Fog of War: Serving on a Bank Board

fog.jpg“I know what many of you are thinking. You’re thinking, ‘This man is duplicitous. You’re thinking that he has held things close to his chest. You’re thinking that he did not respond fully to the desires and wishes of the American people. And I want to tell you ‘you’re wrong.’”
–Robert S. McNamara in “The Fog of War,” a documentary.

Defense Secretary Robert McNamara made a lot of unfortunate decisions during the Vietnam War, depicted in the 2003 documentary, “The Fog of War.” Some of the battles that banks face are obviously not as horrifying as an actual war. But they do involve a great deal of money. And any decisions involving a great deal of money require a great deal of care. Banks and their customers are under increasing attack by highly sophisticated cyber criminals successfully stealing confidential information and hundreds of millions or even billions of dollars. (There is no comprehensive official number or record keeping.) Bank boards are trying to figure out how to respond and what to do to provide proper oversight of their security apparatus.

“In terms of cyber crime, a lot of us think it’s going to get worse before it gets better,” said Ken Jones, director of fraud risk management at the consulting firm KPMG, speaking to an audience of about 300 people at Bank Director’s Bank Audit & Risk Committees Conference in Chicago recently.  “The (community banks) here are absolutely a focus of the international cyber criminals.”

While some vendors may have a personal interest in terrifying you, it was clear to me that many bank directors in the audience are very concerned about cyber attacks and whether their banks are adequately addressing the problem. Is your bank staff staying abreast of threats, using security software the way it was intended and keeping a keen eye on your IT vendors? Other threats that could prove to be very costly in the years ahead include:

Interest rate risk. Many banks are extending credit at a fixed rate of interest for longer terms in an effort to compete and generate much-needed returns. This will be a problem for some of them when interest rates rise and low cost deposits start fleeing for higher rates elsewhere. You could assume the asset/liability equation will equal out, but will it? Steve Hovde, president and CEO of the investment bank Hovde Group in Chicago, is worried about financial institutions taking on too much interest rate risk, as he has seen credit unions offer 10- or 15-year fixed-rate loans at 3.25 percent interest. “I’m seeing borrowers get better deals with good credit quality than they have ever gotten in history,” he said at the conference.

Reputation risk. In the age of social media, anyone can and does publicize to hundreds of friends any complaint against a bank. Cyber attacks, such as the one that befell Target Corp., can be devastating and cost the CEO his or her job. Rhonda Barnat, managing director of The Abernathy MacGregor Group Inc., says it’s important not to give TV news an incentive to do a story, such as telling a reporter that your employee’s laptop was stolen at a McDonald’s with sensitive customer information, prompting a visit by the camera crew to the McDonald’s. As of now, there is no requirement to publicly disclose the number of records stolen, so public relations firms such as The Abernathy MacGregor Group urge circumspection. Disclosing a theft, but not disclosing how many customer records were stolen, could keep you off the front page of the local newspaper. Focus on the people who matter most: your customers, investors and possibly, your regulators. They want to know how you are going to fix the problem.

Compliance risk. Regulators are increasingly breathing down the necks of bank directors, wanting evidence that the board is actively engaged and challenging management. The official minutes need to reflect this demand, without necessarily going overboard with 25 pages of detailed discussion, for example. Local regulators are increasingly deferring questions to Washington, D.C., where they can get stuck in limbo. When regulators do give guidance, it is often only verbal rather than written and can cross the line into making business decisions for the bank, said Robert Fleetwood, a partner at Barack Ferrazzano in Chicago. In such an environment, it’s important to have good relations with your regulators and to keep them informed.

*Thanks to Wintrust Financial Corp.’s audit committee Chairman Ingrid Stafford for giving me an idea for the title of this article, if not the actual article.

Three Strategic Imperatives: What Your Bank Needs to Know

4-28-14-GT.pngDespite continued regulatory challenges and a sluggish economic environment, most financial institutions have seen their situations improve in recent months. How will banks keep the momentum going? We outline three areas to focus on.

Priority #1: Increasing Capital
Capital drives so much right now from the regulators’ perspective. Excluding statutory requirements, capital is the regulators’ be-all and end-all.

