Tips to Navigate Top Risk Factors for Banks in 2021

Risk is always a prominent factor for banks. Their ability to strategically navigate change proved to be crucial in a year of unprecedented challenges caused by the Covid-19 pandemic.

Moss Adams partnered with Bank Director to conduct the 2021 Risk Survey that explored key risks facing the industry — and forecast how banks will emerge from the pandemic. Below is a summary of top insights from the survey, as well as considerations that bank leadership should keep front of mind as they go into the second half of the year.

Rising Credit Risk Concerns

Unsurprisingly, concerns around credit risk increased in 2020.

Two-thirds of bank respondents worry about concentrations in their loan portfolio, particularly around industries significantly strained during the pandemic, including commercial real estate and hospitality. Almost all respondents modified loans in second and third quarters of 2020 to aid their customers during the initial wave; some of these modifications extended into the fourth quarter.

Evaluation Metrics and Portfolio Concerns

Two separate metrics are now in play for regulators’ evaluations. As a result, it’s important to remember that just because your bank’s loan portfolio doesn’t receive a favorable rating doesn’t mean your bank or management won’t be evaluated favorably.

Regulators might downgrade a portfolio rating as some credits went into deferrals due to business shutdowns and borrowers being unable to make payments. However, bank management could receive a strong rating because of actions they took to keep the bank running and support customers.

While modifications reflect current realities, they don’t diminish the fact that portfolios are degrading from a stability standpoint. Forty-three percent of respondents tightened underwriting standards during the pandemic, while roughly half are unsure if they’ll adjust standards in 2021 and 2022.

Banks that have good governance will loosen their underwriting standards and will be strategic about to whom they lend money. In addition, they will assess which loans they’ll permit to be in delinquent status without taking action, and which they’ll defer.

Increases in Stress Testing

While annual stress tests are common for banks, 60% of respondents expanded the quantity or depth of economic scenarios in response to the pandemic. This is despite regulators’ previous increase of the asset cap threshold for required testing.

Most institutions focus not just on interest rate stress testing — they test the whole portfolio. This is driving more stress testing on the viability of collateral for loans and liquidity. Institutions know they’ll face increased allowance provisions and write-offs, so they’re stress testing the capital resiliency of their organization and see how they would shoulder that burden.

Looking forward, banks may want to focus on concentrated risks within the portfolio. They may also want to apply different, more specific stress testing criteria to various segments such as multifamily real estate, hospitality and mortgages, knowing certain areas may pose greater risk.

Improved Plans for Continuity and Disaster Recovery

The pandemic placed a renewed focus on continuity and disaster recovery. While most organizations had a pandemic provision in their plans following guidance from the Federal Financial Institutions Examination Council (FFIEC), they had been considered only hypothetical exercises. When an actual pandemic hit, many organizations had to react quickly, focus and learn how to adapt during the experience. Most banks will enhance their business continuity plans as a result of the pandemic: 84% of respondents say they’ve made or plan to make changes to their plans.

Key improvement areas include plans to:

  • Formalize remote work procedures.
  • Educate and train employees.
  • Provide the right tools to staff.
  • Ensure the bank’s IT infrastructure can adapt in a crisis.

Cybersecurity and Remote Work Setups

Three-quarters of respondents plan for at least some employees to work remotely after the pandemic abates. This makes cybersecurity a significant concern that boards need to further explore and implement additional precautions around.

Previously, with employees working in one space, there was only one entry point of attack for cybercriminals. Suddenly, with employees working from potentially hundreds of different locations, hundreds of entry points could exist.

Factoring in employees’ mental states is also a crucial vulnerability. It’s easier for cybercriminals to take advantage of or deceive employees that are navigating the difficulties of working from home and the general stresses of the pandemic. Increased staff training, as well as technology improvements, can help better detect and deter cyberthreats and intrusions.

Looking Forward

Though many respondents noted the resilience of the industry, it’s important to not get complacent. Banks certainly weathered the hard times, but the biggest impacts of the past year likely won’t be fully visible until the pandemic subsides.

Once that occurs, some businesses will reopen but may need more capital. Others may still close permanently, leaving banks to determine which loans won’t get repaid, engage bankruptcy courts, take cents on the dollars for the loan and charge write-offs.

So while this past year has been a major learning experience, the lesson likely won’t be concluded until early 2022.

 

Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory services offered through Moss Adams Wealth Advisors LLC.

Strengthening Stress Tests After Covid-19

Banks below $50 billion in assets aren’t required to conduct an annual stress test, following regulatory relief passed by Congress in May 2018. But most banks still conduct one or more annual tests, according to Bank Director’s 2021 Risk Survey.

A stress test determines whether a bank would have adequate capital or liquidity to survive an adverse event, based on historical or hypothetical scenarios. Financial institutions found value in the practice through the Covid-19 pandemic and related economic events, which created significant uncertainty around credit — particularly around commercial real estate loans and loans made to the hospitality sector, which includes hotels and restaurants.

