Can Bank Directors Really Govern Risk?

The following feature appeared in the third quarter 2023 edition of Bank Director magazine. It and other stories are available to magazine subscribers and members of Bank Director’s Bank Services Membership Program. Learn more about subscribing here.

It was considered one of the top banks in the country. It had grown rapidly, nearly tripling its asset base over a nine-year period, but had also used short-term deposits to fund a large portfolio of longer-term U.S. government securities. When the Federal Reserve began to aggressively raise the federal funds rate to bring inflation under control, the market value of those supposedly safe bonds plummeted well below their face value. As the full extent of the problem became widely known, the bank’s depositors withdrew their funds, resulting in a liquidity crisis that forced the federal banking regulators to act.

No, the bank in question was not Santa Clara, California-based Silicon Valley Bank, San Francisco-based First Republic Bank or New York-based Signature Bank – three highly regarded institutions that fell victim to a liquidity crisis earlier this year brought about in part by a sudden change in monetary policy by the Federal Reserve.

The institution in this case was First Pennsylvania Bank N.A. in Philadelphia, and the year was 1980. Mark Twain once opined that,”History never repeats itself, but it does often rhyme.” And the similarities between the story of First Pennsylvania 43 years ago and the failure of Silicon Valley, First Republic and Signature have a marked rhythmic quality.

There are a few key differences between the two situations. First Pennsylvania was also saddled with a lot of bad loans, which contributed to its downfall, while Silicon Valley Bank, First Republic and Signature appeared to have relatively clean credit portfolios. And unlike those three, which were taken over by the Federal Deposit Insurance Corp., the agency stepped in and helped First Pennsylvania fight another day. Otherwise, their stories are disturbingly similar. History did indeed rhyme in 2023.

“We had the same thing in First Pennsylvania, which was a good bank – [then] the oldest bank in the country,” says William Isaac, chairman of the advisory firm Secura/Isaac Group. Isaac served on the FDIC’s board when the agency bailed out First Pennsylvania in 1980 and was appointed chairman the following year. The bank had loaded up on U.S. government securities just before former Fed Chair Paul Volcker jacked up interest rates to get runaway inflation under control and found itself caught in the same liquidity crisis that took down Silicon Valley Bank, Signature and First Republic. “We’ve been there and done that before, but it was so long ago that we seem to have forgotten about it,” Isaac says.

Risk governance may well be the greatest challenge facing a bank’s independent directors, most of whom come from outside the industry and have little direct experience with the volatile nature of financial assets. The most successful banks are intelligent risk takers, and they keep themselves out of trouble by relying on strong risk management practices at both the operating and board levels. As the failures of Silicon Valley Bank, Signature and First Republic demonstrate, the risk environment can change very quickly, and banks must be able to react accordingly. A failure of imagination in risk governance can sometimes lead to disaster.

“There’s no autopilot in risk governance,” says Brandon Koeser, a senior analyst at the consulting firm RSM US LLP. “It’s fluid. You have to devote sufficient attention at the board level, especially in these periods of instability. If you’re not, not only do you open yourself up to regulatory criticism, it can be far worse, as we’ve seen.”

The failures of the three banks were in one sense surprising because they all had an established track record of superior financial performance. They were also well capitalized – and capital has traditionally been viewed as the first line of defense against failure. But they were also outliers because of their highly focused business models. Silicon Valley concentrated on startup companies and their venture capital investors, while Signature and First Republic focused on high net worth individuals. Signature had also carved out a niche for itself servicing cryptocurrency companies. Additionally, the banks all had large percentages of uninsured deposits in their deposit base.

The crisis began on March 8, 2023, when SVB Financial Group, the holding company for Silicon Valley Bank, announced that it had sold approximately $21 billion worth of securities at a loss of $1.8 billion to meet deposit withdrawals that had been ongoing since the second quarter of 2022. Like many banks throughout the industry, Silicon Valley’s portfolio of U.S. government and mortgage-backed securities had plummeted in value as the Federal Reserve, intent on bringing down inflation, increased the fed funds rate from a range of 0.25%-0.50% in March 2022 to a range of 4.75%-5% in March 2023. That same day, another highly specialized institution – Silvergate Bank in La Jolla, California, which focused on digital currency companies – announced its intent to self-liquidate after it had been forced to sell securities at a loss to meet depositor demands.

