When It Comes to Fintech Partnerships, Look Before You Leap


fintech-5-12-18.pngAt the risk of oversimplification, there are essentially three categories of innovation in banking. There is a small but growing number of banks that have positioned themselves as early adopters of new technology. There are also fast followers, which are not the first banks to try a new technology but don’t lag far behind. Then there are the late adopters.

The digital economy is moving so fast that no bank today can afford to be in the final category. Being an early adopter is probably too risky for many institutions, but at the very least they need to be fast followers or risk getting left behind as the pace of the industry’s digitalization begins to accelerate.

How and when to successfully engage with a fintech company was a recurrent theme at Bank Director’s 2018 FinXTech Annual Summit, held May 10-11 at The Phoenician resort in Scottsdale, Arizona. Deciding to work with a fintech company on the development of a new consumer banking app or the automation of an internal process like small business lending is more than just another vendor relationship. Typically, these are highly collaborative partnerships where the fintech will be given at least some access to the bank’s systems and operations—and could be a risk to the bank if all does not go well.

The first piece of advice for any bank contemplating this kind of engagement is to perform a thorough due diligence of your intended partner. As highly regulated entities, banks need to make sure that any third-party service or product provider they work with have security and compliance processes in place that will satisfy the bank’s regulators. And the younger the fintech company, the less likely they have a compliance environment that most banks would (or should) be comfortable with.

Mark P. Jacobsen, president and chief executive officer at Arlington, Virginia-based Promontory Interfinancial Network, cautioned during a presentation that banks should not consider working with an early-stage fintech unless they have “an extremely experienced CIO, a very robust risk management system and access to very experienced legal talent.” It also makes sense for banks, to check a fintech’s references before finalizing its selection. “There are so many new things out there that it’s important to get that outside validation,” said Adom Greenland, senior vice president and chief operating officer at ChoiceOne Financial Services, a $622 million asset bank headquartered in Sparta, Michigan.

Cultural difference was also a recurrent theme at the Summit. Banks with a culture of innovation are more likely to be early adopters or, at the very least, fast followers. “Culture is a huge barrier to innovation,” said Bill McNulty, operating partner at Capital One Growth Ventures, a unit of Capital One Financial Corp., during a presentation on some of the common obstacles to innovation. “And culture always starts with people.”

McNulty said while he senses the urgency around innovation in banking is beginning to change, he knows of large fintech players that originally wanted to partner with banks, but have grown frustrated with the conservative culture at many institutions. “They decided it is too hard and takes too long and they would do it themselves,” he said. “If we don’t address culture, the best fintechs will do it themselves. Some of these companies will build [their own] banks.”

Bank Director announced the winners for its 2018 Annual Best of FinXTech Awards on May 10, choosing from among 10 finalists across three award categories, and while big banks were represented among the finalists—including U.S. Bancorp, Citizens Financial Corp., Pinnacle Financial Partners and USAA—two of the winners were community banks. And that fact underlines an important point when talking about innovation in banking. Small banks can play this game just as well and maybe even better than their larger peers.

Regtech: Reaping the Rewards


regtech-4-24-18.pngAs it evolves, regtech is uniquely poised to save banks time and money in their compliance efforts, and has become a common topic for many in the banking industry. If you’re ready to realize the promise of regtech at your institution, here are a few key steps to take before you start parsing through providers or sending out requests for proposals.

Consider changes to your organizational structure that would place oversight of both legal and compliance transformations under one department. In Burnmark’s RegTech 2.0 report, Chee Kin Lam, the group head of legal, compliance and secretariat for DBS Bank, pointed to his authority over both legal and compliance functions and budgets as a key to the Singapore-based bank’s ability to work with regtech companies.

At first blush, a change to your bank’s internal structure seems like an extreme measure for a precursor to a technology pilot, but that perception misses the big-picture implications of implementing a new regtech solution. If a bank intends to engage meaningfully with regtech, Lam pointed out, there’s a need for an overarching framework for onboarding new technologies to make sure they “speak to each other at a legal/compliance level instead of at an individual function level—e.g. control room, trade surveillance, AML surveillance and so on.”

What’s more, legal and compliance functions are already tied closely together, and any regtech solution would likely impact both areas of the bank. Central management of these two functions can help ensure efficient regtech implementation.

Create a solid, detailed problem statement before you ever look for a solution. Lam suggests identifying the top legal and compliance risks your bank is facing, and working from there to identify pain points for your employees and customers when they interact with that risk area. One way to go about this process is to utilize design thinking, which looks at products and experiences from the point of view of the customers and employees who utilize them.