“It gives you a peace of mind that we are prepared for some pretty big disasters,” says Craig Dwight, chair and CEO at $5.9 billion Horizon Bancorp, based in Michigan City, Indiana. Horizon disclosed its stress test results in third quarter 2020 to reassure its investors, as well as regulators, customers and its communities, about the safety and soundness of the bank. “We were well-capitalized, even under two-times the worst-case scenario,” he says. “[T]hat was an important message to deliver.”

Horizon Bancorp has been stress testing for years now. The two-times worst case scenario he mentions refers to loss history data from the Office of the Comptroller of the Currency; the bank examines the worst losses in that data, and then doubles those losses in a separate analysis. Horizon also looks at its own loan loss history.

The bank includes other data sets, as well. Dwight’s a big fan of the national and Midwest leading indicators provided by the Federal Reserve Bank of Chicago; each of those include roughly 18 indicators. “It takes into consideration unemployment, bankruptcy trends, the money supply and the velocity of money,” he says.

It’s a credit to the widespread adoption of stress testing in the years following the financial crisis of 2008-09. “All the infrastructure’s in place, so [bank management teams] can turn on their thinking fairly quickly, and [they] aren’t disconnected [from] what’s happening in the world,” says Steve Turner, managing director at Empyrean Solutions, a technology provider focused on financial risk management.

However, Covid-19 revealed the deficiencies of an exercise that relies on historical data and economic models that didn’t have the unexpected — like a global pandemic — in mind. In response, 60% of survey respondents whose bank conducts an annual stress test say they’ve expanded the quantity and/or depth of economic scenarios examined in this analysis.

“We have tested pandemics, but we really haven’t tested a shutdown of the economy,” says Dwight. “This pandemic was unforeseen by us.”

Getting Granular
The specific pain points felt by the pandemic — which injured some industries and left others thriving — had banks getting more granular about their loan portfolios. This should continue, says Craig Sanders, a partner at Moss Adams LLP. Moss Adams sponsored Bank Director’s 2021 Risk Survey.

Sanders and Turner offer several suggestions of how to strengthen stress testing in the wake of the pandemic. “[D]issect the portfolio … and understand where the risks are based on lending type or lending category,” says Sanders. “It’s going to require the banks to partner a little more closely with their clients and understand their business, and be an advisor to them and apply some data analytics to the client’s business model.” How will shifting behaviors affect the viability of the business? How does the business need to adjust in response?

He recommends an annual analysis of the entire portfolio, but then stratifying it based on the level of risk. High risk areas should be examined more frequently. “You’re focusing that time, energy and capital on the higher-risk areas of the bank,” says Sanders.

The survey finds two-thirds of respondents concerned about overconcentrations in their bank’s loan portfolio, and 43% of respondents worried specifically about commercial real estate loan concentrations. This represents a sharp — but expected — increase from the prior year, which found 78% expressing no concerns about portfolio concentrations.

We’re still not out of the woods yet. Many companies are now discussing what their workplace looks like in the new environment, which could have them reducing office spaces to accommodate remote workers. If a bank’s client has a loan on an office space, which they then rent to other businesses, will they be able to fill the building with new tenants?

If this leads to defaults in 2021-22, then banks need to understand the value of any loan collateral, says Sanders. “Is the collateral still worth what we think it was worth when we wrote the loan?”

It’s hard to predict the future, but Sanders says executives and boards need to evaluate and discuss other long-term effects of the pandemic on the loan portfolio. Today’s underlying issues may rise to the surface in the next couple of years.

Knowing What Will Break Your Bank
Stress testing doesn’t tend to focus on low-probability events — like the pandemic, which (we hope) will prove to be a once-in-a-lifetime occurrence. Turners says bank leaders need to bring a broader, more strategic focus to events that could “break” their bank. That could have been the pandemic, without the passage of government support like the CARES Act.

It’s a practice called reverse stress testing.

Reverse stress testing helps to explore so-called ‘break the bank’ situations, allowing a banking organization to set aside the issue of estimating the likelihood of severe events and to focus more on what kinds of events could threaten the viability of the banking organization,” according to guidance issued by the Federal Reserve, Federal Deposit Insurance Corp. and OCC in 2012. The practice “helps a banking organization evaluate the combined effect of several types of extreme events and circumstances that might threaten the survival of the banking organization, even if in isolation each of the effects might be manageable.”

Statistical models that rely on historical norms are less useful in an unforeseen event, says Turner. “[I]f someone told you in February of 2020 that you should be running a stress test where the entire economy shuts down, you’d say, ‘Nah!’” he says. “What are the events, what are the scenarios that could happen that will break me? And that way I don’t have to rely on my statistical models to explore that space.”

Testing for black swan events that are rare but can have devastating consequences adds another layer to a bank’s stress testing approach, says Turner. These discussions deal in hypotheticals, but they should be data driven. And they shouldn’t replace statistical modeling around the impact of more statistically normal events on the balance sheet. “It’s not, ‘what do we replace,’” says Turner, “but, ‘what do we add?’”

With stress testing, less isn’t more. “My advice is to run multiple scenarios, not just one stress test. For me, it’s gotta be the worst-case stress test,” says Dwight. And stress testing can’t simply check a box. “Can you sleep at night with that worst case scenario, or do you have a plan?”