Silicon Valley also said that it would attempt to raise $2.25 billion in fresh capital but was forced to abandon that effort as the liquidity crisis and a stock price free fall quickly overwhelmed it. On March 9, Silicon Valley customers withdrew over $40 billion in deposits. The bank had another $100 billion in withdrawal requests pending the morning of March 10, but it didn’t have enough collateral to borrow from the Federal Reserve’s discount window to meet that demand. The California Department of Financial Protection and Innovation closed the bank that day and placed it into receivership.

The contagion quickly spread to Signature, which also had a high level of uninsured deposits. On March 10, Signature experienced a similar run on its deposits. When the bank was unable to fulfill all its deposit withdrawal requests, the New York Department of Financial Services closed the bank on March 12 and placed it into receivership with the FDIC.

Like the third piece in a row of dominos, First Republic was the next bank to fall. The bank had a high level of uninsured deposits and its mortgage portfolio was losing value as rates rose – red flags that alarmed both investors and its high net worth client base – and it too began to experience substantial deposit withdrawals. A $30 billion deposit by 11 major U.S. banks – intended to project confidence in the institution’s stability – did buy it some time. But the heavy deposit outflow resumed when First Republic reported its first quarter 2023 financial results, which disclosed the full extent of its funding outflow, and the bank was finally closed on May 1 and placed in receivership with the FDIC when it could no longer meet its depositors’ demands.

Regulatory postmortems conducted after Silicon Valley’s and Signature Bank’s demise identified significant deficiencies in their risk management programs. A review by the Federal Reserve of its supervision of Silicon Valley Bank placed much of the blame on the bank’s management team and board of directors. “The full board of directors did not receive adequate information from management about risks at [the bank] and did not hold management accountable for effectively managing the firm’s risks,” the report states. The Fed also said the bank had failed its own internal liquidity stress tests and lacked workable plans to access liquidity in times of stress. And the Fed criticized the bank for managing its interest rate risk with a focus on short-term profits and protection from potential interest rate decreases, saying the bank had removed interest rate hedges that would have protected it against rising rates. “In both cases the bank changed its own risk management assumptions to reduce how these risks were measured rather than fully addressing the underlying risks,” the report concluded.

In prepared remarks to the U.S. House of Representative’s Committee on Financial Services, FDIC Chairman Martin Gruenberg said that “poor governance and inadequate risk management practices put [Signature] in a position where it could not effectively manage its liquidity in a time of stress, making it unable to meet very large withdrawal requests.” And while First Republic was initially able to meet withdrawal demands from its customers, he said “management’s strategic decision to retain a long-standing business model with a significant asset/liability mismatch during a period of rising interest rates contributed to a loss of confidence in the bank on the part of depositors and ultimately constrained options for the bank to restructure its balance sheet, sell assets or raise capital.”

The Federal Reserve, which regulated Silicon Valley Bank, and the FDIC, which supervised Signature, were also at fault for not pressing the issue of liquidity risk more forcibly with the banks, according to a comprehensive postmortem conducted by the U.S. Government Accountability Office.

“In the five years prior to 2023, regulators identified concerns with Silicon Valley Bank and Signature Bank, but both banks were slow to mitigate the problems the regulators identified, and regulators did not escalate supervisor actions in time to prevent the failures,” according to the report.
Each bank failure has its own set of unique circumstances, and yet often there are similarities that are present in many cases. Julie Stackhouse is the former executive vice president for supervision and credit at the Federal Reserve Bank of St. Louis, and is currently a director and member of the risk committee at Simmons First National Corp., a $27.6 billion regional bank headquartered in Pine Bluff, Arkansas. Stackhouse says the bank failures she witnessed during her 18-year career at the St. Louis Fed often had several things in common.

The first factor was funding: a low amount of core deposits, described by the FDIC as stable deposits with lower costs that reprice more slowly than other deposits when rates rise, and greater reliance of more volatile sources of funding. “During the financial crisis, we saw that banks that were trying to manage problem loans and were losing uninsured deposits, the ones with low levels of core deposits had a [rougher] time than the ones that didn’t,” she says. “A good core deposit structure made a difference.” While the three banks had funding that fit the definition of a core deposit, that funding turned out to be much less stable than the checking and savings accounts that community and regional banks rely on.

The second risk factor was rapid growth. “Many banks grow through normal acquisitions and just normal growth of the economy,” she explains. “Whenever we had a bank that grew very fast relative to its peers, we always said, ‘What’s going on that’s unique about that bank?’ And when problems arose, banks that had grown very rapidly tended to have more problems than those that did not.” According to the GAO report, from 2019 through 2021, Silicon Valley and Signature grew their assets by 198% and 134%, respectively.

