointed by U.S. President with Senate consent) for fixed terms, but no laws specify reasons for removal. - Comptroller of the Currency: five-year term; removable by President for cause with reasons laid before Senate. - FDIC: three remaining directors appointed to six-year terms; one designated Chairman for a five-year term. - Federal Reserve Board of Governors: full or unexpired portion of a 14-year term; Chairman and Vice Chairman designated for four-year terms. - Positions are non-partisan and not expected to resign at conclusion of the President’s term. See 12 U.S.C. § 2; 12 U.S.C. § 242; 12 U.S.C. § 1812. EC3 — Publication of objectives and transparency framework - Findings: - FBAs comply with Government Performance and Results Act of 1993 (5 U.S.C. § 306; 31 U.S.C. § 1115) — strategic plans, annual performance plans and reports are public. - Strategic plans and performance reports are high-level; few objective performance targets; those mainly relate to examination cycle completion and enforcement action initiation timeframes. - Assessors encourage development of performance metrics related to outcomes. - Oversight by Congress, GAO audits; GAO placed U.S. financial regulatory structure on “high risk” list in 2009 and it remains on the list. - Each FBA has an independent Inspector General (IG); IGs perform material loss reviews for bank failures costing FDIC insurance fund more than $50 million. EC4 — Internal governance and communication processes - Findings: - Each FBA has internal governance and accountability structures with delegation and review processes (e.g., Reserve Bank Presidents have delegated authority; examiner-in-charge (EIC) for each bank has day-to-day authority). - Agencies improved governance post-crisis: more centralized direction, high-level risk committees, better coordination between head office and regional/field offices. - Federal Reserve district banks’ governance rules allow two-thirds of boards to be appointed by regulated commercial banks; potential concerns about conflicts of interest exist though assessors saw no operational supervisory interference. - Recommendation: board charters should explicitly bar engagement in supervisory matters and implement robust conflict of interest frameworks. EC5 — Professionalism, integrity and conflict-of-interest rules - Findings: - Federal laws, regulations and codes of conduct govern ethical conduct; statutes restrict certain activities/affiliations (e.g., 12 U.S.C. §§ 11, 241, 242; 12 U.S.C. § 1812). - Senior examination staff subject to one-year post-employment “cooling off” period; violations can lead to civil monetary penalties, removal, and prohibition from participation for up to five years. - Examiners prohibited from accepting loans or gratuities from banks they examine. - OCC employees barred from representing another party before the Federal Government in matters they participated in as OCC employees (two years or permanent). - Criminal statutes prohibit corruption, bribery, theft, fraud; policies outline investment, borrowing prohibitions and recusal requirements. - Assessors were impressed by staff caliber; banks and associations attested to professionalism and integrity. EC6 — Adequate resources and self-funding - Findings: - FBAs are self-funding and not subject to the congressional appropriations process. - Agencies advised they have budgets needed to increase supervisory intensity since the crisis. - Significant build-up of staffing resources, especially for large banking organizations, policy implementation and stress testing; Federal Reserve significantly increased supervision and regulatory policy staffing. - FBAs set salary scales considering other regulators, federal government and private sector; do not match higher-end private sector salaries but market conditions aided experienced hires. - Intensified staff training; budgets support travel for on-site work and participation in supervisory colleges. EC7 — Workforce planning and skills - Findings: - FBAs conduct internal evaluations to ensure staffing resources and skills meet supervisory needs. - Staffing requirements determined in process developing strategies and performance plans. - Active hiring and retention programs; structured skills enhancement to qualify as examiner-in-chief. - Flexibility to bring in specialist staff on fixed-term basis (e.g., FDIC for bank workouts). EC8 — Risk-based resource allocation and supervisory programs - Findings: - By statute, full-scope onsite exam required at least once every twelve months; cycle may be lengthened to 18 months for banks meeting certain asset thresholds and supervisory rating criteria (12 U.S.C. § 1820(d)(4)). - Institutions on longer review cycle account for majority of regulated institutions but only a small percentage of total system assets. - FBAs utilize risk-based supervisory approach; more intense scrutiny for greater risk entities. - Agencies increased staffing for supervision of large banking organizations and focus on stress testing. EC9 — Legal protection against lawsuits and costs of defense - Findings: - FBAs and staff generally protected against lawsuits for actions/omissions made in good faith. - Sovereign immunity bars lawsuits without statutory authorization; common law qualified immunity protects heads and staff for discretionary functions unless conduct clearly violates established rights. - Lawsuits permitted against employees for acts within scope of employment; U.S. may substitute as defendant upon Attorney General certification. - Exception protects employees from lawsuits involving execution of statute/regulation or discretionary functions, whether or not discretion was abused. Assessment — Principle 2: Compliant (comments) - Assessment: Compliant. - Comments and guidance: - FBAs strengthened accountability and transparency post-crisis; further development of performance measures focused on supervisory outcomes is recommended. - FBAs improved internal decision-making and stepped up supervisory intensity, especially for large banking organizations. - Retention of capacity is a challenge as economic conditions improve and specialist skills are in demand; FBAs should keep hiring flexible and training fully funded. - Independence of the Federal Reserve’s supervisory role could be further assured by aligning Federal Reserve district banks’ governance rules with global good practice; at minimum, clarify roles in board charters. ### Principle 3 — Cooperation and collaboration (domestic and foreign) and protection of confidential information EC1 — Domestic cooperation arrangements and practice - Findings: - FBAs have broad statutory powers to share information with domestic banking supervisors (e.g., 12 U.S.C. §§ 1817(a)(2)(A) and (C); 3412(e)). - Formal and informal mechanisms for information sharing are integral to consolidated supervision. - Enhanced collaboration since the crisis: sharing supervisory plans, quarterly examiner meetings for large banks, increased joint supervisory presence, joint participation in Federal Reserve horizontal reviews, stronger commitment to joint guidance. - FBAs routinely exchange information with state supervisory agencies, though state agencies do not necessarily consult FBAs when taking enforcement actions. - MoU between OCC and SEC finalized in September 2014. - Formal arrangements with state insurance supervisors exist to coordinate supervisory activities for banking groups with significant insurance operations. - FSOC facilitates regulatory coordination; Federal Reserve, OCC, CFPB and FDIC are members. EC2 — Cooperation with foreign supervisors - Findings: - FBAs have broad statutory authority to share supervisory information with foreign supervisors (e.g., 12 U.S.C. § 3109). - Entered into bilateral formal information-sharing arrangements (MoUs, statements of cooperation) with foreign supervisors; arrangements emphasize host-to-home sharing and confidentiality. - Arrangements provide for on-site examinations by home authorities of cross-border operations. - FBAs may share information even absent formal arrangements; assessors saw evidence arrangements work in practice. EC3 — Safeguards on releasing confidential information - Findings: - FBAs subject to statutory prohibitions on disclosing certain confidential financial information unless law authorizes sharing. - Regulations require confidential treatment of non-public supervisory information. - Prior to sharing, FBAs require assurances information will be used only for lawful supervisory purposes and kept confidential. - Under International Banking Act, FBAs must determine disclosure appropriate and obtain, to extent necessary, recipient’s agreement to maintain confidentiality “to the extent possible under applicable law” (12 U.S.C. § 3109(a), (b)). EC4 — Use and protection of confidential information received - Findings: - FBAs can deny demands for confidential information except in limited situations (subpoena by court, grand jury or U.S. Congress committee). - When compelled to provide confidential information received from another supervisor, agencies will notify originator and make reasonable efforts to resist disclosure when feasible. - Under International Banking Act, confidential material provided by a foreign supervisor has broad protection from compelled onward disclosure if certain conditions are met; FBAs could not be compelled to disclose such information except to a congressional committee or U.S. court order. EC5 — Support for resolution authorities and recovery/resolution planning - Findings: - FBAs’ broad authority to share information includes sharing recovery- and resolution-related information with foreign resolution authorities, central banks and finance ministries (e.g., 12 U.S.C §§ 1817(a)(2)(A) and (C); 12 U.S.C. § 3109). - FDIC is both resolution authority and a direct supervisor; coordination with other FBAs and state supervisors is integral to effecting orderly resolutions. - Recovery and resolution planning takes place in CMGs established for large U.S. banking groups. - Authorities working with foreign counterparts to complete cooperation agreements (COAGs) to facilitate CMG work and protect sensitive supervisory information. - FBAs participate in firm-specific CMGs and supervisory colleges for global systemically important financial institutions. Assessment — Principle 3: Compliant (comments) - Assessment: Compliant. - Comments: - Multiple FBAs with overlapping responsibilities put premium on effective cooperation for consolidated supervision. - Significant post-crisis efforts to improve cooperation are evident (shared planning, interagency meetings, joint examinations, information sharing). - Consistency issues can arise when FBAs bring different perspectives (example: leveraged lending guidance). - Recommendation: maintain and entrench collaborative practices; prepare supervisory plans on the same cycle or ensure careful coordination when cycles differ; ensure specialized resources availability. - International cooperation improved via supervisory colleges and CMGs; however, state supervisory agencies should consult fully with FBAs and foreign supervisors on impending enforcement actions — identified deficiency to be addressed. ### Principle 4 — Permissible activities and use of the term “bank” EC1 — Definition of “bank” - Findings: - Federal and state laws provide establishment, operation, permissible activities and supervision of “banks”. - “Bank” generally: (a) incorporated or chartered under federal or state law; (b) authorized to engage in specified activities, typically including accepting demand deposits and making loans; (c) subject to supervision by state or federal authorities. - Specialized institutions (e.g., “savings associations”) engage in many banking activities but are not called “banks”; other specialized institutions (industrial loan companies, trust companies, credit card banks, single purpose banks) exist and may be grandfathered into deposit insurance; collectively they have small market share. EC2 — Clearly defined permissible activities - Findings: - Federal and state laws/regulations define permissible activities. - National Bank Act and Home Owners’ Loan Act/specifying regulations define permissible activities of national banks and federal savings associations. - Banks generally limited to “banking” or related activities; broader financial activities may be permitted via subsidiaries or parent companies, but banks generally cannot engage through a subsidiary in activities they could not do directly. - State-chartered banks have state law-permitted activities, with federal overlay; insured state banks may only engage in activities permissible for national banks and federal savings associations unless FDIC determines otherwise. EC3 — Use of the word “bank” controlled - Findings: - No entity may operate as a “bank” and engage in banking operations in the U.S. without federal or state charter. - 12 U.S.C. § 378 makes it a crime to purport to be a bank that accepts deposits without license. - States generally prohibit use of “bank” in corporate name unless chartered. - Federal law criminalizes unauthorized use of terms indicating federal charter, Federal Reserve membership or federal deposit insurance. - FBAs issue public alerts about unauthorized use but cannot themselves take enforcement actions against such usage. EC4 — Taking deposits reserved for licensed supervised institutions - Findings: - 12 U.S.C. § 378 requires persons engaged in demand deposit-taking to be subject to regulation, supervision or oversight by federal or state authorities; violations carry criminal penalties. - In practice, entities engaged in retail deposit-taking (except credit unions) are generally licensed and supervised as banks or savings associations. EC5 — Public list of licensed banks - Findings: - Through FFIEC and separately, FBAs publish and regularly update information on banks and holding companies, including branches of foreign banks, U.S. branches and subsidiaries of foreign banks. - FFIEC’s National Information Center includes detailed financial information and organizational charts. Assessment — Principle 4: Compliant (comments) - Assessment: Compliant. - Comments: - Well-established framework defines permissible activities and protects the term “bank”. - Authorities should monitor disclosure practices of “bank-like” institutions (e.g., mutual funds offering deposit-like products) to ensure public is well informed about security of savings. ### Principle 5 — Licensing criteria, fit and proper tests, business plans and foreign banks EC1 — Authority for granting and withdrawing licenses and coordination with supervisors - Findings: - Banks are licensed and supervised by licensing authority (OCC for national banks and federal savings associations; states for state-chartered banks); often multiple agencies involved for de novo banks (deposit insurance, Federal Reserve membership). - Foreign banks establishing U.S. presence must obtain Federal Reserve approval and relevant licensing authority approvals. - Agencies have practices to communicate and coordinate investigations on licensing and deposit insurance applications and often conduct joint investigations. - Licensing authorities/supervisors can impose prudential conditions or limitations on newly licensed banks. EC2 — Power to set criteria and reject applications - Findings: - Authority to license banks and criteria set out in statutes and regulations. - OCC is licensing authority for national banks (12 U.S.C. § 21 et seq) and federal savings associations (12 U.S.C. § 1464(a)); states license state banks. - OCC and states typically make licensing approvals conditional on deposit insurance coverage. - FDIC alone authorized to determine deposit insurance under the FDI Act. - OCC, FDIC and Federal Reserve may deny authorizations within competencies. - False or misleading information can lead to civil, administrative and criminal liability, including license revocation (12 U.S.C. § 93(a)). - FDIC is the resolution authority. EC3 — Consistency of licensing criteria with ongoing supervision - Findings: - Criteria for issuing licenses generally consistent with ongoing supervision (not expressly required by statute but applied in practice). - OCC considers: organizers’ familiarity with laws, competent management, capitalization and liquidity, reasonable profitability expectation, safe and sound operation (12 CFR 5.20(f)(2)). - FDIC considers seven statutory factors in Section 6 of the FDI Act: financial history/condition, capital structure, proposed ownership/management, earnings prospects, activities, convenience and needs of community, potential risks to Deposit Insurance Fund. EC4 — Assessment of legal, managerial, operational and ownership structures - Findings: - Licensing process assesses legal, managerial, operational and ownership structures on solo and consolidated basis. - Joint Agency Statement on Parallel-Owned Banking Organizations (April 23, 2002) emphasizes structural assessments. - Agencies may deny or terminate license, deposit insurance or Federal Reserve membership if impediments exist. - FBAs have preference for transparent business models viable without over-reliance on affiliates. EC5 — Suitability of major shareholders and transparency of ownership - Findings: - Applicants must identify prospective shareholders and ultimate beneficial owners. - OCC may require prospective principal shareholders (generally those owning or controlling 10 per cent or more) and key decision-makers to provide detailed background and financial information. - FDIC conducts background investigations of prospective principal shareholders, directors and executive officers during deposit insurance review. - Assessments focus on ability of principal shareholders to provide financial support and transparency of ownership sources of initial capital. - FDIC’s “Final Statement of Policy on Qualifications for Failed Bank Acquisitions” (September 2, 2009) confirms complex opaque ownership structures would not be granted approval to own an insured depository institution. EC6 — Minimum initial capital - Findings: - De novo depository institutions must have minimum initial capital available and ready to be deployed. - OCC does not stipulate a minimum dollar amount but requires sufficient initial capital net of pre-opening expenses to support projected business. - A de facto minimum of $2 million applies since that is the FDIC’s minimum capital requirement for inclusion in deposit insurance scheme. - OCC expects de novo banks to remain above “well-capitalized” level during first three years and requires minimum leverage ratio (tier 1 capital to on-balance sheet assets) of 8 per cent throughout that period. - For de novo federal savings associations, statutory minimum initial required capital of $2 million (12 CFR 1431.3(b)). - FDIC requires institutions to maintain adequate Allowance for Loan and Lease Losses (ALLL). - For state nonmember institutions, the FDIC requires minimum leverage ratio of 8 per cent throughout the first seven years. - FDIC/other appropriate agencies may impose minimum leverage ratios in excess of 8 per cent depending on risk profile. - Assessors questioned the de facto $2 million minimum, noted it is much lower than other jurisdictions; OCC advised initial capital in range of $10-20 million is more typical for smaller de novo banks. EC7 — Fit and proper tests for Board and senior management - Findings: - FBAs evaluate proposed directors and senior management for expertise, integrity and conflicts of interest. - OCC considers: financial institution/business experience, duties/responsibilities, personal/professional financial responsibility, reputation for honesty/integrity, familiarity with community (12 CFR guidance). - Applicants must demonstrate prospective directors’ competence, experience and ability to direct policies in a safe and sound manner; officers must show ability to perform duties (interviews). - Assessors saw ample evidence of evaluation processes. EC8 — Review of strategic and operating plans, governance, risk management and AML controls - Findings: - Applicants must show business plan viability and management’s ability to implement. - Business plan must: establish ability to achieve reasonable market share; show reasonable earnings prospects and ability to attract/maintain capital; demonstrate management knowledge of community needs; be supported by adequate policies, procedures and expertise for safe and sound operation. - Applicants must provide documented market analysis and realistic financial projections. - Licensing authorities review corporate governance, board oversight, organizational charts, policies/procedures, conflict of interest relationships, compensation terms. - Applicants must have written investment, loan, funds management and liquidity policies; internal control structure and audit program; AML/CFT policies; oversight of outsourced functions. - Operational structure and risk-management framework must match complexity and scope. - High-risk business plans require specific documentation; additional documentation required for competitive or marginal market entries. - Assessors confirmed evaluation processes are detailed and comprehensive. EC9 — Review of pro forma financials and projections - Findings: - OCC evaluates inherent risks, reasonableness of financial projections, adequacy of financial strength including capital levels to support strategic plan. - Estimates must be documented, supported and based on established growth patterns; OCC reviews funding concentration and contingency funding plans. - OCC may require stress tests to show maintenance of minimum capital ratios and profitability under adverse conditions. - Applicants must demonstrate ability to achieve stabilized operations and adequate profit within a reasonable period (typically, three years). EC10 — Foreign banks establishing branches/subsidiaries: home supervisor consultation - Findings: - Foreign banks establishing branch, agency or subsidiary in U.S. must obtain Federal Reserve approval and relevant licensing authority approvals. - Licensing authority may, and Federal Reserve generally must, determine foreign bank and any parent are subject to comprehensive and consolidated home-country supervision. - Licensing authority and Federal Reserve assess home supervisor oversight of operations between foreign bank and foreign nonbank parent. - Licensing authority and Federal Reserve contact home country supervisor during application and consider home supervisor’s approval or statement of no objection (12 CFR 28.12(b)(6) for OCC). - Foreign entity not a BHC must obtain Federal Reserve approval before establishing or acquiring a subsidiary savings association; Federal Reserve must determine foreign bank and parent are subject to comprehensive consolidated supervision. EC11 — Monitoring progress of new entrants against business plans and conditions - Findings: - FBAs monitor de novo institutions’ progress in meeting business plans and compliance with licensing conditions. - De novo banks must give FDIC prior notice of changes to business plan during first three years. - As condition of deposit insurance, FDIC requires de novo state nonmember banks to submit pro forma financial statements and business plan for operating years four through seven (or longer if appropriate) before end of third year. - FDIC monitors compliance during annual examinations and requires prior non-objection for material deviations. - FDIC stepped up intensity of supervision of de novo banks after crisis failures in fourth to eighth years and extended period of 8 per cent leverage ratio application. Assessment — Principle 5: Compliant (comments) - Assessment: Compliant. - Comments: - Under U.S. dual banking structure, banks may choose federal or state charter; all banks have a primary Federal supervisor. - Evaluation processes for national charters and deposit insurance are thorough. - Concerns about “regime shopping” and charter conversions noted; FFIEC “Statement on Regulatory Conversions” (2009) and DFA addressed conversion-related issues; FBAs will not accept conversions involving 4 or 5 rated institutions. - DFA gave statutory force to key FFIEC statement aspects and resulted in OTS dissolution. *Source: IMF assessment text provided in the supplied content unit.* ### Section 612 of that Act generally prohibits charter conversions, in either direction, while the ### _cr1589 - Section 612 of that Act generally prohibits charter conversions, in either direction, while the ### Section 612 and charter conversions - Section 612 generally prohibits charter conversions, in either direction, while the institution concerned is subject to any formal enforcement actions that involve a significant supervisory matter. - Exceptions to this conversion prohibition are possible in certain defined circumstances, which are expected to be rare. - The FFIEC Statement remains in place, since it covers a broader range of circumstances than section 612. - A large number of (well-rated) banks and savings associations currently fall outside the scope of these conversion restrictions and there has been a steady stream of charter conversions in both directions, although the numbers are not large in absolute terms. - FBAs have explained to the assessors: - State banks generally convert to federal charters if they have national ambitions. - National banks and savings associations converting to state charters generally claim that state supervisory authorities are more attuned to local economic conditions and the needs of smaller community banking organizations. - Charter conversions that fall outside the scope of the FFIEC Statement are generally subject to handover “protocols” that would discourage inappropriate regime shopping; the assessors see merit in incorporating these protocols in the FFIEC Statement. - The choices made by banking organizations between the three FBAs can, over time, have important implications for the staffing and sustainability of regional offices; FBAs need to guard against creating perceptions of differences in supervisory style or intensity in these offices that could sway charter-conversion choices. ### Principle 6 — Transfer of significant ownership: overview and essential criteria - Principle 6: The supervisor has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. - Essential criteria summary: - EC1: Laws or regulations contain clear definitions of “significant ownership” and “controlling interest”. - EC2: Requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest. - EC3: Power to reject proposals for change in significant ownership or to prevent exercise of voting rights to ensure criteria comparable to licensing; power to reject, modify or reverse changes based on false information. - EC4: Supervisor obtains names and holdings of all significant shareholders, including beneficial owners, via periodic reporting or on-site examinations. - EC5: Power to modify, reverse or otherwise address a change of control that has taken place without necessary notification or approval. - EC6: Requirement for banks to notify the supervisor as soon as they become aware of material information which may negatively affect the suitability of a major shareholder or controlling party. ### EC1 — Definitions and statutory framework (findings) - Federal statutes and implementing regulations: - Define “controlling interest” but not “significant ownership”. - Prior authorization by the appropriate FBA is generally required for any person to acquire “control” of a bank. - “Control” is defined as “the power, directly or indirectly, to direct the management or policies of an insured depository institution or to vote 25 per cent or more of any class of voting securities of an insured depository institution.” See The Change in Bank Control Act (CIBC Act) 12 U.S.C. §1817(j)(8)(B). - Under limited circumstances a presumption of control arises when a person would own, control, or hold the power to vote 10 percent or more of any class of voting securities. - In certain cases, a five percent voting share may be assessed as “a rebuttable threshold” for deeming a person to having control. - A “person” for purposes of the CIBC Act includes an individual, a group of individuals acting in concert, or certain entities (e.g. corporations, partnerships, and trusts) that own shares of banks but that do not qualify as bank holding companies. - Bank Holding Company Act (BHC Act) and Federal Reserve: - Prior authorization of the Federal Reserve is generally required under 12 U.S.C. § 1842(a) for a company subject to the BHC Act to directly or indirectly acquire control of a bank or BHC. - “Control” for this purpose generally includes direct or indirect ownership, control, or the power to vote 25 percent or more of any class of voting securities of a bank or BHC. - “Control” also includes (a) control over the election of a majority of directors or persons exercising similar functions; or (b) the power to exercise directly or indirectly a controlling influence over the management or policies of the bank or BHC (see 12 CFR 225.2(e)(1)). - For existing BHCs, Federal Reserve authorization is required before the BHC can acquire, directly or indirectly, 5 percent or more of any class of voting shares of another bank (see 12 U.S.C. § 1842(a)(3)). - The Federal Reserve generally is required to consult with the state banking agency and/or the OCC (as appropriate) in processing the request for authorization (see 12 U.S.C. § 1842(b)(1)). - By statute, the Federal Reserve cannot approve a BHC application under certain enumerated circumstances (see 12 U.S.C. § 1842(c) and 12 CFR 225.13). - Home Owners’ Loan Act (HOLA): - Prior authorization of the Federal Reserve is required under 12 U.S.C. § 1467a (e) for a company directly or indirectly to acquire control of a savings association or savings and loan holding company (SLHC). - Definition of “control” under HOLA is similar to BHC Act definition of control. - Subject to statutorily enumerated exceptions, Federal Reserve approval is required before an SLHC can acquire, directly or indirectly, more than 5 percent of a class of voting securities of another savings association or SLHC (see 12 U.S.C. § 1467a (e) (1) (A) (iii)). - Practical note: While “significant ownership” is not defined, there is a threshold for annual reporting of shareholders with five percent or more of the total votes; Federal Reserve approval requirements for 5 percent+ acquisitions may be interpreted as a measure of “significant ownership”. ### EC2 — Notification and approval procedures (findings) - Statutory authority: - FBAs have statutory authority under the CIBC Act, 12 U.S.C. § 1817(j), to review, reject, and impose conditions on proposals involving significant changes in ownership or control of banks. - Prior authorization by the appropriate federal banking agency is generally required for any person to acquire “control” of a bank or BHC. - Procedures and exemptions: - Implementing regulations for the CIBC Act, the BHC Act, and the HOLA set forth procedures to effect a change in ownership (including beneficial ownership), the exercise of voting rights over a particular threshold, or control of a bank or holding company. - Submission of a prior notice under the CIBC Act is normally required, but the CIBC Act exempts various categories of transactions from this requirement or requires a 90-days after-the-fact notice for other categories of transactions (this applies for instance to “unexpected transactions” such as gifts, changes in other persons’ shareholdings etcetera). - Federal Reserve regulations provide for filing either an application or prior notice with respect to a company’s acquisition of a bank, identify a limited set of transactions not requiring agency approval, and allow for a waiver of filing requirements under certain circumstances (see 12 CFR part 225.12). - OCC regulations pertaining to application requirements and procedures are found at 12 CFR 5.33 (national banks) and 12 CFR 163.22 (federal savings