Banks Regain Sovereignty Over Risk Practices

The financial crisis and the passage of the Dodd-Frank Act in 2010 had what could easily be described as an earth-shattering impact on risk practices in the financial services industry. Banks of varying sizes worked hard to wrap their arms around the regulatory requirements and recommendations, and adapt them to their own models and cultures.

Less than a decade later, Bank Director’s 2019 Risk Survey, sponsored by Moss Adams, finds more than half of executives and directors from banks above $10 billion in assets saying their concerns around compliance risk have increased over the past year. Thirty-nine percent of all respondents are more concerned about compliance risk.

These concerns pose an interesting juxtaposition, as banks between $10 billion and $50 billion in assets saw two key requirements disappear with the passage of the Economic Growth, Regulatory Relief and Consumer Protection Act in May 2018: the requirement to conduct stress tests, and to establish and maintain a board-level risk committee.

However, regulatory relief has arrived at an uncertain time for financial institutions, with bank executives and boards concerned about the economy after an almost record-long period of growth, worried about political uncertainty amid yet another government shutdown when the survey was conducted (the longest in U.S. history), and experiencing competitive pressure following a year of rising interest rates and continued technological change impacting how and where consumers want to bank-both giving an edge to the biggest banks.

In this uncertain environment, most bank leadership teams still see value in stress testing. “It’s a great indicator and a great barometer of the health of their portfolios and structures,” says Craig Sanders, a partner at Moss Adams.

More than three-quarters of banks below $10 billion in assets conduct an annual stress test, even though it’s not required of their institutions.

New York City-based Amalgamated Bank, with $4 billion in assets, conducts two forms of stress testing, according to Chief Executive Officer Keith Mestrich-a loan-level test and a macro portfolio test. “The stress tests help the bank identify and confirm which portfolios are riskier and/or more volatile, and allows us to set portfolio limits accordingly,” he says. “In addition, as a public company, these tests will help in determining capital policy using data-driven analytics.”

Given concerns in the industry around commercial real estate concentrations, $4.7 billion asset Bryn Mawr Bank Corp., based in Bryn Mawr, Pennsylvania, began stress testing its CRE portfolio quarterly, says Chief Risk Officer Patrick Killeen. The results inform the bank’s decisions on capital management. The bank relies on the three Dodd-Frank Act Stress Test (DFAST) scenarios released annually by the Federal Reserve. The impact of the results on all lines of business, including non-interest income streams such as wealth management, fee revenue and mortgages, is considered. “We will actually sit down with management and ascertain their perspectives around how the changing economic environment, as articulated within adverse and severely adverse scenarios, would have a potential impact on those fee businesses,” he says. “We incorporate those results into our ultimate outcome.”

Of banks above $10 billion in assets, 60 percent say their bank will maintain their stress test practices, in line with the former requirements.

“From an expense standpoint, stress testing is not generally one of the larger expenses in [a bank’s] internal audit budget, so the value the data provides to the management team and the board for the money they expend is probably why [we’re] seeing a strong desire to keep that in place,” says Sanders. The investment has been made and the infrastructure is in place for these institutions, and “it’s a good business practice,” he adds.

It’s a practice $31 billion asset Wintrust Financial Corp., headquartered just outside of Chicago in Rosemont, Illinois, plans to keep in place for now.

“Stress testing is a control in itself,” says Kerris Lee, Wintrust’s enterprise risk management officer. “Understanding where our operational loss[es] are better informs our committees to make better decisions, both from a qualitative and quantitative standpoint.” With the climate in Washington and the broader economy growing more unpredictable, the information obtained via stress tests can provide useful ammo as banks enter uncertain times.

While most banks plan to keep their stress test procedures in place for now, almost one-third indicate their bank will scale back on their stress testing procedures, and 13 percent say they have modified or are modifying their stress test practices.
It’s difficult to measure shades of grey in a survey format, as respondents were unable to detail exactly how their bank is changing their stress testing processes. But it does give one pause, because the information obtained can provide value to bank leadership teams.