Bank Director’s 2021 Risk Survey, sponsored by Moss Adams LLP, 188 independent directors, chief executive officers, chief risk officers and other senior executives of U.S. banks below $50 billion in assets. The survey was conducted in January 2021, and focuses on the key risks facing the industry today and how banks will emerge from the pandemic environment.

Bank Director has published several recent articles and videos about stress testing, including an Online Training Series unit on stress testing. You may also consider reading “Recalibrating Bank Stress Tests to a New Reality.”

2021 Risk Survey Results: High Anxiety

An outsized crisis requires bold action. The banking industry responded in kind when the economy spiraled as a result of the Covid-19 pandemic.

Financial institutions across the country assisted small businesses by issuing Paycheck Protection Program loans. Banks also almost universally modified loans to help borrowers weather the storm, according to Bank Director’s 2021 Risk Survey, sponsored by Moss Adams LLP. At the peak of the downturn, 43% of the directors, CEOs, chief risk officers and other senior executives responding to the survey say their bank modified more than 10% of the loans in their portfolio.

Conducted on the heels of a tumultuous 2020 — with the pandemic, social strife and political change continuing into January — the survey reveals high levels of anxiety across the risk spectrum. In particular, respondents indicate greater unease regarding cybersecurity (92%) and credit (89%), as well as strategic (62%) and operational (52%) risks.

Almost half of respondents indicate that some or most of the loan modifications extended into the fourth quarter 2020, and two-thirds reveal concerns about concentrations in their loan portfolio, with most pointing to commercial real estate (43%) and/or the hospitality industry (31%).

Forty-three percent indicate that their bank tightened underwriting standards during the downturn. Looking ahead, many are unsure whether they’ll ease their standards to lend to business customers in 2021 and 2022. The challenges to bankers have been deep during the past year.

As the CEO of a small, southeastern community bank put it: “What doesn’t kill you makes you stronger.”

Despite this uncertainty, bankers express some optimism. More than three-quarters believe that supporting their communities during the pandemic has positively affected their bank’s reputation. Eighty-seven percent expect fewer than 10% of their bank’s business customers to fail. And 84% will improve their bank’s business continuity plan due to what they’ve experienced.

Key Findings

More Robust Stress Testing
More than 80% say their bank conducts an annual stress test. Of these, 60% have expanded the quantity and/or depth of economic scenarios examined in response to the Covid-19 pandemic.

Cybersecurity Gaps
Sixty-three percent say their institution increased its oversight of cybersecurity and data privacy in 2020. Most say the bank needs to improve its cybersecurity program by training staff (68%) and implementing technology to better detect or deter threats and intrusions (65%).

Pandemic Plans Adjusted
Respondents identify several areas where they’ll enhance their business continuity plan as a result of the pandemic. The majority point to formalizing remote work procedures and policies (77%), educating and training employees (56%) and/or providing the right tools to staff (55%). Roughly half say that fewer than a quarter of employees will work remotely when the pandemic abates; 25% say that no employees will work remotely.

Banking Marijuana
Forty-one percent of respondents represent a bank headquartered where marijuana use is at least partly legal. Overall, one-third are unsure if their bank would be willing to serve marijuana businesses. Just 7% serve these businesses; 34% have discussed banking this industry but don’t work with these companies yet.

Climate Change Still Not a Hot Topic
Just 14% say their board discusses the risks posed by climate change at least annually; this is up slightly from 11% in last year’s survey. Fewer than 10% say an executive reports to the board about the risks and opportunities that climate change presents to the institution.

To view the full results of the survey, click here.

Navigating Troubled, Murky Waters

Banks face a cloudy future as they navigate today’s unique environment, characterized by an economic downturn — caused by a health crisis rather than an asset bubble or industry malfeasance — and a prolonged low-rate environment.

“This downturn is different,” says Steve Turner, a managing director at Empyrean Solutions who has focused on balance sheet management and risk over his multi-decade career.

“All of the problems in the last downturn, you pretty much knew where you were. You could look at your balance sheet, you could look at the credit profiles,” he continues. But this time, “we have such a wide range of things that could be happening to us over the next number of months and years.”

With that in mind, Turner joined me as co-host for a virtual peer exchange on Aug. 5, where 10 chief financial officers shared their perspectives on how they’re planning for loan losses and handling the deposit glut, and the lessons they learned from the last crisis.

Asset Quality Remains Strong … For Now
So far, these CFOs aren’t seeing indicators of weakness in their markets. Yet, their experience in the industry tells them that losses are coming. How does a bank still using the incurred loss model justify a loan allowance that aligns with U.S. accounting principles and still prepares it for what history tells them is inevitable?

“The allowance, we’re struggling with that a little bit,” says Suzanne Loken, CFO at $1.3 billion S.B.C.P. Bancorp in Cross Plains, Wisconsin. “Just looking at our data, we don’t see the losses coming through.”

The bank provides talking points to lenders so they can conduct structured conversations with troubled clients, she adds.