associations). ### EC3 — Power to reject or condition changes in ownership (findings) - FBAs have the power to reject a proposal for a change in ownership. - Factors considered are comparable to those used in approving new banks, including statutory factors in section 7(j) of the Federal Deposit Insurance Act (FDIA), such as: - Whether the proposal would result in a monopoly or substantially lessen competition or restrain trade; - The financial condition of the acquiring party and its potential impact on the bank or depositors; - The competence, experience or integrity of any acquiring person or proposed management; - The effect on the Deposit Insurance Fund. - Other statutes (Bank Merger Act, CIBC, BHC Act, HOLA) prompt evaluation of: - (a) the financial condition and integrity of the ownership group; - (b) the competence, experience, and integrity of management; - (c) the future prospects of the resulting entity; - (d) business plans of the resulting entity; - (e) the impact of the proposal on the safety and soundness of the resulting entity; - (f) the convenience and needs of the community(ies) to be served; and - (g) the impact of the proposal on financial stability. - Agencies also consider competitive effects, compliance with consumer protection and anti-money laundering statutes, and CRA-covered activities. - Agencies may impose conditions limiting an acquirer’s exercise of voting rights, and may deny authorization. - If a change in significant ownership was based on false information, FBAs have powers to impose penalties and affirmative requirements, potentially including divestiture (see 12 U.S.C. § 1818(b)(6); 12 U.S.C. § 1817(j)(15)(B)(ii)). ### EC4 — Reporting and identification of significant shareholders (findings) - Agencies obtain names and holdings of significant shareholders through annual reporting and/or on-site examinations. - The Federal Reserve requires the annual submission of the identities of those shareholders who own or control 5 percent or more of a class of voting shares of a bank or BHC. - On-site or off-site examinations periodically review ownership of significant shareholders. - Corresponding rules apply at other FBAs for savings banks and SHLCs. ### EC5 — Remedial powers for unauthorized changes (findings) - Agencies require after-the-fact requests for authorization for changes in control made without necessary notice or approval. - In evaluating such requests, agencies consider whether the failure to request authorization was a knowing violation of the law; such a violation could result in civil monetary penalties and sanctions against any “institution-affiliated party” up to debarment. - Agencies consider whether appropriate policies and procedures have been put in place to prevent further violations. - Agencies have authority to deny or condition an after-the-fact request, including barring a shareholder from voting or appointing directors, and may require divestiture of the stockholding. ### EC6 — Timely notification of material information (findings and recommendation) - There is no explicit regulatory requirement that banks notify the agencies as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or controlling party. - The agencies nevertheless expect controlling shareholders, or the bank with which they are affiliated, to provide timely notice of material information affecting suitability on general safety-and-soundness grounds. - Assessment comment and recommendation: - Assessment of principle 6: Compliant. - Comment: The concept of “significant ownership” is not defined per se, but the practice of a five percent threshold for reporting significant shareholders is applied. - Shortcoming: There is no explicit regulatory requirement for a bank to immediately report when a major shareholder is no longer suitable; assessors saw no evidence of such reporting in written documentation. - Recommendation: Assessors recommend that such a supervisory requirement be introduced to ensure supervisors are promptly informed if a major shareholder is no longer suitable; assessors addressed this shortcoming under CP 9. ### Principle 7 — Major acquisitions (EC1 partial findings) - Principle 7: The supervisor has the power to approve or reject, and impose prudential conditions on, major acquisitions or investments by a bank, including establishment of cross-border operations, to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. - EC1 findings: - Federal and state laws limit and define types of acquisitions or investments banks may make; permissible activities and investments are set forth in statutes discussed under Principle 4 and implementing regulations. - Agencies have established regulatory criteria for prior approval of major acquisitions or investments of banks. - Not every investment or acquisition must be approved in advance, but procedural criteria allow supervisors to review acquisitions or investments that could have a significant effect on a bank’s condition (e.g., mergers and acquisitions of subsidiaries). - Under the Federal Reserve’s Regulation K (12 CFR part 211), foreign investments by member banks may be made under general consent, prior notice, or application procedures: prior approval is necessary for new or large investments, while post-notice is sufficient for smaller investments. - “Well capitalized and well managed” FHCs are allowed to execute a wider range of acquisitions and investments on a general consent basis (12 CFR 211.9). - FDIC’s International Banking regulations (12 CFR part 347) authorize state nonmember banks to make foreign investments under general consent or with prior approval after filing an application; criteria are in 12 CFR 347.117, 347.118, and 347.119. - Under 12 CFR 28.3, national banks acquiring an interest in an Edge or agreement corporation, foreign bank, or other foreign organization must provide notice to the OCC. - OCC’s regulations for federal savings associations on Lending and Investment are referenced (12 CFR ...). *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr1589.pdf* ### part 160 (in particular 160.36), and Subordinate Organizations, 12 CFR part 159 apply to both ### _cr1589 - part 160 (in particular 160.36), and Subordinate Organizations, 12 CFR part 159 apply to both ### Regulatory scope and approval framework - part 160 (in particular 160.36), and Subordinate Organizations, 12 CFR part 159 apply to both domestic and foreign activities and investments. - CFR 12 CFR 24.4 and 24.5 requires that OCC approves a written request for investments exceeding in aggregate 5 percent of the acquiring institution’s capital and surplus. - The BHC Act and section 10 of the HOL Act set forth permissible activities of BHCs and SLHCs (see 12 U.S.C. §§ 1843(c) and 1843(k) and 12 U.S.C. § 1467a(c)). - The Federal Reserve’s SLHC regulation applies to both domestic and foreign activities and investments. - For both BHCs and SLHCs, there are clear regulatory directions as to when an application for prior supervisory approval is necessary or when post-notice is sufficient for an acquisition. - Nationally chartered banks may only acquire minority stakes in non-bank activities; these must be related to banking (e.g., investments in service corporations). ### Approval categories and examples (main points highlighted) - Prior Notice, Prior Approval, General Consent, Post Notice, FDIC Statutory Approval apply across: - All Bank Holding Companies - Investments abroad above a specific dollar amount or amount of capital - Acquisition of a bank or thrift - Purchase of more than 5% of a bank - New non-banking activities - Purchase of more than 5% of a non-bank company - Investments abroad below a specific dollar amount or amount of capital - Acquisition of an uninsured entity that takes deposits by an insured depository institution - Additional distinctions for large groups: - BHC and FHC above $50bn of assets: same approvals as above plus acquisition if any shares in a financial company greater than $10bn; acquisitions that do not give rise to financial stability concerns; reporting of acquisitions of nonbank companies. - Well Capitalized and Well managed BHC and FHC: Investments abroad above a specific dollar amount of capital; acquisitions of a bank or thrift; investments abroad below a specific amount of capital; reporting of acquisitions of nonbank companies. ### Evaluation criteria for proposals (EC2) - Implementing regulations and sometimes statutes (Bank Merger Act, CIBC Act, BHC Act, HOL Act) specify criteria. - Factors considered generally include: - competitive concerns - financial and managerial resources - future prospects of the resultant bank - the convenience and needs of the community to be served - CRA compliance - anti-money laundering compliance - impact on risk to the stability of the U.S. banking or financial system - compliance with consumer protection statutes (see e.g., 12 U.S.C. 1828(c)(5); 12 CFR 5.33(e)) - Investors making foreign investments must comply with minimum capital adequacy standards and, to use general consent authority, must have at least a composite rating of “satisfactory” at the most recent examination. ### Risk and host-country information considerations (EC3) - The supervisor assesses whether acquisitions/investments expose a bank to undue risk or hinder effective supervision, including analysis of host country supervision. - The supervisor can prohibit major acquisitions/investments in countries with laws or regulations prohibiting information flows necessary for consolidated supervision. - Authorities rely on 12 CFR part 28, subpart A and 12 CFR 211.13(a)(3) for obtaining information and exercising consolidated supervision. ### Capacity and prudential assessment (EC4 & EC5) - For authorizations, FBAs evaluate financial, managerial and organizational resources, including: - amount and source of initial funding - resulting capital condition of the acquirer - impact of the acquisition on examination ratings - policies and procedures to be implemented at the target (including BSA/AML compliance) - a three-year projection of the financial impact of the acquisition on the acquiring institution is required. - Significant nonbanking activities must be approved in advance by applicable FBAs. - Any investment in nonbanking activities by a BHC or SHLC requires prior approval by the Federal Reserve; well-capitalized and well-managed FHCs may make such investments and notify after-the-fact. - Statutory limits to protect a bank from affiliate losses include: - lending from the bank to another affiliate may not exceed 10 percent of the bank’s capital - aggregate lending to all other affiliates may not exceed 20 percent of the bank’s capital - Supervisors review inter-affiliate transactions during examinations and can take corrective actions where safety and soundness concerns arise (see 12 U.S.C. § 1843; 12 CFR 225.26). ### Additional supervisory review of group acquisitions (AC1) - FBAs review acquisitions within the banking group to ensure they do not expose the bank to undue risks or hinder supervision. - Relevant regulations include: - 12 CFR 5.39; 12 CFR part 208 subpart G; 12 CFR part 362; 12 CFR part 211 subpart A; 12 CFR part 225 subparts C and I; 12 CFR part 238 subparts F and G. - Major acquisitions require prior approval; others may qualify for limited or post-notice. Approving agencies may impose conditions to mitigate concerns. ### Assessment of Principle 7 - Assessment: Compliant - Comments: - Laws and regulations define when prior approval, post-notice, or general consent are required and supply clear criteria. - Legislation and regulations restrict permissible investments (e.g., non-bank related). - Assessors reviewed supervisors’ reports and applications showing application of rules in practice. ### Supervisory approach: structure and risk-based methodology (Principle 8, EC1–EC2) - The U.S. adopts a risk-based approach with structured supervisory process, mandated reviews, a uniform rating process, and extensive planning. - Supervisory ratings and tools: - Federal Reserve uses RFI for BHCs on a consolidated basis. - All agencies use CAMELS (UFIRS) for banks; ROCA for FBOs. - Uniform Bank Performance Report supports cross-bank comparisons. - Prompt Corrective Action (PCA) statutory framework provides authority to resolve capital deficiencies. - Supervisory intensity thresholds: - Generally use a $10bn threshold as a dividing point for intensity of supervision. - Banking Institutions with at least $10bn of Assets: continuous assessment and resident teams. - Banking Institutions with at least $50bn of Assets: most intensive supervision and greatest resources. - SR 12-17 (2012) guidance targets firms with consolidated assets of $50 billion or more, focusing on enhancing resiliency and reducing the impact of a firm’s failure. - Dodd-Frank Act (DFA) requires systemically-significant BHCs or nonbank financial firms to submit periodic resolution plans and provides for orderly liquidation of covered financial companies. ### Forward-looking risk assessments, on-site and off-site integration (EC2–EC4) - Agencies conduct full-scope on-site examinations at least annually (for banks with assets of at least $500 million or not well-managed/well-capitalized) or every 18 months for smaller qualifying banks. - Examinations address capital adequacy, asset quality, management, compliance, earnings, liquidity, and sensitivity to market risk. - For banks exceeding $10bn or $50bn, supervisory programs include targeted reviews, resident teams, company-run stress tests, and supervisory-run stress tests (CCAR/CCAR-related). - Stress testing and capital planning: - DFA requires company-run stress tests for institutions supervised by Federal Reserve, FDIC, and OCC with total consolidated assets greater than $10 billion. - Federal Reserve Capital Plan Rule (November 2011) applies to U.S.-domiciled top-tier BHCs with total consolidated assets of $50 billion or more. - CCAR and supervisory stress tests assess resiliency over nine quarters under baseline, adverse, and severely adverse scenarios. - Company-run stress tests mirror supervisory-run scenarios. ### Supervisory techniques and tools (Principle 9, EC1–EC3) - Mix of on-site and off-site supervision is tailored by size, complexity, and risk: - On-site verifies policies, procedures, controls; off-site reviews financial condition and emerging risks. - Agencies segment organizations and allocate resources proportionately. - Off-site surveillance uses regulatory returns, prior assessments, audit reports, public filings, and other sources. - Information-sharing and coordination: - Regular coordination among FBAs and with functional supervisors; Memorandum of Understanding (May 16, 2012) among CFPB, OCC, Federal Reserve, and FDIC for examination coordination. - Agencies share supervisory information and may rely on other supervisors’ work to minimize duplication. - Supervision of smaller institutions: - Banks with less than $500mn in assets: generally annual examinations; qualifying banks with CAMELS ratings of 1 or 2 may be on an 18-month cycle. - Small bank holding companies (less than $10bn) inspections by Federal Reserve, often following lead bank cycle. - Specialized programs and tools: - Federal Reserve SR-SABR model; OCC Canary System; FDIC Large Insured Depository Institution (LIDI) program. - Agencies conduct joint reviews of large syndicated credits (2013 review: over 9,300 credit facilities totaling $3.0 trillion to approximately 5,800 borrowers). ### Resolvability and recovery planning (EC6–EC7) - PCA and implementing regulations enable timely resolution of capital deficiencies. - DFA requires covered entities (domestic BHCs/FBOs with total consolidated assets of $50 billion or more and non-bank financial companies designated by FSOC) to submit annual resolution plans (living wills). - Federal Reserve and FDIC regulations for resolution plans (November 2011): - Agencies may jointly find a plan not credible; firms have 90 days to resubmit; failure to correct deficiencies may trigger more stringent capital, leverage, liquidity requirements, or restrictions on growth/activities. - Resolution plans must not rely on extraordinary government support. - Resolution plans aim to minimize market and public confidence effects and ensure investor loss absorption without taxpayer support. ### Perimeter, regulatory arbitrage, and corrective actions (EC8) - FBAs can raise bank-like activities outside the regulatory perimeter with Congress for legislative change. - Supervisors have authority to prevent restructuring intended to evade the perimeter and can require elimination of impermissible activities via informal or formal corrective actions. - Approval orders often include conditions requiring prior notice of changes to business plans (e.g., new organizations required to provide prior notice of changes during the first three years of operation). ### Key numeric thresholds and exact figures (preserved verbatim) - 5 percent (aggregate investments threshold in 12 CFR 24.4 and 24.5) - $50bn (BHC and FHC asset threshold referenced multiple times) - $10bn (dividing point in intensity of supervision; also threshold for CFPB authority and for certain acquisition reporting) - $500 million (minimum asset threshold for requiring audited financial statements and additional reporting on internal controls) - three-year projection (required for financial impact of acquisition) - nine quarters (planning horizon for stress tests) - 18 months (examination cycle for qualifying smaller banks) - annual or two year basis (mandated BHC inspections depending on size/complexity/rating) - 10 percent (limit on lending from the bank to another affiliate) - 20 percent (aggregate lending limit to all other affiliates) - 70 (approximate number of banks in OCC’s Special Supervision function) - over 100 (number of matters requiring attention seen for some firms) - 9,300 credit facilities totaling $3.0 trillion extended to approximately 5,800 borrowers (2013 joint review) ### Assessment of Principle 8 and 9 - Principle 8: Compliant - Comments note the supervisory regime is effective and risk-based, with increasing focus on resolution for larger firms. - Assessors recommend simplification and clearer prioritization of supervisory communications (MRAs, MRBAs, MRIAs), and note ageing of some matters requiring attention (example: three years). - Principle 9: The U.S. employs an appropriate mix of on-site and off-site tools, tiered supervisory intensity, extensive coordination, and specialized programs for large and complex firms. *Source: _cr1589 - part 160 (in particular 160.36), and Subordinate Organizations, 12 CFR part 159 apply to both* ### Section 404 of the Sarbanes-Oxley Act, requires an external auditor of a bank or holding ### _cr1589 - Section 404 of the Sarbanes-Oxley Act, requires an external auditor of a bank or holding ### Regulatory requirements by institution size - Section 404 of the Sarbanes-Oxley Act: requires an external auditor of a bank or holding company that is a public company annually to render an opinion on the effectiveness of the company’s internal controls over financial reporting and make a management assessment. - Banking Institutions with at least $1bn of Assets: - Section 112 of the Federal Deposit Insurance Corporation Improvement Act (FDICIA) requires a formal attestation from company management on the quality of the internal control structure. - External auditors are required to attest to, and report separately on, the assertions of the bank’s management regarding internal controls. - Banking Institutions with at least $10bn of Assets: - As part of their Report of Examination, supervisors will specify matters requiring attention from the board. These are practices that deviate from sound governance, internal control, and risk management principles, which may adversely impact earnings or the capital, risk profile, or reputation if not addressed, or that result in substantial noncompliance with laws and regulations, internal processes, or supervisory guidelines. - Supervisors evaluate management plans for corrective action and consider whether they are likely to be effective. - In cases of severe problems or where management has been unable or unwilling to correct deficiencies, either formal or informal actions are typically issued against the bank and holding company. - These actions often require the bank or holding company to correct the most serious of examination findings and communicate progress of those corrections to the responsible agency, commonly on a quarterly basis. - The U.S. federal banking agency then has the ability to render judgment on management’s progress and can in turn structure the ongoing supervisory plans accordingly. ### Continuous monitoring and supervisory practices for the largest organizations - Continuous monitoring activities include: - meetings with a banking organization’s management and directors; - review of governance committee meeting notes and information packages; - analysis of internal MIS reports, market indicators, and other internal and external information; - review of internal and external audit and compliance findings; - analysis of internal and external financial reporting including regulatory and business line reporting, cross-firm analysis, identification of emerging issues; - coordination with other relevant supervisors and functional regulators and utilization of their work as appropriate. - Reference in text: "38 Please refer to Principle 10." ### EC4 — Tools used by the supervisor to review and assess safety and soundness - The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking system, such as: - (a) analysis of financial statements and accounts; - (b) business model analysis; - (c) horizontal peer reviews; - (d) review of the outcome of stress tests undertaken by the bank; and - (e) analysis of corporate governance, including risk management and internal control systems. - The supervisor communicates its findings to the bank as appropriate and requires the bank to take action to mitigate any particular vulnerability that have the potential to affect its safety and soundness. - The supervisor uses its analysis to determine follow-up work required, if any. ### Description and findings regarding EC4 — off-site monitoring, reports, and data - Off-site monitoring programs use: - automated screening systems; - regulatory reports; - standardized financial reports detailing key financial ratios and measures; - public sources of financial information to monitor performance and condition and promptly identify those requiring heightened supervisory attention. - Supervisors periodically (e.g., quarterly) communicate with the bank’s or holding company’s management to discuss emerging issues or concerns. - Supervisors provide written reports following targeted or limited-scope examinations, horizontal / comparative examinations, and annual summary reports that provide a consolidated overview of supervisors’ view of the institution as a whole, including assessments of significant subsidiary operations. - Examination staff use off-site surveillance tools and reports to: - plan the scope of, and determine priorities for, on-site examination work; - monitor the progress in responding to matters requiring further attention. - Included standardized financial data and reports: - FFEIC 031 or 041 Consolidated Reports of Condition and Income (Call Report); - FR-Y9 Consolidated Financial Statements for Holding Companies. - Supervisors carry out comparative peer analyses of the standardized reports for all organizations. - Supervisors require banks to submit financial reports and management analyses of the overall organization, subsidiaries, and business activities including financial, market risk, and operational risk management analyses. - Supervisors receive copies of board of directors’ minutes and exhibits, minutes and exhibits for their various committees, as well as minutes and materials for significant management committees throughout the supervised organization. ### Range of supervisory activities and coordination - Supervisors use a range of supervisory activities to maintain a comprehensive understanding and assessment of each firm, including: - a) In developing and executing a detailed supervisory plan for each firm, supervisors generally rely to the fullest extent possible on the information and assessments provided by other relevant supervisors and functional regulators. The supervisors actively participate in interagency information sharing and coordination, consistent with applicable laws, to promote comprehensive and effective supervision and limit unnecessary duplication of information requests. Supervisory agencies continue to enhance formal and informal discussions to jointly identify and address key vulnerabilities, and to coordinate supervisory strategies for large financial institutions. - b) Supervisors use firm-specific examination and continuous monitoring activities (“continuous monitoring activities” include meetings with a banking organization’s management; analysis of internal MIS reports, market indicators, and other internal and external information; review of internal and external audit findings; and coordination with other relevant supervisors and functional regulators and utilization of their work as appropriate) undertaken to maintain an understanding and assessment across the core areas of supervisory focus for each firm. These activities include review and assessment of changes in strategy, inherent risks, control processes, and key personnel, and follow-up on previously identified concerns (for example, areas subject to enforcement actions or other supervisory issues), or emerging vulnerabilities. - c) Coordinated horizontal reviews involve examination of several institutions simultaneously, encompassing firm-specific supervision and the development of cross-firm perspectives. The supervisors recognize the priority of these reviews through the dedication of multidisciplinary skills and experienced staff. Examples include analysis of capital adequacy and planning via the Comprehensive Capital Analysis and Review (CCAR) and the required annual company-run stress tests, as well as horizontal evaluations of resolution plans and incentive compensation practices. For a more detailed description of stress tests. The assessors noted the greater use of horizontal reviews, particularly for the larger banks. However the assessors noted that there were occasions where supervisory expectations of the peer-group were not clearly established and many of the contacts the assessors spoke to, suggested that supervisory expectations drifted and became relative to the peer-group, rather than absolute in terms of rules or guidance. - d) In certain instances, supervisors may be able to rely on a firm’s internal audit or internal control functions in developing a comprehensive understanding and assessment if deemed effective. - Supervisors also review corporate governance, risk management systems and practices, as well as the internal control systems, including operations, management information systems and audit effectiveness, in assessing an institution’s overall condition. ### Supervisory review objectives - The reviews seek two primary objectives: - 1. Enhancing resiliency of a firm to lower the probability of its failure or inability to serve as a financial intermediary. Each firm is expected to ensure that the consolidated organization (or the combined U.S. operations in the case of FBOs) and its core business lines can survive under a broad range of internal or external stresses. This requires financial resilience by maintaining sufficient capital and liquidity, and operational resilience by maintaining effective corporate governance, risk management, and recovery planning; and *Source: _cr1589 - Section 404 of the Sarbanes-Oxley Act, requires an external auditor of a bank or holding* ### 2. Reducing the impact on the financial system and the broader economy in the event ### 2. Reducing the impact on the financial system and the broader economy in the event ### Risk identification, monitoring, and stress testing (EC5) - Supervisory agencies monitor emerging risks using staff economists and financial analysts and horizontal examinations/horizontal analysis to detect concentrations and operational trends. - OCC: formal National Risk Committee (NRC) issues a semi-annual report in the Spring and Autumn; objectives include identifying primary and emerging risks and informing the OCC’s Executive Committee. - Federal Reserve: created a Risk Council to consolidate views of risks within regulated firms. - Banking Institutions with at least $10bn of Assets: - Firms are required to conduct an annual company-run stress test at the bank level over a nine quarters planning horizon using baseline, adverse, and severely adverse scenarios coordinated with agencies. - Banking Institutions with at least $50bn of Assets: - Federal Reserve conducts supervisory-run stress tests annually (participation by OCC and FDIC) using institutions’ exposure data; results with qualitative and quantitative feedback are provided in writing and inform the annual assessment. - Federal Reserve has begun liquidity-focused stress tests for institutions in the LISCC portfolio. - Communication of horizontal findings: - Single-institution findings: direct supervisory letter. - Emerging but not threatening risks: discussion with management, public comments by supervisory leaders, Bulletins, Financial Institution Letters, Supervision & Regulation or Community Affairs Letters, Handbooks, Examination Manual updates. ### Internal audit and reliance (EC6) - FBAs assess the quality and scope of every bank’s and holding company’s internal audit function regardless of whether audits are internal or outsourced. - Assessments consider independence, appropriateness of risk assessment program, size and quality of staffing, and effectiveness/completeness of audits. - Results determine the extent to which supervisors may rely on internal audit work for supervisory assessments. ### Supervisory engagement with boards and management (EC7, EC8) - Supervisors maintain frequent contacts with boards, non-executive directors, audit committees, senior and middle management, including heads of business units and control functions, to assess strategy, governance, capital, liquidity, asset quality, risk management, and internal controls. - At each exam conclusion, supervisors meet with senior management and board to discuss findings and obtain commitments; a written Report of Examination (ROE) is provided for review by all directors and senior officers. - For banks with at least $10bn of assets, supervisory communication frequency and scope increase based on size or risk profile and may include ongoing on-site presence by CPC and EIC teams. - Findings are delivered in written reports and discussed during the examination cycle; supervisory ratings and any resulting regulatory restrictions are conveyed to boards and senior management. - Assessors noted a tendency for supervisory communications to conflate board and senior management roles. ### Follow-up, MRAs, and escalation (EC9) - Supervisors undertake follow-up to verify corrective actions, including escalation to appropriate supervisory levels and the bank’s board where required. - Federal Reserve uses MRAs/MRBAs/MRIAs; these are detailed in examination reports and can lead to informal or formal enforcement actions with specified corrective actions and completion dates. - Assessors observed MRAs outstanding beyond original dates; supervisory management monitors aging MRAs and is considering further examiner guidance to reduce aged MRAs. - Where banks have large numbers of MRAs, prioritization and thematic issues can be lost. ### Notification and change reporting (EC10) — findings and recommendation - FBAs have an expectation, but not a formal requirement, that banks notify them in advance of substantive changes in activities, structure, or overall condition; some statutory notification