“If they’re [scaling back] purely as cost-cutting, that would concern me-they’re not placing any value on the data,” says Sanders. “The cost of conducting the stress testing and the structural integrity it indicates in the portfolio is probably of more value than saving a few dollars.”

It’s interesting that regulatory relief arrived just as concerns began creeping up in the broader economy. Lee is already seeing signals in the industry that give him concern and underscore the need for banks to continue to strengthen their risk practices. “I’ve observed some banks switching some of their loan loss reserves, some of which have increased dramatically,” he says. “What that tells me in the hottest credit market there is right now, if more and more banks are putting larger amounts of reserves, that leads me to believe that some slowdown is around the corner.”

Sixty-seven percent of survey respondents say their concerns have increased around credit risk over the past year. “Any time there are drastic swings in our economic stability, our economic environment, credit risk, for the banks, becomes an issue,” says Sanders.

As concerns increase around the lending environment and the future health of loan portfolios, it’s important to take a look at the role the board plays in approving key loans, particularly given the liability facing directors if a significant loan goes south. Seventy-seven percent-primarily but not exclusively from banks below $10 billion in assets-say the board or a board-level committee approves all loans that meet specific criteria. Less than one-quarter say the board focuses on credit policy and risk, and doesn’t have a role in approving loans.

“As institutions grow, the makeup of a board [in terms of] skill set and expertise changes,” says Sanders. Boards tend to be filled with high-level executive talent-backgrounds well-suited to the strategic oversight of the bank. However, as an institution grows larger and more complex, and its geographic footprint expands, the board may no longer possess the knowledge needed to approve individual loans. Bank leaders may want to regularly assess the board’s role in this process.

This change can be as much a cultural as a structural one, and it can take time. It’s something Bank of Tennessee, based in Kingsport, Tennessee, has worked through over the past few years, according to CRO Robert Bradley. The board’s credit committee used to meet twice a month; now, they meet approximately every six weeks. “We have increased the exposure limit significantly to where the board sees fewer and fewer loans,” with the board involved if the loan exposures exceed 8 to 10 percent of the bank’s capital, he says.

Bank of Santa Clarita, based in Santa Clarita, California, with $301 million in assets, takes a different approach, according to CRO John Vescovo. A senior loan committee-comprised of Vescovo, Executive Chairman and CEO Frank Di Tomaso, Chief Credit Officer Gregory Weinberg and one member of the board-makes decisions on loans over $3 million. (This could be a single loan or a combination of loans to the same borrower). For the rare loan that exceeds 90 percent of the bank’s legal lending limit, an executive loan committee-Vescovo, Di Tomaso, Weinberg and three directors-will review and approve the loan. “Our larger loans and larger relationships in the bank often draw in that kind of committee meeting,” says Vescovo. “If it’s below that, then it’s a management-level decision, where our CEO, our chief credit officer and maybe the key lending officers involved in the particular project sign off on that particular loan.”

All policy exceptions made throughout the year are reviewed by the board annually. “When it comes to any bank policy, you’re going to have the occasional exception, but if it’s too frequent, that means that policy is not really effective, and that means it needs to be re-evaluated [or] reconsidered, or that means that you have to put more teeth into it” so certain exceptions are no longer allowed, says Vescovo.

Interest rate risk is closely tied to credit concerns, and three-quarters of respondents say they have grown more worried about interest rate risk over the past year.

If interest rates rise by more than one percentage point over the next 18 months, almost half believe their bank will be able to reprice between 25 and 50 percent of its loan portfolio. Twenty-eight percent say their bank will be able to reprice at least half of the portfolio.

But interest rates have had a significant impact on competition for deposits: Fifty-eight percent believe they will lose deposits in a scenario where interest rates rise by more than one point, and 31 percent admit their bank lost deposit share in 2018.

The Federal Reserve raised the federal funds rate-which directly impacts the interest rates paid on deposit accounts and charged on loans-four times in 2018. Citing a backdrop of continued economic growth coupled with investor concerns, “we’re in a place where we can be patient and flexible, and wait and see what does evolve,” Fed Chairman Jerome Powell said in an interview with David Rubenstein, the CEO of The Carlyle Group, on his eponymous Bloomberg TV show. He later told “60 Minutes” that the Fed’s interest rate policy was “in a very good place” that would not urge the economy to speed up or slow down.