Banks are doing their best to monitor the environment, sometimes employing a deeper analysis so they can better assess any potential damage. Joseph Chybowski, CFO at $2.8 billion Bridgewater Bancshares, shares that his team at the Bloomington, Minnesota-based bank created a tenant rental database to better identify troubled areas. “[It’s] a much more granular look on a go-forward basis of what our borrowers’ tenant bases look like,” he explains.

Focus on Deposits, Funding Costs
Arkadelphia, Arkansas-based Southern Bancorp planned to jettison its excess liquidity in 2020, as part of its strategy to improve earnings and profitability. Instead, Paycheck Protection Program loans have swelled the balance sheet of the $1.5 billion community development financial institution (CDFI). “And when these loans are forgiven, our excess liquidity is going to almost double from that perspective,” says CFO Christopher Wewers. “So, [we’re] working hard to drive down the cost of funds.”

In the discussion, the CFOs report that new PPP customers were required to open a deposit account with them to apply for the loan, fueling deposit growth. They expect to deepen these relationships, as their banks essentially kept these customers afloat when their old bank left them out to dry.

The group also confirms that they’re exercising caution around promoting particular deposit products, like certificates of deposit. And the retail team, like the lending team, should be provided talking points so they can better convey today’s reality to customers, says Emily Girsh, CFO at Reinbeck, Iowa-based Lincoln Savings Bank, a $1.4 billion subsidiary of Lincoln Bancorp. “We need to help walk [customers] through and educate them about the market.”

Lessons from the Last Crisis
While the root of the coronavirus crisis differs from the 2008-09 financial crisis, bankers did learn valuable lessons about managing through a prolonged low-rate environment.

“We learned a deposit pricing lesson,” says Michele Schuh, CFO at Anchorage, Alaska-based First National Bank Alaska, which has $4.6 billion in assets. To strengthen customer relationships in the aftermath of the previous crisis, the bank floored deposit rates. “Our assets didn’t immediately downward reprice [then], so we wanted to continue to share and provide some level of above-market yield to the customers that had money deposited in the bank.”

No one could have forecasted that a decade later, rates would remain low. “As rates have come back down … we’ve taken a little bit more practical approach to trying to decide where and how we might floor rates,” she adds.

There’s also caution around hedging. Out of the last crisis, “there were institutions for five years that were betting on rates going up, and [those] institutions lost a lot of money,” notes Kevin LeMahieu, CFO of $2.2 billion Bank First Corp., based in Manitowoc, Wisconsin. “

In the most uncertain environment in memory, how bank leaders look ahead will matter,” says Turner. “Stress testing should look at more scenarios, early warning indicators and processes should be beefed up, and sensitivity to staff and customer concerns should be heightened. Fee income opportunities and creating relationships with new customers from the PPP program will be opportunities to offset some of the lost income from net interest margin compression.”

The $700 Billion Credit Question for Banks

It’s the $700 billion question: How bad could it get for banks?

That’s the maximum amount of losses that the Federal Reserve modeled in a special sensitivity analysis in June for the nation’s 34 largest banks over nine quarters as part of its annual stress testing exercise.

Proportional losses could be devastating for community banks, which also tend to lack the sophisticated stress testing models of their bigger peers and employ a more straight-forward approach to risk management. Experts say that community banks should draw inspiration from the Fed’s analysis and broad stress-testing practices to address potential balance sheet risk, even if they don’t undergo a full stress analysis.

“It’s always good to understand your downsides,” says Steve Turner, managing director at Empyrean Solutions, an asset and liability tool for financial institutions. “Economic environments do two things: They tend to trend and then they tend to change abruptly. Most people are really good at predicting trends, very few are good at forecasting the abrupt changes. Stress testing provides you with insight into what could be the abrupt changes.”

For the most part, stress testing, an exercise that subjects existing and historical balance sheet data to a variety of adverse macroeconomic outlooks to create a range of potential outcomes, has been the domain of the largest banks. But considering worst-case scenarios and working backward to mitigate those outcomes — one of the main takeaways and advantages of stress testing — is “unequivocally” part of prudent risk and profitability management for banks, says Ed Young, senior director and capital planning strategist at Moody’s Analytics.

Capital & Liquidity
The results of the Fed’s sensitivity analysis underpinned the regulator’s decision to alter planned capital actions at large banks, capping dividend levels and ceasing most stock repurchase activity. Young says bank boards should look at the analysis and conclusion before revisiting their comfort levels with “how much capital you’re letting exit from your firm today” through planned distributions.

Share repurchases are relatively easy to turn on and off; pausing or cutting a dividend could have more significant consequences. Boards should also revisit the strategic plan and assess the capital intensity of certain planned projects. They may need to pause anticipated acquisitions, business line additions and branch expansions that could expend valuable capital. They also need to be realistic about the likelihood of raising new capital — what form and at what cost — should they need to bolster their ratios.

Boards need to frequently assess their liquidity position too, Young says. Exercises that demonstrate the bank can maintain adequate capital for 12 months mean little if sufficient liquidity runs out after six months.

Credit
When it comes to credit, community banks may want to start by comparing the distribution of the loan portfolios of the banks involved in the exercise to their own. These players are active lenders in many of the same areas that community banks are, with sizable commercial and industrial, commercial real estate and mortgage portfolios.