By seeking out pain points and working through the design-thinking process to find their root cause, bank leadership can identify specific, actionable areas for improvement. As tempting as it can be for an institution to attempt a total overhaul of its regulatory processes, banks should pursue modular regtech solutions to solve specific, defined problem statements instead. As Peter Lancos, CEO and co-founder of Exate Technology, points out in RegTech 2.0, “[f]ragmentation makes a regulatory strategy impossible—especially due to geographic spread and banks having separate teams set up to deal with individual regulations.”

Leverage outside expertise. The risks of implementing regtech can be daunting, so bank leaders need to use every tool in their arsenal to get deployment right. Banks should involve regulators in the conversation early on in the process of working with a regtech company. According to Jonathan Frieder of Accenture in The Growing Need for RegTech, “[r]egulators globally have continued to accept and, ultimately, to embrace regtech” making 2018 “a pivotal year.”

In addition to getting regulators on board, banks should consider enlisting outside assistance from consultants or other regulatory experts. Such experts provide assistance with assessing problem statements or potential regtech vendors. Lancos states that he feels “it is essential for banks to have regulatory expertise support to actually write the rules that go into the rules engine of regtech solutions.”

Regtech implementation is a lot more involved than an average plug-and-play fintech product. However, when a bank considers the cost efficiencies, improved compliance record and decreased customer and employee frustration, the upside of regtech can be well worth the planning it requires.

How Technology Alters the Reality of Regulatory Compliance


regtech-4-18-18.pngIn case you haven’t noticed, regulatory compliance is expensive. The banking industry spends an estimated $60-$70 billion a year on compliance, and many banks complain they have been forced to expand their compliance staffs in recent years just to keep up with the increase in regulations. Indeed, compliance-related activities can account for nearly 20 percent of a bank’s overhead.

The compliance function is also critically important. The three federal prudential bank regulators consider a poor compliance track record to be an indictment of a bank’s overall management capability, and they will severely punish any bank that has a significant compliance violation, especially of the Bank Secrecy Act (BSA) and related anti-money laundering (AML) regulations. Among the negative ramifications of a serious BSA violation is the inability to consummate an acquisition or execute a major business expansion. The poster child for this nightmare scenario is probably M&T Bank Corp., which acquired Hudson City Bancorp in July 2012 but was prevented by the Federal Reserve from completing the acquisition until November 2015 after the Fed uncovered deficiencies in M&T’s BSA program after the deal had been announced.

These and other issues will be topics of discussion at Bank Director’s 2018 The Reality of RegTech event, which takes place at the Nasdaq MarketSite April 18 in New York’s Times Square. Presentations focusing on regtech include an examination of some of the technologies impacting AML and know-your-customer (KYC) rules, and how artificial intelligence can be incorporated into a bank’s compliance program.

Compliance requirements like BSA, the Community Reinvestment Act, the Fair Lending Act, the Home Mortgage Disclosure Act and vendor management lend themselves well to the use of technology because they often involve large amounts of data and repetitive tasks, and the application of regtech solutions to these activities can lead to improvements in accuracy, efficiency and costs.

However, the promise of lower compliance costs may take longer to materialize since the initial investment in new technology, the time to train the compliance staff with the technology and for them to become proficient could actually raise a bank’s compliance costs in the short run. In fact, in Bank Director’s 2018 Risk Survey, 55 percent of the participating directors and senior bank executives say their compliance budget actually increased after the introduction of new technology, while 27 percent say it had no effect and just 5 percent said it decreased.

The compliance function is not the only area where technology is increasingly being used to improve bank performance. Advanced tools also help senior executive teams and boards of directors improve their management and oversight of a variety of risk exposures. The risk management challenge is not unlike the compliance challenge in that there are often large amounts of data to manage and analyze—particularly in an area like credit risk—and technology can both accelerate and improve data aggregation and analysis. The Reality of RegTech event will also offer presentations on the integration of solutions to manage credit risk, emerging enterprise risk management solutions, and advancements in operational risk management.

RegTech: A New Name for an Old Friend


regtech-3-20-18.pngWith all of the buzz around regtech, it’s easy to forget that banks have leveraged technology for compliance and reporting for decades. But thanks to recent developments in data architecture, artificial intelligence and more, regtech is on the rise, and it’s evolving into something a lot more sophisticated.