A third similarity among failed banks is what Stackhouse calls “layering of risk.” Typically, this would tie the risk in a bank’s loan portfolio to something else. For example, all three failed banks tended to underwrite loans for the same class of customers they gathered most of their deposits from. This was particularly evident at Silicon Valley, which lent money to the same startup companies that also provided the bank with much of its funding. “You had the unusual nature of the credit risk and the concentration to one industry, [and] deposits from the same industry that were more volatile because of the nature of the industry,” she says.

Another common element in many bank failures is an outsized business model concentration relative to the overall asset footprint, which was evident in all three banks. Stackhouse says that if a bank is going to concentrate heavily on a specific business or industry, the board needs to think about the impact on capital if a tail event occurs – which is an event with low probability but very high risk. “You have to understand the [total] amount of capital you have,” she says. “If there is a tail event, a high capital ratio might not be enough.”

During a time of crisis, it’s also important that banks attempt to raise capital before their situation becomes too dire. Stackhouse saw this happen during the financial crisis where “the banks that went to the capital markets early tended to survive. Those that tried to go to the capital markets too late just couldn’t access them.” Silicon Valley also hoped to raise capital but ran out of time because of the run on its deposits.

And finally, a bank’s failure can often be traced back to a complacent board of directors that failed to challenge its management team on risk issues. “As a board of directors, you’re the one who chooses management leadership, and you have to be comfortable they are carrying out their responsibilities,” Stackhouse says.

For example, it is critical that boards follow up on issues that have been identified by the bank’s regulators to make sure they have been addressed. It is known from the GAO report that federal bank regulators had concerns about how Silicon Valley and Signature were handling liquidity risk. What is unknown at this point is how hard the boards at either bank pushed the management teams to resolve the regulators’ concerns. Stackhouse says boards should always ask why the bank didn’t identify a regulatory concern first, who is accountable, what is being done to fix the problem and how soon it will happen.

The prudential bank regulators have clear expectations for boards of directors when it comes to risk governance. “I think they want to see independence,” says Gary Bronstein, a partner and leader of the financial services team at Kilpatrick Townsend & Stockton. “I think they want to make sure that the board is free and independent of management and is assessing risk, and will ask the hard questions and will disagree with management when appropriate.” Bronstein says the board’s role includes working with the management team to set the bank’s risk appetite, and then following through to make sure the team’s plans and initiatives are consistent with the risk profile that has been established.

Determining the bank’s risk appetite – which is essentially how much risk the bank is willing to assume in pursuit of profitability – can be a challenge for directors who have never made a loan or evaluated the credit worthiness of a borrower. “It’s an art, not a science,” says Sydney Menefee, a partner with the consulting firm Crowe LLP, and previously the senior deputy comptroller for midsize and community bank supervision for the Office of the Comptroller of the Currency. “It’s putting your risk appetite into tolerance levels.” Examples might include a determination by the board that it’s not comfortable having more than a 30% concentration of deposits associated with digital assets or more than 20% of the loan portfolio comprised of construction loans. “You’re taking a qualitative statement and turning it into a quantitative assessment that can be tracked and monitored,” says Menefee.

Other important elements of effective risk governance include comprehensive reporting, so the board understands how risk is rolling up through the entire bank. This is often done through key risk indicators, which are a set of metrics that help identify elevated risk exposures throughout the organization. “Ultimately that reporting is what allows the board to measure, monitor and control the risk in the organization,” says Koeser. “If that reporting is soft, how is the board going to be able to understand not only what management is doing from an operational and strategic growth standpoint, but how those actions are impacted by risk?”

Because most directors come from outside the industry, it’s also important that risk discussions not be loaded with technical jargon. Eugene Ludwig, who served as the comptroller of the currency from 1993 to 1998 and is currently CEO of Ludwig Advisors, says bank’s executives should be forced to explain the bank’s risks in plain English. “Usually if someone can’t explain it to you that way, it doesn’t mean you’re an idiot,” he says. “It means they are either lying to you or they don’t understand it themselves. Anybody on a board of directors should be able to understand the fundamental risks of the enterprise.”

Ludwig also believes that boards should pay more attention to those risks that are less likely to happen – but can be devastating when they do. “I’m very much in favor that boards and risk committees insist that part of the meeting talk about tail risks that, if they happened, could put us out of business,” he says. “There’s very little of that that goes on, much less forcing folks to answer questions like, ‘What happens if interest rates go up a lot higher?’ There’s too much time spent, not just in board meetings but in risk discussions generally, on the center of the bell curve – the normal distribution – and less on the tails.”

