Curious About Cannabis

Written by

As the smoke clears around banking the marijuana industry, more banks are exploring its potential to drive deposits and revenue, according to Bank Director’s 2023 Risk Survey. 

While few banks actively count marijuana businesses as customers, 43% of the bank executives and board members responding to Bank Director’s survey in January indicated their bank had discussed working with those businesses. That interest represents an uptick compared to the survey in 2021, when 34% said their bank’s leadership had discussed potential opportunities or risks. 

Though it is still illegal on a federal level, marijuana has been legalized for recreational and medical use in 22 states and Washington, D.C. and approved for medical use only in 16 states, according to an analysis by CNN. In Bank Director’s survey, 36% said their bank was headquartered in a state where marijuana was fully legal; another 35% said marijuana was approved for medicinal use only. 

Expanding legalization plays a hand in banks’ growing interest in providing financial services to this industry, as does its growth outlook. The cannabis data firm BDSA projects legal cannabis sales in the U.S. to grow at a compound annual growth rate of roughly 11%, increasing from $26.2 billion in 2022 to $44.6 billion in 2027. 

“You look at a typical community bank board, and you have lots of entrepreneurs and real estate developers,” says Tony Repanich, CEO of Shield Compliance, a compliance platform focused on helping financial institutions bank cannabis. “They are seeing what’s going on in the industry, and they’re asking management, ‘Should we be considering this?’” 

As the cannabis industry matures and regulatory expectations become more clear, best practices have evolved around working with those and other high-risk businesses. Banks will need to invest more in staffing, expertise and technology, and enhance existing policies and procedures, says Joseph Silvia, an attorney at Dickinson Wright.  

“A lot of the risk that banks are looking at is much less about cannabis and more about the fundamental compliance, BSA [Bank Secrecy Act] or risk management components,” Silvia says. “It’s less that cannabis is high risk and more that we need to have these systems, reporting, compliance staff expertise, and so forth. It doesn’t really matter whether it’s cannabis or money services businesses, money transmitters or virtual currency.” 

In 2014, the Financial Crimes Enforcement Network (FinCEN) issued guidance intended to clarify customer due diligence and reporting requirements for banks interested in serving marijuana-related businesses. But as more financial institutions have begun banking cannabis businesses and successfully passing regulatory examination cycles, that’s provided an added level of assurance that bankers who are meeting all of their reporting requirements are not going to get dinged simply for banking a high-risk business, says Paul Dunford, cofounder and vice president of knowledge at Green Check Verified, a technology provider focused on the cannabis sector.  

“In the world that we live in, cannabis banking is based on precedent,” Dunford says. “Every year you see more and more financial institutions willing to express an interest because it’s been happening for a while. We hear stories about people banking cannabis, and people are not getting their charters revoked. The horror stories are not coming true.” 

Broadly speaking, banks serving the cannabis industry tend to stick to offering deposit products to those customers. Far fewer have gotten comfortable actually lending to cannabis businesses, in large part because the industry lacks accepted underwriting standards and banks cannot collateralize a controlled substance, Dunford says. But those banks that do lend to cannabis businesses can usually command higher interest rates on the loans.  

“We see good fee income associated with these accounts,” Repanich says, noting that mortgage income has declined as interest rates have increased, and non-sufficient funds and overdraft fees are under pressure by regulators like the Consumer Financial Protection Bureau. “Some of our banks are providing loan facilities to the industry, and they’re usually getting a better than average yield.”

Directors and executives contemplating whether cannabis might complement their bank’s business model should weigh the risks and benefits, and clearly define the geographic area they’re willing to serve, Silvia says. They should also consider exactly what services their bank will and will not provide; some banks are not comfortable offering wire services, for example. It’s also important to get buy-in from the compliance staff who would be handling the day-to-day operations associated with those accounts.  

“It’s very difficult to dip your toe in one of these higher risk areas,” says Silvia. “You either jump in head first, or you stay out because the cost of putting together the risk management is not insubstantial.”  

Does Your Board Need More Cyber Expertise?