The definition of regtech is simple. According to New-York-based analytics firm CB Insights, regtech is “technology that addresses regulatory challenges and facilitates the delivery of compliance requirements.” Regtech can be as simple as using an Excel spreadsheet for financial reporting or as complex as using adaptive algorithms to monitor markets. By studying the evolution of regtech, banks can begin to decipher which technologies are aspirational and which ones are crucial to navigating today’s demanding regulatory regime.

Regtech has and is evolving in three key phases, according to the CFA Institute Research Foundation, a nonprofit research group in Charlottesville, Virginia. The first phase was focused on quantifying and monitoring credit and market risks. A powerful illustration of the forces driving this initial phase can be seen in the Basel II accord, which was published in 2004. Basel II focused on three pillars: minimum capital requirements, supervisory review by regulators and disclosure requirements meant to enhance market discipline.

Despite the enhanced regulatory requirements of Basel II, the global financial crisis of 2008 exposed serious deficiencies in capital requirements that spurred the second and current phase of regtech’s evolution. New anti-money laundering (AML) and Know Your Customer (KYC) laws have drastically increased compliance costs. According to Medici, a financial media company, financial institutions spend more than $70 billion annually on compliance. In addition, increased fines for banks, new capital requirements and stress testing have resulted in a heavily burdened banking system. With increased regulatory requirements, we have seen a corresponding increase in technology solutions poised to meet them. The following are a few key areas banks should explore:

  • Modeling and Forecasting: Even if your bank is not subject to the Dodd-Frank Act Stress Test (DFAST) or Comprehensive Capital Analysis and Review (CCAR), it should still be able to leverage modeling and forecasting tools to manage liquidity, meet CECL (current expected credit loss) accounting standards and monitor important trends.
  • KYC/AML: Regulatory requirements that require your financial institution to “know your customer” when you onboard them often rely heavily on paper-based processes and duplicative tasks. In addition, the Bank Secrecy Act requires banks to perform intense transaction monitoring to help prevent fraud. Both of these obligations can be curtailed through the use of technology, and solutions are available to digitize client onboarding and use AI to monitor transactions.
  • Monitoring Regulations: Rules and regulations are being promulgated and revised at a rapid pace. Instead of hiring a cadre of attorneys to keep up, banks can use regtech to monitor requirements and recommend actions to keep the bank in compliance.

Banking is, by necessity, a risk-averse industry. As such, taking a leap with companies that will touch bank data, gather information from back-office software or deploy AI can seem like a scary proposition. Some regtech providers on the marketplace today are new, but some were forged through the fires of the financial crisis, and others are time-tested vendors that have been around for decades. Whether a regtech partner is established or emerging, banks can (and should) hedge their bets by communicating with their regulators and forming a plan to monitor the new technology.

The CFA Institute Research Foundation posits that we are on the precipice of phase three in the evolution of regtech. This future state will be marked by a need for regulators to develop a means of processing the large amounts of data that regtech solutions generate. In addition, regtech has the potential to enable real-time monitoring. Both advancements will require a rethinking of the regulatory framework, and more openness between banks and regulators.

Despite the portmanteau (which is usually reserved for new or unfamiliar concepts), regtech is an old friend to the banking industry. Its future may hold the keys to a new conceptualization of what oversight means. For now, though, regtech represents an opportunity for banks to leverage technology for what it was intended to do: Save humans time, labor and money.

2018 Risk Survey: Technology’s Impact on Compliance


regtech-3-19-18.pngIn addition to better meeting the needs of consumers, technology’s promise often revolves around efficiency. Banks are clamoring to make the compliance function—a significant burden on the business that doesn’t directly drive revenue—less expensive. But the jury’s out on whether financial institutions are seeing greater profitability as a result of regtech solutions.

In Bank Director’s 2018 Risk Survey, 55 percent of directors, chief executive officers, chief risk officers and other senior executives of U.S. banks above $250 million in assets say that the introduction of technology to improve the compliance function has increased the bank’s compliance costs, forcing them to budget for higher expenses. Just 5 percent say that technology has decreased the compliance budget.

Regtech solutions to comply with the Bank Secrecy Act, vendor management and Know Your Customer rules are widely used, according to survey respondents.

Accounting and consulting firm Moss Adams LLP sponsored the 2018 Risk Survey, which was conducted in January 2018 and completed by 224 executives and board members. The survey examines the risk landscape for the banking industry, including cybersecurity, credit risk and the impact of rising interest rates.

Fifty-eight percent say that the fiscal year 2018 budget increased by less than 10 percent from the previous year, and 26 percent say the budget increased between 10 and 25 percent. Respondents report a median compliance budget in FY 2018 of $350,000.