So how much is enough? In recent stress tests of the banking system, the results show that all but one of the top 30 banks—Salt Lake City, Utah-based Zions Bancorp.—would have ample capital to survive the exceptionally poor economic conditions and continue to lend. However, regulators failed four other banks based on qualitative concerns about their capital plans. The latest Comprehensive Capital Analysis and Review took some industry observers by surprise, as the Federal Reserve objected to five of the 30 participants’ capital plans, and approved another two banks only after they resubmitted.

The regulatory scrutiny clearly remains intense, and banks should not expect this level of oversight to ease anytime soon. To stay ahead of the curve, banks should examine their capital levels and ask a number of questions, including:

  • How will my capital ratios be impacted by changes in risk weights?
  • How will I respond to those changes?
  • Do I need to change my product mix or my underwriting? Should I even consider a strategy where the bank’s assets shrink in the short term?
  • Do I need to adjust my risk tolerance in lending?
  • Should I consider outsourcing certain functions or decrease operating expenses?

At a minimum, banks will need to integrate into their capital planning and strategic planning processes an analysis of where they stand relative to Basel III requirements. This will ensure they are well-positioned to address any capital needs.

Priority #2: Managing Credit Quality
The continued low-rate environment has compressed the net interest margin for most institutions. As a result, bank executives are turning to new, expanded or modified product offerings and service lines to improve performance.

As with any new opportunity, it’s critical to make sure that the risks are appropriately assessed and priced. New products and services may have a totally different risk profile than the bank’s traditional fare—and the bank may be ill-equipped to manage the risks of the new products and services. Banks may lack the necessary controls, risk-management processes, expertise and appropriate information systems needed to effectively monitor and manage these new products and services.

As banks look for new sources of income, it is imperative that they demonstrate the ability to manage the associated risks. Banks should not only be extremely diligent about following their underwriting standards, but also should be looking for new ways to shore them up.

A well-managed plan for expansion into new products, services or markets will include the following:

  1. Clearly communicate the growth strategy to regulators and the board.
  2. Develop risk plans that address risks particular to any new areas.
  3. Ensure sustained board and senior management oversight.
  4. Manage and monitor credit risk.
  5. Clearly document lending policies and procedures.
  6. Confirm that diversification/concentration management and controls align with established risk tolerances.
  7. Undertake stress testing and risk monitoring.
  8. Strengthen underwriting and documentation standards.
  9. Confirm that adequate loan review programs are separate from credit extending units/personnel.

Priority #3: Managing Interest Rate Risk
Interest rates remain low, compressing net interest margins and creating fierce competition among banks for higher yielding assets. Many banks are now turning to aggressive interest-rate strategies, such as extending asset or loan maturities or increasing holdings of riskier investments. However the OCC cautions that when interest rates increase, “banks that reached for yield could face significant earnings pressure, possibly to the point of capital erosion.”

While managing interest rate risk is highly complex, doing the following will help ensure a well-managed program:

  1. Be prepared to demonstrate to regulators your interest-rate-risk management plans and to support key assumptions used in modeling.
  2. Maintain documentation of how the bank considered the results of the models.
  3. Establish risk controls and limits.
  4. Monitor and report risk.
  5. Ensure adequacy of internal controls and audit.
  6. Consider whether to add certain expertise to your board or management team.
  7. Banks that are not already stress testing should begin to do so.
  8. For public banks, evaluate whether your interest rate risk disclosures appropriately tell your story.

This article is adapted from Grant Thornton’s 2014 Banking Report.

Interest Rate Risk: Are Your Assumptions Accurate?

4-16-14-Moss-Adams.pngModel assumptions have gained a great deal of importance in the banking industry. Financial institutions are using them more and more to generate output that summarizes the risks embedded in their balance sheet. But are these models always accurate? The answer, at least from banking regulators, is increasingly no.