Written by

Despite continued and growing anxiety around cybersecurity, boards have long struggled to understand the intricacies of the bank’s security efforts. Instead, they have often left it to the technology and security experts within the institution. But with increased scrutiny from regulators, a shift toward proactive oversight at the board level may be in the works.

According to Bank Director’s 2023 Risk Survey, 89% of bank executives and board members reported in January that their institution conducted a cybersecurity assessment in 2021-22. In response to that assessment, 46% said that the board had increased or planned to increase its oversight of cybersecurity moving forward.

Ideally, that could have the board taking an active oversight role by asking pointed questions about the threats facing the organization and how it would respond in various scenarios. In order to do that, boards could look to add cybersecurity experts to their membership.

For public banks, a requirement to make known the cybersecurity expertise on the board is expected to go into effect soon. The Securities and Exchange Commission announced last year that public companies would need to disclose which board members have cybersecurity expertise, with details about the director’s prior work experience and relevant background information, such as certifications or other experience. The SEC adds that cyber expertise on the board doesn’t decrease the responsibilities or liabilities of the remaining directors. The proposed rules, which also include expectations around disclosing cyber incidents, were first expected to go into effect in April 2023.

The demand for cyber expertise in the boardroom “will eventually trickle down to all community banks,” predicts Joe Oleksak, a partner focused on cybersecurity at the business advisory firm Plante Moran. “Very few [people] have that very specific cybersecurity experience,” he continues. “It’s often confused with technology experience.”

Last year, Bank Director’s 2022 Governance Best Practices Survey found 72% of directors and CEOs indicating a need for more board-level training about cybersecurity. The previous year, 45% reported that at least one board member had cyber expertise.

Often, bank boards seek cyber expertise by adding new directors with that particular skill set; other times, a board member may take ownership over the space and learn how to oversee it. Both approaches come with significant hurdles. An existing board member may not have the extra time required to become the board’s de facto cyber expert. An in-demand outsider may not be willing to financially commit to the bank; board members are typically subject to ownership requirements.

Boards rely on information from the bank’s executives as part of the deliberation process. It’s common for directors to trust the chief technology officer, chief security officer or the chief information security officer to provide updates on cyber threats and tactics. But understanding the incentives and expertise of the executive would ensure that directors understand the value of the information they receive, says Craig Sanders, a partner of the accounting firm Moss Adams, which sponsored the Risk Survey.

Boards leaning on their CSO, for instance, need to understand that these officers solely focus on broad defense of the institution, which includes both physical and digital protection of the bank. The CISO, on the other hand, homes in on securing data. Meanwhile, the CTO should have a broad understanding of cybersecurity, but likely will not be able to dig into the weeds as they’re primarily focused on the bank’s technology.

A third party can help fill in the gaps for the board.

“If you have someone coming in that has seen hundreds of institutions, then you get a better lens,” says Sanders. An outside advisor can educate directors about common security threats based on what’s happening at other institutions. A third party can also provide an external point of view.

Some, however, hesitate in suggesting that a board should seek to add a cyber expert to its membership. “It’s going to taint your board or what the purpose of your board is,” says Joshua Sitta, co-founder and CISO at the cybersecurity advisor Sittadel. “I think you’re going to have a voice driving [the board] toward risk management.”

Sitta explains that those focused on cybersecurity will push for more security. But a board’s role is oversight, governance and providing a sounding board to executive management to keep the bank safe, sound and growing. Having cyber talent at the board level could discourage growth opportunities for fear that any new initiative could pressure security efforts.

Banks should ensure they’re protected against large breaches of critical data, says Sitta, but should avoid complete protection that has them investing to prevent every breach or fraud alert, no matter how insignificant. Understanding what’s a reasonable concern is important for the board to grasp. But cybersecurity experts within the company or advising the board should simply “inform” the board, according to Sitta. With that information, the board can then assess whether the bank has the risk appetite to add a debated service or investment.