requirements exist (e.g., BSA breaches). - Supervisory staff obtain frequent reports (quarterly if not monthly) and discuss changes during onsite and offsite monitoring. - Assessors recommend introducing a supervisory requirement that banks promptly notify supervisors if a major shareholder is no longer suitable, to ensure supervisors are promptly informed and can react given potential safety-and-soundness impacts. ### Use of external experts (EC11) - FBAs do not outsource prudential supervisory activities to independent third parties. On an as-needed basis, external experts (typically former supervisors or subject matter experts) may be engaged for specific tasks (e.g., commercial credit reviews) under formal contracts and supervised by agency personnel. ### Information systems and data collection (EC12 & Principle 10) - Federal Reserve maintains a National Information Centre (NIC) database for financial, regulatory, and structure report data. - Federal Reserve uses C-SCAPE for consolidated supervision workflow across LISCC, LBOs, large FBOs, and FMU portfolios to enable continuous updates and CAEL analyses. - OCC tools: Strategy Automation Tool (SAT), Examiner View (EV), eDocs, National Resource Planning Tool (NRPT), National Scheduling Application (NSA), Large Bank Institutional Database (LBID), National Credit Tool, FINDRS, SIS Reports, DART, Canary ratios, custom Tableau visualizations. - Principle 10 (Supervisory reporting) findings: - FBAs have broad authority to require information on a consolidated basis; there is no bank-level solo reporting mandate. - Reporting frequency: quarterly Call Reports for all federal banks and savings and loan associations; bank holding companies with consolidated assets of $500 million or more must submit consolidated reports; BHCs below $500 million submit parent-only reports semi-annually. - Volcker Rule: phased-in reporting metrics for significant trading activity by trading desk. - Accounting standards: statutory requirement to use U.S. GAAP; in some reports IFRS or other national standards may be allowed if no less stringent than U.S. GAAP. - Data verification: - Off-site automated edit programs (validity edits and quality edits); all edit exceptions must be corrected or explained; FBAs do not use external experts to verify supervisory returns. - Periodic reviews of reporting: - FFIEC Task Force of Reports and the Paperwork Reduction Act (PRA) require periodic review; most recent five-yearly Call Report review occurred in November 2012. - Next FFIEC/FBAs regulatory review to identify outdated regulations must be completed by December 31, 2016. - Assessment: Principle 10 rated Compliant. - Commentary: FBAs do not collect solo-level bank data; assessors consider current omission not sufficiently material now given U.S. bank subsidiaries tend to be small, but recommend future verification and consideration of solo reporting if group structures change. ### Findings on supervisory communication and report quality - Assessors observed communication shortcomings and made recommendations: - Large letters and reports can be extensive and may lose key messages, especially for Boards; extensive MRAs or transaction-specific observations exacerbate this (EC4). - Supervisors sometimes conflate the roles of board and senior management in communication and guidance (EC8). - Instances of what assessors viewed as excessive praise in supervisory communications; assessors recommend supervisors adopt communication strategies that produce balanced feedback (EC4). - Supervisory history narratives sometimes over-recount events to banks; assessors suggested these histories could be shortened with no loss of context (EC4). ### Assessment of supervisory framework and corrective powers (Principles 9, 11) - Principle 9 assessment: Largely Compliant. - Authorities possess an array of supervisory tools and are developing new techniques (stress testing, horizontal reviews). - Recommendation: introduce explicit supervisory reporting requirement for unsuitability of major shareholders. - Concerns: traditional heavy reliance on on-site examinations and limited bank reporting may create risks of delayed supervisory response; assessors list three risks: - potential single source of failure if examination misses changes; - removes onus on banks to consider what to report; and - delays supervisor response until next exam or contact. - Assessors support efforts to reduce aged MRAs and to improve clarity of MRAs. - Principle 11 assessment: Compliant. - FBAs can raise concerns early, require written corrective actions, request progress reports, and follow up. - Available tools include informal measures and formal enforcement actions (Formal/Written Agreements, Cease and Desist Orders, Safety and Soundness Orders, Capital Directives, PCA Directives, Civil Money Penalty Assessments), with public disclosure requirements. - Prompt Corrective Action (PCA) statute (12 U.S.C. § 1831o) provides objective capital thresholds and mandatory remedial measures for undercapitalized banks. - Agencies can apply sanctions against banks and Institution-Affiliated Parties (IAPs), including removal, suspension, civil money penalties, and activity restrictions. - Agencies can take corrective measures to ring-fence banks from parent/affiliate actions (including Source of Strength doctrine at 12 U.S.C. §1831o-1). - Conservatorship and receivership powers exist; FDIC cooperates in resolution and receives supervisory information for resolution planning. - Practical observations: - Agencies track MRAs and enforce timeframes; agencies maintain a 45 days time limit between end of full-scope exam and sending the Supervisory Letter (may be prolonged in individual cases). - Assessors recommend considering rules promoting early action for issues beyond capital and liquidity and continuing to strengthen timelines for MRAs/MRIAs. - Assessment: Principle 11 rated Compliant. ### Consolidated supervision (start of Principle 12) - Federal Reserve is consolidated supervisor for U.S. bank holding companies (BHCs), financial holding companies (FHCs), and savings and loan holding companies (SLHCs). - Federal Reserve uses ongoing supervision and required approvals for holding company formation, acquisitions, and new activities to understand group structure, material activities, and risk management; it relies on primary supervisors, functional regulators, and foreign supervisors for additional information on entities within the holding company structure. *Source: IMF assessment chapter titled "2. Reducing the impact on the financial system and the broader economy in the event" (UNITED STATES).* ### Section 604 of the DFA makes it easier for the Federal Reserve to obtain information directly ### Section 604 of the DFA makes it easier for the Federal Reserve to obtain information directly from BHC subsidiaries, including functionally regulated subsidiaries ### Federal Reserve information and examination authority under Section 604 (DFA) - Section 604 grants the Federal Reserve examination authority over BHC subsidiaries, including functionally regulated subsidiaries, to inform itself of: - (1) the nature of the operations and financial condition of the BHC and the subsidiaries; - (2) the financial, operational and other risks within the BHC system that may pose a threat to the safety and soundness of the BHC or any of its depository subsidiaries or the stability of the financial system of the U.S.; and - (3) the systems of the BHC for monitoring and controlling the foregoing risks. - In exercising this authority, the Federal Reserve must: - rely to the fullest extent possible on examination reports prepared by a functional regulator; and - notify the functional regulator before conducting an examination of the functionally regulated subsidiary. - Section 604 repealed a provision of the GLB Act that barred the Federal Reserve from exercising enforcement or rulemaking authority over functionally regulated subsidiaries except in extraordinary circumstances. ### Consolidated supervision mechanisms and structural developments - Formal and informal mechanisms among U.S. FBAs and state bank supervisors facilitate consolidated supervision, covering: - coordination of examinations; - communication protocols for emergency situations; - information sharing related to electronic databases containing examination reports, financial records, and other supervisory information. - Functional regulators (SEC, CFTC, state insurance supervisors) exchange information with FBAs on securities and insurance companies in holding companies or financial conglomerates; FBAs normally rely on information from functional regulators before making own requests. - U.S. law authorizes FBAs to exchange financial records, examination reports, and other information regarding banks and holding companies. - Structural changes implying improved consolidated supervision: - an increasing number of insurance companies have acquired thrifts, resulting in holding companies supervised by the Federal Reserve on a consolidated basis; - the scope of supervision of the largest groups has been broadened and examination teams now include macroeconomic, IT, and legal experts in addition to prudential supervisors. ### Group-wide reporting, standards, and supervisory tools - Prudential standards and supervisory focus (findings re EC2) include standards to address: - 1) Resolution and recovery plans for large holding companies - 2) Capital adequacy—see Principle 16 for detail - 3) Liquidity—see Principle 24 for detail - 4) Large exposures and lending limits—see Principle 19 for detail - 5) Exposures to related parties—see Principle 20 for detail - 6) Group structure—see Principle 4, Principle 6, and Principle 7 for detail - Federal Reserve consolidated application: - imposes prudential standards on capital adequacy, risk management, risk-specific measures, internal audit and controls, accounting and disclosures on a consolidated, group-wide basis; - requires regular financial and organizational structure reporting by all holding companies: - holding companies having over $500 million in assets report financial data on a consolidated basis; - smaller holding companies provide parent-only financial statements which, combined with bank financial reports, provide an approximate consolidated view; - organizational structure information is updated on an ongoing basis; - reported information is analyzed in conjunction with regular supervisory activities and formal off-site monitoring programs. - Stress-testing and capital planning: - the DFA's stress-testing requirements apply to all holding companies having assets in excess of $50 bn and apply on a consolidated basis; - the Capital Plan requirements (2011) require large banks to submit yearly capital plans on a consolidated basis, taking all material risks into account. ### Foreign banking organizations and Section 165 (DFA) - Section 165 requirement: FBOs generally, with some exceptions, must form a holding company for their U.S. affiliates, strengthening consolidated supervision. - In February 2014 the Federal Reserve introduced enhanced prudential standards for FBOs (see 12 CFR part 252) as required in Section 165 of DFA: - for a foreign banking organization with total consolidated assets of $50 billion or more, the rule implements enhanced risk-based and leverage capital requirements, liquidity requirements, risk-management requirements, stress testing requirements, and the debt-to-equity limit for those companies the FSOC has determined pose a potentially grave threat to the financial stability of the U.S.; - requires foreign banking organizations with U.S. non-branch assets of $50 billion or more to form a U.S. intermediate holding company and imposes enhanced prudential standards on that U.S. intermediate holding company; - establishes a risk-committee requirement for publicly traded foreign banking organizations with total consolidated assets of $10 billion or more and implements stress-testing requirements for foreign banking organizations and foreign savings and loan holding companies with total consolidated assets of more than $10 billion. - Liquidity rules for branches to foreign banks apply a 15-day run-off criterion, versus the 30-day period for U.S. banks. ### Home-host cooperation, supervisory colleges, and crisis planning (Principle 13 highlights) - Supervisory colleges: - U.S. FBAs have established supervisory colleges for U.S. banking groups with material cross-border operations; Federal Reserve and OCC co-chair colleges for several groups; - colleges meet at least annually, with conference calls between meetings; core and general college meetings are convened when warranted. - Information sharing and arrangements: - home and host supervisors share appropriate information bilaterally and through colleges, including via MoUs and SOCs (no legal difference between MOUs and SOCs); - U.S. FBAs provide adequate and timely data to host supervisors about U.S. banks and holding companies, including significant supervisory issues; - under the FBO Supervision Program, Federal Reserve and OCC routinely provide copies of essential supervisory products to home country supervisors (annual assessment of combined U.S. operations, supervisory rating, summary examination and findings, SOSA ranking, and on request, examination reports). - Cross-border crisis cooperation: - CMGs have been established for the largest, most systemic U.S. banking groups; U.S. FBAs are completing cooperation agreements (COAGs) to govern CMG activities and information sharing; - U.S. FBAs participate in firm-specific CMGs for G-SIFIs designated by the Financial Stability Board to develop crisis management strategies and resolution plans. - On-site access and coordination: - foreign home supervisors may examine U.S. operations of their banks, generally with prior contact with U.S. FBAs and state authorities; - U.S. FBAs expect on-site access to foreign offices and subsidiaries of U.S. banks and inform host supervisors in advance of intended visits. ### Supervision of cross-border operations and host treatment (EC7–EC9) - U.S. operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to domestic banks under the International Banking Act (12 U.S.C. § 3101 et seq) and implementing regulations (12 CFR part 211, subpart B; 12 CFR part 28, subpart B). - Enhanced prudential standards and intermediate holding company requirements apply to larger FBOs as noted above. - Shell banks are not permitted under U.S. law; U.S. banks may not establish correspondent accounts for foreign shell banks; termination is required if an account is known to be of a foreign shell bank (see 31 CFR 103.177). ### Supervisory consultation and action on information from other supervisors (EC10) - As a general matter, U.S. FBAs do not take action on the basis of information received from another supervisor without independently confirming the information and consulting with the providing supervisor, to the extent possible. - FBAs retain power to take action without prior consultation if the situation is deemed urgent. ### Corporate governance (Principle 14) — supervisory expectations and assessment - Legal and supervisory basis: - corporate governance responsibilities arise from state corporate law and federal regulations, including: NYSE/NASDAQ listing rules, Sarbanes-Oxley Act of 2002, 12 U.S.C. § 1831i, 12 U.S.C. § 1831m, 15 U.S.C. §§ 78j-1, 7262(b), 7265, and 12 CFR 208 Appendix D-1. - Federal Reserve, OCC, and FDIC issue guidance (BHC Supervision Manual, Commercial Bank Examination Manual, Comptroller’s Handbook, SR 12-17) outlining board and senior management responsibilities. - Key board expectations (from SR 12-17 and agency guidance): - maintain a clearly articulated corporate strategy and institutional risk appetite; - ensure senior management expertise and involvement to manage core business lines and material entities; - maintain a corporate culture emphasizing compliance, consumer protection, and avoidance of conflicts of interest; - ensure effective and independent internal audit, compliance, and risk management functions; - align compensation and investments across business lines with corporate strategy and risk appetite; - ensure MIS support for board oversight of core business lines and critical operations. - Board structure and committees: - risk committees required for publicly traded BHCs with assets between $10 and $50 billion, and for BHCs with total consolidated assets of $50 billion or more (12 U.S.C. § 5365; 12 CFR 252.22 and 225.33); - audit committee composition requirements vary by total assets thresholds ($500 million–$1 billion, $1 billion or more, more than $3 billion) and SOX requirements for public companies. - Supervisory assessment and ratings: - board and senior management oversight feed into the CAMELS Management (M) rating and the Federal Reserve’s RFI/C(D) rating system for BHCs; - examiners evaluate board effectiveness across meeting frequency, committee effectiveness, policy adequacy, MIS quality, and responsiveness to auditors and supervisors. - Assessment of Principle 14: Largely Compliant - comments cite recent strengthening of supervisory expectations (SR 12-17, OCC Heightened Expectations), increased board involvement, and ongoing implementation; remaining gaps and phased implementation mean further progress is required. ### Risk management framework (Principle 15) — supervisory findings and tiered expectations - General approach: - supervisors require banks to have comprehensive risk management processes proportionate to size, complexity, and risk profile; supervisory assessment is risk-focused and reflected in examination ratings. - Size-based expectations and thresholds: - Banking institutions with at least $10bn of assets: subject to DFA requirements such as annual company-run stress tests and formation of a risk committee; supervisory guidance on stress testing applies to banking organizations with at least $10 billion in total assets. - Banking institutions with at least $50bn of assets: subject to DFA-enhanced requirements for risk-management frameworks, the Federal Reserve’s Capital Plan Rule, annual CCAR, and Comprehensive Liquidity Analysis and Review (CLAR). - Banking institutions with at least $250 billion in total consolidated assets or at least $10 billion in total on-balance sheet foreign exposure: subject to advanced approaches under Basel II and related supervisory review process. - Risk management components examined: - board and senior management oversight; policies, procedures and limits; risk measurement, monitoring and MIS; and comprehensive internal controls. - Models, validation, and stress testing: - banks must perform independent validation and testing of models; Federal Reserve expects effective independent review and validation of models used in internal capital planning (Capital Planning guidance, August 2013). - stress testing is integral; supervisors require forward-looking stress testing proportionate to risk profile and assess integration of results into capital, liquidity, and contingency planning. - Information systems and new products: - supervisors determine MIS adequacy for measuring and reporting exposures across risk types and that boards and senior management obtain and understand such information. - policies must ensure risks of new products and major initiatives are assessed and approved by the board or committee where appropriate. - Risk management function and CRO: - larger and more complex banks (notably those with at least $50bn in assets) are required to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) who must report directly to both the risk committee and the CEO; compensation must support objective assessment of risks. - current guidance is silent on whether CRO removal requires prior board approval or disclosure; OCC Heightened Standards propose board/risk committee approval for appointment/removal and approval of CRO compensation. - Assessment of Principle 15: Largely Compliant - supervisors observed substantial improvements since the crisis but note implementation remains a work in progress, particularly for larger firms and for smaller banks where many essential criteria are not met; recommendations include clearer delineation of board vs management roles and clarification regarding CRO removal procedures. ### Capital adequacy (Principle 16) — legal framework and Basel III implementation - Statutory and regulatory basis: - FBAs are authorized to establish minimum capital requirements and adopted former capital standards (Basel I) and, in July 2013, adopted a new capital rule implementing global capital reforms and certain DFA changes (Basel III revisions). - the new rule restructures regulatory capital into three forms: common equity tier 1 capital, additional tier 1 capital, and tier 2 capital, with criteria emphasizing permanence and loss-absorption on a going concern basis (12 CFR part 3; 12 CFR part 217; 12 CFR part 324). - Prescribed minimum consolidated risk-based capital ratios under the new rule: - 4.5 per cent common equity tier 1 capital; - 6 per cent tier 1 capital; - 8 per cent total capital. - Capital buffers: - the new rule incorporates a capital conservation buffer of 2.5 per cent and, for banking organizations using the advanced approaches risk-based capital rule, a countercyclical capital buffer of up to [text truncated in source beyond this point]. *International Monetary Fund — Staff Country Report excerpt (source PDF: _cr1589 - Section 604 of the DFA makes it easier for the Federal Reserve to obtain information directly)* ### 2.5 per cent; both buffers are composed of common equity tier 1 capital. ### _cr1589 - 2.5 per cent; both buffers are composed of common equity tier 1 capital. ### Capital requirements overview - New capital regulatory framework maintains the longstanding minimum 4 per cent leverage ratio requirement (tier 1 capital to total on-balance-sheet assets) for banking organizations. - Capital buffers: 2.5 per cent; both buffers are composed of common equity tier 1 capital. - The new capital rule requires compliance by different types of organizations at different times, commencing on 1 January 2014, and incorporates transition provisions consistent with Basel III. - Bank holding companies with $500 million or less in total consolidated assets are exempt from the new rule and are instead subject to the standards in the Federal Reserve’s Small BHC Policy (see 12 CFR part 225, Appendix C). - Savings and loan holding companies were not subject to the former capital standards, but most are or will be subject to the new capital rule. Certain savings and loan holding companies with substantial commercial or insurance operations are currently excluded from the new capital rule (see 12 CFR part 217, subpart A); however, consistent with legal requirements, the Federal Reserve anticipates applying capital requirements to these excluded holding companies in the future. (See 12 U.S.C. § 5371.) ### Supplementary leverage ratio and scope - “Core” banking organizations (those with total consolidated assets of at least $250 billion or total consolidated on-balance sheet foreign exposures of at least $10 billion) that are required to use the advanced approaches risk-based capital rule, and other banking organizations that elect to do so, are also required to meet a minimum “supplementary leverage ratio” of 3 per cent, consistent with the Basel III leverage ratio. - The supplementary leverage ratio is defined in terms of tier 1 capital to total on- and off-balance sheet assets. - Regulatory citations: 12 CFR 3.10 (OCC); 12 CFR 217.10 (Federal Reserve); 12 CFR 324.10 (FDIC). - In April 2014, the FBAs adopted an enhanced supplementary leverage ratio final rule for top-tier bank holding companies and their insured depository institution subsidiaries. (See EC4). ### Regulatory treatment of capital instruments - The FBAs review the quality and regulatory capital eligibility of more complex instruments as necessary on a case-by-case basis. - A banking organization must request approval from its primary FBA before including a capital element in regulatory capital, unless certain conditions are satisfied. - The FBAs consult with each other when determining whether a new element should be included in common equity tier 1, additional tier 1 or tier 2 capital, and such decisions are made publicly available, including a brief description of the capital element and the rationale for the conclusion. - Regulatory citations for procedures: 12 CFR part 3, subpart C (OCC); 12 CFR part 217, subpart C (Federal Reserve); 12 CFR part 324, subpart C (FDIC). ### Prompt Corrective Action (PCA) framework and capital classifications - The Prompt Corrective Action (PCA) requirements provide the FBAs with a framework to take necessary measures should a bank become less-than-well capitalized. - A bank’s common equity tier 1, tier 1 and total risk-based capital ratios, and leverage ratios, including the supplementary leverage ratio if applicable, must be at or above the regulatory minimum requirements to be considered adequately capitalized. - The PCA framework is not applicable to bank holding companies. - Minimum ratio requirements and PCA constraints are codified in: 12 CFR part 6 (OCC); 12 CFR part 208, subpart D (Federal Reserve); 12 CFR part 324, subpart H, 12 CFR part 325, subpart B, and 12 CFR part 390, subpart Y (FDIC). ### PCA classification thresholds and associated restrictions - Capital classification definitions: - "Well Capitalized": A bank is "well capitalized" if it significantly exceeds the required minimum levels of capital (risk-based and leverage). - "Adequately Capitalized": A bank is "adequately capitalized" if it meets the required minimum levels of capital. - "Undercapitalized": A bank is "undercapitalized" if it fails to meet any required minimum level of capital. - "Significantly Undercapitalized": A bank is "significantly undercapitalized" if it is significantly below any required minimum level of capital. - "Critically Undercapitalized": A bank is "critically undercapitalized" if it fails to meet the "critical capital" level to be determined by the regulators. - Numeric thresholds (as presented): - Total Capital: ≥10% (Well Capitalized) ; ≥8% (Adequately Capitalized) ; <8% (Undercapitalized) ; <6% (Significantly Undercapitalized) - Tangible Equity (defined as Tier 1 capital plus non Tier 1 perpetual stock) to Total Assets: ≤2% (Critically Undercapitalized) - Tier 1 Capital: ≥8% (Well Capitalized) ; ≥6% (Adequately Capitalized) ; <6% (Undercapitalized) ; <4% (Significantly Undercapitalized) - Common Equity Tier 1: ≥6.5% (Well Capitalized) ; ≥4.5% (Adequately Capitalized) ; <4.5% (Undercapitalized) ; <3% (Significantly Undercapitalized) - Leverage Ratio: ≥5% (Well Capitalized) ; ≥4% (Adequately Capitalized) ; <4% (Undercapitalized) ; <3% (Significantly Undercapitalized) - Supplementary Leverage Ratio: Not Applicable (Well Capitalized) ; ≥3% (Adequately Capitalized) ; <3% (Undercapitalized) ; Not Applicable (Significantly Undercapitalized) ; Not Applicable (Critically Undercapitalized) - Capital distributions: - Permitted if afterwards the bank is not classified as undercapitalized. - Not permitted (when under certain classifications). - Operational and market restrictions by classification (selected highlights): - Well-capitalized: None. Well-capitalized banks actually benefit. They may accept brokered deposits and the regulators may examine them less frequently. - Adequately capitalized: None. Adequately capitalized banks are subject to some restrictions. - Undercapitalized and Significantly Undercapitalized: Restrictions on brokered deposits (may accept only with FDIC waiver), FHLB restrictions, increased risk-based deposit premiums, requirement for a capital restoration plan, limits on growth, limits on access to the Federal Reserve's discount window, approvals required for acquisitions/branching/entering new lines of business, prohibition on executive bonuses or raises without regulatory approval. - Additional actions for undercapitalized banks may include sale of securities, elimination of the sister bank exemption to Section 23A, further restrict transactions with affiliates, limit interest rates paid, improve management (including requiring new board or dismissing directors/executive officers who have served at least 180 days), prohibit deposits from correspondent banks, require divestitures by the bank or the bank's parent, and require any other actions deemed necessary. - Critically undercapitalized: Must be placed in conservatorship or receivership within 90 days of such a determination unless FDIC and appropriate regulators determine that other action would protect the deposit fund. Redetermination is required every 90 days. If bank is, on average, critically undercapitalized for 270 days, then a receiver must be appointed unless the bank: - has positive net worth, - is in substantial compliance with an approved capital restoration plan, - is profitable, - is reducing its ratio of nonperforming loans to total loans, and - the FDIC chairperson and the appropriate regulator certify that the bank is both viable and not expected to fail. - The FDIC must by regulation or order prohibit a critically undercapitalized bank, without approval, from: - entering into any material transaction not in the ordinary course of business, - extending credit for any highly leveraged transactions, - amending its Articles or bylaws. ### Description and findings re EC2 (internationally active banks) - For internationally active banks (defined by the agencies for these purposes as the advanced approaches banking organizations), the new capital rule provides for definitions of capital and risk coverage that are largely consistent with the applicable Basel standards. - However, the FBAs highlighted differences in methods of calculation and in prescribed requirements between the U.S. advanced approaches and the advanced Basel II approaches, related in particular to: - the U.S. securitization framework, as the use of external ratings are prohibited by the DFA; and - the detailed minimum requirements of the advanced IRB approach. - These differences have been explored in the recent Regulatory Consistency Assessment Programme (RCAP) review of the adoption of the Basel risk-based capital standards (Basel II). *International Monetary Fund — UNITED STATES (extracted content).