Additional Findings

  • Cybersecurity remains a top risk concern, for 84 percent of executives and directors, followed by compliance risk (49 percent) and strategic risk (38 percent).
  • Respondents report that banks budgeted a median of $200,000 for cybersecurity expenses, including personnel and technology.
  • Seventy-one percent say their bank employs a full-time chief information security officer.
  • Sixty-nine percent say the bank has an adequate level of in-house expertise to address cybersecurity.
  • All respondents say that their bank has an incident response plan in place to address a cyber incident, but 37 percent are unsure if that plan is effective. Sixty-nine percent say the bank conducted a table top exercise—essentially, a simulated cyberattack—in 2017.
  • If the Federal Reserve’s Federal Open Market Committee raises interest rates significantly—defined in the survey as a rise of 1 to 3 points—45 percent expect to lose some deposits, but don’t believe this will significantly affect the bank.
  • If rates rise significantly, 45 percent say their bank will be able to reprice between 25 and 50 percent of the loan portfolio. Twenty-eight percent indicate that the bank will be able to reprice less than 25 percent of its loan portfolio.
  • One-quarter of respondents are concerned that the bank’s loan portfolio is overly concentrated in certain types of loans, with 71 percent of those respondents concerned about commercial real estate concentrations.

To view the full results to the survey, click here.

Avoiding Hot Water: Complying with Regulation O


regulation-3-14-18.pngIf a director wants to get into hot water—and their financial institution as well—violating Regulation O is a good place to start. It’s “one of the three things that makes bank examiners see red,” says Sanford Brown, a partner at the law firm Alston & Bird (the other two being the violation of lending limits and noncompliance with Regulation W, which governs transactions between a member bank and its affiliates). Designed to prevent insider abuse and ensure the safety and soundness of the bank through good lending practices, it’s a violation that examiners have zero tolerance for, and often results in a civil money penalty, adds Brown. It’s no wonder that bank directors often err on the side of caution when it comes to compliance with the rule.

Regulation O “governs any extension of credit made by a member bank to an executive officer, director or principal shareholder of the member bank, of any company of which the member bank is a subsidiary, and of any other subsidiary of that company.” Loans made to covered individuals, or businesses that these individuals have an interest in, must be made on par with what any other bank customer would receive, with the same terms and underwriting standards. The covered loans are subject to the bank’s legal lending limits, and the aggregate credit for all covered parties cannot exceed the bank’s unimpaired capital and unimpaired surplus. The extension of credit must be approved by the majority of the board, with the affected person abstaining from the discussion. Executive officers are limited further and may only receive credit to finance their child’s education, and to purchase or refinance a primary residence.

Essentially, Regulation O ensures that directors, officers and principal shareholders aren’t treating the institution like their own personal piggy bank. But directors also want to drive business to their bank. “Most directors want to know where [the] line is and stay away from it, but some believe that their job is to drive all the business they can to the bank, and that’s one of the things that great directors do,” says Brown. “But do it right.” Here are a few things to keep in mind to avoid compliance gaps in Regulation O.

Know Who All Are Affected
“With all the various corporate structures that banks can have, having a strong process for the identification of covered individuals is the No. 1 thing a bank can do to help the compliance process,” says Asaad Faquir, a director at RSK Compliance Solutions, a regulatory compliance consultant.

Under Regulation O, “executive officers” are defined as bank employees that participate, or are authorized to participate, in major policymaking functions—regardless of that person’s title within the organization. This generally includes the president, chairman of the board, cashier, secretary, treasurer and vice presidents. There can be some grey area as to which officers are covered under Regulation O, and some banks provide a broader definition than the rule requires to ensure compliance.

Principal shareholders are defined as those that own more than 10 percent of the organization. The definition of director, as a general rule, doesn’t include advisory directors.

An ill-defined population for Regulation O can raise the risk of noncompliance with the rule, says Tim Kosiek, a partner with the accounting and advisory firm Baker Tilly. The law is relatively black-and-white, as legislation goes, but the holdings of bank directors and principal shareholders can be complex, which heightens the compliance challenge. Banks should not only identify the officers, directors and principal shareholders covered by the law, but also family and business interests. The bank’s governing policy should define that process, and indicate how often it will be reviewed, he says.

Covered individuals are required to prepare an annual statement of related interests, and Brown says this is an area where a well-meaning director can easily trip up. “Full disclosure of every business relationship that the director has is critical. And it’s a pain—some of these people really do have their fingers in lots of pies,” he says. These interests should be communicated throughout the organization, to ensure that a loan officer doesn’t unintentionally conduct business as usual with a company that has a relationship with a covered individual.