One strategy that might improve the quality of risk governance would be to have more ex-bankers serving on the board, just as many boards have recruited directors with knowledge of technology or cybersecurity to help inform the other directors. When former Citigroup board member Michael O’Neill became chair in 2012, he saw a need to strengthen the board’s risk governance practices. One of his first steps was to form a standing risk committee, but he also wanted to add directors who had experience managing risk in a bank, even though he had served as CEO of Bank of Hawaii Corp. for a few years. O’Neill would later recruit former U.S. Bancorp CEO Jerry Grundhofer to the board and have him chair the board’s risk committee. And he elevated Eugene McQuade, a veteran banker who had been CEO of Citigroup’s Citibank N.A. operating unit, to the board as well.

“To ask intelligent, successful people who do not understand the banking business reasonably well to oversee risk in a banking institution, I think, is unrealistic,” O’Neill says. “You need to have board members who are subject matter experts in different areas of risk that the company takes on.”

One of the most important aspects of effective risk governance is accountability. Does the board hold management accountable for its actions – and does it hold itself accountable for providing effective oversight? In its postmortem review of how it supervised Silicon Valley, the Fed pointed out that the bank changed its own risk management assumptions to favorably alter how its liquidity risk was measured rather than dealing with the underlying problem. It’s also known that Silicon Valley operated without a chief risk officer for several months leading up to the crisis.

“If the board is not holding senior management accountable when risk tolerances go astray, when information is not presented timely and accurately, when key personnel is absent from the bank for long periods of time, it’s the board’s responsibility to take action,” Menefee says. “That can be uncomfortable, but that’s their job.”

It’s not uncommon for board decisions to be questioned after the fact, and it’s reasonable to question whether a liquidity crisis was predictable considering the magnitude of the unrealized losses lurking in the three banks’ securities portfolios and their high percentage of uninsured deposits. “Interest rates can’t be zero forever,” says O’Neill. “I think the underlying problem is that management felt they were going to be at zero or near zero forever.”

From O’Neill’s perspective, the banks forgot a fundamental principle of banking. “This is really banking 101,” he says. “Demand deposits can be demanded back, and you better be liquid enough to give your demand depositors their money when they want it without causing a train wreck. … The ones that failed were not in a position to do that.”

O’Neill says the stress testing that Citigroup did while he was chairman taught him the importance of scenario analysis. “Put through your model some scenarios that you think are absurd, that you think will never happen and see what the consequences are if those scenarios occur more frequently than one would like,” he says. “Because the never-will-occur scenarios occur more frequently than one would like. I think there was a failure of imagination here.”

One thing that perhaps was even less predictable than the magnitude and velocity of the Fed rate increases was how the banks’ depositors would react to bad news, beginning with Silicon Valley’s decision to sell bonds at a loss to free up funding. In a cover letter to the Federal Reserve postmortem of Silicon Valley’s failure, Michael Barr, the Fed’s vice chair for supervision, wrote that “the combination of social media, a highly networked and concentrated depositor base, and technology may have fundamentally changed the speed of bank runs. Social media enabled depositors to instantly spread concerns about a bank run, and technology enabled immediate withdrawals of funding.”

What the banks may have failed to anticipate is that their customers would abandon them so quickly. “It could have been predicted that interest rates were going to go up, and they were going to go up fast,” says Menefee. “But the run on the deposits, I think that caught people by surprise. … The environment did change and changed very quickly.”

Menefee says that the regulators and the banks were all victims of recency bias, which is the tendency to place more importance on recent experiences or information when predicting future events. Federal stimulus programs after the Covid-19 pandemic, along with the Federal Reserve’s accommodative monetary policy, had pumped plenty of liquidity into the economy, and banks were awash in cash. The three failed banks had long emphasized relationship management and had nurtured what appeared to be a strong corps of loyal customers.

And that’s how things were until one day they weren’t. If there’s one lesson that all bank directors should take away from the demise of Silicon Valley, Signature and First Republic, it’s that history often rhymes.

Governance issues like these will be covered during Bank Director’s Bank Board Training Forum in Nashville Sept. 11-12, 2023.

This article has been updated to reflect a correction. Crowe’s Sydney Menefee was speaking in general terms and not about any particular banks that failed.