* ### 2.5 and III) by the U.S. ### _cr1589 - 2.5 and III) by the U.S. ### Capital framework and interaction of standardized and advanced approaches - Banking organizations subject to the advanced approaches under the new rule are also subject to a supplementary leverage ratio that is consistent with the Basel III leverage ratio. - All banks and most bank holding companies are currently subject to the general risk-based capital framework (broadly consistent with Basel I) and, starting on January 1, 2015, will become subject to the corresponding rules under the new capital rule (standardized approach). - The U.S. standardized approach is based on the Basel II standardized approach but differs in key respects highlighted by the FBAs: - excludes a capital charge for operational risk and for Credit Value Adjustment (CVA) risk; and - specifies risk-weights for a range of assets instead of basing those risk-weights on external credit assessments, as per the Basel II approach (due to DFA requirements). - The new capital rule requires a banking organization using the advanced approaches to use as its minimum capital ratio the lower of its ratios as calculated under the standardized approach or the advanced approaches, creating a “floor” for the risk-based capital of such organizations and thereby subjecting organizations using internal-ratings-based models and those that are not to generally applicable capital requirements. - The BCP assessors were not in a position to quantify the materiality of the differences between the U.S. standardized approach and the Basel standards; in the absence of an explicit capital charge for operational risk and for the CVA, the assessors find it difficult to satisfy themselves that the new U.S. standardized approach requirements are not lower than the applicable Basel standards. ### Market risk and securitization treatment - Banking organizations, including those using the advanced approaches, with significant trading activity are subject to the market risk rule. - Covered savings and loan holding companies will be subject to the market risk rule in the new capital rule in the same manner as bank holding companies. - The FBAs stated that the market risk requirements in the new capital rule are broadly consistent with the Basel market risk framework, including the 2011 revisions, but differ in the treatment of securitizations—in particular, the maintenance of a transitional rule for non-modeled securitization positions. - The RCAP report (referenced by assessors) concluded that the U.S. implementation of the market risk framework was “materially non-compliant” when taking this difference into account. ### Supervisor powers to impose capital charges and limits (EC3) - The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, if warranted, including risks not adequately transferred or mitigated through transactions (e.g., securitization transactions). - Both on-balance sheet and off-balance sheet risks are included in the calculation of prescribed capital requirements. - The FBAs have broad statutory authority to establish minimum capital levels and to impose specific capital charges (see 12 U.S.C. §§ 3907(a)(2), 3909). - The rules do not give the FBAs the explicit power to directly limit material risk exposures; however, the FBAs can achieve equivalent outcomes by: - altering capital requirements on a bank through discretionary authority, and - using general formal or informal enforcement actions in the case of threats to safety and soundness. - Evidence in supervisory material shows use of this approach, including setting specific minimum capital requirements and requiring capital plans to raise capital commensurate with a bank’s risk profile. - The new capital rule expressly incorporates risk-mitigating activities and off-balance-sheet items such as guarantees, credit protection and collateral, consistent with the Basel capital framework. - Supervisory assessment mechanisms: - UFIRS assesses a bank’s capital adequacy during every full-scope examination; this is reflected in the Capital component of the CAMELS rating and feeds into PCA requirements. - The Federal Reserve’s RFI/C (D) rating system measures overall performance and condition of bank holding companies; the “F” component rates financial condition including capital adequacy. ### Capital adequacy, systemic importance and leverage buffers (EC4) - Prescribed capital requirements reflect banks’ risk profiles and systemic importance in the context of markets and macroeconomic conditions, and constrain leverage build-up. - FBAs acknowledge the rules do not explicitly address all material risks, particularly in the most sophisticated and competitive financial markets; they expect forward-looking capital plans and the ability to impose higher capital levels where necessary. - Leverage considerations: - FBAs review a bank’s or holding company’s tier 1 leverage ratio when assessing capital adequacy. - Under the new capital rule, banking organizations using the advanced approaches are subject to a “supplementary leverage ratio”. - Bank holding companies with $700 billion in total consolidated assets or more that $10 trillion in assets under custody are subject to an enhanced leverage buffer greater than 2 percentage points (above the minimum 3 percent supplementary leverage ratio). - Such bank holding companies must meet a total leverage ratio (tier 1 capital to total on- and off-balance sheet assets) of at least 5 percent to avoid restrictions on capital distributions and discretionary bonus payments to executive officers. - The insured depository institution subsidiaries of those bank holding companies must maintain a supplementary leverage ratio of at least 6 per cent to be considered “well-capitalized” under each agency’s PCA framework. - Supervisory expectations generally require banks and bank holding companies to operate at capital levels well above required minimums; PCA requirements create disincentives to fall below “well-capitalized” status. - Section 165 of the DFA requires the Federal Reserve to impose enhanced prudential standards on large bank holding companies and designated nonbank financial companies; enhanced standards must include capital and stress testing and increase in stringency with systemic footprint (see 12 U.S.C. § 5365). - In February 2014 the Federal Reserve approved a final rule under section 165 establishing enhanced prudential standards for bank holding companies with more than $50 billion in total consolidated assets (see 79 FR 17239). - Foreign-based BHCs with significant U.S. presence are required to establish an intermediate holding company for U.S. subsidiaries, generally subject to the same capital requirements as a U.S.-based BHC. ### Use of internal assessments and model governance (EC5) - Use of banks’ internal assessments of risk as inputs to regulatory capital is approved subject to rigorous qualifying standards. - Under the advanced approaches framework, subject banks and holding companies must use internally generated assessments of credit and operational risk as the basis for regulatory capital where applicable. - Key governance and supervisory controls: - Use of advanced approaches subject to rigorous qualifying criteria in capital rules, to be met on initial and ongoing basis. - A banking organization must complete a parallel run of at least four consecutive calendar quarters before moving to advanced approaches; primary FBA supervisor must deem compliance satisfactory during the parallel run. - During the parallel run, the organization is subject to general risk-based capital rules or the standardized approach for regulatory and supervisory purposes while also calculating and reporting advanced approaches ratios. - If an approved banking organization subsequently fails to comply with qualification requirements, it must submit a satisfactory plan to return to compliance; failure could result in revocation of approval and reversion to the standardized approaches. - Banks must notify their primary FBA supervisor of any change to a system that would result in a material change to risk-weighted asset amounts or significant changes to modeling assumptions. - Supervisors may require banks to calculate risk-based requirements under advanced approaches with supervisory modifications or under the general risk-based capital rule if risk-based capital requirements are not commensurate with risks. - Use of internal models for market risk-weighted assets requires prior approval and continued satisfaction of specific requirements, including model sophistication commensurate with positions and conservative assessment of less liquid positions. - The general risk-based capital rules and the standardized approach generally do not allow internal estimates, with limited exceptions requiring supervisory approval. ### Forward-looking capital management and stress testing (EC6) - The supervisor has power to require banks to adopt a forward-looking approach to capital management, including stress testing and feasible contingency arrangements to maintain or strengthen capital in times of stress. - All banking organizations must hold capital commensurate with a forward-looking view of their risk profile; FBAs can require corrective action if capital plans are inadequate and pose safety and soundness concerns. - Federal Reserve requirements: - Capital planning and stress testing requirements apply to bank holding companies with total consolidated assets greater than $50 billion (see 12 CFR part 252; 12 U.S.C. 5365(i)). - Supervisory stress tests evaluate whether institutions have capital necessary to absorb losses under adverse conditions using FRB-provided scenarios; these institutions also conduct semi-annual company-run stress tests. - Section 165(i)(2) requires financial companies with more than $10 billion in assets to conduct annual company-run stress tests using scenarios provided by the FBAs; FBAs provided final rules and guidance for these tests. - Scenarios include baseline, adverse and severely adverse and specify variables for each quarter over a nine-quarter horizon covering economic activity, asset prices and financial market conditions for the U.S. and key foreign countries. - Capital plan requirements for BHCs with assets greater than $50 billion: - Annual submission required (see 12 CFR 225.8). - Must contain estimates of minimum regulatory capital ratios and tier 1 common ratio under expected and stressed scenarios over a nine-quarter planning horizon. - Must discuss maintenance of regulatory capital ratios and a pro forma tier 1 common ratio above 5 per cent under stressed scenarios and maintain sufficient capital to continue operations, meet obligations and continue serving as a credit intermediary. - Comprehensive Capital Analysis and Review (CCAR): - Annual intensive assessment of capital adequacy and capital management practices for BHCs with assets greater than $50 billion. - Requires firms to analyze potential for significant and rapid changes in risk and demonstrate maintenance of capital above a tier 1 common ratio of 5 per cent post-stress. - Federal Reserve provides qualitative and quantitative assessments and either objects to or provides a non-objection to each company’s capital plan; objections prohibit capital distributions unless resolved. - For banking organizations not subject to CCAR, FBAs collect data on quantitative projections and review qualitative methodologies; annual company-run stress test results are subject to onsite examination and inspection. ### Additional criteria for non-internationally active banks (AC1) - For non-internationally active banks, capital requirements (definition of capital, risk coverage, method of calculation, scope of application and capital required) are broadly consistent with principles of applicable Basel standards relevant to internationally active banks. - As noted in EC2 and earlier sections, from January 1, 2015 all banks and most bank and savings and loan holding companies will be subject to the new capital rule (standardized approach). - The U.S. standardized approach provides definitions of capital largely consistent with Basel III but differs in risk coverage and method of calculation: - excludes a capital charge for operational risk and for CVA risk; and - specifies risk-weights for a range of assets instead of basing those risk-weights on external credit assessments as per the Basel II approach. - The assessors were not in a position to quantify the materiality of these differences; absence of explicit operational risk and CVA charges makes it difficult to conclude that the U.S. standardized approach is not lower than applicable Basel standards. *Italic: Source — _cr1589 - 2.5 and III) by the U.S., IMF assessment chapter content provided in the supplied PDF excerpt.* ### Section 171 of the DFA requires the FBAs to establish, on a consolidated basis, minimum risk- ### _cr1589 - Section 171 of the DFA requires the FBAs to establish, on a consolidated basis, minimum risk- ### Section 171 and consolidated minimum capital requirements - Section 171 of the DFA requires the FBAs to establish, on a consolidated basis, minimum risk-based and leverage capital requirements for bank holding companies, savings and loan holding companies, and nonbank financial companies that “shall not be less than” the generally applicable capital requirements for insured depository institutions. - The minimum capital requirements cannot be “quantitatively lower than” the generally applicable capital requirements for insured depository institutions that were in effect in July 2010. ### AC2 — distribution of capital within banking groups - The supervisor requires adequate distribution of capital within different entities of a banking group according to the allocation of risks. - Description and findings re AC2: - The FBAs apply minimum capital requirements at both the bank (including its subsidiaries) and holding company levels. - Other prudential supervisors of holding company subsidiaries may set minimum capital requirements for those subsidiaries. - The FBAs expect the distribution of capital among entities within a banking group to reflect the risks presented by those entities. - Other subsidiaries are expected to maintain appropriate levels of capital consistent with the expectations of supervisors with oversight responsibilities. - If an FBA believes a bank or holding company is operating in an unsafe or unsound manner, including after taking into account affiliate capital adequacy, the FBA can require it to hold more capital. - By statute, bank holding companies and savings and loan holding companies are required to serve as sources of financial strength for any subsidiaries that are depository institutions (see 12 U.S.C. § 1831o-1). - The Federal Reserve is limited by statute in its ability to require that regulated broker-dealers or insurance companies within a holding company structure provide funds or other assets to an affiliated depository institution (see 12 U.S.C. § 1844(g)). - Bank holding companies with consolidated assets of less than $500 million are generally exempt from the calculation and analysis of risk-based capital ratios on a consolidated holding company basis, subject to certain terms and restrictions. - The Federal Reserve may apply the risk-based capital rules at its discretion to any BHC, regardless of asset size, if such action is warranted for supervisory purposes. ### Assessment of Principle 16 — summary and key judgments - Assessment: Largely Compliant - Comments and findings: - The FBAs have a robust and comprehensive approach to setting prudent and adequate capital adequacy requirements for banks and most holding companies, strengthened since the financial crisis in response to the Basel and DFA reform initiatives. - Broad adoption of the Basel III definition of capital, when fully implemented, will improve the quality of bank capital by limiting inclusion of certain intangibles previously counted for a high proportion of bank capital. - Introduction of risk-based capital rules based on Basel standards for most savings and loan holding companies removes a prior anomaly of case-by-case determination. However, savings and loan holding companies with substantial insurance or commercial activities are excluded from the new regulatory capital rules. - The exclusion of those savings and loan holding companies could, over time, create safety and soundness and competitive neutrality issues; assessors encourage the Federal Reserve to complete a comprehensive capital framework for holding companies. - Stress testing: - Stress testing has become an essential element of capital adequacy assessments for banking organizations with more than $10 billion of assets. - The stress-testing regime is embedding a forward-looking approach to capital needs and engaging boards and senior management more fully in capital planning. - The regime is very data-and-resource-intensive for both firms and supervisory agencies. - Assessors believe credibility would be further enhanced if the regime avoids excessive granularity and secures continued board engagement by using scenarios that readily meet the “severe but plausible” test. - Compliance context and transitional considerations: - Compliance with this CP requires the assessors to determine that the capital adequacy regime for internationally active banks is “not lower” than relevant Basel standards (EC 2) and that for non-internationally active banks is “broadly consistent” with the standards (AC1). - The U.S. regulatory capital framework is in transition. Major elements of the Basel II advanced approaches were implemented from I January, 2014 and the U.S. standardized approach based on Basel II will begin to come into effect from 1 January, 2015. - Until implementation, most banking organizations remain subject to former capital standards; assessors saw little sense in assessing former standards at this late stage. - Key differences with the Basel framework noted by assessors: - Risk-based capital requirements for internationally active banks under the advanced approaches differ in a number of respects from the Basel framework. - The U.S. standardized approach (the “floor” for advanced approach banking organizations and applicable to all other banking organizations) does not impose a capital charge for operational risk or for CVA risk; there are also divergences regarding the standardized approach to market risk. - The absence of capital charges for operational risk and CVA is a significant omission in risk coverage and distinguishes the U.S. capital regime from other major jurisdictions. - While leverage ratio requirements provide an important backstop, a leverage ratio framework was never intended to replace the Basel risk-based framework, which requires explicit incorporation of significant identifiable risks in minimum capital requirements. - The absence of operational risk and CVA charges makes the “standardized” floor less binding than it may appear. ### Principle 17 — introduction and EC1 (credit risk management) - Principle 17 overview: - Focus: Credit risk. The supervisor determines that banks have an adequate credit risk management process that takes into account their risk appetite, risk profile and market and macroeconomic conditions. - Coverage: Includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk (including counterparty credit risk) on a timely basis; covers the full credit lifecycle including credit underwriting, credit evaluation, and ongoing management of loan and investment portfolios. - Essential Criterion EC1: - Laws, regulations or the supervisor require banks to have appropriate credit risk management processes that provide a comprehensive bank-wide view of credit risk exposures. - The supervisor determines the processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank, take into account market and macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, administration and monitoring. - Description and findings re EC1: - All Banks: Banks and holding companies are subject to extensive credit-risk management requirements which provide a comprehensive bank-wide view of credit exposures. - The U.S. federal banking regulations relevant to credit risk management are set out in Table 17.1. - Table 17.1 (excerpted requirements and citations as presented in the source): - Requirement: Loan documentation and credit underwriting - Federal Reserve citation: 12 CFR part 208, appendix D-1, part II(C), (D) - OCC citation: 12 CFR part 30, appendix A, part II (C), (D) - Requirement: Capital adequacy guidelines - Federal Reserve citation: 12 CFR part 225 *International Monetary Fund — United States country report content unit _cr1589* ### appendix G ### _cr1589 - appendix G ### Supervisory framework and guidance for credit-risk management - Key regulatory references cited: - 12 CFR part 3, appendix C - 12 CFR part 208, subpart E - 12 CFR part 34, subpart D - Supervisory guidance examples and supervisory releases referenced (titles preserved): - SR08-2 (sub-prime), SR06-15 (non-traditional mortgage guidance), SR09-7 (prudent commercial real estate loan workouts) - BCBS’s Principles for the Management of Credit Risk (September 2000) and Sound credit risk assessment and valuation for loans (June 2006) - Supervisory evaluation tools and practices: - Uniform Financial Institutions Ratings System (UFIRS) including an asset quality component (A) - Quantitative measures (delinquent, troubled, and classified assets) plus qualitative evaluations (board and senior management oversight, policies, limits, internal controls, MIS) - Use of peer practice comparisons and data analyses where available and relevant ### Essential Criteria EC2 — Board and senior management oversight of credit risk - Supervisory determinations require that: - The Board approves, and regularly reviews, the credit risk management strategy and significant policies and processes for identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk and associated potential future exposure). - Senior management implements the Board-approved credit risk strategy and develops policies and processes. - Supervisory assessment focus and methods: - Assess whether the board understands the credit risk, communicates risk appetite, delegates development of policies and controls. - Review aggregated management information provided to the board for comprehensiveness, timeliness, and accuracy. - Review minutes of board, committee, and management meetings; conduct interviews; review internal policies; perform transaction testing. - Compliance with supervisory guidance on credit-risk management is reviewed through interviews, policy reviews, and transaction testing. ### Essential Criteria EC3 — Required elements of credit risk environment - Supervisor requires policies/processes to establish an appropriate, controlled credit risk environment, including: - (a) well documented strategy and sound policies/processes for assuming credit risk, without undue reliance on external credit assessments; - (b) well defined criteria/policies/processes for approving new exposures and for renewals/refinancings, with appropriate approval authority; - (c) effective credit administration including continued borrower analysis, monitoring of documentation/legal covenants/collateral, and an appropriate asset grading/classification system; - (d) effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to the Board and senior management on an on-going basis; - (e) prudent and appropriate credit limits consistent with risk appetite, risk profile and capital strength; - (f) exception tracking and reporting processes ensuring prompt action at appropriate senior levels; and - (g) effective controls around models used to identify/measure credit risk and set limits (quality/reliability/relevance of data, validation procedures). - Supervisory practices and published guidance: - Supervisors publish examination manuals supplemented with topical guidance and evaluate banks’ compliance with guidance during examinations. - Since last BCP Assessment, Federal Reserve issued new credit risk-related guidance including (preserved list): - SR 14-7; SR 14-5; SR 13-23; SR 13-19; SR 13-18; SR 13-17; SR 13-3; SR 12-11; SR 12-10; SR 12-5; SR 12-3; SR 11-14; SR 11-15; SR 11-10; SR 11-7; SR 10-17; SR 10-16. - Supervisory expectations (examples reviewed during examinations): - Comprehensive documented credit-risk policies covering lending, investing, trading, trust, fiduciary activities. - Review and approval by key risk/control personnel of new credit products and establishment of risk/control infrastructure prior to initiation. - Credit administration practices covering borrower analyses, documentation, covenants, collateral valuation, underwriting criteria, pricing tools, limit monitoring, collections, workout and restructuring, and loan loss reserving. - Maintenance of documentation supporting borrower ability/willingness to repay at extension/renewal/restructure, including collateral valuation and guarantor information. - Effective risk rating/grading systems that assess absolute/relative credit risk, measure migration, and drive decision-making. - Stress testing processes to identify impacts on asset quality, earnings, capital, concentrations, and downside scenarios on individual exposures. - Management information systems structured to monitor exposures against limits and produce timely reports including total credit exposure, loans in excess of limits, new extensions/renewals/restructured credits, delinquent/nonaccrual loans, adversely graded credits, insider credits, non-compliant credits, and analyses by type/geography/collateral. - Governance and control mechanisms for model risk management, including development, implementation, validation, and board/senior management oversight. - Policies for problem loan management, timely identification, mitigation, and allowance for credit losses assessment. - Robust loan review processes and prompt identification/action for deteriorating loans. - Policies and procedures for the Allowance for Loan and Lease Losses (ALLL) complying with accounting and supervisory guidance. - Systems to identify portfolio business risks and transaction/portfolio risk limits with compliance, review/approval, and exception reporting processes. - Due diligence and audit procedures for third-party originations and secondary market risk strategies. ### Essential Criteria EC4–EC8 — Specific supervisory requirements and findings - EC4 — Monitoring total indebtedness: - Supervisor requires policies/processes to monitor total indebtedness (global debt) including significant unhedged foreign exchange risk. - Cites Interagency Policy Statement on the Review and Classification of CRE Loans (November 1991) and October 30, 2009 Interagency Policy Statement on Prudent CRE Loan Workouts emphasizing borrower’s global debt analysis and consideration of contingent obligations. - Supervisors observed examples where banks were required to consolidate debt positions previously treated separately. - EC5 — Arms-length credit decisions and conflict of interest controls: - Supervisors require policies to define/address conflicts of interest and require independent credit-approval functions. - Expectation that risk-management functions are independent of transaction initiators; practices vary by size/complexity. - Supervisors review credit files, committee minutes, internal audit to verify arm’s-length standards; Regulation O addresses insider credit procedures. - EC6 — Escalation to Board/senior management for major exposures: - Supervisor requires credit policy to prescribe Board/senior management decision for major exposures exceeding certain amounts or percentages of capital and for especially risky or non-mainstream exposures. - Assessors judged Essential Criterion 6 was not met because there are no specific nationwide requirements codifying limits/thresholds; however supervisors review and expect limits and may deem absence of limits unsafe and unsound case-by-case. - Guidance example: Interagency Guidance on Concentrations in Commercial Real Estate Lending sets exposure thresholds expressed as percentages of capital: 100 per cent for construction and land development loans and 300 per cent for commercial real estate (CRE) loans. - Assessors recommend forthcoming guidance codify limits to reduce supervisory discretion gaps and improve offsite monitoring triggers. - EC7 — Full supervisory access to credit information and personnel: - Under statutory examination authority, supervisors may review all books and records and have full access during examinations to information and employees involved in credit risk; contracts with third-party providers expected to include agency access clauses. - EC8 — Inclusion of credit risk in stress testing: - Stress testing requirements by asset size: - Banking Institutions with less than $10bn of Assets: There is no stress testing requirement. - Banking Institutions with at least $10bn of Assets: DFA introduced standards for institutions between $10bn and $50bn (such as annual company-run stress tests). These cover all credit risks. - Banking Institutions with at least $50bn of Assets: Federal Reserve’s Capital Plan Rule and annual CCAR impose additional requirements for Bank Holding Companies with at least $50bn in assets; firms must have internal processes assessing capital adequacy in normal and stressed conditions. These cover all credit risks. - Stress testing framework principles supervisors advise (five principles preserved): - A stress-testing framework should include activities and exercises that are tailored to and sufficiently capture the banking organization’s exposures, activities, and risks. This principle specifically states that credit risk exposure may be included in the overall stress-testing framework. - An effective stress-testing framework employs multiple conceptually sound stress testing activities and approaches. - An effective stress-testing framework is forward-looking and flexible. - Stress test results should be clear, actionable, well supported, and inform decision-making. - An organization’s stress testing framework should include strong governance and effective internal controls. ### Assessment and commentary on Principle 17 - Assessment: Compliant - Comment highlights: - U.S. approach to credit risk is exceptionally codified in regulation and guidance; supervisors observed extensive credit material even in firms where credit was not the major risk. - Assessors found Essential Criterion 6 not met due to absence of specific codified limits; evidence existed that banks had such limits and supervisors could require limits on an individual basis. - Risks from absence of codified policy limits identified: - (i) policy limit acts as a preventive signal of acceptability; - (ii) the time gap between breaching a threshold and action may be longer without codified limits; - (iii) limits provide a reference for offsite/continuous monitoring and trigger supervisory review. - Assessors recommend forthcoming guidance codify limits despite potential restriction of supervisory discretion. ### Principle 18 — Problem assets, provisions and reserves (overview and findings) - Principle objective: Supervisor determines banks have adequate policies/processes for early identification and management of problem assets, and maintenance of adequate provisions and reserves. - EC1 — Legal and supervisory requirements: - Safety-and-soundness provision of the FDI Act (12 U.S.C. §1831p-i(b)) requires FBAs to establish asset quality standards. - Interagency safety-and-soundness guidelines require banks to: identify problem assets; estimate inherent losses and establish allowances/reserves; compare problem assets to capital; take corrective action; consider concentration risk; provide periodic asset reports for management and board. - Accounting: Reports required by FBAs must be uniform and consistent with U.S. GAAP; FBAs can prescribe alternative principles if “no less stringent” than U.S. GAAP (rare). - FBAs issued December 2006 “Interagency Policy Statement on the Allowance for Loan and Lease Losses (ALLL)” detailing responsibilities, factors for ALLL estimation, loan review system elements, and documentation requirements. - FBAs expect banks to perform reasonable stress tests considering contingent exposures (commitments, securitization, counterparty credit). - FASB issued an exposure draft in December 2012 proposing a Current Expected Loss Model (CELM) to replace incurred-loss method; proposal still being finalized. - EC2 — Supervisor determines adequacy of grading/classification and provisioning: - FBAs confirm adequacy of loan classification, provisioning and capital during supervisory cycles via UFIRS assessments and transaction testing; external experts generally not used. - Shared National Credit Program: interagency annual reviews of large syndicated loan classifications with assigned classifications applicable to participating institutions. - EC3 — Off-balance-sheet exposures included: - FDI Act (12 U.S.C. §1831n(a)(3)(c)) requires assets/liabilities, including contingent items, to be reported or taken into account in required reports. - 2006 ALLL statement requires recognition of credit losses in off-balance-sheet exposures (loan commitments, standby letters of credit, guarantees, recourse liabilities). - EC4 — Timely provisions and write-offs: - Banks expected to review ALLL quarterly or more frequently; ALLL should reflect current judgments, qualitative/internal/external factors, rigorous quantitative analyses supplemented by management judgment. - FBAs review bank policies/processes and