“You can essentially take those results and translate them, to a certain degree, into your bank’s size and risk profile,” says Frank Manahan, a managing director in KPMG’s financial services practice. “It’s not going to be highly mathematical or highly quantitative, but it is a data point to show you how severe these other institutions expect it to be for them. Then, on a pro-rated basis, you can extract information down to your size.”

Turner says many community banks could “reverse stress test” their loan portfolios to produce useful insights and potential ways to proceed as well as identify emerging weaknesses or risks.

They should try to calculate their loss-absorbing capacity if credit takes a nosedive, or use a tiered approach to imagine if something “bad, really bad and cataclysmic” happens in their market. Credit and loan teams can leverage their knowledge of customers to come up with potential worst-case scenarios for individual borrowers or groups, as well as what it would mean for the bank.

“Rather than say, ‘I project that a worst-case scenarios is X,’ turn it around and say, ‘If I get this level of losses in my owner-occupied commercial real estate portfolio, then I have a capital problem,’” Turner says. “I’ll have a sense of what actions I need to take after that stress test process.”

A key driver of credit problems in the past has been the unemployment rate, Manahan says. Unemployment is at record highs, but banks can still leverage their historical experience of credit performance when unemployment hit 9.5% in June 2009.

“If you’ve done scenarios that show you that an increase in unemployment from 10% to 15% will have this dollar impact on the balance sheet — that is a hugely useful data point,” he says. “That’s essentially a sensitivity analysis, to say that a 1 basis point increase in unemployment translates into … an increase in losses or a decrease in revenue perspective to the balance sheet.”

After identifying the worst-case scenarios, banks should then tackle changing or refining the data or information that will serve as early-warning indicators. That could be a drawdown of deposit accounts, additional requests for deferrals or changes in customer cash flow — anything that may indicate eventual erosion of credit quality. They should then look for those indicators in the borrowers or asset classes that could create the biggest problems for the bank and act accordingly.

Additional insights

  • Experts and executives report that banks are having stress testing conversations monthly, given the heightened risk environment. In normal times, Turner says they can happen semi-annual.
  • Sophisticated models are useful but have their limits, including a lack of historical data for a pandemic. Young points out that the Fed’s sensitivity analysis discussed how big banks are incorporating detailed management judgement on top of their loss models.
  • Vendors exist to help firms do one-time or sporadic stress tests of loan portfolios against a range of potential economic forecasts and can use publicly available information or internal data. This could be an option for firms that want a formal analysis but don’t have the time or money to implement a system internally.
  • Experts recommend taking advantage of opportunities, like the pandemic, to enhance risk management and the processes and procedures around it.

2020 Risk Survey Results: “Don’t Panic. Just Fly the Airplane.”

It wasn’t uncommon in the latter half of 2019 for bank executives to note the margin pressure faced by the industry, brought on by an inhospitable interest rate environment. And rates dropped even lower in early 2020, with the Federal Reserve cutting rates to zero.

“In spite of the Fed’s yo-yo interest rate, we have a responsibility to manage our assets in a manner that is in the best interest[s] of our shareholders and communities we serve. The key is not to panic, but [to] hold the course,” said John Allison, CEO of Conway, Arkansas-based Home Bancshares, in the $15 billion bank’s second quarter 2019 earnings call. “At the end of the day, your management’s trying to operate profitably in the middle of this chaos. They say when you’re piloting an airplane and there’s a major problem, like an engine going out: ‘Don’t panic. Just fly the airplane.’”

Allison’s advice to “just fly the airplane” seems an appropriate way to frame the risks facing the banking industry, which Bank Director explored again in its 2020 Risk Survey, sponsored by Moss Adams. Conducted in January, it includes the views of more than 200 independent directors, CEOs, risk officers and other senior executives of U.S. banks below $50 billion in assets.

A majority of these industry leaders say they’re more worried about interest rate risk amid a competitive environment for deposit growth — 25% report their bank lost deposit share in 2019, and 34% report gains in this area. Looking ahead to 2020, most (73%) say their bank will leverage personal relationships to attract deposits from other institutions. Less than half will leverage digital channels, a strategy that skews toward — but is not exclusive to — larger banks.

In the survey, almost 60% cite increased concerns around credit risk, consistent with the Federal Reserve’s Senior Loan Officer Opinion Survey from January, which reports dampened demand for commercial loans and expectations that credit quality will moderately deteriorate.

Interestingly, Bank Director’s 2020 Risk Survey finds respondents almost unanimously reporting that their bank’s loan standards have remained consistent over the past year. However, the majority (67%) also believe that competing banks and credit unions have eased their underwriting standards over the same time period.