Many boards, though, might not have a full awareness of the level of attacks the bank faces. In Bank Director’s 2022 Risk Survey, conducted last year, board members and executives were asked if their bank experienced a data breach or ransomware attack in 2020-21, with 93% noting that they had not. This could indicate that board members and top executives aren’t fully aware of the threats their bank faces on a daily basis, or that they could weather a threat soon.

“They get into a false sense [of security],” says Sanders. “Everyone is going to have some kind of disclosure. Assessing the program and making changes once a year probably isn’t sufficient.”

While 71% of respondents in last year’s Risk Survey said their board was apprised of deficiencies in the bank’s cybersecurity risk program, less than half — 42% — reported that their board reviewed detailed metrics or scorecards that outlined cyber incidents, and 35% used data and relevant metrics to facilitate strategic decisions and monitor cyber risk.

The lack of awareness of a threat or breach could give the board a sense of ease. But this could hold the bank back from making the shifts needed to protect from the largest attacks. Further, a board that remains unaware of the true rates of incidents could underestimate the imperative to build or adjust a cyber response.

Another factor that boards must consider is how they have long prioritized cybersecurity.

“A lot of smaller organizations view cybersecurity as a cost center,” says Oleksak. The 2023 Risk Survey found that banks budget a median $250,000 for cybersecurity, ranging from $125,000 reported for the smallest institutions to $3 million for banks above $10 billion in assets. “It’s like insurance. You understand that it’s not a revenue generation center, [but] ignoring it can significantly affect the organization.”

Resources
Bank Director’s 2023 Risk Survey, sponsored by Moss Adams, surveyed 212 independent directors, CEOs, chief risk officers and other senior executives of U.S. banks below $100 billion in assets to gauge their concerns and explore several key risk areas, including interest rate risk, credit and cybersecurity. Members of the Bank Services Program have exclusive access to the complete results of the survey, which was conducted in January 2023.

Bank Director’s 2022 Governance Best Practices Survey, sponsored by Bryan Cave Leighton Paisner, surveyed 234 independent directors and CEOs of U.S. banks below $100 billion in assets to explore governance practices, board culture, committee structure and ESG oversight. The survey was conducted in February and March 2022

Risk issues like these will be covered during Bank Director’s Bank Audit & Risk Conference in Chicago, June 12-14, 2023.

2023 Risk Survey Results: Deposit Pressures Dominate

Written by

In 2023, the overarching question on bank leaders’ minds is how their organization will fare in the next crisis.

That manifested in increased concerns around interest rates, liquidity, credit and consumer risk, and other issues gauged in Bank Director’s 2023 Risk Survey, sponsored by Moss Adams LLP. The survey was fielded in January, before a run on deposits imperiled several institutions and regulators began closing banks in March, including $209 billion SVB Financial Corp.’s Silicon Valley Bank.

Well before this turmoil, bank executives and board members were feeling the pressure as the Federal Open Market Committee raised rates, leading bankers to selectively raise deposit rates and control their cost of funds. Over the past year, respondent concerns about interest rate risk (91%), credit risk (77%) and liquidity (71%) all increased markedly. Executives and directors also identify cybersecurity (84%) and compliance (70%) as areas where their concerns have increased, but managing the balance sheet has become, by and large, their first priority.

Bank leaders name deposit pricing (51%) and talent retention (50%) among the top strategic challenges their organization faces in 2023. Sixty-one percent say their bank has experienced some deposit loss, with minimal to moderate impacts on their funding base, and another 11% say that deposit outflows had a significant impact on their funding base.

Net interest margins improved for a majority (53%) of bank leaders taking part in the survey, but respondents are mixed about whether their bank’s NIM will expand or contract over 2023.

Three-quarters of bank executives and board members report that business clients remain strong in spite of inflation and economic pressures, although some are pausing growth plans. As commercial clients face increasing costs of materials and labor, talent pressures and shrinking revenues, that’s having an impact on commercial loan demand, some bankers say. And as the Federal Reserve continues to battle inflation against an uncertain macroeconomic backdrop, half of respondents say their concerns around consumer risk have increased, a significant shift from last year’s survey.

