The shifting focus of regulators is indeed a concern for bankers and bank boards these days. The creation of the Consumer Financial Protection Bureau (CFPB) has impacted almost all banks and thrifts, not just the $10-billion-plus financial institutions that are subject to CFPB exams. The CFPB is publishing new rules monthly about topics such as fair lending, mortgage disclosures and even the interest rate banks can charge for residential loans. Plus, regulatory exams that end badly can have serious negative consequences for banks, so it’s a good idea to keep tabs of what regulators are thinking about your bank.
At Bank Director’s Bank Audit Committee Conference in Chicago last month, Deputy Comptroller Bert Otto in the central district in the Office of the Comptroller of the Currency (OCC) joined David Van Vickle, assistant regional director at the Federal Deposit Insurance Corp. (FDIC) and Molly Curl, bank regulatory national advisory partner at Grant Thornton LLP, in a discussion of what regulators are looking for in exams. John Geiringer, a partner at law firm Barack Ferrazzano Kirschbaum & Nagelberg LLP, moderated the discussion.
Otto said strategic risk is one of the things his office is most worried about right now. Banks are focused on improving earnings, but he would like bank boards to look at the risk involved in their strategic plan and any new products or services offered by the bank.
He said regulators are focused on risk: What are the bank’s risks and is the bank leadership identifying them? “The focus of all the regulators going forward, at least at the OCC, is really risk on a forward-looking basis,’’ he said.
Van Vickle agreed that this is a focus for his agency as well. Examiners are asking: What is the bank’s tolerance for risk? What are the key indicators of risk? In terms of mitigating risk, Curl said banks should have a full risk profile with risks rated from highest to lowest, and a plan for how to mitigate those risks. The risk line of defense then involves the compliance department, as well as internal audit, which will review at least annually the internal controls to see if policies and procedures are being followed. A bank can opt for yet another line of defense: an outside firm to review the bank’s risk profile and procedures for mitigating risk.
Banks frequently use outside vendors of various sorts, but they can actually be a source of risk as well. Note recent news about the CFPB crackdown on Minneapolis-based U.S. Bancorp over subprime auto loans to military service members, which were provided to U.S. Bancorp through a vendor. Van Vickle, speaking in general and not about U.S. Bancorp, said: “We will hold the bank responsible for a lot of what those service providers are saying, if they are approaching customers and making promises and not making appropriate disclosures.”
Compliance risk can also hinder acquisition plans, as it did in M&T Bank Corp.’s purchase of Hudson City Bancorp this year, when regulators delayed the closing date of the sale amid questions about M&T’s compliance with anti-money laundering rules. The Bank Secrecy Act (BSA) and anti-money laundering laws are now more significant in regulatory exams than in years past because a bank’s compliance track record now impacts its safety and soundness rating, Curl said.
“BSA should be a critical element to any products you roll out,’’ Geiringer said. “It used to be the compliance officer came in at the end, and was Dr. No.” Nowadays, the compliance officer should be involved in the beginning of the process of rolling out new services and products, he said. Consumer compliance is a new focus of regulation, Geiringer said. The Dodd-Frank Act expanded consumer law in the form of UDAAP (Unfair, Deceptive, or Abusive Acts or Practices) to include the term “abusive.” Ask yourself: Would you sell the bank’s products to your mom or dad? Does your bank board set the right tone in reacting to compliance issues? If new regulations are mentioned at a board meeting, do you roll your eyes? How does that impact management if they see board members doing that?
There has been a shift in banking regulation and it’s worth paying attention to. The regulatory panel at the audit conference made that clear.
Editor’s note: On May 29, 2013, the Consumer Financial Protection Bureau amended its new rule to delay implementation of the balloon payment injunction for two years for small lenders with less than $2 billion in assets who make fewer than 500 first-lien mortgages per year. The delay lasts for two years after the implementation date of January, 2014.
January, 2013, was a watershed month for mortgage standards after the Consumer Financial Protection Bureau released the long-awaited final rules on ability to repay, qualified mortgages, mortgage servicing, and appraisal requirements. Each of these rules promises to keep compliance gurus busy throughout this year and into 2014.