expect prompt charge-off when exposures are uncollectible. - EC5 — Early identification and oversight of deteriorating assets: - Banks expected to have policies/processes and resources for early identification, ongoing oversight, and collections. - For homogeneous retail portfolios, classification when payments arrears reach minimum days (e.g., 30, 60, 90 days); supervisors may deviate if underwriting/account management weak. - Supervisors assess rating migration trends and may direct re-grading. - EC6 — Supervisory access and documentation: - Under statutory authority supervisors may review all books and records and have full access to records related to credit risk; non-cooperation can lead to sanctions/prosecution. - Quarterly Call Reports include details on credit categories, delinquencies and provisioning. - EC7 — Power to require adjustments: - FBAs can require banks to adjust classifications, increase provisioning, reserves or capital, and impose remedial measures (12 U.S.C. § 1818(b)). - If ALLL deemed inadequate, supervisors can require adjustment reflected in current period provision or restatement and may require capital additions or enforcement actions. - Assessors saw examples of rigorous examination and willingness to increase ALLL and use enforcement tools. - EC8 — Valuation of risk mitigants and collateral: - FBAs expect periodic assessment of guarantees, collateral at net realizable value; appraisal and real estate lending standards govern valuation and LTV limits. - For individually impaired loans, impairment measured by present value of expected future cash flows discounted at effective interest rate, observable market price, or fair value of collateral for collateral-dependent loans; U.S. GAAP definition of “fair value” applies. - For pools evaluated on a pool basis, systematic and documented loss measurement methods required. - EC9 — Criteria for problem asset identification and reclassification: - FBAs have criteria consistent with U.S. GAAP for identifying impaired assets (12 U.S.C. §1831p-1(b)). - Reclassification to performing may occur when none of principal/interest is due and unpaid and repayment expected (e.g., after six months of sustained repayment performance), or when well secured and in process of collection. - EC10 — Board reporting on asset portfolio condition: - Banks expected to provide board timely/appropriate information on asset portfolio condition, classifications, provisioning, and major problem assets, including summary results, trends, and measurements of deterioration and expected losses. - Supervisors have increased focus on quality of board reporting; OCC’s Heightened Standards reinforce this focus. - EC11 — Individual valuation for significant exposures: - 2006 ALLL statement expects valuation, classification and provisioning for large exposures on an individual item basis; impaired loans must be individually reviewed. - EC12 — Systemic trends and concentrations: - FBAs monitor trends/concentrations via horizontal peer reviews and system-wide analysis; agencies issue guidance from these reviews (example: 2013 “Interagency Guidance on Leveraged Lending”). - Assessors noted no evidence that systemic guidance has been translated into structured advice to supervisors on assessing provisions/reserves; assessments remain institution-specific. - Assessment of Principle 18: Compliant - Comments: - FBAs have a rigorous process and willingness to challenge and require increases in ALLL; supervisory judgments constrained by U.S. GAAP’s incurred loss recognition. - CELM (if finalized) would allow more forward-looking provisioning and greater scope to incorporate system-wide assessments into ALLL reviews. - FBAs currently lack a structured process for incorporating system-wide assessments into individual ALLL reviews; assessors encourage coordination with accounting/auditing practitioners once CELM implemented. ### Principle 19 — Concentration risk and large exposure limits (overview and findings) - Principle objective: Supervisor determines banks have adequate policies/processes to identify, measure, evaluate, monitor, report and control/mitigate concentrations of risk on a timely basis; supervisors set prudential limits on single counterparties/groups of connected counterparties. - EC1 — Bank-wide view of concentration risk: - Banks expected to monitor single counterparty, groups of similar counterparties, economic sectors, and countries; on- and off-balance sheet exposures and contingent liabilities captured. - FBAs have not set regulatory limits for lending to specific sectors/geographies; supervisors expect banks to set prudent limits subject to review. - For commercial real estate (CRE), 2006 guidance directs banks to establish internal lending guidelines and concentration limits, periodic board review/approval, and adequate capital. - Guidance sets exposure thresholds expressed as percentages of capital: 100 per cent for construction and land development loans and 300 per cent for CRE loans; assessors were unclear on supervisory force of these thresholds and recommended graduated triggers for heightened attention. - Post-crisis additional guidance includes: - 2010 “Interagency Guidance on Correspondent Concentration Risks” - 2011 “Interagency Counterparty Credit Risk Management Guidance” (primarily for organizations with large derivatives portfolios) - 2013 “Interagency Guidance on Leveraged Lending” - Assessors noted strong supervisory focus on credit concentration but less comparable focus on market and other concentration types (asset classes, products, collateral, currencies); recent guidance is high-level and not reflected in detailed requirements for full range of concentration risk. - Stress testing linkage: - 2012 “Supervisory Guidance on Stress Testing for Banking Organizations with More Than $10 Billion in Total Consolidated Assets” expects stress-testing frameworks to cover all material exposures, activities and risks, whether on- or off-balance sheet, capturing interplay and combined effects. *Source: _cr1589 - appendix G* ### section 165 of the DFA, all banking organizations with total consolidated assets of more than ### _cr1589 - section 165 of the DFA, all banking organizations with total consolidated assets of more than ### Regulatory scope and heightened standards - Section 165 of the DFA: all banking organizations with total consolidated assets of more than $10 billion are required to conduct and publically disclose the results of annual stress tests using scenarios specified by their primary supervisor. - In 2014, the OCC finalized its “Heightened Standards for Large Financial Institutions,” applying to national banks, federal savings associations and federal branches of foreign banks with $50 billion or more in total consolidated assets. These standards: - are intended to strengthen governance and risk management practices; - direct covered institutions to include concentration risk limits in the risk governance framework that should limit excessive risk-taking and should not exceed the limits established in the institution’s risk appetite statement. ### Management information systems and concentration identification (EC2) - Supervisory expectation: - banks and holding companies must maintain adequate management information systems (MIS) that identify large borrower relationships and are appropriate to the size, complexity and global footprint of the banking organization. - supervisors assess timeliness and quality of MIS reports to ensure absolute and relative changes in exposures to individual counterparties and groups of connected counterparties are clearly identified in reports to boards and senior management. - FBA 2011 guidance on counterparty credit risk (CCR): - banking organizations with large derivatives positions are expected to have MIS capable of measuring exposures at various levels of aggregation (e.g. by business line, legal entity or consolidated by industry) and on a timely basis; - aggregation is expected to cover all CCR exposures and all other forms of credit risk to the same counterparty; - management is expected to strive for a single comprehensive CCR exposure measurement platform or, if not possible, to minimize the number of platforms and methodologies and manual adjustment to exposure calculations. - Gap noted: - There are no explicit requirements that banks’ MIS identify sources of concentration risk other than credit risk/large exposures. ### Risk governance, thresholds, and board reporting (EC3) - Board and governance expectations: - boards are expected to be actively involved in approval, periodic review and oversight of the risk management framework, including strategies and policies for taking and managing credit risk; - boards are expected to establish prudent concentration control processes, including escalation procedures and approval processes for exceptions to policy limits. - Internal thresholds and reporting: - banking organizations are expected to establish internal thresholds for acceptable concentrations of credit and to report all material concentrations to the board for review. - Supervisory definition of material concentration: - supervisors confirm management identifies, defines, measures, monitors and controls concentrations of credit risk, generally defined by the agencies as direct or indirect extensions of credit and contingent obligations that in aggregate exceed 25 per cent of tier 1 capital plus the Allowance for Loan and Lease Losses. - OCC Heightened Standards: - direct covered institutions to have policies and supporting processes to effectively identify, measure, monitor and control concentration of risk, on- and off-balance sheet. - Limitation: - assessors did not see detailed requirements, guidance, or supervisory assessments related to identification and management of material risk concentrations other than credit risk. ### Supervisory monitoring and portfolio concentration review (EC4) - Supervisory data collection: - supervisors regularly obtain, through regulatory reports and on-site examinations, information enabling review of credit concentrations, including sectoral, geographical and currency exposures. - supervisors may request additional information or direct reduction of credit concentrations presenting significant risks, with examples of formal supervisory action observed by assessors. - Additional monitoring: - the six largest U.S. bank holding companies report exposure to top counterparties (individually) across a broad range of categories to the Federal Reserve on a weekly basis. - Gap noted: - monitoring of concentrations other than credit risk is still evolving. ### Definition of groups of connected counterparties and combination rules (EC5) - OCC combination rules: - regulations define individuals and entities whose interests will be attributed to the single borrower for computing legal limits; - a “corporate group” for lending limits includes a “person” and all of its subsidiaries where the person owns or beneficially owns more than 50 per cent of the voting securities/interests of the subsidiaries. - the OCC generally has discretion to apply combination rules to reflect actual risk exposure; this discretion has not often been needed. - see 12 U.S.C. §84 and 12 CFR 32.5. - Federal Reserve proposed large exposures regime (for total consolidated assets above $50 billion): - proposed a simple common ownership test to define when parties under common ownership would be treated as exposure to a single counterparty; - the definition of a subsidiary for these purposes would apply a 25 per cent rather than 50 per cent threshold for ownership of voting shares or equity by the parent. ### Legal limits on single-counterparty and group exposures (EC6 and AC1) - National banks single-counterparty lending limit (12 U.S.C. §84): - total outstanding loans and extensions of credit to one borrower or group of connected borrowers not appropriately secured are limited to 15 per cent of the bank’s capital and surplus funds; - a further 10 per cent may be extended if the loan is fully secured by readily marketable collateral; - aggregate limit of 25 per cent of a bank’s capital and surplus funds. - limits cover on- and off-balance sheet extensions of credit and, since introduction of the DFA, counterparty credit risk from derivatives and securities financing transactions. - Corporate group limit: - a bank may not lend more than 50 per cent of its capital and surplus funds to a corporate group (FBAs explain this limit rarely comes into play). - combination rules apply the 15 per cent limit when proceeds of a loan to one borrower are used for the direct benefit of another borrower or where a “common enterprise” is deemed to exist. - four circumstances for a common enterprise: (i) common source of repayment; (ii) related through common control and substantially financially interdependent; (iii) separate borrowers acquiring more than 50 per cent of voting interests of a company; (iv) OCC determination based on facts and circumstances. - examiners review financial condition and interdependencies and combine loans when a common enterprise is deemed to exist. - Applicability: - legal limits apply to all savings associations (with narrow exceptions) and to Federal branches and agencies of foreign banks (based on U.S. dollar equivalent of the foreign bank’s capital). - FBAs may seek restitution and civil money penalties for breaches (see 12 U.S.C. §1818 and 12 U.S.C. §93). - Separate limits on money market investments and securities holdings: - separate limits (10 or 25 per cent) apply on amount of money market investments and securities issued by any one obligor (other than obligations of or guaranteed by the U.S. Government) that may be held by a banking organization on its own account; - these separate limits do not apply to federal savings associations. - Federal Reserve proposed regime for large bank holding companies and foreign banking organizations: - would limit exposures to any unaffiliated company to 25 per cent of capital, or a lower amount as prescribed by the Federal Reserve; - a more stringent credit exposure limit would apply between a major covered company and any other major counterparty. - AC1 (additional criteria) requirements: - (a) 10 percent or more of a bank’s capital is defined as a large exposure; and - (b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties. - Finding: FBAs do not apply a threshold of 10 per cent of capital to define a large exposure (see description under EC6). ### Stress testing and inclusion of concentration risk (EC7) - Supervisory expectations and practices: - large banking organizations with significant CCR exposures are expected to maintain a comprehensive stress-testing framework integrated into CCR management; - framework should include measurement of largest counterparty-level impacts across portfolios and consideration, at least quarterly, of stressed exposures arising from joint movement of exposures and related counterparty creditworthiness; - senior management should evaluate stress test results, take appropriate risk reduction strategies, and communicate results to the board at an appropriate frequency. - Federal Reserve Regulation YY: - implemented comprehensive stress test framework for bank holding companies and state member banks, covering their material risks; - Federal Reserve annually develops scenarios for supervisory stress tests for large bank holding companies and requires these companies and state member banks to use the same scenarios in company-run stress tests; - in 2014, the Federal Reserve required eight large, interconnected bank holding companies to apply a counterparty default scenario component to their securities lending, repo and derivative exposures. - FBA 2012 guidance on stress testing: - sets out principles expecting banking organizations to maintain stress-testing frameworks covering all material exposures, activities and risks, on- and off-balance sheet, and capturing interplay among exposures, activities and risks. - FBAs view this guidance, together with DFA company-run annual stress tests, as providing a holistic framework for assessing all material risks, including significant risk concentrations. - Observed practice and gap: - in practice, concentration risk other than credit risk has not to date been imbedded in stress testing. - community banks are not subject to legal or supervisory requirements for enterprise-wide stress testing but are expected to have capacity to analyze potential impact of adverse outcomes. ### Assessment, findings, and policy commentary - Assessment of Principle 19: Largely compliant. - Key assessor observations and recommendations: - FBAs have an effective supervisory framework for dealing with credit concentration risk with strong supervisory focus in credit quality reviews. - guidance issued on specific areas of credit concentration risk is followed up in supervisory reviews; some reassessment of supervisory treatment of commercial real estate exposure thresholds is warranted. - increased attention is being given to concentration risk in counterparty credit risk management. - detailed supervisory framework and guidance for market and other risk concentrations (excessive exposure to particular asset classes, products, collateral or currencies) is not well developed; assessors saw no evidence that identification and assessment of such non-credit concentrations is part of supervisory requirements. - assessors encourage FBAs to consider stress test scenarios that highlight concentration risk beyond credit concentration. - OCC Heightened Standards (effective from September 2014) will place onus on boards to ensure robust risk management framework for concentration risk. - widening of large exposure definition under the DFA to include counterparty credit risk from derivatives and securities financing transactions brings thresholds closer to AC1, but anomalies remain. - separate/additional limits for money market investments and security holdings leave possibility of excessive concentrations; 2010 DAR recommendation to include these exposures in the 15 plus 10 limits has not been adopted. - the 50 per cent limit on exposures to a corporate group appears prima facie out of line with AC1 and could result in excessive concentrations in certain scenarios; FBAs view it as a rarely approached “catch-all”. - inconsistency between OCC combination rules and Federal Reserve proposed framework (common ownership test, 25 per cent threshold) should be reconciled. - Federal Reserve is actively working to finalize its large exposures framework, with legal limits, for large bank holding companies and foreign banking organizations in light of the Basel Committee’s new large exposures regime. ### Transactions with related parties — introductory findings (Principle 20, EC1) - Two major statutory frameworks: - sections 23A and 23B of the Federal Reserve Act: prevent misuse of a bank’s resources through preferential transactions with affiliates; cover loans/extensions of credit to an affiliate, investments in securities issued by an affiliate, asset purchases from an affiliate, issuance of guarantee or letter of credit on behalf of an affiliate, and credit exposures from derivative transactions and securities borrowing and lending between a bank and an affiliate; section 23A imposes quantitative limits and collateral requirements on covered transactions. - sections 22(g) and 22(h) of the Federal Reserve Act: restrict extensions of credit between a bank and its insiders and insiders of its affiliates. - Scope and supervisory application: - regulatory restrictions apply only to bank subsidiaries of holding companies, state and national, but FBAs encourage all banking organizations to adopt policies avoiding preferential transactions with affiliates or insiders; - Federal Reserve, as consolidated supervisor, monitors material intra-group transactions and exposures and ensures holding companies have adequate risk management processes. - Definitions and discretion: - Regulation O and the Federal Reserve Act clearly define individuals and entities to which lending restrictions apply; definitions are broad with some supervisory discretion rarely exercised; - “affiliate” includes any entity that directly or indirectly controls, or is under common control with, the bank, but does not include the bank’s subsidiaries; - “insider” includes executive officers, directors, and principal shareholders of a bank or any of its affiliates, as well as their related interests, but does not explicitly include family members of insiders other than principal shareholders; - a transaction where funds are transferred to, or used for the benefit of, an affiliate or insider is considered a transaction with that affiliate or insider. *Source: IMF assessment text in content unit _cr1589 - section 165 of the DFA, all banking organizations with total consolidated assets of more than* ### Section 23B of the Federal Reserve Act provides that covered transactions between a bank and ### _cr1589 - Section 23B of the Federal Reserve Act provides that covered transactions between a bank and ### Legal and regulatory framework for affiliate, insider, and related‑party transactions - Section 23B: covered transactions between a bank and its affiliates must be on terms and under conditions, including credit standards, that are substantially the same or at least as favorable to the bank as those prevailing at the time for comparable transactions with or involving non‑affiliated companies. - Section 22(h) (Regulation O): extensions of credit to an insider must (a) be made on substantially the same terms (including interest rates and collateral) as, and following credit underwriting procedures that are not less stringent than, those prevailing at the time for comparable transactions by the bank with non‑insiders and (b) not involve more than the normal risk of repayment. - Banks are required to maintain records to document compliance with these restrictions. - Violations can give rise to reimbursement and formal enforcement actions against a bank, and civil money penalties. ### Supervisory expectations and board approval (EC3, EC4) - Regulation O: extensions of credit to an insider must be reviewed and approved by the board if the aggregate exposure would exceed $500,000 upon consummation of the new credit facility. A lower review threshold applies to smaller banks. - Extensions of credit to insiders above the review threshold require the prior approval of a majority of board directors; the insider must not participate in preparation, discussion or vote on the credit. - Board members with conflicts of interest must recuse themselves from consideration of any matter in which they have an interest. - Except for certain securities and asset purchases, there is no regulation requiring prior board approval for transactions between a bank and an affiliate, nor for write‑offs of related‑party transactions. - Under the OCC’s “Heightened Standards” (effective from September 2014), board oversight of the risk management function should cover compliance risk, which would include risk associated with affiliate transactions. - Supervisors require that transactions with related parties and the write‑off of related‑party exposures exceeding specified amounts or otherwise posing special risks are subject to prior approval by the bank’s Board; Board members with conflicts are excluded from the approval process. - Banks are expected to have policies and processes to prevent persons benefiting from the transaction and/or persons related to such a person from being part of the process of granting and managing the transaction. Supervisors review lists of loans to directors and seek confirmation that directors did not involve themselves in matters in which they have an interest. ### Quantitative limits and capital treatment (EC5) - Section 23A limits: - 10 per cent of the bank’s capital and surplus: limit to the aggregate amount of transactions with any one affiliate. - 20 per cent of the bank’s capital and surplus: limit to the aggregate amount of transactions with all affiliates. - Any credit transaction with an affiliate generally must be fully secured; purchases of “low‑quality assets” are generally prohibited. - Insider transaction limits (12 U.S.C. §84): - Loans and extensions to an individual insider, aggregated with all extensions to that person’s related interests, generally may not exceed 15 per cent of the bank’s capital and surplus. - Aggregate extensions of credit to insiders may not exceed a bank’s capital and surplus. - For banks with deposits of less than $100 million, the limit is two times a bank’s capital and surplus, subject to board determination that such a higher limit is consistent with prudent, safe and sound banking practices. - Extensions of credit to an executive officer, other than loans with a residential housing or educational purpose, may not exceed $100,000. - Supervisors can require deduction of affiliate or insider exposures from capital when assessing capital adequacy and can require posting of additional capital. ### Identification, monitoring, reporting and review (EC6, EC7) - Banks must identify all insiders through an annual survey and maintain records of all extensions of credit to insiders. - Banks in holding companies must report covered transactions with affiliates on a quarterly basis to the Federal Reserve. - FBAs require banks to develop policies to ensure credit decisions are based on an independent and complete credit evaluation; MIS should identify and quantify credits to related parties; loan management and review should routinely review these transactions. - Reporting requirements: - All top‑tier bank holding companies and foreign banking organizations that own a U.S. insured depository institution must file the quarterly FR Y‑8 report on transactions with affiliates. - In Schedule RC‑M of the Call Report, banks must report to the OCC the aggregate amount and number of extensions of credit to insiders when they exceed the lessor of $500,000 or 5 per cent of capital. - Assessors were shown examples of Schedule RM‑C. - FFIEC reporting: Country Exposure Report FFIEC 009 and Country Exposure Information Report FFIEC 009a; FFIEC E.16 Country Exposure Lending Survey (aggregate, publicly available). ### Assessment of Principle 20 (related party transactions) - Assessment: Largely compliant - Key findings and concerns: - The CP requires a higher degree of board involvement and oversight than presently required by U.S. laws and supervisory guidance. - No formal requirements for prior board approval of transactions with affiliated parties or for write‑offs of related party exposures exceeding specified amounts (EC3). - No formal requirement for ongoing board oversight of related party transactions and exceptions to policies, processes and limits (EC6). - Statutory limit structure is generally strict and constraining, but one exception is of concern: - Aggregate lending to insiders limit: 100 per cent of a bank’s capital and surplus (and 200 per cent for smaller banks) — considered higher than prudent practices and posing risk that a small group of insiders could deplete bank own funds. - No regulated limits for holding company transactions with affiliates or insiders — creates potential for routing insider loans through holding company to avoid bank limits. - The “related party” regime is narrower than the CP: definition of “covered transactions” in section 23A does not include service and construction contracts, and lease agreements; definition of affiliates excludes subsidiaries of the bank; definition of “related interests” of insiders does not explicitly include family members. - Recommendation: - Assessors recommend amending the “related party” regime to bring it into line with the CP (broader definition and coverage). --- ### Country and transfer risk framework (Principle 21) - Principle statement: The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk and transfer risk in their international lending and investment activities on a timely basis. - Legal and supervisory basis: - FBAs required to evaluate banks’ and holding companies’ foreign country exposure and transfer risk as part of examination and supervision. See 12 U.S.C. § 3903(a). - Reporting criteria: banks and holding companies meeting certain cross‑border exposure thresholds must identify and monitor these risks and provide quarterly reports to supervisors detailing significant claims on foreign entities. - International Lending Supervision Act (ILSA), 12 U.S.C. §§ 3901‑3911, sets out obligations; ILSA does not apply to savings associations and SLHCs (savings associations excluded from “bank” for this CP). - ATRR (Allocated Transfer Risk Reserve) requirements: 12 CFR 211.43; 12 CFR 347.303; 12 CFR 28.52 — where warranted, organizations must write off or establish and maintain an ATRR for assets with impaired value due to transfer risk. - ICERC (Interagency Country Exposure Review Committee) coordinates assessment of cross‑border risk and mandates ATRRs where appropriate. - Supervisory guidance: Federal Reserve SR 02‑05 “Interagency Guidance on Country Risk Management”; Interagency statement on “Sound Risk Management Practices: Country Risk”. - Supervisory practices and expectations (EC1–EC3): - Banks are expected to have comprehensive risk‑management systems for country risk: board oversight, well‑defined policies and procedures, accurate country exposure reporting, effective country analysis, country risk rating system, established country exposure limits, monitoring, stress testing and scenario planning, internal controls and audit. - OCC conducted a horizontal examination in 2011‑2012 on Country Risk Management to identify best practices. - Agencies expect procedures for dealing with exposures in troubled countries, including contingency plans for reducing risk or exiting the country. - Provisioning and reserves (EC4): - ILSA requires setup of allocated reserves for assets subject to severe transfer risk when warranted. - ICERC evaluates countries and mandates ATRRs where countries have defaulted or when exposures are large; ATRRs determined by country, type of exposure and tenor. - ATRR requirement does not apply to U.S. branches, agencies, or commercial lending company subsidiaries of foreign banking organizations; agencies may impose other special measures for branches/agencies as warranted. - Stress testing (EC5): - Agencies have rules for annual stress tests for supervised institutions; May, 2012 guidance on Stress Testing for Banking Organizations with Total Consolidated Assets of More Than $10 Billion. - Banks and BHCs required to include appropriate scenario analysis and stress tests of country and transfer risk in their country risk management framework. - Supervisors assess adequacy of stress testing of international activities, including whether scenarios target countries/regions/business lines with material foreign exposures and whether stress testing incorporates contingency and action plans. - Observation: country risk has not been included in the stress tests conducted so far. - Supervisory information and data (EC6): - Quarterly reporting required under ILSA Section 907 (FFIEC 009 and FFIEC 009a) and supervisory evaluation under ILSA Section 904. - Agencies maintain FFIEC E.16 Country Exposure Lending Survey (public aggregate report); restricted detailed data used by supervisors. - 2013 ICERC enhancements to reporting requirements: more detailed breakdown by type of obligor, memorandum items (netting of trading items), expanded reporting of credit derivatives, addition of U.S. as reporting country. - FBAs may use information sharing, supervisory colleges and CMGs with foreign supervisors; statutory examination authority allows review of all books and records. ### Assessment of Principle 21 - Assessment: Compliant - Comments and recommendations: - Robust framework exists for regulation and assessment of country and transfer risks and for allocation of loan loss reserves reflecting country and transfer risks. - Gaps: - Rules do not cover savings associations (due to limited international exposures); assessors recommend introduction of a de minimis regime applied to all categories of banks. - U.S. affiliates of foreign banks are not covered (expected under consolidated supervision by home authorities); acceptable provided good cooperation and information sharing. - Country risk has not yet been specifically tested in mandated stress tests; assessors recommend guidance and rules on stress testing specifically include country risk. *International Monetary Fund — assessment text as provided in the source content.