 

Key Findings

  • Scaling Back on Stress Tests. The Economic Growth, Regulatory Relief and Consumer Protection Act, passed in May 2018, freed banks between $10 billion and $50 billion in assets from the Dodd-Frank Act (DFAST) stress test requirements. While last year’s survey found that 60% of respondents at these banks planned to keep their stress test practices in place, participants this year reveal they have scaled back (7%) or modified (67%) these procedures.
  • Ready for CECL. More than half of survey respondents say their bank is prepared to comply with the current expected credit loss (CECL) standards; 43% indicate they will be prepared when the standards take effect for their institution.
  • Cyber Anxiety Rising. Eighty-seven percent of respondents say their concerns about cybersecurity threats have risen over the past year. This is the top risk facing the banking industry, according to executives and directors. Further, 77% say their bank has significantly increased its oversight of cybersecurity and data privacy.
  • Board Oversight. Most boards review cybersecurity regularly — either quarterly (46%) or at every board meeting (24%). How the board handles cybersecurity governance varies: 28% handle it within a technology committee, 26% within the risk committee and 19% as a full board. Just one-third have a director with cybersecurity expertise.
  • Climate Change Overlooked. Despite rising attention from regulators, proxy advisors and shareholders, just 11% say their bank’s board discusses climate change at least annually as part of its analysis and understanding of the risks facing the organization. Just 9% say an executive reports to the board annually about the risks and opportunities presented by climate change. More than 20% of respondents say their bank has been impacted by a natural disaster in the past two years.

To view the full results of the survey, click here.

Coronavirus Strategies, Considerations for Banks

Over the past two weeks, we have received numerous inquiries from financial institutions on what actions should be taken or considered to address the COVID-19, or the new coronavirus, pandemic. While the current situation is evolving each day, we have engaged in numerous discussions with banks on various strategies and considerations that are being reviewed or implemented during this uncertain time.

Business Continuity Plan

Every financial institution should have implemented pandemic planning contingencies contained in its business continuity plan. In response to the burgeoning public health crisis, the Federal Financial Institutions Examination Council issued revised guidance on March 6 on how to address pandemic planning in a bank’s business continuity plans. The revision updates previous guidance issued in response to the avian flu pandemic of 2007.

Although there are no substantive updates contained in the revised Pandemic Planning Guidance, the FFIEC’s update reiterates and emphasizes the importance of maintaining a pandemic response plan that includes strategies to minimize disruptions and recover from a pandemic wave. The updated guidance states that banks should consider minimizing staff contact, encouraging employees to telecommute and redirecting customers from branch to electronic banking services. We anticipate that regulators will review an institution’s utilization of its business continuity plan at upcoming safety and soundness examinations.

Branch Operations

Based on our discussions, we believe that many banks have taken or plan to take actions related to their branch operations. Below is a summary of various actions that a bank may wish to take regarding its branch operations.

Branches Remain Open, with Caveats. A number of banks have elected to close branch lobbies and direct customers to utilize drive-up facilities, walk-up teller lines and ATM machines where possible. In addition, they are also directing customers to their online platforms. Some banks are requesting customers who require physical or in-person assistance, such as access to a safe deposit box, to schedule an appointment with bank employees.

Branch Closures. To the extent a bank may be readying a branch closure strategy, below are federal and state requirements that must be satisfied.

Federal Requirements. On March 13, the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency and the Federal Reserve Board issued corresponding guidance addressing COVID-19’s impact on customers and bank operations indicating that they expect bank branch closures, or changes to branch hours. In such an event, they recommend that a bank (i) notify the applicable federal banking regulator as soon as practicable of the closure/change in bank hours, (ii) comply with any notice or filing requirements with applicable state banking regulators and (iii) place a customer notice on the front entrance of the impacted branch describing the reason for the closure and/or change in hours.

State Law Requirements. Closing lobbies and redirecting customers to drive-ups does not generally require a bank to obtain the approval of state banking authorities, but some state banking authorities have requested that banks provide notice of such changes. For example, Illinois-chartered banks seeking to fully close a branch or change branch hours must provide prior notice to the Illinois Department of Financial and Professional Regulation, Division of Banking, and obtain an official proclamation from the IDB under the Illinois Banking Emergencies Act (205 ILCS 610). In addition, the bank must post notice of the temporary closing or change in branch hours and the authorization for such change on the main entrance doors of the applicable branch.

ATM/Cash-On-Hand Strategies. In a push to increase customer traffic to ATMs and minimize direct customer contact, some banks have increased or plan to increase ATM daily allowable cash withdrawal limits. The size of the increase depends on the individual circumstances of the institution. Banks may experience greater cash withdrawal requests from depositors and may wish to keep higher levels of cash in its branch offices.

Regular and Periodic Cleaning of Branches. Each bank we spoke with also indicated that they have implemented enhanced periodic cleaning of their branches and offices. Some banks have indicated that “deep” cleanings are being completed on a weekly basis.

Employee Considerations

Flexible Work-from-Home Arrangements. We have also discussed the potential for implementing flexible work-from-home or telecommuting arrangements for specific business line employees with institutions. Whether or not this is a viable option for a specific institution is dependent upon a number of specific circumstances: whether the bank’s information technology systems can support an increased number of employees utilizing the bank’s server remotely, ensuring that each employee who remotely accesses the bank’s systems can do so in a confidential manner that protects that bank’s data and whether there are geographic and business-line specific considerations that prevent working remotely, among others. Nonetheless, a bank should plan to test their IT systems and update policies prior to implementing such arrangements.