If the terms of a covered loan are modified, the modification should go back through the bank’s Regulation O process, says Kosiek. And if a director acquires an interest in a company with a preexisting credit relationship with the bank, that should also be reviewed due to the director’s involvement.

Document Everything
A director, officer or principal shareholder must ensure that he or she is seen as having no influence on the process for the approval of a loan in which the covered individual has any interest. It’s a good practice for the affected director to just leave the boardroom before the related loan is discussed, says Faquir. “It protects the directors themselves, it protects the institution, and it’s a cleaner process.” He provides one example where a director explained to the board his own involvement in a loan, and then recused himself—with the good intention of being transparent about the process. From the point of view of the bank’s regulator, however, this was perceived as influencing the board in the loan’s approval. It’s best for the recusal to be immediate, so the regulators, upon reviewing the documentation, find no cause to believe that there was undue influence.

The law requires that each bank maintain records that identify covered parties, and document all extensions of credit to directors, principal shareholders and executive officers, to prove that the bank followed the letter of the law. “If you are to demonstrate compliance with the regulation, you have to make sure that your minutes reflect, No. 1, that the individual did not participate in the discussion” and that the rate and terms offered are the same as what would be offered to any other bank customer, says Scott Coleman, a partner at the law firm Ballard Spahr. Document the credit analysis to ensure the loan received the appropriate terms and underwriting standards. The board should also deliberate annually on who is covered by Regulation O, particularly which officers are involved in policymaking. Recordkeeping in this case can help address questions that come up in an exam, says Coleman.

Handle Violations Proactively
Mistakes can happen, so pay attention to quarterly loan reports. A director may find that a business she is involved in but doesn’t run daily received a loan from the bank. Own the error and make it right by disposing of the loan. Assuming it’s a good loan—which it should be—pay it off in full, at no loss to the bank, and move it to another (unconnected) bank. “That’s the easiest way to remedy it, and to show that there were systems in place to prevent these sorts of things from happening, [and] it just was an honest mistake,” says Brown.

Coleman recommends that banks self-report inadvertent infractions, as the penalties are likely to be less severe. “Contact [the regulator], indicate what was discovered, how the error was made, how the error was corrected and what the bank intends to do in the future to monitor Reg O,” he says.

More serious Regulation O violations can suggest to regulators that other abuses are occurring, and they may go looking for larger problems, adds Coleman. And a violation will almost certainly result in civil money penalties, for the covered individual as well as the board that approved the loan or the loan officer responsible for underwriting the loan. In extreme cases where a violation was seen as intentional, there can be criminal implications in addition to the fine, says Coleman, and regulators could seek the removal of that officer.

Brown believes that regulators under the current administration will focus more on safety and soundness and less on social issues, like consumer risk. “I think the current policymakers are going to focus on where banks make money and where banks lose money, and the real risk in the balance sheet is the loan portfolio,” he says. Banks tend to fail due to bad loans or fraud, so that could mean a heightened focus on Regulation O.

Protecting Elderly Customers from Financial Abuse


regulation-2-28-18.pngRegulators across the financial services industry remain keenly focused on protecting the interests of an aging population, especially where there may be signs of diminished cognitive capacity. Banks should consider various operational and compliance measures to guard against elder financial exploitation. While bank staff are on the front lines in protecting elderly customers, bank directors play a pivotal, top-down role in emphasizing a culture of vigilance, and in defining policy and strategy to combat elder financial fraud.

Be Aware of the Problem
Frontline personnel in branches and call centers are the first and last lines of defense to prevent elder financial exploitation. These personnel are the most likely to interact with elderly clients, many of whom are more inclined to conduct their financial transactions in a branch or over the phone, rather than electronically. Conducting periodic training that highlights real-world scenarios will help personnel recognize the signs of elder financial exploitation. An additional training element that may prove beneficial, but that often goes overlooked, is educating personnel on the psychological and emotional aspects of elder fraud. A customer’s diminished cognitive capacity or potential confusion, fear or embarrassment may be central to a perpetrator’s ability to prey on an elderly client.

Empower Employees to Speak Up
Identifying signs of potential financial exploitation of elderly clients is a great start. However, it is critical that personnel escalate suspicious activity through the proper channels within the bank. Personnel may be reluctant to follow through with escalating an event that is not blatantly fraudulent, perhaps out of fear of delaying a transaction or potentially embarrassing or even angering a client. However, speaking up is prudent, even when in doubt.