The unfair, deceptive or abusive acts or practices standard (UDAAP) is one of the most talked about compliance issues today. The Dodd-Frank Act added the word “abusive” to what was forbidden under the law previously, expanding the scope of what constituted an UDAAP violation. All banking regulators are now charged with enforcing a new standard in consumer protection. This renewed focus on UDAAP has created an especially heightened regulatory concern for banks and other financial institutions governed by the Consumer Financial Protection Bureau (CFPB), particularly due to the lack of certainty behind how the term “abusive” will be interpreted. Given the heavy fines issued by the CFPB in 2012 and high profile settlements, directors will want to take inventory of their UDAAP compliance program and evaluate how each product and service is impacting the consumer. Here are a few recommendations.
Forward-thinking financial institutions are future-proofing their risk and compliance programs. They are detecting tracking and understanding not only emerging issues, trends and regulatory requirements, but also the next big areas of potential vulnerability. We are hearing from our bank clients that regulatory risk is at the top of the list. While bank directors do not need to be technical compliance experts, they do need to actively oversee compliance management and have an understanding of the changes coming.
The most immediate effect that the CFPB will have for banks over the $10 billion threshold is that their compliance examinations will now be conducted by an agency whose mission is based solely on consumer protection. For banks under the $10-billion asset threshold, the primary potential impact is that the CFPB will promulgate consumer protection regulations for these smaller banks, even though it will not generally examine them. This may create a disconnect in the CFPB’s understanding of smaller institutions and exacerbate the current one-size-fits-all compliance approach about which community banks have expressed concern. In addition, all banks should be prepared to respond to postings on the CFPB’s website, which prominently invites the public to “submit a complaint” about their financial institutions.
Banks and other insured depository institutions with total assets of more than $10 billion and their affiliates are serving as guinea pigs as the CFPB develops its examination staff, standards and procedures. Banks that have gone or are currently going through CFPB compliance examinations have reported that the experience is very challenging. Accordingly, large banks need to double check the effectiveness of their compliance function before the CFPB comes calling.
The cost and compliance burden [of the new CFPB] will put a damper on consumer lending, but it will be more pronounced with respect to banks with assets in excess of $10 billion. It is already happening. Almost by necessity, the CFPB is taking or will take a one-size-fits-all approach to regulation, such that the problems associated with the worst and least regulated entities are presumed to be the industry norm, and all participants’ conduct will have to comport with a regulatory reaction that is based on the lowest common denominator. When the CFPB issues rulemaking, the bank regulators, who will police the conduct of the under-$10-billion banks, will not want to be viewed as lax enforcers. The cost and risk of lending will increase for all banks. That will result is less lending.
With uncertainty over how the Bureau’s approach to supervision and enforcement and its priorities will evolve during the next several years, an important task for banks, regardless of asset size, has been to establish good working relationships with Bureau staff. For larger banks with assets over $10 billion, such relationship building is critical in light of the Bureau’s exclusive examination authority and primary enforcement authority for compliance with federal consumer financial laws. However, smaller banks with assets of less than $10 billion also have an incentive to build a solid reputation with Bureau staff. Although it has no examination and enforcement authority over smaller banks, the Bureau may participate in examinations conducted by the prudential banking regulators (“on a sampling basis”), refer enforcement actions and require reports from these institutions.
Regardless of whether the Consumer Financial Protection Bureau (“CFPB”) has supervisory authority over a financial institution or not, its presence, seemingly atop the regulatory pantheon, will mean increased costs on financial institutions and reduced availability of credit. It is too early to say how the CFPB will maintain a balance between regulation and cost of compliance, on one hand, and availability of reasonably priced credit, on the other hand. Recent indications do not look good for financial institutions or credit availability. A classic example is the CFPB’s statements regarding unfair, deceptive, abusive acts and practices (UDAAP). The CFPB has indicated that a financial institution needs to evaluate whether a proposed customer, such as an elderly customer, understands all of a product’s terms. The consequences for financial institutions that are out of compliance with issues such as UDAAP are quite severe. Financial institutions will err on the side of not making certain loans, rather than expose themselves to losses.
Banks with more than $10 billion in assets also are already undergoing CFPB compliance examinations. Even those banks that believed they were fully prepared have been surprised by the scope and duration of these examinations. The pre-examination information requests alone often exceed in scope what bankers would face in an entire examination cycle that included all aspects of compliance and safety and soundness. Banks with less than $10 billion [in assets] are not subject to the direct compliance examination authority of the CFPB, but will still incur significant costs. First, the CFPB has the primary responsibility for developing and implementing new consumer protection regulations. These costs will come in the future, but banks of all sizes will need to contend with these new regulations.