Key Findings

Deposit Pressures
Asked about what steps they might take to manage liquidity, 73% of executives and directors say they would raise interest rates offered on deposits, and 62% say they would borrow funds from a Federal Home Loan Bank. Less favored options include raising brokered deposits (30%), the use of participation loans (28%), tightening credit standards (22%) and using incentives to entice depositors (20%). Respondents say they would be comfortable maintaining a median loan-to-deposit ratio of 70% at the low end and 90% at the high end.

Strategic Challenges Vary
While the majority of respondents identify deposit pricing and/or talent retention as significant strategic challenges, 31% cite slowing credit demand, followed by liquidity management (29%), evolving regulatory and compliance requirements (28%) and CEO or senior management succession (20%).

Continued Vigilance on Cybersecurity
Eighty-seven percent of respondents say their bank has completed a cybersecurity assessment, with most banks using the tool offered by the Federal Financial Institutions Examination Council. Respondents cite detection technology, training for bank staff and internal communications as the most common areas where they have made changes after completing their assessment. Respondents report a median of $250,000 budgeted for cybersecurity-related expenses.

Stress On Fees
A little over a third (36%) of respondents say their bank has adjusted its fee structure in anticipation of regulatory pressure, while a minority (8%) did so in response to direct prodding by regulators. More than half of banks over $10 billion in assets say they adjusted their fee structure, either in response to direct regulatory pressure or anticipated regulatory pressure.

Climate Discussions Pick Up
The proportion of bank leaders who say their board discusses climate change at least annually increased over the past year to 21%, from 16% in 2022. Sixty-one percent of respondents say they do not focus on environmental, social and governance issues in a comprehensive manner, but the proportion of public banks that disclose their progress on ESG goals grew to 15%, from 10% last year.

Stress Testing Adjustments
Just over three-quarters of respondents say their bank conducts an annual stress test. In comments, offered before the Federal Reserve added a new component to its stress testing for the largest banks, many bank leaders described the ways that they’ve changed their approach to stress testing in anticipation of a downturn. One respondent described adding a liquidity stress test in response to increased deposit pricing and unrealized losses in the securities portfolio.

To view the high-level findings, click here.

Bank Services members can access a deeper exploration of the survey results. Members can click here to view the complete results, broken out by asset category and other relevant attributes. If you want to find out how your bank can gain access to this exclusive report, contact [email protected].

2023 Risk Survey: Complete Results

Written by

Bank Director’s 2023 Risk Survey, sponsored by Moss Adams LLP, finds interest rates and liquidity risk dominating bank leaders’ minds in 2023.

The survey, which explores several key risk areas, was conducted in January, before a run on deposits imperiled several institutions, including $209 billion SVB Financial Corp., which regulators closed in March. Bank executives and board members were feeling pressure on deposit costs well before that turmoil, as the Federal Open Market Committee raised the federal funds rate through 2022 and into 2023.

Over the past year, respondent concerns about interest rate risk (91%), credit risk (77%) and liquidity (71%) all increased markedly. Executives and directors also identify cybersecurity and compliance as areas where their concerns have increased, but managing the balance sheet has become, by and large, their first priority.

Bank leaders name deposit pricing as the top strategic challenge their organization faces in 2023, and a majority say their bank has experienced some deposit loss, with minimal to significant impacts on their funding base. Most respondents say their No. 1 liquidity management strategy would be to raise the rates they pay on deposits, followed by increasing their borrowings from a Federal Home Loan Bank.

While SVB operated a unique business model that featured a high level of uninsured deposits and a pronounced concentration in the tech industry, many banks are facing tension as deposits reprice faster than the loans on their books.

Net interest margins improved for a majority of bank leaders taking part in the survey, but respondents are mixed about whether their bank’s NIM will expand or contract over 2023.

Click here to view the complete results.