Develop the Three Ps
Banks should develop policies, processes and procedures that are easy to understand and follow.

Policies: Clearly define your organization’s views, guidelines and stated mission with regard to elder financial fraud.

Processes: Identify the mechanisms in place to effectively carry out the bank’s stated policies. This may include pre-set withdrawal limits (either daily or monthly), disbursement waiting periods or communications with external sources, such as a trusted contact person for the client, local adult protective services (APS) or law enforcement.

Procedures: Describe the precise steps that personnel should follow to execute the identified processes. What must a teller do in the event that a withdrawal request exceeds an established limit? Who does a call center representative contact in the event of suspicious activity, and what information should be provided? What information should personnel provide to a trusted contact person? What reports must be filed with authorities?

Report Suspected Exploitation
Banks are subject to various reporting requirements at the state and federal levels that relate to suspected elder financial fraud. National banks, state banks insured by the Federal Deposit Insurance Corp. and other financial institutions must file a suspicious activity report (SAR) with the Financial Crimes Enforcement Network (FinCEN) upon detection of a known or suspected crime involving a transaction. FinCEN has provided related guidance, and the electronic SAR form includes an “elder financial exploitation” category of suspicious activity. Several states’ laws and regulations also require that banks report suspected elder abuse to APS or law enforcement.

Banks may consider permitting clients to identify a “trusted contact person” that the bank may contact upon reasonable suspicion of potential exploitation. This is consistent with a March 2016 advisory from the Consumer Financial Protection Bureau (CFPB). Privacy concerns exist when disclosing customer information to a third party. However, the Gramm-Leach-Bliley Act (GLBA) permits disclosure of nonpublic personal information with customer consent. Regulation P under GLBA also grants an exception to the notice and opt-out requirements to protect against fraud or unauthorized transactions, or to comply with federal, state or local laws, rules and other applicable legal requirements. Additionally, 2013 Interagency Guidance “clarifies that reporting suspected financial abuse of older adults to appropriate local, state or federal agencies does not, in general, violate the privacy provisions of the GLBA or its implementing regulations.” A safe harbor from liability also exists for a bank that voluntarily discloses a possible violation of law or suspicious activity by filing a SAR. Bank personnel are also protected from liability in this situation.

Regulators at all levels of, and sectors within, the financial services industry continue to prioritize the interests of elderly customers, especially where there may be signs of diminished cognitive capacity. The banking community has gone to great lengths to support these efforts, and bank directors will continue to play an important role in defining internal policies and emphasizing the importance of vigilance in this area.

Nine Vendor Risk Management Tips for the Board


risk-management-7-19-17.png2017 is already proving to be a very difficult year for bank boards. While being on a board can be a rewarding experience, increasing regulatory pressures certainly don’t make the position and its corresponding responsibilities any easier.

One particular area of intense focus by the regulators is third-party risk management. Ultimately, the regulators have stated that it is your responsibility to ensure that you have a third-party risk program in place that addresses your vendors and the level of risk they pose.

Aside from potential enforcement actions and fines from the regulators, an inadequate third-party risk program can leave your institution ill-prepared or vulnerable to a host of issues. Worsening vendor financial performance could be an indicator of woes to come, such as poor customer service, bugs and issues with its system. Banks that auto-renew vendor contracts could miss a chance to re-negotiate old contracts.

Poor due diligence could mean partnering with a vendor that is damaging to your institution’s reputation. For example, if you don’t understand where customer complaints are coming from and why, regulators could question your ability to properly oversee and monitor your vendor’s performance and manage the corresponding impact on your customers.

While there will always be unforeseen issues you cannot avoid, having an effective third-party risk policy and program in place can ensure your full compliance with the guidance and help steer you to partnerships that will benefit your institution.

And, even when those unforeseen issues do occur, and they will, you’re better prepared to react in an effective and organized manner. To help, here are nine tips to keep you on the right path.

Nine Vendor Risk Management Tips for the Board

1. Read and understand the guidance from your primary regulator as it pertains to third-party risk management. There are key expectations clearly identified in the guidance and they should give you ample fodder for asking your institution’s senior management team pertinent questions.

2. Set expectations and tone from the top. Make sure that from senior management all the way to the front-line customer service representatives, everyone understands his or her responsibilities when it comes to compliance with the rules, as well as how your organization wants to handle vendor-risk management.

3. Have your vendor risk management program thoroughly reviewed for any possible deficiencies and focus on areas that are often overlooked, such as fourth-party risk management or reviewing third parties’ procedures for complaint management.