For example, many interest rate risk (IRR) models continue to show that earnings will improve as a result of an increase in interest rates. However, a December 2012 presentation by the San Francisco Federal Reserve indicates that deposit assumptions, such as decay rates, beta-adjusted gaps (the relative repricing rate assumed for deposits versus a benchmark rate), account balances and deposit mix have a significant impact on IRR measurements. As a result, the Fed contends that the current IRR environment may cause model results to provide misleading data. In particular, the Fed cited an increase in non-maturity deposits as a percentage of total deposits.

The Fed noted that one of the main reasons for the increase in non-maturity deposits since midway through the recession is the drop in the federal funds rate. It believes that customers have parked funds over the past several years in non-maturity deposits since there’s been little difference in earnings between non-maturity and time deposits. This shift has caused non-maturity deposits to increase to 83 percent of total deposits as of December 31, 2012, from an average of 62 percent from 1985 to 2008—an increase of 33 percent.

So, for example, if your institution’s IRR model deposit mix assumption is based on current or recent historical deposit characteristics, there could be a surprise waiting for you, since it isn’t likely that interest margins on your deposit base will remain the same as interest rates rise. More likely, most institutions’ deposit mix will return to average pre-recession levels.

Changes to basic deposit assumptions can have a significant impact on earnings. For example, if interest rates rise by 200 basis points (bps), reallocation of the deposits mix to pre-recession levels may negatively impact earnings at risk (EAR) by up to 400 bps. EAR is a measure of the change in earnings based on changes in interest rates. Let’s say you’re currently reporting a positive exposure to EAR of 5.8 percent using today’s deposit mix. By adjusting the deposit mix to pre-recession levels, using the same 200 bps increase in interest rates, you’d see your EAR drop to a positive exposure of 1.8 percent.

Similarly, changing account balance assumptions to assume a decline in non–interest bearing deposits or changing deposit decay and beta-adjusted gap assumptions could easily take a positive EAR result and make it negative.

So what can you do to help your institution address these risks and regulators’ concerns?

  1. Reexamine key IRR assumptions. Don’t focus only on deposit assumptions, but regularly evaluate all assumptions feeding your IRR. This exercise most likely will result in an adjustment of your model assumptions and drive a deeper understanding of the true risks embedded in your balance sheet.
  2. Perform stress testing or scenario testing of your assumptions periodically. Determine which have the greatest potential impact on your institution, and spend more time ensuring those assumptions are valid.
  3. Perform detailed, comprehensive back testing. The best way to determine whether the assumptions used in your IRR model are reasonable is to test actual results based on prior assumptions. Analysis will help you identify the impact of shifts in transactional patterns and the resulting impact on the balance sheet. Although you may not be able to predict these types of shifts, by completing this testing you’ll be able to modify assumptions and update your model, resulting in more accurate, meaningful reporting.
  4. Revisit scenario testing. What changes are occurring in the market that could affect your institution negatively? What’s the likelihood they’ll occur and the degree of impact on your institution? Is your institution willing to assume that level of risk?
  5. Document your evaluation. Your regulator conducts analysis in these areas to evaluate your management of IRR. Thoroughly documenting the basis of your assumptions will aid them in understanding how you mitigate risk as an organization.

Two Risks of BOLI That Boards Should Understand

Over the past 30 years, bank-owned life insurance (BOLI) has proven to be a powerful asset for banks, providing strong yields that help offset the ever-rising cost of benefits. Over 3,840 banks reported BOLI holdings of almost $144 billion in the third quarter of 2013, and the pace of BOLI purchases remains robust.

BOLI Holdings Reported by Banks
Asset Size # of Banks # and % Reporting BOLI Assets Tier 1 Capital Reported BOLI CSV % of BOLI to Assets % of BOLI to Capital
< $100M 2,118 770
$48,132 $5,284 $933 1.94% 17.65%
$100M-$300M 2,622 1,499
$277,174 $29,007 $4,852 1.75% 16.73%
$300M-$500M 802 551
$212,624 $21,736 $3,679 1.73% 16.92%
$500M-$1B 677 481
$335,637 $34,358 $5,593 1.67% 16.28%
$1B-$5B 496 394
$782,354 $78,152 $11,827 1.51% 15.13%
$5B-$10B 67 47
$341,573 $32,716 $4,746 1.39% 14.51%
> $10B 106 73
$10,407,383 $865,119 $109,997 1.06% 12.71%
Total 6,888 3,815
$12,404,876 $1,066,373 $141,627 1.14% 13.28%

* Source: Call Reports as of 9/30/2013. Values reported in (000,000s).