* ### appendix E ### appendix E ### Market risk framework and scope - The Market Risk Rule threshold is set as banking organizations that have aggregated trading assets and liabilities of at least $1 billion or 10 percent of total assets. - The provisions listed in Column 2 (Table 22.1) reflect the agencies’ implementation of the market risk amendments to the Basel framework (including the 2011 revisions). - The impact on market risk of different market and macroeconomic conditions and the risk of a significant deterioration in market liquidity are taken into account in the stress testing program (see EC5 and EC6). - Guidance does not clearly articulate the roles and responsibilities for identification, measuring, monitoring and control of market risk. - Banking Institutions with aggregated trading assets and liabilities less than $1 billion or 10 percent of total assets: - FDIC’s independent assessment of risk is conducted in order to make a determination on insurance pricing. Insurance premiums need to be adjusted to compensate for riskier activities. - The Federal Reserve has also issued guidance with respect to market risk. - The U.S. applied a modified version of Basel II Standardized Approach, which takes into account the 2009 “Enhancements to the Basel II Framework”. - The requirements do not include references to credit ratings, consistent with section 939A of the Dodd Frank Act, but include alternative standards of creditworthiness. - The Simplified Supervisory Framework Approach (SSFA) has been introduced and is only available to banking organizations for which the Advanced Approach and/or the Market Risk Final Rule do not apply. - If the SSFA is not applied, a gross-up approach can be used. If neither approach is used, a risk weight of 1,250 percent is applied, but the chosen securitization approach must be applied consistently across all securitization exposures. - The U.S. is currently undertaking a Basel Regulatory Capital Assessment Programme (RCAP), which will determine the materiality of deviations. - Banking Institutions with aggregated trading assets and liabilities of at least $1 billion or 10 percent of total assets: - Supervisors expect all material market risks to be captured within the market risk rule. - Supervisors have set standards for use of internal models for Value-at-Risk (VAR) calculations and Stressed VaR in market risk capital calculations including treatment of credit spread risk, correlations within and across risk categories, as well as risks arising from the nonlinear price movements. - Standards set for specific risk capital requirements include use of internal models and the application of specific risk add-on factors. - Banking Institutions with $250bn or more in consolidated total assets or $10bn or more in consolidated total on-balance sheet foreign exposure (Advanced Approach): - From 1 January 2014, for banking organizations subject to the advanced approaches framework (column 3 – Table 22.1), market risk capital requirements are calculated under subpart F of the agencies’ new capital rule that implements the Basel capital framework, as modified by Basel II and Basel III. - Advanced Approaches organizations will be required to calculate both a general risk-based capital requirement as well as an advanced risk-based capital requirement. Each measure of market risk (general or advanced) will need to be multiplied by 12.5 to determine its market risk equivalent assets. - Note: From 1 January 2015 all other banking organizations subject to the agencies’ capital regulations will adopt the approach calculated under subpart F of the agencies’ new capital rule. ### EC2 — Board approval and oversight of market risk management - The supervisor determines that banks’ strategies, policies and processes for the management of market risk have been approved by the banks’ Boards and that the Boards oversee management in a way that ensures that these policies and processes are implemented effectively and fully integrated into the banks’ overall risk management process. - Supervisory practices and guidance: - Supervisors examine banks and holding companies to determine whether they have comprehensive risk-management policies and processes for identifying, evaluating, monitoring, and controlling or mitigating all material risks, including market risk. - The Federal Reserve and OCC issued joint guidance on model risk management (SR 11-7 and OCC Bulletin 2011-12). This guidance sets out the overall responsibilities a banking organization’s board and senior management collectively are expected to deliver, including the establishment of a strong model risk management framework that fits into the broader risk management of the organization. - The OCC issued supplemental guidance (Bulletin 2014-8) specifying examination procedures applicable to any national bank, federal branch or agency, or federal savings association that is an active end-user of derivatives or has significant trading activity. The guidance set out examination requirements on the evaluation of a bank's board of directors' ability to understand and oversee risks related to end-user derivatives and trading activities. ### EC3 — Risk environment, limits, reporting, and model controls - The supervisor determines that the bank’s policies and processes establish an appropriate and properly controlled market risk environment including: - (a) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk exposure to the bank’s Board and senior management; - (b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and capital strength, and with the management’s ability to manage market risk and which are understood by, and regularly communicated to, relevant staff; - (c) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior management or Board, where necessary; - (d) effective controls around the use of models to identify and measure market risk, and set limits; and - (e) sound policies and processes for allocation of exposures to the trading book. - Description and supervisory findings: - Market risk capital requirements provide that banking organizations subject to the market risk rule requirements (e.g. SR09-1) must establish limits on positions and monitor them daily, and that senior management and qualified personnel must periodically (at least annually) reassess these limits. - Banking organizations must validate their models on an on-going basis in accordance with the various parameters set forth in the agencies’ new capital rule. - Capital rules include oversight and audit requirements with respect to market risk models and require banking organizations to adequately document all material aspects of the internal models, management and valuation of market risk positions, control, oversight, validation, and review processes and results. - The rule requires banking organizations to have a rigorous process for assessing overall capital adequacy in relation to their market risk; this includes the allocation to the trading book. - Federal Reserve and OCC joint guidance (SR 11-7 and OCC Bulletin 2011-12) specify supervisory expectations in relation to model risk. - Under the agencies’ general supervisory authority, supervisors may assess and monitor a supervised banking organization’s policies and procedures to determine whether it is adequately monitoring and controlling its market risk. - OCC’s Bulletin 2014-8 requires examiners to evaluate any bank that is an active end-user of derivatives or has significant trading activity, including the market risk management information system and whether it can generate daily reports at portfolio, line-of-business and other appropriate levels. Examiners monitor limit breaches and the escalation of any breaches that are unapproved. - The OCC requires banks to notify the agency of models banks use to calculate risk-based capital requirements under the market risk rule, in advance of making any material changes, or extension of a model to a new business or product type. ### EC4 — Valuation practices, independent verification, and model validation - The supervisor determines that systems and controls ensure positions are re-valued frequently, transactions are captured timely, valuation uses consistent and prudent practices, and reliable market data is verified by a function independent of the relevant risk-taking business units. Where modeling is relied upon, the model must be validated by a function independent of the relevant business units. Banks are required to establish policies and processes for valuation adjustments for positions that cannot be prudently valued. - Description and supervisory findings: - Market risk capital requirements require banking organizations subject to the rule to mark positions to market or model on a daily basis and require rigorous valuation processes. - Banking organizations must have a risk control unit independent from the business trading units and a validation process independent of model development, implementation, and operation, or otherwise subject to independent review. - A banking organization must have an internal audit function independent of business-line management that assesses the market risk controls. - Under the rule, a banking organization must have policies and procedures on valuation of positions, marking positions to market or to model, independent price verification, and valuation adjustments or reserves. - Federal Reserve and OCC guidance (SR 11-7 and OCC Bulletin 2011-12) specify supervisory expectations related to model validation: all model components are expected to be subject to validation; validation should be subject to critical review by an independent party; validation staff should have explicit authority to challenge developers and users and to elevate findings; and there is an expectation of regular, and at least annual, reviews of models, including vendor models. - An effective validation framework should include three core elements: - Evaluation of conceptual soundness, including developmental evidence; - On-going monitoring, including process verification and benchmarking; and - Outcomes analysis, including back testing. - Supervisors carry out targeted examinations and on-going supervisory monitoring programs to determine that systems and controls ensure banks’ marked-to-market positions are re-valued daily and comply with regulatory requirements. Targeted examinations review front office marked-to-market processes, financial control policies and procedures for independent verification, thresholds for pricing variance, and escalation and resolution procedures for disagreements. - FDIC practices: - As the primary federal regulator for State Non-Member banks, the FDIC has dedicated staff to monitor and assess the banks’ valuation process, supplemented by periodic target examinations that involve transaction testing. - As the back-up regulator for national banks and state-member banks, the FDIC participates in OCC and Federal Reserve led reviews of the financial controller’s group and front office business to assess valuation practices. These reviews can be conducted as part of evaluation of compliance with market requirements or as a separate review targeting the financial controller’s group. - OCC’s Bulletin 2014-8 requires examiners to determine whether the bank’s valuation policies, processes, and controls produce consistent and reliable valuation of positions, to identify deficiencies, and to evaluate the valuation control function’s effectiveness through price-testing results and fair value adjustments review by the independent valuation control unit. ### EC5 — Capital for unexpected losses and valuation adjustments - The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities. - Description and supervisory findings: - Banking Institutions with aggregated trading assets and liabilities of at least $1 billion or 10 percent of total assets: - The Market Risk Capital rules require a banking organization to have a rigorous process for assessing its overall capital adequacy in relation to its market risk. - A banking organization must have a process for prudent valuation of its trading positions covered by the market risk requirements, including policies and procedures on the valuation of positions, marking positions to market or to model, independent price verification, and valuation adjustments or reserves. - The valuation process must consider, as appropriate, unearned credit spreads, closeout costs, early termination costs, investing and funding costs, liquidity, and model risk. - Banking Institutions with at least $10bn of Assets: - The U.S. Federal Banking Agencies implement section 165(i)(2) of the DFA, which requires financial companies with more than $10 billion in assets to conduct annual company-run stress tests using scenarios provided by the FBAs. - Banking Institutions with at least $50bn of Assets: - [Content for this category appears in the source following this excerpt.] *International Monetary Fund — UNITED STATES — appendix E* ### Section 165(i)(1) of the DFA requires the Federal Reserve to conduct annual stress tests of U.S. ### _cr1589 - Section 165(i)(1) of the DFA requires the Federal Reserve to conduct annual stress tests of U.S. ### Stress testing and market risk (Principle 22 / EC6) - Section 165(i)(1) of the DFA requires the Federal Reserve to conduct annual stress tests of U.S. Bank Holding Companies with total consolidated assets of $50 billion or more. The board of directors and senior management must use the results of the stress tests in: - (i) their capital plan and capital planning process; - (ii) assessing their exposures, concentrations, and risk positions; and - (iii) their update to the covered company's resolution plan. - Supervisors require banks to include market risk exposure into their stress testing programs for risk management purposes. - Capital rules require stress testing of market risk of covered positions at a frequency appropriate to each portfolio, taking into account concentration risk, illiquidity under stressed market conditions, and trading-activity risks not captured in internal models. Banks must calculate a stressed VaR. - Supervisory rules and guidance: - Financial companies with more than $10 billion in assets must conduct annual company-run stress tests using scenarios provided by the FBAs; FBAs may require inclusion of a market shock component for significant trading activity. - Federal Reserve rule for BHCs with total consolidated assets between $10 billion and $50 billion may require a market shock component for firms with significant trading activity; this may also apply to state member banks subject to market risk capital requirements. - OCC requires nationally chartered banks and savings associations with consolidated assets of more than $10 billion to perform a company-run stress test annually; scenarios span a nine-quarter horizon and may include a “market shock” for significant trading activities. - The Federal Reserve may use a “market shock” scenario in its supervisory stress test and may require firms to include such scenarios; currently the market shock component applies to BHCs subject to market risk capital requirements with total consolidated assets greater than $500 billion. - Assessment: - Assessment of Principle 22: Compliant. - Comments: Market Risk regime is comprehensive and supervisors are actively engaged. Stress Test Regime under DFA has improved completeness and use of market stress testing. Material weaknesses identified in 2009 BCP have been significantly improved. ### Interest rate risk in the banking book (Principle 23) - Principle summary: Supervisor determines banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis. - Definitions and key risk drivers: - Interest rate risk in the banking book = current or prospective risk to earnings and capital from adverse interest rate movements. - Main sources: re-pricing risk, yield curve risk, basis risk, option features embedded in financial instruments. - Regulatory and supervisory framework: - No specified tiering in guidance; principles-based approach proportionate to risk. - Safety-and-soundness statutes and guidance provide legal basis for enforcement; agencies can increase capital if necessary. - Interagency policy statement (1996), 2010 interagency Advisory on Interest Rate Risk Management, and SR 12-2 FAQs form the supervisory backbone. - UFIRS/CAMELS Sensitivity to Market Risk (S) component used in examinations. - Supervisory expectations for bank governance and processes (EC1–EC4): - Boards must set tolerance for interest rate risk, approve relevant risk limits, identify lines of authority, and ensure adequate resources. - Senior management must develop and implement policies, procedures, systems, internal controls, and reporting to manage interest rate risk. - Firms expected to include scenario and sensitivity analysis within interest rate risk management; supervisors may require scenarios via unsafe-or-unsound determinations if expectations not met. - Scenario guidance: static parallel shocks of plus and minus 200 basis points may be insufficient; institutions expected to assess shocks of greater magnitude (e.g., up and down 300 and 400 basis points), changing slopes and twists, and ensure scenarios are severe but plausible given rate cycle. - Stress scenarios expected to include: instantaneous rate shocks; prolonged rate shocks; basis risk; yield curve slope and shape changes. - Supervisory use of banks’ internal measures: - Supervisors use internal measures, Call Reports (maturity and re-pricing), fair value reporting, and on-site reviews to assess interest rate risk measurement and governance. - Assessment: - Assessment of Principle 23: Compliant. - Comments: Principles-based approach backed by proportionate supervision and active engagement. Assessors recommend consideration of revising 1996 guidance to include more quantitative guidelines to provide clearer signals and faster supervisory action given sectoral inconsistencies and elevated interest rate exposure. ### Liquidity risk (Principle 24) - Principle summary: Supervisor sets prudent and appropriate liquidity requirements and determines banks have strategies to manage liquidity risk across appropriate time horizons. For internationally active banks, requirements are at least Basel standards. - Tiered approach and rulemaking: - U.S. FBAs implementing an LCR requirement consistent with Basel III (proposed rule dated 29 November 2013). Proposed rule applies to internationally active banking organizations and consolidated insured depository institution subsidiaries with $10 billion or more in total consolidated assets; also applies to certain nonbank financial companies supervised by the Federal Reserve. - Proposed LCR details: institutions required to hold high-quality liquid assets sufficient to cover projected cash outflows minus projected cash inflows during a 30-day stress period. High-quality liquid assets classified as level 1, level 2A, level 2B. - Federal Reserve proposed a less stringent version of LCR (21-day stress scenario) for BHCs and S&L Holding Companies that are not internationally active but have $50 billion or more in total consolidated assets. - Liquidity supervisory expectations (EC1–EC8): - Liquidity management process expected to meet daily funding needs, cover expected and unexpected deviations, include comprehensive measurement, monitoring, and stress testing across time horizons. - Call Reports collect liability and deposit mix, large uninsured deposits, non-maturity deposits, non-deposit borrowings, and off-balance-sheet commitments for surveillance. - Regulation YY applies enhanced liquidity standards to U.S. BHCs with at least $50bn in assets: - Regular cash flow projections over short- and long-term horizons. - Internal liquidity stress tests must include at least: adverse market conditions; idiosyncratic stress event; combined market and idiosyncratic stress. - Firms must hold a buffer of highly liquid assets to cover 30 days of net outflows identified by internal stress tests. - Requirements scale in stringency by nature, scope, size, scale, concentration, interconnectedness, and mix of activities. - FBOs with Combined U.S. Assets of at least $50bn: Regulation YY applies to U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee; liquidity buffer requirements: Intermediate Holding Company must cover 30-day planning horizon; U.S. Branches must cover first 14 days of the 30-day horizon. - Global Systemically Important Banks: detailed daily liquidity information collected including funding risks and liquidity buffers. - Liquidity buffer and encumbrance: - Buffer must be unencumbered, diversified, and sufficient to meet projected net cash outflows over stress scenarios. Buffer assets must be free of regulatory and contractual restrictions and not pledged. - Proposed LCR would require measurable amounts of unencumbered assets and operational capacity to liquidate a sample of buffer assets. - Supervisory reviews and actions: - Supervisors conduct horizontal reviews (e.g., CLAR) and firm-specific monitoring; over one hundred Matters Requiring Attention (MRAs) issued to large firms for liquidity improvements. - Supervisory assessments cover quantitative liquidity position, governance, policies, limits, measurement (cash flow projections, collateral, encumbrance), independence of oversight, stress testing frameworks, and contingency funding plans. - Assessment: - Assessment of Principle 24: Compliant. - Comments: Regime for banks below $50bn is high level but supervisory action is evident. Reporting on encumbered assets is currently limited; implementation of LCR expected to increase reporting depth. For institutions with at least $50bn (and GSIBs), Regulation YY provides a comprehensive and robust regime. Some implementation challenges noted from differing agency interpretations. ### Key liquidity stress-testing and contingency expectations (EC4–EC7) - Stress testing expectations: - Banks expected to conduct regular stress tests across institution-specific and market-wide events, multiple horizons; results must inform contingency planning. - For firms subject to Regulation YY, internal liquidity stress tests must be conducted at least monthly and include minimum required scenarios (adverse market, idiosyncratic, combined). - Stress tests must incorporate conservative assumptions, reflect firm-specific factors (capital structure, risk profile, complexity, legal entity), and inform buffer sizing and contingency funding plans. - Contingency Funding Plans (EC6): - Banks must maintain formally articulated, documented contingency funding plans that address a range of stress environments without reliance on lender-of-last-resort support. - Plans should set clear lines of responsibility, communication plans (including with supervisors), be regularly tested and updated, and be feasible relative to risk profile and systemic importance. - Supervisors evaluate contingency plans during examinations; Regulation YY requires comprehensive contingency funding plans for covered BHCs and covered FBOs. - Foreign currency liquidity (EC8): - Supervisors expect banks to measure, monitor, and control liquidity positions for each major currency and review currency mismatch assumptions for reasonableness under stress. - Regulation YY: currency matching of projected cash inflows and outflows is important and should be reflected in stress tests and buffer composition; foreign-currency denominated assets are not disqualified from buffer but currency frictions and haircuts should be considered. ### Operational risk (Principle 25) - Principle summary: Supervisor determines banks have adequate operational risk management frameworks proportionate to risk profile, including policies and processes to identify, assess, monitor, report and control or mitigate operational risk. - Supervisory framework and guidance: - Tiered approach: safety-and-soundness statutes and supervisory guidance provide legal basis; expectations are commensurate with size, nature, and complexity. - Agencies expect implementation of risk-management programs, coverage of consumer protection compliance, and periodic reassessment of operational risk exposure. - Supervisors use UFIRS, URSIT, UITRS, and internal risk-assessment systems (e.g., OCC Risk Assessment System) to evaluate operational risk. - Agencies encourage alignment with BCBS Principles for the Sound Management of Operational Risk and have issued interagency guidance on internal controls, IT, outsourcing, payment systems, audit, BCP, compliance, insurance, fiduciary operations, etc. - Advanced approaches and operational risk capital: - Risk-based capital rules effective 1 January 2014 implement Basel III and impose specific regulatory requirements for operational risk for Advanced Approach institutions. - Interagency Guidance on Advanced Measurement Approaches for Operational Risk issued June 2011; supervisory guidance for data, modeling, and model risk management under AMA issued June 2014. - Advanced approaches banks are subject to explicit operational risk capital requirements. For the 8 BHCs that exited parallel run, the operational risk capital requirement as a percentage of common equity tier 1 capital on a weighted average basis is 16.7% (data as of the second quarter of 2014). - Governance and board oversight (EC2–EC3): - Boards are ultimately accountable; supervisors require board review and approval of operational risk strategies, policies, and processes and evaluate board oversight through minutes, audit reports, and MIS. - Supervisors assess implementation effectiveness via on-site testing, external/internal audit review, and supervisory validation. - Business continuity and disaster recovery (EC4): - Supervisors review and test disaster recovery and BCPs to assess feasibility under severe disruptions. Risk-focused reviews are performed with scope based on risk profile. - Large firms and market utilities have dedicated supervisory teams; guidance aligns with Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (April 2003). - Assessment: - Principle 25: (assessment text provided describes supervisory enhancements and explicit operational-risk capital rule; no single-line assessment extracted). *International Monetary Fund — assessment text extracted from the referenced content.* ### appendix that will stress the importance of resiliency in the use of business critical third parties, ### _cr1589 - appendix that will stress the importance of resiliency in the use of business critical third parties, ### EC5 — Information technology governance, resilience and security - Supervisor role: - Determines that banks have appropriate information technology policies and processes to identify, assess, monitor and manage technology risks. - Determines that banks have appropriate and sound information technology infrastructure to meet current and projected business requirements (under normal circumstances and in periods of stress), ensuring data and system integrity, security and availability and supporting integrated and comprehensive risk management. - Description and findings: - Supervisors address information security and system development through on-site examinations that consider the risk profile of the banking organization. - Supervisory procedures determine whether a banking organization has appropriate policies and procedures to effectively respond to cyber-attacks. - Agencies have examiners with specialized IT skill sets to lead or assist in examinations of complex IT or operating environments. - Consumer compliance examiners work with IT examiners to review compliance with statutory consumer privacy provisions to ensure controls protect sensitive customer information and that appropriate disclosures are made regarding information sharing practices. - Various supervisory policies, standards, and guidance statements relevant to IT risk management issued on an interagency basis, many through the FFIEC’s IT Sub-committee. - The FFIEC’s Information Security booklet provides extensive guidance and examination procedures to evaluate IT security practices. ### EC6 — Information systems to monitor and report operational risk - Supervisor role: - Determines that banks have appropriate and effective information systems to: (a) monitor operational risk; (b) compile and analyse operational risk data; and (c) facilitate appropriate reporting mechanisms at Boards, senior management and business line levels. - Description and findings: - Supervisors evaluate quality of management information systems and their ability to facilitate appropriate board and senior management risk management (including Board Risk packs). - Tools used by banking organizations for operational risk management include: scenario analysis; risk and control self-assessments; scorecards; key risk indicators; risk assessment processes for information security risk under the Gramm-Leach-Bliley Act; business continuity, internal audit, and internal control assessments under the Sarbanes-Oxley Act. - U.S. banking agencies expect accurate assessment of operational risk levels and appropriate controls or mitigants. - Assessment of rare and tail risk losses (e.g., severe litigation losses and cyber attacks) is acknowledged as hard to evaluate. - Banking organizations subject to the Advanced Approach (banks with $250bn or more in consolidated total assets or $10bn or more in consolidated total on-balance sheet foreign exposure) are subject to targeted examinations of their AMA implementation, including data and management information system quality. ### EC7 — Reporting mechanisms to keep the supervisor apprised of operational risk developments - Supervisor requirement: - EC7 states the supervisor requires banks to have appropriate reporting mechanisms to keep the supervisor apprised of developments affecting operational risk. - Description and findings: - Supervisors do not require direct operational-risk reporting; they rely on supervisory activities and required regulatory and public disclosures and reporting by banking organizations (including statutes and rules such as Gramm-Leach Bliley and requirements under FDIA 363(b)). - Formal application or notification requirements for mergers, acquisitions, changes in control, and expansions into certain activities provide indicators of events that could affect operational risk profiles. - Supervisors maintain on- and off-site monitoring; at larger organizations this may include supervisors with specialized IT or operational risk skills. - Agencies maintain surveillance units that analyze balance sheet, profit/loss, and supplemental information routinely submitted through quarterly regulatory financial reports to identify performance trends that may point to operational risk developments. - Under safety and soundness standards, internal controls and information systems must ensure compliance with applicable laws and regulations; supervisors assess compliance as part of supervision activities. ### EC8 — Outsourcing risk management - Supervisor role: - Determines that banks have appropriate policies and processes to assess, manage and monitor outsourced activities covering: (a) due diligence for selecting service providers; (b) structuring outsourcing arrangements; (c) managing and monitoring associated risks; (d) ensuring an effective control environment; and (e) establishing viable contingency planning. - Outsourcing policies require