Utilization of Split-Staff and Split-Location Strategies. In addition, we’ve discussed split-staff and split-location strategies;  a number of banks indicated that they are currently utilizing a split-staff strategy. Under a split-staff strategy, an institution staggers its employees on any given day. For instance, half of the institution’s employees come in on Monday, Wednesday and Friday, and the other half of the employees come in on Tuesday, Thursday and Saturday. The aim is that limiting employee interaction with customers on any given day allows a bank to maintain operations on a much more limited basis if only one group of employees is potentially exposed to COVID-19.

In addition, some institutions also indicated that they plan to utilize a split-location strategy, distributing staff across various branches and offices. If one location is potentially exposed to COVID-19, a bank’s operations can continue through its other locations.

Employee Training. Banks have also implemented staff training on how to properly interact with customers during this troubling time. Following guidance from the World Health Organization and Centers for Disease Control and Prevention, banks have implemented new procedures meant to limit physical contact (like prohibiting handshakes) and eliminating or reducing scheduled meetings.

Liquidity and Capital Considerations

During times of uncertainty and financial market volatility, like the financial crisis, banks have often found it difficult to enhance liquidity and raise additional capital when they may need it the most. Based on our discussions, we recommend that financial institutions review their current and near-term liquidity/capital strategies. Below are a few items to consider.

Subordinated Debt and Equity Issuances. Banks may need to weather a prolonged economic slowdown. Bankers agree that reviewing the firm’s capital strategies in uncertain times is a critical consideration to address any potential need to enhance immediate or near-term liquidity or to shore up capital. Other banks may also wish to review various alternatives available to issue debt for additional liquidity, to potentially refinance outstanding debt arrangements at lower rates, or to provide additional capital.

Lines of Credit. As lenders, banks are aware that their borrowers may be considering a draw down on existing lines of credit. Banks may also wish to consider potentially drawing down on their existing lines of credit (such as Federal Home Loan Bank advances or holding company lines of credit) as an effective tool to increase the holding company’s or bank’s liquidity. Before either drawing down any existing line of credit or utilizing the proceeds for any purpose other than increasing cash-on-hand, a bank should carefully review the covenants in the underlying loan agreements.

Securities Portfolio. Reviewing current strategies pertaining to an institution’s securities portfolio is also a consideration for banks. Many banks have built-in gains in their portfolio. Consequently, institutions are reviewing their portfolios to determine whether to realize existing gains to boost liquidity in the short-term or maintain its current strategy to assist earnings in the longer-term.

Stock Repurchase Programs. Many publicly traded banks have suspended their stock repurchase programs as part of a capital conservation strategy. While no bank has announced plans to cut dividends, now is the time to review contingency plans and consider when such action may be warranted.

Federal Reserve Discount Window. Bankers should also discuss potentially using the Federal Reserve’s short-term emergency loans dispensed through the discount window if necessary. While many institutions consider using the discount window as a last resort and could indicate dire financial straits, senior bank management should revisit their policies and procedures to ensure their institution can access the discount window should circumstances require it.

Importantly, on March 17, the Federal Reserve and eight of the largest financial institutions in the U.S. worked together to provide these large financial institutions access to the discount window. Largely symbolic, the actions are being viewed by banks as an effort to remove the stigma of accessing the discount window. Whether these coordinated efforts will be a success remains to be seen.

Stress Testing of Loans. We anticipate that many institutions will consider the need to begin stress testing their portfolios, and some already are. For some, stress testing may be centered on specific industries and sectors of the loan portfolio that may have been more substantially impacted by COVID-19 (such as hospitality/restaurants, travel, entertainment and companies with supply chains dependent upon China or Europe). For others, the entire loan portfolio may be tested, under the assumption it could be subject to pandemic-related stress.

Review Insurance Policies. Another consideration we’ve discussed with banks is the need to review in-place insurance policies for business disruption coverage to determine if they would cover matters resulting from the COVID-19 pandemic.

Assist Impacted Customers. Consistent with the recent guidance issued by the Fed, FDIC and OCC, banks are considering offering a variety of relief options related to specific product/service lines to customers. Some banks may waive late fees on loan payments or credit cards and others may waive ATM- and deposit-related fees. We expect these relief options will be limited to specific product and service lines, and to a certain period of time.

On March 19, the FDIC issued a set of Frequently Asked Questions for banks impacted by the coronavirus. The FAQs provide insight into how the FDIC, and potentially other federal banking regulators, will view payment accommodations, reporting of delinquent loans, document retention and reporting requirements, troubled debt restructurings, nonaccrual loans and the allowance for loan and lease losses. Banks should review the FAQs in connection with providing any financial assistance to impacted customers.

The items noted above should not be considered definitive or exclusive. A financial institution should carefully consider the above items, among others, and determine how to tailor any proposed changes to its operations in light of the very fluid circumstances surrounding the current COVID-19 pandemic.

Click here to review the March 13 OCC Bulletin 2020-15 (Pandemic Planning: Working With Customers Affected by Coronavirus and Regulatory Assistance).