4. Automate your third-party risk program. Most institutions have already taken the steps away from Excel and other spreadsheet programs in favor of ones that help to manage a complicated network of vendors and regulatory expectations.

5. Involve your internal audit department, compliance team and counsel in evaluating the effectiveness of the vendor management program.

6. Strongly consider making vendor management directly accountable to the board or the most senior risk committee at your institution. Firmly establish its independence from the various lines of business and ensure the needs of vendor management do not fall on deaf ears. Ensure that any issues raised, whether in the course of normal business or during examinations, are promptly and thoroughly addressed.

7. Invite the head of your vendor management program to report regularly at board meetings. A standard set of reports is adequate, but make sure that any concerns or significant issues are clearly called out and reflected in the minutes of the meetings.

8. Ensure those involved in vendor management have adequate resources, such as staffing and a high enough budget, as well as ample training and experience to do the job well. Seek outside independent expertise or outsource tasks where needed, particularly for highly technical items such as business continuity plan reviews for SSAE 18 analysis, attestation standards issued by the American Institute of CPAs.

9. Ask pertinent questions and drill down when anything seems amiss. Use industry news, new regulations and enforcement actions as opportunities to view your own vendor management program through that lens and see if there are areas of concern that should be addressed.

The world of vendor management isn’t easy and your job as a director is incredibly complex and overwhelming at times. Fortunately, done well, vendor risk management can also be a significant strategic advantage, allowing you to do business with well-managed companies in a compliant and cost-efficient manner.

Resources
Venminder Library
CFPB guidance 2016-02
FDIC FIL 44 2008
OCC Bulletin 2013 29
OCC Bulletin 2017 21
FFIEC Appendix J

Filling Fraud Detection Gaps



Investment in fraud detection can be a competitive advantage, especially as real-time payments initiatives create new opportunities—and threats—for financial institutions. Luis Rojas of Bottomline Technologies explains where and how to address gaps in fraud detection, and how bank boards should examine the true costs of fraud.

Outlooks for Payments Fraud

  • How Banks Should Address Fraud Gaps
  • Dealing with Legacy Systems
  • What Boards Need to Understand

Facing Up to the Financial Technology Challenge


technology-5-18-17.pngOf all the most difficult issues that bank boards must deal with, technology may be at the top of the list. Banks have long been reliant on technology (think IBM mainframes and ATMs) to run their operations, but in recent years technology has become a primary driver of retail and small business banking strategy. This change can be tied to the growing ubiquity of digital commerce, the integration of the mobile phone into the fabric of our everyday lives, the birth of social media and its adoption as an important business and commercial channel, and the ascendency of the millennial cohort as a major factor in our economy. Technology is everywhere, it’s in everything, and that trend is only going to become more pronounced in the future.

Why do bank directors as a group struggle so much with technology? Are they just a bunch of Luddites? In all fairness, most directors are not career technologists and therefore bring only limited professional knowledge of technology to the task of board governance. But demographics are clearly a factor as well. The average age for most bank boards ranges between the early 60s to the mid-70s, and baby boomers often find themselves overwhelmed by all of the technology-driven changes they see occurring around them. And while there may be an understandable tendency to resist adapting to new technologies in their personal lives, bank directors simply must understand how technology is changing their industry, and how it is impacting their institutions.

Christa Steele is the former president and CEO of Mechanics Bank, a $3.4 billion asset bank in Richmond, California, and more recently the founder and CEO of Boardroom Consulting LLC in San Francisco, where she works closely with bank CEOs and their boards. Steele doesn’t mince words—directors must educate themselves about the changes in financial technology that are transforming their industry—and she offers some suggestions about how this can be done. The following interview has been edited for length and clarity.

BD: Why do most directors at community banks struggle so much with the topic of technology?
Scope of knowledge and lack of diversity in the boardroom. This diversity does not stop at gender, age and ethnicity. Typically, community bank boardrooms are filled with childhood friends and family. This served a purpose early on, especially when those banks were formed. However, as a bank grows and evolves, it’s important to bring in new perspectives. It’s no secret that the majority of community bank revenue models are derived from the net interest margin. Fee revenue is virtually obsolete relative to the overall operating income for most of these institutions.

So how does a bank make up for this shortfall of diversified revenue streams? Management teams and their bank boards need to take a serious look at their digital strategy and internal infrastructure. If they do not assimilate to the changes occurring in what I call this vortex of technology, they’re going to get left behind.