comprehensive contracts and/or service level agreements with clear allocation of responsibilities. - Description and findings: - Supervisors maintain that a bank’s board and management remain responsible and accountable for outsourced activities, including security, integrity, and availability of sensitive data or assets transferred to service providers. - Examination procedures ensure supervisors evaluate, through on-site exams, that banks establish appropriate policies and processes for outsourcing, including due diligence, structuring, risk assessment and mitigation, effective controls, and establishing and testing back-up plans. - Interagency guidance issued through the FFIEC; specific guidance includes Guidance on the Risk Management of Outsourced Technology Services (Federal Reserve, November 2000) and the Outsourcing Technology Services Booklet (FFIEC, June 2004). - OCC Bulletin 2013-29 “Third Party Relationships – Risk Management Guidance” addresses outsourcing risks beyond IT. ### Additional criteria — AC1: common points of exposure - AC1 criterion: - Supervisor regularly identifies any common points of exposure to operational risk or potential vulnerability (e.g., outsourcing of key operations by many banks to a common service provider). - Description and findings: - Supervisors regularly assess and evaluate potential common points of exposure to operational risk or potential vulnerability. - For banking institutions with at least $10bn of assets, resolution plan documents required under the DFA are reviewed to evaluate common risk exposures and concentration risks associated with service providers, CCPs, and clearinghouses. - Supervisory agencies have internal risk committees to evaluate ranges of risks for early identification of common or systemic risk exposures (examples: transaction processing and BCP service provider concentrations, software vendor concentrations, payment system dependency concentrations, CCP membership concentrations). - OCC publishes its Semi-annual Perspective on Risk; FDIC publishes Supervisory Insights. - Under the Bank Service Company Act, supervisors pool resources to perform IT-related risk management evaluations/examinations of data processing service providers with significant client bases. - Multi-regional Data Processing Servicers (MDPS) Program administered by the FFIEC IT Subcommittee for large service providers with systemic implications; Regional Technology Service Provider (Regional TSP) program administered by agencies’ regional or local offices for other providers. ### Assessment of Principle 25 - Overall assessment: Largely Compliant - Comments: - U.S. Federal Agencies placing increasing emphasis on operational risk issues, co-coordinating additional inter-agency guidance, and identifying mitigation actions in vertical and horizontal reviews. - Agencies alert to changing threat landscape, including escalation of fines and other penalties from litigation and cyber. - Overall regime has not reached a sufficient level of maturity (equivalent to market and credit risk). - Guidance for banks under AMA is well specified (at time of assessment, only 8 banks), but for other banks operational risk management largely falls within “general” risk management and guidance is disparate. - Weakness compounded by absence of a comprehensive reporting regime—only certain operational risks are covered by GLBA 501(b). - No standardized capital charge for operational risk noted. - Positive developments for banks with at least $50bn of assets: Federal Reserve’s Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice (August 2013) covers operational loss data; OCC’s proposed Heightened Standards Guidelines seek to elevate operational, strategic and reputational risks in Board Risk Appetite statements. - Assessors note agencies’ priority on Cyber Risk and establishment of FFIEC working groups, but coordination across banking agencies and beyond will be challenging. ### Principle 26 — Internal control and audit (overview and ECs) - Principle 26 statement: - Supervisor determines that banks have adequate internal control frameworks to establish and maintain a properly controlled operating environment, including delegation of authority; separation of committing, paying and accounting functions; reconciliation; safeguarding assets; and appropriate independent internal audit and compliance functions. - EC1 — Legal/regulatory requirement for internal control frameworks: - Description and findings: - Safety-and-soundness provisions of the Federal Deposit Insurance Act (“FDIA”) (section 39) require Supervisors to prescribe standards relating to internal controls, information systems and audits; amplified by Section 36 of FDIA. - Interagency guidelines (e.g., SR 95-51) specify internal controls/information systems appropriate to size, nature and risk of activities and require: organizational structure, effective risk assessment, timely and accurate reports, adequate safeguards, compliance with laws and regulations, and an internal audit system appropriate to size and scope. - Supervisors evaluate effectiveness of internal controls through on-site examinations, on- and off-site monitoring, and surveillance; may require compliance plans or other supervisory actions. - Supervisors consider a list of factors when evaluating adequacy of internal control (bullet list preserved in source). - Supervisors review documentation including SOX section 404 materials and conduct horizontal examinations. - EC2 — Balance of skills and resources between control/back office and business origination: - Description and findings: - Supervisors evaluate control functions via on-site and monitoring activities and coordinate reviews across areas (credit, capital markets, compliance, information systems). - Supervisors perform periodic reviews of control monitoring functions (e.g., internal audit) and targeted reviews of high-risk areas such as trading. - Supervisory guidance cautions to be alert for inappropriate balance of skills and resources. - EC3 — Compliance function: - Description and findings: - Supervisors’ guidance and examination procedures determine whether compliance function is independent and commensurate with size and activities. - Board responsible for developing and administering compliance management system. - Supervisors confirm that boards and management establish effective compliance management including: clear expectations; policy statements; appointment of a compliance officer with authority; resource allocation; periodic compliance audits; appropriate business-line personnel with compliance expertise; recurrent reports by the compliance officer. - EC4 — Internal audit function (role and oversight): - Description and findings: - Interagency Guidance on Internal Audit and its Outsourcing and the Federal Reserve’s Supplemental Guidance set expectations; full-time audit beneficial for large firms; small banks should have independent reviews of key controls. - Banking institutions with less than $50bn of assets: guidance suggests annual evaluation of changes to Internal Audit through continuous monitoring and a full scope review every three years. - Banking institutions with at least $50bn of assets: Federal Reserve’s August 2013 publication sets expectations for internal audit’s role in capital planning. - OCC’s Heightened Standards Guidelines (September 2014) establish minimum standards for Risk Governance Framework and expect appropriate audit functions and an Internal Audit QAIP program; phased compliance dates include: - banks with average total consolidated assets of $750 billion or more comply on 10 November 2014; - banks with average total consolidated assets of $100 billion or more but less than $750 billion comply by 10 May 2015; - banks with average total consolidated assets of $50 billion or more but less than $100 billion comply by 10 May 2016; - banks with average total consolidated assets of less than $50 billion that are subject via affiliation comply on the same date as affiliated bank; - banks with average total consolidated assets of less than $50 billion on the effective date that subsequently becomes subject comply within 18 months as of date of the most recent Call Report used to calculate the average. - Supervisors assess the quality and scope of internal audit whether performed in-house or outsourced; consider a detailed list of assessment factors (preserved from source). - EC5 — Internal audit resourcing, independence and scope: - EC5 requirements: - (a) sufficient resources and suitably trained staff; - (b) appropriate independence with reporting to the Board or audit committee and status to ensure senior management acts on recommendations; - (c) kept informed of material changes to risk management strategy, policies or processes; - (d) full access to staff and records; - (e) methodology identifying material risks; - (f) prepares an audit plan based on its own risk assessment; - (g) authority to assess outsourced functions. - Description and findings: - Supervisors use industry standards (e.g., Institute of Internal Auditors) to assess audit adequacy. - Scope of periodic reviews includes audit independence and competency; audit universe and planning; work papers; follow-up of issues; interaction with management. - Interagency Policy Statement on the Internal Audit Function and Its Outsourcing and Supplemental Statement instruct supervisors to determine whether outsourcing arrangements maintain or improve audit quality, ensure clear communication lines, revise scope when environment changes, preserve independence, and perform sufficient due diligence on vendors. - Supervisors assess competence by education, professional background, and experience of principal internal auditors. - Assessment of Principle 26: - Overall assessment: Compliant - Comments: - Federal Banking Agencies raising the bar for control functions, particularly Internal Audit; supervisors finding issues classified as Matters Requiring Attention (at the OCC there were 405 outstanding at the time of this report). - Internal Audit has improved since last BCP review but technical areas still need development. - Compliance function received relatively little mention except BSA/AML; heavy legislative/regulatory focus on BSA/AML has concentrated resources within authorities and firms, possibly deemphasizing other forms of criminal abuse (e.g., fraud). - Assessors recommend authorities seek an appropriate balance in surveillance and guidance and consider consolidating guidance into fewer places. ### Principle 27 — Financial reporting and external audit (overview and ECs) - Principle 27 statement: - Supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies widely accepted internationally, annually publish information that fairly reflects financial condition and performance and bears an independent external auditor’s opinion, and have adequate governance and oversight of the external audit function. - EC1 — Board/management responsibility for financial statements and recordkeeping: - Description and findings: - Banks below $500 million asset threshold exempt from requirements to publish financial statements reviewed by an independent public accountant (many do not avail themselves of exemption). - Banks exceeding $500 million required to prepare annual financial statements in accordance with U.S. GAAP. See U.S.C §1831m(b)1 and section 37 of FDI Act, 12 U.S.C §1831n. - Banks between $500 million and $1bn must produce audited comparative annual financial statements; an independent public accountant’s report; and a management report with statements on management’s responsibilities for preparing financial statements, maintaining internal control over financial reporting, and complying with designated laws/regulations. - If bank has assets of $1bn or greater, management and independent public accountant reports are expanded to include assessment of effectiveness of internal control over financial reporting; independent public accountant’s attestation report includes the Call Report and/or FR Y-9C report. - If a bank is $5bn or greater and has a CAMELS rating of 1 or 2 it may comply through the bank’s holding company if holding company holds at least 75 percent of consolidated group’s assets. - Banks and holding companies must establish and maintain adequate financial record-keeping systems (see statutes e.g., 12 U.S.C §§161, 1464(v), 1831m). - FBAs have broad remedial authority to take enforcement actions against a bank and its IAPs, including board members and management, for false or misleading information. - EC2 — External auditor opinion and standards: - Description and findings: - For financial statements under EC1 Acts, U.S.C.1831(m)(d)1 prescribes audits by an independent public accountant. - Publicly traded institutions registered with SEC required to undergo quarterly review by an independent public accountant who must report findings to the bank’s audit committee, which must provide the report to the relevant federal or state banking agency. - Supervisory guidance requires audits performed in accordance with PCAOB and AICPA auditing standards. - Supervisors have broad enforcement powers to hold boards and management responsible; banks and holding companies must file reports certified by CFO and specified number of directors. - EC3 — Valuation practices and fair value framework: - Description and findings: - Banks must apply U.S. GAAP or no less stringent principles; accounting rules allow different bases including historical cost, amortized cost, lower of cost and fair value, and fair value. - FASB ASC Topic Fair Value Measurement defines fair value and a three-level hierarchy for measuring fair value; FBAs determine institutions have robust controls and documentation on valuation policies and processes. - EC4 — Power to set audit scope and standards: - Description and findings: - External audits must meet or exceed scope/procedures required by GAAS or PCAOB auditing standards (see 12 U.S.C §1831(m)(f)1). - Audits are risk- and materiality-based; supervisors may encourage auditors to expand audit scope but cannot require. - EC5 — Audit coverage areas: - Description and findings: - Banks and holding companies subject to legislation required to obtain annual audits and external audits of internal control over financial reporting covering loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading/securities activities, derivatives, asset securitizations, consolidation of off-balance sheet vehicles and adequacy of internal controls over financial reporting. - Smaller banks not subject to audit requirements commonly use non-audit agreed-upon procedures or attestation engagements integrated with audit of internal controls. - EC6 — Power to reject external auditor: - Description and findings: - Independent public accountants must meet statutory qualifying criteria (see U.S.C §1831m(g)(3)). - FDIC or another federal banking agency may remove, suspend, or bar an independent public accountant upon showing of good cause (e.g., inadequate expertise or independence, not following professional standards). - Agencies may bar accountant from performing audits under the act; enforcement action has only rarely taken place and never against a whole audit firm. - Banks required to provide agencies written notice of engagement, resignation or dismissal of an independent public accountant and reasons for such events. - EC7 — Auditor rotation: - (Text for EC7 begins in source but is not included in supplied excerpt.) *International Monetary Fund — assessment appendix excerpt: _cr1589 - appendix that will stress the importance of resiliency in the use of business critical third parties,* ### Section 203 of the Sarbanes-Oxley Act of 2002 made it unlawful for a registered public ### _cr1589 - Section 203 of the Sarbanes-Oxley Act of 2002 made it unlawful for a registered public ### Auditor independence and rotation (Section 203, Part 363) - Section 203 of the Sarbanes-Oxley Act of 2002: unlawful for a registered public accounting firm to provide audit services to an issuer if the lead (or coordinating) audit partner having primary responsibility for the audit or the audit partner responsible for reviewing the audit, has performed audit services for that issuer in each of the five previous fiscal years. See 15 U.S.C §78j-1. - Rules mandate a five year “timeout” period after rotation. - Alternative rule for accounting firms with fewer than five public audit clients and fewer than ten partners. - Assessors observed supervisors determining that banks adhere to these rules; supervisors have issued orders to banks to rotate external auditors. - Part 363 of the FDIC rules includes some (but not comprehensive) requirements for non-public banks to rotate their auditors. ### Supervisor interaction with external auditors (EC8, EC9) - EC8: Supervisors meet periodically with external audit firms to discuss issues of common interest relating to bank operations. - FBAs meet with external audit firms, FASB, the SEC, the AICPA and the PCAOB to discuss accounting, audit, and financial disclosure issues related to banks and holding companies. - Supervisors meet periodically with external audit firms regarding individual banks and holding companies to discuss accounting and disclosure practices. - External auditors typically ask to speak to supervisors before signing off on annual financial statements to ensure supervisors do not have information that would preclude their sign-off. Referenced: Interagency Guidance on Coordination and Communication Between External Auditors and Examiners (July 1992). - EC9: Requirement for external auditors to report matters of material significance to the supervisor. - There is no requirement for the external auditor to report directly to the FBAs, and there is no “safe harbor” protection for auditors who do report. - Under Part 363 of the FDIC rules, the bank must inform the supervisors within 15 days of any written information from the auditor about a violation. - Supervisors generally meet auditors and will be informed through those meetings. - Supervisors do not use auditors for supervisory purposes. - As part of evaluation of a bank’s compliance with part 363, supervisors review communication to management and audit committee made by external auditors. - External auditors must notify management and the audit committee (or the full board of directors) of any control issues noted as a result of the financial statement audit. - Under PCAOB’s and AICPA’s auditing standards, when an auditor concludes that an illegal act has or is likely to have occurred, the auditor must ensure that those charged with governance are informed and this must be documented in writing. ### Access to audit work papers and supervisory powers (AC1; Assessment of Principle 27) - AC1: Supervisor power to access external auditors’ working papers, where necessary. - External auditors of large banks are required to agree to provide related audit work papers, policies and procedures to supervisors, if requested. See 12 U.S.C. §1831m(g)(3)(A). - Best practice expectation: all banks should obtain agreement of external auditors in engagement letters to grant supervisors access to all work papers and other material pertaining to the bank. - Banks that fail to grant access are subject to informal or formal enforcement action. - Assessment of Principle 27: Largely compliant. - Comments: - Not all banks are required to issue full financial statements reviewed by an independent accountant in accordance with independent audit requirements. - No requirement for external auditors to report immediately directly to the supervisor; reporting is through the bank if auditors identify matters of significant importance. - No comprehensive requirement for auditor rotation; only some provisions and an expectation for non-public banks to rotate their external auditors. - The supervisor cannot set the scope of the external audit but could encourage the auditor, after the preliminary audit but before finalization, to include new issues. - U.S. legislation clearly sets out the minimum scope of the external audit; assessors recommend FBAs be given legal powers to add issues to the scope of the external audit in specific cases to address relevant issues not normally covered in an external audit. ### Disclosure and transparency (Principle 28 — EC1–EC5, AC1; Assessment) - EC1: Periodic public disclosures by banks on consolidated and, where appropriate, solo basis. - All banks regardless of size must submit regulatory reports that include financial and other information. - Holding companies with assets of U.S.D500 million or more and SLHC of all sizes must submit regulatory reports that include financial and other information on a consolidated basis. - Reporting includes balance sheet items, off-balance-sheet exposures, profit and loss, capital adequacy, asset quality, loan loss provisioning, and some information on interest rate risk sensitivity and market risk. See 12 U.S.C.§§161 and 1464(v). - FBAs ensure periodic public disclosure of information in these regulatory reports and require that they adequately reflect the true financial condition of the bank or holding company. - Disclosure and reporting requirements are subject to uniform submission deadlines; uniform standards ensure comparability. - Under the Basel III disclosure framework, U.S. banks and holding companies adopting the Advanced Approaches and certain U.S. banks and holding companies adopting the Standardized Approach rules will, from January, 1st, 2015, be subject to the Pillar 3 disclosure requirements. - Each bank with consolidated assets of more than U.S.D 500 million is required to prepare a Part 363 Annual Report and submit it to the FDIC, the appropriate federal banking agency (if other than the FDIC) and any appropriate state bank supervisor; the bank must also make this report available to the public. The report includes audited financial statements and the auditor’s opinion, and a management report containing: - (1) statement of management’s responsibilities for preparing the annual financial statements, establishing and maintaining an adequate internal control structure and procedures for financial reporting, and complying with certain designated laws and regulations relating to safety and soundness, and - (2) an assessment by management of the bank’s compliance with such laws and regulations during the year. - Note: U.S. interpretation of “solo basis” differs from BCP Methodology; U.S. “solo basis” considered to encompass the bank and its subsidiaries. - EC2: Required disclosures include qualitative and quantitative information commensurate with risk profile and systemic importance. - FBAs have a robust reporting framework; regulatory reports permit footnotes or narrative disclosures (quantitative or qualitative). - Examples of regulatory reports: call reports (FFIEC 031 and FFIEC 041), FR Y-9C, FR Y-9LP, FR Y-9 SP, FR Y-11, FR 2314, and FR Y-7N. - U.S. banks adopting Basel III will be subject to Pillar 3 disclosures that are both qualitative and quantitative. - EC3: Requirement to disclose all material entities in group structure. - Regulation Y (12 CFR 225.5(b) for BHCs and LL (12 CFR 238.4 for SLHCs) and FR Y-6 report filed by all top-tier holding companies require organizational chart and annual verification of domestic branches and information on identity, percentage ownership, and business interests of principal shareholders, directors and executive officers. - FR Y-10 provides data on organizational structural changes. - FR Y-7 and FFIEC 002 required for foreign banking organizations with U.S. presence; reports are public unless exemption requested (never happened). - EC4: Supervisor or another government agency effectively reviews and enforces compliance with disclosure standards. - FBAs require by statute that banks comply with reporting requirements; failure to comply can lead to informal or formal enforcement measures including cease-and-desist (C&D) proceedings and civil monetary penalties (CMP). See 12 U.S.C. §§ 164, 1813(u), 1817(a), and 1818(b) and (i). - Remedial provisions structured appropriate to severity. - Supervisory review includes internal controls related to financial reporting and Basel III Pillar 3 disclosures when implemented. - SEC has primary responsibility for review of public disclosures of public companies and coordinates with FBAs on enforcement matters affecting banks and holding companies. - EC5: Publication of aggregate information on the banking system to facilitate public understanding and market discipline. - FBAs publish aggregate information including balance sheet indicators and statistical parameters (balance sheet structure, capital ratios, income earning capacity, risk profiles). - FBAs publish quarterly Uniform Bank Performance Reports (UBPR) for each bank based on Call Reports; UBPR include indicators and ratios for peer groups and community bank metrics. - Federal Reserve produces the BHC Performance Report (BHCPR) for aggregated BHC information. - FDIC publishes the Quarterly Banking Profile (QBP) with aggregate balance sheet and income statement data, key performance ratios, loan performance and quality data, holdings of derivative contracts, servicing, securitization, and asset sales activities; includes breakdowns by asset size range and geographic area. - FDIC publishes Statistics on Depository Institutions (SDI) each quarter as a publicly available searchable database with standardized financial data reports and customizable peer group reporting. - OCC and the Federal Reserve each publish a quarterly report on developments of banks’ credit underwriting criteria. - AC1 (additional criterion): Disclosure requirements promoting information on a bank’s risk exposures during a financial reporting period. - There are no examples of such disclosures. - Assessment of Principle 28: Compliant. - Comments: - No examples of disclosures covering ongoing developments during a financial reporting period, except occasional analytical papers; most comprehensive published report periodicity is quarterly (call reports). - FBAs do not collect data from banks at the solo level (i.e., bank excluding subsidiaries); regulatory requirements such as Basel III capital intended to be imposed on both stand-alone and consolidated basis can only be tracked on the consolidated basis. - Assessors consider omission to have no prudential significance in practice since U.S. bank subsidiaries tend to be small relative to parent and can only undertake activities the bank could undertake in its own name. ### Abuse of financial services, BSA/AML and related supervisory powers (Principle 29 — EC1, EC2) - EC1: Laws or regulations establish supervisor duties, responsibilities and powers related to prevention of criminal activities. - FBAs have clear statutory authority to regulate banks and holding companies, examine for compliance with laws related to prevention of criminal misuse, and enforce through civil enforcement actions. See e.g. 12 U.S.C. §§ 1818(s)(2) and (s)(3); 1818 (i). - Over the years, banks and holding companies have been assessed penalties for BSA/AML failures (Note: BSA refers also to fraud and tax evasion transactions). - FBAs issue a BSA/AML Examination Manual that is frequently updated. - FinCEN provides guidance on emerging fraud and AML threats. - FBAs coordinate and share information via National Bank Fraud Working Group, FFIEC BSA/AML Working Group and BSA Advisory Group. - Bank Protection Act, 12 U.S.C. §1882, requires agencies to promulgate rules on installation and operation of security devices and procedures to discourage robberies, burglaries, larcenies and assist identification and apprehension of perpetrators. Examples: 12 CFR 21, subpart A (OCC); 12 CFR 326 (FDIC); 12 CFR 208.61 (Federal Reserve). - Interagency Guidelines Establishing Information Security Standards: 12 CFR 30, appendix B (OCC); 12 CFR 364 appendix B (FDIC); 12 CFR appendix D-2 (Federal Reserve); 12 CFR 225, appendix F (Federal Reserve). These set standards for safeguards for security, confidentiality and integrity of customer information and advise background checks for employees with responsibilities for or access to customer information. See 31 U.S.C. §5318(l); 12 CFR 21.21(b)(2), 12 CFR 163.177(b)(2) (OCC); 12 CFR 208.63(b)(2) (Federal Reserve); 12 CFR 326.8(b)(2) (FDIC); and 31 CFR 1010.220 (FinCEN). - EC2: Banks must have adequate policies and processes to promote ethical standards and prevent criminal use. - FBAs and Treasury regulations require banks to establish and maintain BSA/AML Compliance Programs with minimum elements: - (a) internal controls to ensure BSA compliance, - (b) independent testing of compliance, - (c) an individual responsible for coordinating and monitoring day-to-day compliance, and - (d) training for appropriate personnel. - Agencies and Treasury have issued separate regulations requiring banks to establish a customer identification program (CIP). - Agencies and Treasury require banks and holding companies to file a suspicious activity report with FinCEN within 30 days of the initial detection of certain facts (within 60 days if attempting to identify a subject). - Bank Protection Act requires rules on installation and operation of security devices and procedures to discourage robberies, burglaries, larcenies and assist identification and apprehension of perpetrators. - Interagency Information Security Guidelines set standards for safeguards for customer information and advise background checks for employees with responsibilities for or access to customer information. *Source: _cr1589 - Section 203 of the Sarbanes-Oxley Act of 2002 made it unlawful for a registered public* ### Section 12 U.S.C 1818 (e) allows the FBAs to remove or to prohibit an institution affiliated ### _cr1589 - Section 12 U.S.C 1818 (e) allows the FBAs to remove or to prohibit an institution affiliated party (IAP) from engaging in an act, omission or practice which constitutes a violation of law or written agreement with the bank supervisors, an unsafe or unsound practice, or breach of such party’s fiduciary duty, provided certain additional factors are satisfied (such as loss to the bank, gain to the IAP, etc.) ### FBAs' enforcement powers and supervisory actions - 12 U.S.C 1818(e) permits FBAs to remove or prohibit an IAP from engaging in acts/omissions/practices that: - constitute a violation of law or written agreement with bank supervisors, - are an unsafe or unsound practice, or - breach the IAP’s fiduciary duty, - provided certain additional factors are satisfied (such as loss to the bank, gain to the IAP, etc.). - FBAs and FinCEN can assess penalties for BSA violations. See 31 U.S.C. § 5321. - DOJ has authority to bring criminal cases for violations of criminal statutes, including BSA provisions. See 31 U.S.C. § 5322; 18 U.S.C. §§ 1956 and 1957. - FBAs may take formal or informal enforcement actions, including: - issuing cease and desist orders (12 U.S.C. §1818(s)(3)) for BSA Compliance Program violations; - imposing civil money penalties; - reprimanding or barring individuals from industry employment; - restricting or suspending activities; - revoking charter or deposit insurance coverage; - terminating activities of a financial institution (including a branch or agency of a foreign bank) for serious criminal offenses. - Thousands of AML/CFT inspection actions are carried out by the FBAs each year, and hundreds of related enforcement actions have been initiated. - Over 300 such enforcement actions related to AML/CFT have been initiated in the last 4 years. ### Supervisory expectations for BSA/AML Compliance Programs and internal controls - BSA/AML Compliance Program mandatory elements: - sufficient internal controls for monitoring suspicious activity; - a qualified BSA compliance officer to oversee the program; - independent testing to verify vulnerabilities; - regular BSA/AML compliance training for relevant personnel. - FFIEC BSA/AML Examination Manual: - publicly issued to inform banks of examination criteria and