Click here to review the March 13 FDIC FIL-17-2020 (Regulatory Relief: Working with Customers Affected by the Coronavirus).

Click here to review the March 13 FRB SR 20-4/CA 20-3 (Supervisory Practices Regarding Financial Institutions Affected by Coronavirus).

Exclusive: How This Growing Community Bank Focuses on Risk


risk-5-16-19.pngManaging risk and satisfying examiners can be difficult for any bank. It’s particularly hard for community banks that want to manage their limited resources wisely.

One bank that balances these challenges well is Bryn Mawr Bank Corp., a $4.6 billion asset based in Bryn Mawr, Pennsylvania, on the outskirts of Philadelphia.

Bank Director Vice President of Research Emily McCormick recently interviewed Chief Risk Officer Patrick Killeen about the bank’s approach to risk for a feature story in our second quarter 2019 issue. That story, titled “Banks Regain Sovereignty Over Risk Practices,” dives into the results of Bank Director’s 2019 Risk Survey. (You can read that story here.)

In the transcript of the interview—available exclusively to members of our Bank Services program—Killeen goes into detail about how his bank approaches stress testing, cybersecurity and credit risk, and explains how the executive team and board have strengthened the organization for future growth.

He discusses:

  • The top risks facing his community bank
  • Hiring the right talent to balance risk and growth
  • Balancing board and management responsibilities in lending
  • Conducting stress tests as a community bank
  • Managing cyber risk
  • Responding to Bank Secrecy Act and anti-money laundering guidance

The interview has been edited for brevity, clarity and flow.

download.png Download transcript for the full exclusive interview

2019 Risk Survey: Cybersecurity Oversight


risk-3-25-19.pngBank leaders are more worried than ever about cybersecurity: Eighty-three percent of the chief risk officers, chief executives, independent directors and other senior executives of U.S. banks responding to Bank Director’s 2019 Risk Survey say their concerns about cybersecurity have increased over the past year. Executives and directors have listed cybersecurity as their top risk concern in five prior versions of this survey, so finding that they’re more—rather than less—worried could be indicative of the industry’s struggles to wrap their hands around the issue.

The survey, sponsored by Moss Adams, was conducted in January 2019. It reveals the views of 180 bank leaders, representing banks ranging from $250 million to $50 billion in assets, about today’s risk landscape, including risk governance, the impact of regulatory relief on risk practices, the potential effect of rising interest rates and the use of technology to enhance compliance.

The survey also examines how banks oversee cybersecurity risk.

More banks are hiring chief information security officers: The percentage indicating their bank employs a CISO ticked up by seven points from last year’s survey and by 17 points from 2017. This year, Bank Director delved deeper to uncover whether the CISO holds additional responsibilities at the bank (49 percent) or focuses exclusively on cybersecurity (30 percent)—a practice more common at banks above $10 billion in assets.

How bank boards adapt their governance structures to effectively oversee cybersecurity remains a mixed bag. Cybersecurity may be addressed within the risk committee (27 percent), the technology committee (25 percent) or the audit committee (19 percent). Eight percent of respondents report their board has a board-level cybersecurity committee. Twenty percent address cybersecurity as a full board rather than delegating it to a committee.

A little more than one-third indicate one director is a cybersecurity expert, suggesting a skill gap some boards may seek to address.

Additional Findings

  • Three-quarters of respondents reveal enhanced concerns around interest rate risk.
  • Fifty-eight percent expect to lose deposits if the Federal Reserve raises interest rates by more than one hundred basis points (1 percentage point) over the next 18 months. Thirty-one percent lost deposit share in 2018 as a result of rate competition.
  • The regulatory relief package, passed in 2018, freed banks between $10 billion and $50 billion in assets from stress test requirements. Yet, 60 percent of respondents in this asset class reveal they are keeping the Dodd-Frank Act (DFAST) stress test practices in place.
  • For smaller banks, more than three-quarters of those surveyed say they conduct an annual stress test.
  • When asked how their bank’s capital position would be affected in a severe economic downturn, more than half foresee a moderate impact on capital, with the bank’s capital ratio dropping to a range of 7 to 9.9 percent. Thirty-four percent believe their capital position would remain strong.
  • Following a statement issued by federal regulators late last year, 71 percent indicate they have implemented or plan to implement more innovative technology in 2019 to better comply with Bank Secrecy Act/anti-money laundering (BSA/AML) rules. Another 10 percent will work toward implementation in 2020.
  • Despite buzz around artificial intelligence, 63 percent indicate their bank hasn’t explored using AI technology to better comply with the myriad rules and regulations banks face.

To view the full results of the survey, click here.

What You Should Know About M&A in 2019



Deal values have been rising, and economic factors—including regulatory easing and increased deposit competition—could drive more deals for regional acquirers, explains Deloitte & Touche Partner Matt Hutton in this video. He also shares how nontraditional acquisitions could impact deal structures, and the importance of due diligence and stress testing at this stage in the credit cycle.

  • Today’s M&A Environment
  • Deal Structure Considerations
  • Expectations for 2019
  • Advice for Boards and Management Teams