Those statements have many predicting fewer-or perhaps no-increases in 2019.

The second piece impacted by regulatory relief is risk governance, with banks in the $10 billion to $50 billion asset range no longer required to have a dedicated board-level risk committee. But the survey reveals that most of these banks are keeping this practice: Ninety-three percent of executives and directors representing a bank in this range have a separate board-level risk committee.

Consistent with past iterations of this survey, a small majority-59 percent-of those representing banks between $1 billion and $10 billion in assets have a separate risk committee. Boards of banks below $1 billion are more likely to govern risk within the audit committee.

“Banks our size are evolving,” Bradley says of $1.2 billion asset Bank of Tennessee and similarly sized institutions. “There’s no one way to approach risk management and governance. I think that part of it is just making sure that there’s a cultural awareness all around that everybody is involved daily in the risk management business,” he says.

Most survey respondents reveal their bank employs a chief risk officer. For banks above $10 billion in assets, that person is focused exclusively on risk management. But for respondents below $10 billion, that person is more likely to wear two or more hats within the bank. That’s the case for Bank of Santa Clarita’s Vescovo: compliance, information security and audit all fall under his responsibilities, along with risk management.

Formally, Vescovo reports to the board’s audit chair. (There is no board-level risk committee.) “I’m the only member of management that meets with the audit committee,” he says. “Whereas in a lot of banks where the culture isn’t as strong as ours, you see a lot of people in management attending those meetings and trying to influence [that committee] … I’ve got a lot of independence in dealing with them.” Vescovo then communicates issues and concerns back to the bank’s CEO.

One area seeing more regulatory pressure is the compliance space. Late last year, federal regulators released a statement that encouraged the broader adoption of innovative technology by banks to better meet compliance obligations around the Bank Secrecy Act and anti-money laundering rules. In response, roughly one-third of respondents say their bank will implement new solutions to improve BSA/AML compliance. Thirty-seven percent indicate their bank already has innovative solutions in place. As the regtech space evolves, pressure could mount as regulators grow increasingly eager for financial institutions to adopt more automated solutions that heighten their compliance capabilities.

For most banks, Sanders doesn’t worry that risk management best practices will fall away. “The goal of any risk management regimen is to influence the behavior of and decisions made by management,” he says. “If an institution is using stress testing to better understand their portfolio, and how it interacts with the current and expected economic realities of their market, then they are likely getting value out of it.”

The same holds true for board-level risk committees. “I wouldn’t see many banks going back if they have already invested in establishing a risk committee,” Sanders says. “Further, as we move forward, I think there will be a desire to conform to industry standards, and it will be driven by business sense rather than regulatory pressure.”

With concerns about the economy preeminent in the minds of bank CROs, CEOs and boards, the best practices established by Dodd-Frank that have trickled through the industry could become even more vital as financial institutions-and the economy at large-prepare for a potential downturn.

“The processes and framework that we put in have been really great at servicing challenges or opportunities within the organization and helps with our overall governance of risk, especially in these uncertain times,” says Wintrust’s Lee. “A good sturdy risk framework-that Wintrust has-is what kept us solvent. We saw that in the economic downturn; we actually gained market share, so we anticipate that [approach] will continue on.”

About the Survey
Bank Director’s 2019 Risk Survey surveyed 180 independent directors, chief risk officers, chief executives and other senior executives of U.S. banks between $250 million and $50 billion in assets to examine the risk landscape for the banking industry, including the impact of regulatory relief on bank risk practices, the potential effect of rising interest rates, risk governance, cybersecurity oversight and the use of technology to enhance the compliance function. The survey was conducted in January 2019. Forty-seven percent of respondents serve on a bank board, 21 percent serve as CEO, and 14 percent serve as the organization’s CRO. The 2019 Risk Survey is sponsored by Moss Adams. The complete results are available in the research section at BankDirector.com.

Questions About Our Research?
Contact Emily McCormick at [email protected] if you’d like to know more about Bank Director’s research initiatives.