supervisory expectations; - addresses internal controls, including CDD requirements; - requires the Board of Directors to set policies regarding BSA/AML risk and prescribe relationships with high risk accounts and countries. - 12 U.S.C. § 1818(s) requires agency examinations to review BSA Compliance Programs and report identified problems. - Banks must maintain records of CDD and individual transactions with at least a five year retention period. - Banks must have a Customer Identification Program (CIP) and verify identity at account opening; CIP must include procedures for when the bank cannot form a reasonable belief in the customer’s identity. - CIP and CDD distinctions: - For certain non-U.S. accounts and transactions, banks must identify all beneficial owners. - For U.S. transactions where the client is a legal entity, identification of the ultimate beneficial owner is not required (current framework). - 12 U.S.C §5318(i) and 31 CFR Part 1010 require risk based due diligence for U.S. private banking and correspondent accounts involving foreign persons, including reasonable steps to ascertain identity of nominal and beneficial owners (except of legal entities) and source of funds. - Stricter requirements apply when customer is a foreign PEP; in practice, banks apply higher standards broadly. ### Customer Due Diligence (CDD) requirements and supervision (EC5) - CDD program essential elements (group-wide): - (a) a customer acceptance policy identifying business relationships the bank will not accept based on identified risks; - (b) a customer identification, verification and due diligence programme on an ongoing basis, encompassing verification of beneficial ownership, understanding purpose and nature of the business relationship, and risk-based reviews to ensure records are updated and relevant; - (c) policies and processes to monitor and recognize unusual or potentially suspicious transactions; - (d) enhanced due diligence on high-risk accounts (e.g. escalation to the bank’s senior management level of decisions on entering into business relationships with these accounts or maintaining such relationships when an existing relationship becomes high-risk); - (e) enhanced due diligence on politically exposed persons (including, among other things, escalation to the bank’s senior management level of decisions on entering into business relationships with these persons); - (f) clear rules on what records must be kept on CDD and individual transactions and their retention period. - Findings: - Agencies have enforced supervisory guidance directing banks to establish risk-based CDD policies integrated into overall risk management. - Agencies have identified failures of such policies during examinations, evidenced by recent public enforcement actions. - Pursuant to 31 U.S.C §5318(1), regulations require account opening procedures and maintaining records used to verify identity. - There is no explicit requirement that decisions on entering into relationships with PEPs shall be escalated to senior management; current U.S. PEP definition only includes foreign nationals (domestic PEPs not defined, expected to be included in high net worth monitoring). ### Suspicious Activity Reporting, incident reporting, and coordination with supervisors (EC3, EC4) - Reporting expectations: - Banks report suspicious activities and incidents of fraud to the financial intelligence unit and report to banking supervisors when such activities/incidents are material to safety, soundness or reputation of the bank. - In cases requiring immediate attention (e.g., intrusion into IT-systems), the filing institution must immediately notify law enforcement and the relevant FBA. - FBAs expect banks to report directly any suspicious activities and incidents of fraud material to safety, soundness, or reputation. - Supervisory actions: - FBAs review BSA data (including SARs) as part of examination scoping to identify BSA/AML and fraud risks and document examination plans accordingly. - Agencies review SARs that report known or suspected criminal activities by current or former officials, directors, employees, and other IAPs to ensure appropriate enforcement actions. - If the supervisor becomes aware of additional suspicious transactions, it informs the financial intelligence unit and, if applicable, other designated authority; supervisors share information related to suspected or actual criminal activities with relevant authorities. - The Right to Financial Privacy Act provides exceptions for disclosures for law enforcement purposes; FBAs and FinCEN have specific regulations addressing disclosure of SARs to other government agencies. - When noncompliance indicates possible criminal activity, matters are referred to DOJ. ### Correspondent banking and cross-border due diligence (EC6) - Legal and supervisory requirements: - 31 U.S.C §5318(i) and 31 CFR 1010.610 require risk-based due diligence policies and procedures reasonably designed to detect and report money laundering through correspondent accounts established, maintained, administered or managed in the U.S. for a foreign financial institution. - Enhanced due diligence required for foreign correspondent banks under certain high-risk banking licenses (ownership information, additional scrutiny of transactions, ascertain access to other foreign financial institutions). - 31 U.S.C §5318(j) prohibits U.S. banks from providing correspondent accounts to foreign shell banks. - FFIEC Manual contains a chapter addressing correspondent banking relationships and high-profile BSA/AML risk factors. - Findings: - Agencies have enforced requirements and cited failures in enhanced due diligence during examinations. - U.S. agencies view BSA/AML risks in domestic correspondent banking as low compared to other services but evaluate policies/procedures for U.S. banks offering correspondent services to domestic respondent banks. - Applicable requirements include that correspondent relationships are not initiated when counterpart controls are inadequate; detailed in 31CFR 103.176. ### Controls, governance, staffing, and training (EC7, EC9, EC10, EC11) - Internal audit, compliance, and monitoring: - FBAs examine banks/holding companies for safety/soundness and compliance; internal audit and compliance functions expected to identify and report potential abuse. - Off-site review of FinCEN databases occurs prior to examinations to verify SARs and CTRs filings for completeness and timeliness. - For larger and more complex organizations, resident on-site supervisors perform continuous monitoring and annual assessments. - Staffing and screening: - Agencies have issued guidelines advising reasonable employment screening and background checks (references, credit/background checks, Internet searches, criminal background checks including FBI fingerprint check) for staff with responsibilities/access to customer information. - FDIC FIL-46-2005 “Pre-employment Background Screening” provided guidance. - Banks may not hire an IAP convicted of crimes involving dishonesty, breach of trust or money laundering, or who attended a pretrial diversion or similar program without written consent of the FDIC (12 U.S.C. 1829(a)); similar restrictions with Federal Reserve (12 U.S.C. § 1829 (d) & (e)). - No supervisory requirement that banks have screening policies for hiring staff in general. - Training and compliance officers: - Banks are required to regularly arrange training programs for staff on BSA/AML issues; banks expected, but not required, to train on other criminal abuse issues. - Banks must designate compliance officer(s) responsible for coordinating and monitoring day-to-day BSA/AML compliance; the compliance officer must have expertise and authority. - Reporting lines and MIS: - Banks must have procedures reasonably designed to detect and report suspicious activity to FinCEN and an officer responsible for the program, including adequate management information systems. See EC 2; 12 CFR 21.11(h). - Whenever a bank files a SAR, it must promptly notify the board of directors or relevant board committee. See 12 CFR 21.11(h); id. at 208.62(h); id. at 353.3(f). - SARs on insiders must be filed regardless of the amount involved. - Audit committees of publicly held banks subject to section 301 of Sarbanes-Oxley must establish procedures for confidential, anonymous submission by employees of concerns regarding questionable accounting/auditing matters (15 U.S.C. § 78j-1(m)(4)). - Safe harbor for reporters: - BSA and agency SAR regulations provide protection from civil liability for filing a SAR or making disclosures in a SAR; interagency guidance issued May 24, 2004, on the scope of the safe harbor. - Federal law protects banks, holding companies, directors, officers, employees, and agents from liability for disclosures of possible violations made to appropriate authorities. - The safe harbor applies only to SARs and not to suspicions of other criminal activities. ### Information sharing and specialist resources (EC4, EC12, EC13) - Information sharing: - Agencies authorized to inform relevant authorities, including Treasury and FinCEN, of suspicious transactions; may share with judicial authorities within prescribed procedures. - FBAs inform financial intelligence unit and other designated authorities when they become aware of suspicious transactions. - FBAs and FinCEN have regulations addressing SAR disclosure to other government agencies; assessors verified this sharing takes place. - FBAs have broad authority to share relevant supervisory information with domestic and foreign counterparts, spontaneously or upon request; MOUs in place for routine sharing. - Agencies may share information with foreign bank supervisors and other foreign bodies, including law enforcement, subject to confidentiality restrictions (see 12 CFR 4.37(c); 12 CFR 309; 12 U.S.C. § 1817(2)(C)). - Specialist expertise: - FBAs employ specialists in BSA/AML compliance and terrorist financing offences; experts receive ongoing training and are deployed to complex/high-risk institutions. - Agencies have fraud experts to handle fraud cases and liaise with law enforcement. - FBAs and FinCEN issue alerts, notices, guidance and industry presentations to inform banks of fraud schemes and risks. ### Findings, gaps, and recommendations - Assessment of Principle 29: Largely Compliant. - Key findings and gaps: - Rules and supervisory expectations on BSA/AML issues are comprehensive, with strong political and supervisory focus and significant resource deployment. - Vulnerability to other forms of criminal abuse is more disparately addressed and risks being deemphasized. - Current legal and regulatory framework does not require identification of the ultimate beneficial owner of legal entity clients; proposed amendments (open for public consultation) will introduce requirements to address this deficiency. - There is no explicit supervisory requirement that decisions on entering relationships with high-risk accounts and countries, including with foreign and domestic PEPs, be escalated to senior management. - Recommendations (as stated in assessors' comments): - Supervisors should explicitly require, rather than “expect”, that a bank’s decision to enter into relationships with high-risk accounts and countries, including with foreign and domestic PEPs, should be escalated to the senior management level. - Approve and implement proposed amendments to require identification of the ultimate beneficiary owner of legal entity clients. - Seek an appropriate balance in surveillance and guidance to address non-BSA/AML forms of criminal abuse, possibly by consolidating related issues in fewer places than at present. *International Monetary Fund — assessment extracts from the United States Financial Sector CP 29 review contained in the supplied content.* ### 1. Responsibilities, ### _cr1589 - 1. Responsibilities ### 1. Responsibilities, objectives and powers - Grade: LC - Findings: - DFA reforms rationalized some responsibilities: dissolution of the OTS and establishment of a specialized, stand-alone consumer protection regulator. - Multiple regulators with distinct but overlapping mandates remain. - Further clarification of FBAs' priorities in mission statements is needed. - Division of responsibilities between the FBAs and the CFPB should be made more coherent at the working level. - Conclusion: Further work required to make the new supervisory structure more focused and effective. ### 2. Independence, accountability, resourcing and legal protection for supervisors - Grade: C - Findings: - Since the crisis, FBAs strengthened accountability, transparency, and internal decision-making. - FBAs have strengthened capacities through active hiring and training programs. - Risks/Recommen­dations: - The challenge is retaining capacities as U.S. economic conditions improve and specialist skills become more attractive to industry. - Assessors encourage FBAs to keep hiring programs flexible and responsive and training programs fully funded. - Further steps could be taken to assure the independence of the Federal Reserve’s supervisory role. ### 3. Cooperation and collaboration - Grade: C - Findings: - Substantial efforts since the crisis to improve cooperation and collaboration to ensure consolidated supervision is targeted, comprehensive and timely. - Recommendations: - International cooperation would be further strengthened if state supervisory agencies consulted fully, in all cases, with the FBAs and foreign supervisors on impending enforcement actions. ### 4. Permissible activities - Grade: C - Findings: - Well-established framework for defining permissible activities of banks and protecting the integrity of the term “bank”. - Not a specific FBA responsibility, but important for U.S. authorities to monitor disclosure practices of “bank-like” institutions to ensure community is informed about the security of their savings. ### 5. Licensing criteria - Grade: C - Findings: - Evaluation processes for national charters and access to the deposit insurance fund appear thorough and testing. - DFA has given statutory force to interagency initiatives addressing inappropriate regime shopping, but further guidance could be provided. - Risks: - FBAs need to guard against perceptions of differences in supervisory style or intensity in regional offices that could influence banks' charter conversion choices. ### 6. Transfer of significant ownership - Grade: C - Findings: - Comprehensive definitions for “controlling interest” considering quantitative and qualitative factors. - Clear rules for prior approval or notifications of ownership changes; supervisors may deny improper changes and may require reversal or remedial actions. - In practice, the international practice of a five percent threshold for reporting significant shareholders is applied. - Assessors saw evidence that rules and policies are applied in practice. - Shortcoming and Recommendation: - No explicit regulatory requirement for immediate bank reporting if a major shareholder is no longer suitable; assessors recommend introducing such a supervisory requirement (addressed under CP 9). ### 7. Major acquisitions - Grade: C - Findings: - Laws and regulations define which acquisitions and investments require prior approval, notification after-the-fact, or general consent. - Clear criteria exist for application assessment and restrictions on permissible investments/acquisitions (e.g., non-bank related activities). - Evidence that rules and policies are applied in practice. ### 8. Supervisory approach - Grade: C - Findings: - U.S. regulation changing rapidly, broadening supervision and introducing tiering (e.g., Banking Institutions with at least $50bn of Assets). - Net effect of changes positive: supervisory regime is effective and risk-based with increased focus on resolution for larger firms. - Recommendations: - Agencies should review communication approach with firms. - Simplify system of supervisory issues requiring action (e.g., MRAs) and ideally move to a common interagency approach. - Continue efforts to address long-outstanding MRAs. ### 9. Supervisory techniques and tools - Grade: LC - Findings: - Agencies possess an array of tools and are developing new techniques such as stress testing and horizontal reviews, altering supervisors’ work balance. - Absence of formal reporting requirements on banks to inform supervisors of key changes and developments is a system weakness. - Recommendations: - Ensure intentions for each horizontal review are clear (absolute or relative standard). - Improve communication with banks: clarify key messages; do not conflate roles and expectations of boards and senior management; balance feedback to avoid excessive praise or excessive reporting on recent history. - Align planning cycles to maximize joint working opportunities. ### 10. Supervisory reporting - Grade: C - Findings: - Long-established and effective regulatory reporting framework with demonstrated flexibility to expand requirements during crises. - FBAs do not collect data from banks at the solo level (bank excluding subsidiaries); assessors understand omission is not sufficiently material to lower CP 12 rating under current circumstances. - Recommendations: - Review level of granularity of data collected, particularly for stress testing and liquidity analysis, to ensure continued need for that level. ### 11. Corrective and sanctioning powers of supervisors - Grade: C - Findings: - U.S. legislation, regulations, and processes for taking supervisory action are robust and have been strengthened. - Earlier cases showed escalation of measures sometimes took longer than appropriate; recent years show clear reduction in such cases. - Recommendations: - Consider implementing rules for promoting early action beyond bank capital and liquidity. - Set more explicit rules for ageing of MRAs and MRIAs. - Continue evolving practice of setting timelines for remedial actions and requiring regular progress reporting. - Encourage implementation of planned OCC guidance on supervisory practices relating to MRAs. ### 12. Consolidated supervision - Grade: LC - Findings: - Lack of full compliance due to absence of regulatory and supervisory rules, guidance, and a formal rating system for SLHCs, and absence of a capital rule for corporate and insurance company SLHCs. - Capital standards not required at diversified financial group level under Basel framework; lack of supervisory assessment framework may hamper action at holding company (SHLC) level. - FBAs do not collect solo-level data (see CP 10); assessors satisfied omission has no prudential significance under current circumstances as U.S. bank subsidiaries are small relative to parent and restricted in activities. ### 13. Home-host relationships - Grade: C - Findings: - Comprehensive framework for cooperation and information exchange between FBAs and foreign supervisory authorities, strengthened by supervisory colleges and CMGs. - Recommendations: - Establish agreements with foreign counterparts on communication strategies, especially for crisis situations. - State supervisory agencies should consult fully, in all cases, with FBAs and foreign supervisors on impending enforcement actions; assessors noted instances where this did not occur. - Observations: - Some specific rules apply to foreign institutions (shorter run-off period for foreign branches in liquidity, asset maintenance requirements for branches, requirements for large FBOs to set up intermediate U.S. holding companies). - BCP mandate is limited to ensuring prudential rules and supervision for minimum safety and soundness and does not assess level playing field issues. ### 14. Corporate governance - Grade: LC - Findings: - Major post-2008-09 changes in supervisors' demands and banks’ approaches to corporate governance. - Raised expectations particularly in: (i) Board involvement in setting risk appetite; (ii) establishment of Risk Management Committees; (iii) increased frequency of Board meetings. - Evidence in supervisory examination reports and enforcement actions; heightened focus by boards and management. - Shortcomings: - Historically unclear distinction between roles of board and senior management; many instances where “board and senior management” used where only one should have specific responsibility. - New regulations (e.g., SR 12-17 by the FRB and Heightened Standards by the OCC) recently in force and not yet fully implemented; primarily refer to large banks. - Requirements on roles and responsibilities of bank boards still fall short of international standards in areas (see CP 20 on Lending to related parties). - AC1: requirements for banks to inform supervisors promptly about material developments affecting fitness and propriety of Board directors or senior management are defined only for a narrow scope of events and should be broadened. ### 15. Risk management process - Grade: LC - Findings: - Substantial improvement from a low starting point; some changes bring U.S. to standard practice elsewhere (e.g., frequency of board meetings, board composition, existence of risk committees). - Risk aggregation has improved. - Risk oversight remains work in progress; much guidance is new or yet to be implemented. - Gaps and Recommendations: - Guidance needed for Banking Institutions with less than $10bn of Assets as supervision of these fails to meet many essential criteria (but not sufficient to warrant material non-compliance). - Place greater weight in communications on the role of the Board and delineate it from senior management. - Clarify aspects of Chief Risk Officer role, particularly surrounding their departure. - Further work needed on firm-led stress tests where firms may stretch scenarios beyond credibility rather than assessing appropriate loss levels from given shock severity. ### 16. Capital adequacy - Grade: LC - Findings: - FBAs have robust and comprehensive approach to capital adequacy for banks and most holding companies, strengthened in response to Basel and DFA reforms. - Stress testing essential for banking organizations with more than $10 billion of assets. - Concerns from 2010 DAO about quality of capital and coverage of most savings and loan holding companies have been addressed in new regulatory capital rule; savings and loan holding companies with substantial insurance or commercial activities are excluded. - Divergences from Basel and Implications: - Differences exist between new capital rule and Basel framework in capital definitions, risk coverage, and calculation methods—supporting LC rating. - Risk-based capital requirements for internationally active banks under advanced approaches differ from Basel in several respects. - U.S. standardized approach (the “floor”) does not impose capital charge for operational risk or for CVA risk (and some divergences on standardized approach to market risk). - Omission in risk coverage may be significant for a broad segment of the banking system and distinguishes the U.S. capital regime from other major jurisdictions, making the “standardized” floor less binding than it may appear. ### 17. Credit risk - Grade: C - Findings: - U.S. approach to Credit Risk is exceptionally codified in regulation and guidance. - Agencies do not set limits, but assessors found evidence limits were in place in banks and that agencies would require limits and escalation criteria if absent. - Recommendation: - Consider the use of limits when guidelines are next reviewed. ### 18. Problem assets, provisions, and reserves - Grade: C - Findings: - Long-established and rigorous process for evaluating banks’ approaches to problem assets and maintenance of an adequate ALLL. - FBAs consistently challenge unrealistic bank ALLL estimates and secure increases or take enforcement action when necessary. - Constraint and Outlook: - Supervisory judgments constrained by “incurred loss” requirements of U.S. GAAP; proposed reforms will permit more forward-looking provisioning. - Approach likely to be tested as U.S. economy improves. ### 19. Concentration risk and large exposure limits - Grade: LC - Findings: - Sound supervisory framework for credit concentration risk with issued guidance that is followed up in reviews; some reassessment of thresholds for commercial real estate exposures warranted. - Little evidence of comparable supervisory framework/guidance for other risk concentrations as required by EC 1. - DFA widened definition of large exposures to include counterparty credit risk from derivatives and securities financing transactions, aligning thresholds more with AC1. - Remaining Issues: - Separate and additional limits for money market investments and security holdings available to banks (but not federal savings associations) leave possibility of excessive risk concentrations. - The 50 per cent limit on exposures to a corporate group appears out of line with AC1 and the Federal Reserve’s proposed large exposures framework for large bank holding companies and foreign banking organizations. *Source: _cr1589 - 1. Responsibilities* ### 20. Transactions with ### 20. Transactions with related parties ### Assessment summary - LC: The “related party” regime in the U.S. regulatory framework does not appear as broad as required by this CP, in terms of the definition of covered transactions, affiliates and insiders. - The CP requires a higher degree of board involvement and oversight than presently required by U.S. laws and supervisory guidance. - There are no formal requirements for prior board approval of transactions with affiliated parties or the write-off of related party exposures exceeding specified amounts (as per EC3) or for board oversight of related party transactions and exceptions to policies, processes and limits on an ongoing basis (as per EC6). - The FBAs expect banks to apply a high degree of board oversight and monitoring of affiliate and insider transactions and review this as a matter of practice. ### Key findings - There are no formal requirements for: - prior board approval of transactions with affiliated parties; - prior board approval for the write-off of related party exposures exceeding specified amounts (as per EC3); - board oversight of related party transactions and exceptions to policies, processes and limits on an ongoing basis (as per EC6). - The aggregate limit for lending to insiders is: - 100 per cent of a bank’s capital and surplus (and 200 per cent for smaller banks). - The assessors conclude that the 100 per cent (and 200 per cent for smaller banks) aggregate limit does not appear consistent with the general intent of this CP and creates the risk that a small group of insiders could deplete the own funds of a bank. - There are no regulated limits for holding company transactions with their affiliates or insiders. ### Implications - The narrower scope of the U.S. “related party” regime relative to the CP may leave gaps in: - definitions of covered transactions, affiliates and insiders; - formal board involvement and oversight requirements. - The high aggregate lending limits to insiders pose a risk of concentrated depletion of bank own funds. - Absence of regulated limits at the holding company level leaves potential unregulated intra-group exposures. ### Recommendations - Consider broadening the legal/regulatory definition of “related party” to align with the CP’s scope for covered transactions, affiliates and insiders. - Introduce formal requirements for: - prior board approval of transactions with affiliated parties; - board approval or oversight for write-offs of related party exposures exceeding specified amounts (as per EC3); - ongoing board oversight of related party transactions and exceptions to policies, processes and limits (as per EC6). - Reassess the aggregate limits for lending to insiders (currently 100 per cent of capital and surplus, and 200 per cent for smaller banks) to reduce the risk that insiders could deplete a bank’s own funds. - Establish regulated limits or oversight mechanisms for holding company transactions with affiliates and insiders. *Source: _cr1589 - 20. Transactions with related parties* ### 29. Abuse of financial ### 29. Abuse of financial services ### Overview and assessors’ conclusions - There are rules and supervisory expectations on BSA/AML issues that are comprehensive. - Assessors did not see evidence that deficiencies in the legislation were compensated for in the supervisory process. - CP 29 covers all forms of criminal abuse and the need to protect banks. - There is strong political and supervisory focus on BSA/AML, and assessors saw evidence that significant resources are deployed within the authorities and banks to meet very stringent standards. - Vulnerability to other forms of criminal abuse is more disparately addressed within the regime and risks being deemphasized. - Assessors recommend that authorities seek an appropriate balance in surveillance and guidance, perhaps by consolidating related issues in fewer places. ### Specific deficiencies and proposed legal changes - Supervisory expectation versus requirement: - Supervisors should explicitly require, rather than “expect”, that a bank’s decision to enter into relationships with high-risk accounts and countries, including with foreign and domestic PEPs, be escalated to the senior management level. - Ultimate beneficial owner (UBO) identification: - Current legal and regulatory framework does not require the identification of the ultimate beneficiary owner of legal entity clients. - Proposed amendments open for public consultation will introduce requirements to address this deficiency. - Assessors welcome the proposed rule and understand its approval and implementation will improve compliance with this CP. ### Relevant supervisory and regulatory context (selected related recommendations and practices) - Banks and supervisory practices referenced in the assessment include: - Requirement that supervisors explicitly require escalation of bank relationships with high-risk accounts and countries (Principle 29). - Proposed amendments to require identification of the ultimate beneficiary owner of legal entity clients (CP 29 deficiency to be addressed). - Examples of supervisory practices and requirements elsewhere in the report that provide context for supervisory intensity and standards: - Establishing forward-looking stress testing requirements for banks with less than $10 billion in assets. - Requiring institutions with total assets of less than $500 million in certain instances to have an independent audit of their financial statements. - Tighter U.S. quantitative limits for affiliate transactions: 10 percent of bank capital for transactions with a single affiliate and 20 percent of capital for aggregate transactions with all bank affiliates, instead of 25 percent of the bank’s capital. - Inclusion of asset purchases by a bank from affiliates in the 10/20 limit structure. - Prohibition on a bank having any unsecured credit exposure to an affiliate. - Prohibition on a bank purchasing low-quality assets from an affiliate. - Capital and liquidity standards exceeding Basel minima, including: - Supplementary leverage ratio buffer greater than 2 percentage points above the 3 percent minimum, for a total of more than 5 percent, to avoid restrictions on capital distributions and discretionary bonus payments. - Insured depository institution subsidiaries of these firms must maintain at least a 6 percent supplementary leverage ratio to be considered “well capitalized.” ### Assessors’ recommendations (actionable items related to CP 29) - Supervisors should: - Explicitly require escalation of bank decisions to enter into relationships with high-risk accounts and countries, including with foreign and domestic PEPs, to senior management. - Authorities should: - Approve and implement the proposed amendments that introduce requirements to identify the ultimate beneficiary owner of legal entity clients to improve compliance with CP 29. *Source: IMF FSAP assessment chapter titled "29. Abuse of financial services" (CR1589).* --- _Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr1589.pdf_