Key Findings

Deposit Pressures
Asked about what steps they might take to manage liquidity, 73% of executives and directors say they would raise interest rates offered on deposits, and 62% say they would borrow funds from a Federal Home Loan Bank. Less favored options include raising brokered deposits (30%), the use of participation loans (28%), tightening credit standards (22%) and using incentives to entice depositors (20%). Respondents say they would be comfortable maintaining a median loan-to-deposit ratio of 70% at the low end and 90% at the high end.

Strategic Challenges Vary
While the majority of respondents identify deposit pricing and/or talent retention as significant strategic challenges, 31% cite slowing credit demand, followed by liquidity management (29%), evolving regulatory and compliance requirements (28%) and CEO or senior management succession (20%).

Continued Vigilance on Cybersecurity
Eighty-seven percent of respondents say their bank has completed a cybersecurity assessment, with most banks using the tool offered by the Federal Financial Institutions Examination Council. Respondents cite detection technology, training for bank staff and internal communications as the most common areas where they have made changes after completing their assessment. Respondents report a median of $250,000 budgeted for cybersecurity-related expenses.

Stress On Fees
A little over a third (36%) of respondents say their bank has adjusted its fee structure in anticipation of regulatory pressure, while a minority (8%) did so in response to direct prodding by regulators. More than half of banks over $10 billion in assets say they adjusted their fee structure, either in response to direct regulatory pressure or anticipated regulatory pressure.

Climate Discussions Pick Up
The proportion of bank leaders who say their board discusses climate change at least annually increased over the past year to 21%, from 16% in 2022. Sixty-one percent of respondents say they do not focus on environmental, social and governance issues in a comprehensive manner, but the proportion of public banks that disclose their progress on ESG goals grew to 15%, from 10% last year.

Stress Testing Adjustments
Just over three-quarters of respondents say their bank conducts an annual stress test. In comments, offered before the Federal Reserve added a new component to its stress testing for the largest banks, many bank leaders described the ways that they’ve changed their approach to stress testing in anticipation of a downturn. One respondent described adding a liquidity stress test in response to increased deposit pricing and unrealized losses in the securities portfolio.

Expect Funding Wars, Tech Troubles in 2023

Written by

Back in January 2022, rising interest rates looked increasingly likely but weren’t yet a reality. In Bank Director’s 2022 Risk Survey, bank executives and board members indicated their hopes for a moderate rise in rates, defined as one percentage point, or 100 basis points. Of course, those expectations seem quaint today: In 2022, the Federal Reserve increased the federal funds rate’s target range from 0 to 0.25% in the first quarter to 4.25% to 4.5% in December — a more than 400 basis point increase.

A year ago, anyone looking at recent history would have been challenged to foresee this dramatic increase. And looking ahead to 2023, bankers see a precarious future. “We’ve never seen more uncertainty, on so many fronts, across the entire balance sheet,” says Matt Pieniazek, CEO of Darling Consulting Group. “Let clarity drive your thought process and decision-making, not fear.” 

While we can’t predict the future, we can leverage the recent past to prepare for what’s ahead. Here are three questions that could help boards and leadership teams plan for tomorrow. 

How Will Rising Interest Rates Impact the Bank?
Despite the rapid rise in the federal funds rate, just a handful of banks pay savings rates north of 3%: These include PNC Financial Services Group, which pays 4%; Citizens Financial Group, at 3.75%; and Capital One Financial Corp., at 3.3%. Most still pay the bare minimum to depositors, averaging 0.19% as of Dec. 14, 2022, according to Bankrate.

Pieniazek believes this will change in 2023. “[Banks have] got to accept that they were given a gift [in 2022].” Because of an environment that combined a rapid rise in rates with excess liquidity, banks were able to delay increasing the interest rates paid on deposits.

Funding costs are already beginning to reflect this changing picture, rising from an average 0.16% at the beginning of 2022 to 0.64% in the third quarter, according to the Federal Deposit Insurance Corp. 

“The liquidity narrative is changing,” says Pieniazek. “Our models are projecting that there’s going to be substantial catch-up.” Typically, deposits start to get more competitive after a 300 basis point increase in the federal funds rate, he says. We’re well past that.