BOLI is an investment tool and insurance product on the lives of bank officers which allows for enhanced tax-preferred earnings for the bank.

Interagency guidance on BOLI requires thorough pre-purchase analysis and ongoing risk management of BOLI. While regulators have identified eight risks inherent in BOLI, two of them warrant greater attention, credit risk and interest rate risk. 

Credit risk arises from a carrier’s obligation to pay benefits upon death, or cash surrender value (CSV) upon surrender. In loan terms, will the carrier repay when the “loan” becomes due? A life carrier default, where payment of life insurance is truly in question, can only occur after “busting through” a safeguard framework with multiple layers of policy owner protection. 

The potential 30- to 40-year holding period for a BOLI policy is one of the primary reasons why the carriers that actively offer BOLI are rated in the top 10 percent of their industry—discerning bank purchasers wouldn’t have it any other way. Because of the long-standing framework and history for policy owner protection, we believe there is nominal difference in credit risk among most BOLI carriers.

At a minimum, banks have reviewed credit ratings; some even do a cursory review of carrier financial statements. While that suffices as an initial filter, in the post-Dodd-Frank Act world, banks should no longer rely solely on credit rating agencies to assess the quality of BOLI carriers. A trusted BOLI vendor can help banks get a thorough pre-purchase and monitoring process in place. 

Interest rate risk is the risk to earnings from movements in market rates. It is a function of the maturities of the assets in the carrier’s investment portfolio. Unlike a bank’s bond portfolio, general account and hybrid account BOLI does NOT expose a bank to mark-to-market risk when rates rise. That’s because the insurance company owns the assets on its books and offers a set rate of return to the bank. (Carriers offer separate account BOLI as well, where banks are able to choose the underlying investment portfolio. However, separate accounts can expose the bank to mark-to-market risk.) 

Arriving at BOLI yield is fairly simple: Carriers invest banks’ premiums and retain a portion of their return as compensation for their investment management, resulting in a gross crediting rate. From the gross crediting rate, carriers subtract cost of insurance (COI) charges to compensate them for insurance risk. The end result is the policy’s net yield.

It’s important to note that the potential holding period for BOLI (30-40 years) is NOT its interest rate risk. Carrier portfolios are typically 6-10 years in average duration. While this longer duration is how BOLI provides greater yield potential, in a rising rate environment, it may create a temporary disconnect in expected return. BOLI crediting rates will lag market trends, and it’s important to review BOLI yield projections in that context.

When reviewing BOLI projections, focus on gross crediting rate and COI charges. No carrier can consistently credit more than it can earn on its assets, just as a bank can’t pay more on its deposits than its cost of funds. Ask for and review the carrier’s history of net yield on invested assets. Carriers have had relatively similar investment yields over the past five years. The question to ask is how reasonable is the gross crediting rate given the carrier’s recent actual history?

COI charges are very competitive for most carriers. However, there are clear outliers with higher COIs, suggesting that those carriers must credit a higher rate to overcome their higher COI charges. To our knowledge, no carrier has raised COI charges on existing BOLI, so it is reasonable to expect projected COIs to remain stable. 

In addition to credit risk and interest rate risk, boards should thoroughly evaluate the additional risks of BOLI. The key to a positive experience with BOLI is to fully understand those risks and have reasonable expectations explained to your board by a trusted BOLI advisor. BOLI has a competitive yield, no mark-to-market risk (except for separate account BOLI), very strong credit risk, and gross crediting rates that should adjust with the general market, albeit with a lag. When presented accurately, fully understood and implemented properly, BOLI is an attractive asset for banks to own.

Scott Richardson is a registered representative of Independent Capital Company, Inc., Parma, Ohio.  IZALE Financial Group is not affiliated with Independent Capital Company, Inc.