Fixing this starts with succession planning for the institution. We have a lot of community banks where the management teams are close to or at retirement age. Many of these leaders do not want to make necessary changes because of the threat of internal disruption, time commitment, costs and maintaining a short-term horizon. Boards are similar. Most bank boards are tired. I feel boards in general have done an exceptional job getting their arms around compliance and safety and soundness issues in the last 10 years. However, they’ve taken their eye off of the ball when it comes to marketing, digital strategy and technology initiatives. I remember hearing about a Bank Director survey a few years ago in which board members were polled and asked how many of them used their cell phones to transact. It was staggering to learn that nearly half of the respondents didn’t use their bank’s mobile channel. How are these board members supposed to understand technology trends and its impact on the financial sector and their own banks?

BD: What can directors do to become more comfortable with technology?
Get educated beyond compliance training. Attend Bank Director conferences, ask questions, talk to folks involved in financial technology, follow automation. Pay attention to what’s trending. Get connected to social media. Join LinkedIn and gain perspective on what’s going on in the United States and abroad pertaining to technology in the financial sector. See what other people are doing outside of your own market.

Change up the boardroom. Board appointment should be strategic in nature and no longer be about bringing your childhood friend or local jeweler down the street on your board. Bring in a fresh perspective. Evaluate board terms and board limits. A board that is a strategic asset to its bank should consist of expertise in marketing, cybersecurity, digital/e-commerce, financial and risk. Each of these appointments should be from outside your institution. Do not be opposed to bringing in someone younger in their 30s or 40s. By bringing in somebody younger, you bring in someone who is engaged in social media. Social media is where it’s at. We have banks that are interacting and partnering with Facebook. Bank of America just started letting customers transact through a universal login with Facebook where their customers can pay their mortgage payments, they can transfer money between accounts, they can do a variety of things through Facebook. The remainder of your director appointments should be former or current CEOs who provide a macro-level mindset to the ongoing challenges facing the institution.

BD: What are some of the barriers to innovation, particularly in the community bank space, around financial technology?
Lack of understanding the competitive landscape (it’s no longer just the community bank down the street), time, cost and willingness to embark upon a digital transformation. It’s a lot of heavy lifting for management, and oftentimes the board does not understand the complexities and costs associated with this endeavor. Many banks do not fully understand the technology contracts they have in place with their core providers and other technology vendors. Those contracts have them locked in for a duration of time, typically three to seven years. That is the number one barrier to making any changes. It is costly to exit existing contracts.

Many community banks are under utilizing the capability of their existing vendors. At Mechanics Bank, we went through and evaluated every vendor contract. We cut $3.5 million dollars out of our budget in a single calendar year through renegotiating, exiting and forming new relationships with vendors. We found we were paying for services we did not need and paying for services we weren’t using but should be using. This is the first step in embarking upon a new digital strategy.

I highly encourage bank boards to have a refresher course on how a bank operates using a bank simulation model. Each board member picks a role of CEO, CFO, senior credit officer, etc. and has to manage a bank’s funding, pricing, growth, capital requirements, loan loss provisions and so on. This is not only a great team-building exercise and will provide for a greater appreciation of the day-to-day management team of the bank, it will also set a solid foundation for discussing what is needed in the way of technology innovation to run the bank going forward.

Evaluate what you have, get educated on what’s trending, then decide what you need. Do not be the retailer that gets eaten alive by Amazon Prime. Be proactive instead of reactive to the changing needs of your customer base.

BD: Are the major cores an impediment to innovation?
I wouldn’t say impediment. There is no doubt that the big three core technology providers have a stronghold. But they are looking to innovate as well. Their biggest attribute is size and scale. Their biggest downfall is they are a slow-moving ship coming in and out of port. The long and the short of it is, you’re not going to get rid of your core provider. I feel it’s become increasingly important to be better partners with your core. When banks push for some kind of innovation, the cores typically say they’re planning on doing that two years from now. That is when the banks get irritated and push for needing it now but do not want to have to pay for a custom project. That is the frustrating part for the bankers, but the bankers need to help the core understand their needs. I am a firm believer in more outsourcing and in banks becoming nimble. This takes time but is achievable and necessary in this day and age.

BD: When we think about the technology challenges that banks face today and how the board should engage in finding solutions, does it really boil down to a people issue?
Yes, it is that simple. There are a lot of community banks that just refuse to think that financial technology innovation is impacting them. CEOs and directors need to have an open mind and be willing to learn something new. If you understand your digital strategy, you understand your technology strategy and you understand what’s going on around you—guess what, all of the sudden your board is engaged, and it’s going to make your company perform better.