That means banks need to understand their depositors. Pieniazek recommends breaking these into three groups: the largest accounts, which tend to be the smallest in number and most sensitive to rate changes; stable, mass market accounts with less than $100,000 in deposits; and account holders between these groups, with roughly $100,000 to $750,000 in deposits. Understand the behaviors of each group, and tailor pricing strategies accordingly. 

Will Banks Feel the Pain on Credit?
“Most banks are cutting their loan growth outlook in half for 2023, versus 2022,” says Pieniazek. Bank executives and boards should have frank discussions around growth and risk appetites, including loan concentrations. “Are we appropriately pricing for risk? And are we letting blind adherence to competition drive our loan pricing as opposed to stepping back and saying, ‘What is a fair, risk-adjusted return for our bank?,’ and level-set[ting] our loan growth outlook relative to that.” 

Steve Williams, president and co-founder of Cornerstone Advisors, sees less weakness in bank balance sheets — credit quality remained pristine in 2022 — and more concern for shadow banks and fintechs that have grown through leveraged, subprime and buy now, pay later loans. If these entities struggle, it could be an opportunity for banks. 

“The relationship manager model, in certain segments, has great runway,” says Williams. But that doesn’t mean that banks can simply ignore the disruption that’s already occurred. “We’ve been telling our clients, ‘Don’t dance in the end zone and be cocky,’ because … these blueprints for the future are still there,” he explains. “If we’re going to fight the funding war, we’ve got to do it in modern terms.” That means continuing to invest in technology to deliver better digital services. 

How Will the Tech Fallout Impact Banks?
It’s been a rough year for the tech sector. Valuations declined in 2022, according to the research firm CB Insights. Talented employees lost their jobs as tech firms shifted from a growth mindset to a focus on profitability. 

“Tech has never been cheaper than it is right now,” says Alex Johnson, creator of the Fintech Takes newsletter. “There [are] ample opportunities to snap up tech companies in a way that there just has never been.” 

Many banks aren’t interested in investing in, much less acquiring, a tech company, according to the bank executives and board members responding to Bank Director’s 2023 Bank M&A Survey. Just 15% participated in a fintech-focused venture capital fund in 2021-22; 9% directly invested in a fintech. Even fewer (1%) acquired a technology company during that time, though 16% said it’s a possibility for 2023. 

Snatching up laid-off talent could prove more viable for banks: 39% planned to add technology staff in 2022, according to Bank Director’s 2022 Compensation Survey. Many tech workers, scarred by last year’s layoffs, will seek stability. Over the last 10 to 15 years, “tech companies were the most valued place for employees to go; they were paying the highest salaries,” says Johnson. “It’s a huge, almost generational opportunity for banks, when they’re thinking about what their tech strategy is going to be.”

But what about vendors? The number of startups working with banks proliferated over the past few years. Amid this volatility, Johnson advises that banks sort out the “tourists” — opportunistic companies working with banks to demonstrate another avenue for growth — from providers that prioritize working with financial institutions. In today’s tougher fundraising environment, “if you’re a fintech company, you’re basically pulling back from all the things that you don’t think are core to what you do.” 

2023 could make crystal clear which tech companies are serious about working with banks.

4 Key Risks Facing Banks

Written by

Cybersecurity continues to be the top risk identified in Bank Director’s 2022 Risk Survey, sponsored by Moss Adams. But other risk areas have also grown increasingly prominent for the bank executives and board members responding to the survey, particularly interest rate risk. In this video, Moss Adams Partner Craig Sanders shares areas where banks can strengthen their weaknesses on cybersecurity. He also addresses the impact of fintechs on bank strategies and the rising prominence of environmental, social and governance (ESG) matters.

Topics addressed include:

  • Cyber Preparedness
  • Proactive Vendor Risk Management
  • Strategic Risks to Consider
  • Rising Interest Rates
  • Focusing on ESG

The 2022 Risk Survey explores several important risk areas, including credit risk, cybersecurity and emerging issues such as ESG. The survey results are also explored in the 2nd quarter 2022 issue of Bank Director magazine.