Are You Due For an Annual Interest Rate Risk Check-Up?

11-6-13-wipfli.pngThe Federal Deposit Insurance Corp. (FDIC) issued a recent letter to financial institutions saying the agency is increasingly concerned that some banks and thrifts are not sufficiently prepared for volatility or a sustained rise in interest rates. The FDIC is reemphasizing the need for oversight by the board and management, policy frameworks and prudent exposure limits, effective measurement and monitoring of interest rate risk, and risk mitigation strategies. But it also has introduced some new statements in its latest letter worth noting:

“…institutions with a decidedly liability-sensitive position could experience declines in net interest income and potential deposit run-off in a rising rate environment. Moreover, rate sensitive liabilities may re-price faster than earning assets as coupons on variable rate loans and investments remain below their floor.”

“If interest rates were to rise markedly, institutions that have concentrated bond holdings in long-duration issues could experience severe depreciation of a magnitude that could be material relative to their capital position. Institutions that rely primarily on a long-duration fixed-income portfolio for liquidity could have difficulty meeting short-term cash needs if other marketable assets or funding sources are not readily available.”

“…significant, unmitigated levels of interest rate or market risk can lead to losses and liquidity constraints when prevailing rates change significantly.”

Long duration assets, such as step-up bonds or fixed-rate mortgages, will likely be a focus of the FDIC during its next exam of your institution and should be an important concern for the asset liability committee (ALCO). Due to historically low interest rates, bankers have been forced to extend the duration of the investment and loan portfolio in an effort to increase margins; at the same time, depositors are favoring shorter term certificates of depositors or money market funds as they anticipate rising rates. Some banks have a high risk due to extending cash flow on the asset side and not matching the re-pricing on the liabilities side. This has also manifested in significant unrealized losses on securities available for sale. While these unrealized losses do not affect regulatory capital, they do affect GAAP (Generally Accepted Accounting Practices) capital, which can affect market perception and the overall health of the institution should liquidity needs emerge.

The board has the ultimate responsibility for the risks undertaken by its institution. In response to the most recent letter, it is imperative that the foundations listed below are continually and proactively addressed and revisited by the board and management.

  1. Has the board approved the interest rate risk policy in the last twelve months and evaluated the bank’s policy limits? We often hear that the limits set within a policy are the “industry standards.” The policy limits should reflect the institution’s risk appetite that is commensurate with the institution’s strategic plan and capital position.
  2. Have the internal controls of the model been reviewed by an independent third party? Although management may seem to understand the asset-liability committee process and the model it is working with, it is crucial that each institution have its model independently validated. Key assumptions such as prepayment speeds (the change in the behavior of long term assets due to a change in rates, and decay (the speed with which the accounts “decay” or roll off your balance sheet) can alter the model results in ways to make the institution look like it is within policy or vice versa.
  3. Is the board receiving appropriate reporting from management? At minimum, the board should receive a quarterly interest rate risk analysis. The board should get analysis more often if it is managing risk outside policy limits. The income simulations should have a minimum horizon of two years, preferably with a static balance sheet rather than a dynamic balance sheet. The immediate interest rate shocks should include changes in rates of at least 300 and 400 basis points, nonparallel rate shocks (shocks of the yield curve using twists or changing slopes) and account for basis risk and yield curve risk. The market value equity simulation should also include changes in rates of greater magnitude and include nonparallel rate shocks.
  4. Has the board and management considered alternative risk measurement and monitoring tools? Analyzing the bank’s interest rate risk position using alternative methods can provide varying pictures of how well the bank is postured in the current and expected interest rate cycles. In addition to the static interest rate risk and market value of equity calculations, the Asset Liability Committee should consider a variety of modeling techniques such as gap Analysis (the difference between a bank’s rate sensitive assets and rate sensitive liabilities distributed by maturity), stress testing and earnings simulations in a variety of interest rate scenarios.

Economists are still predicting rates will remain fairly flat for the near term; however, rates are unlikely to remain low forever. The time is now to evaluate the bank’s interest rate risk appetite and act if the current position puts the bank’s capital position at risk.