Exclusive: How This Growing Community Bank Focuses on Risk


risk-5-16-19.pngManaging risk and satisfying examiners can be difficult for any bank. It’s particularly hard for community banks that want to manage their limited resources wisely.

One bank that balances these challenges well is Bryn Mawr Bank Corp., a $4.6 billion asset based in Bryn Mawr, Pennsylvania, on the outskirts of Philadelphia.

Bank Director Vice President of Research Emily McCormick recently interviewed Chief Risk Officer Patrick Killeen about the bank’s approach to risk for a feature story in our second quarter 2019 issue. That story, titled “Banks Regain Sovereignty Over Risk Practices,” dives into the results of Bank Director’s 2019 Risk Survey. (You can read that story here.)

In the transcript of the interview—available exclusively to members of our Bank Services program—Killeen goes into detail about how his bank approaches stress testing, cybersecurity and credit risk, and explains how the executive team and board have strengthened the organization for future growth.

He discusses:

  • The top risks facing his community bank
  • Hiring the right talent to balance risk and growth
  • Balancing board and management responsibilities in lending
  • Conducting stress tests as a community bank
  • Managing cyber risk
  • Responding to Bank Secrecy Act and anti-money laundering guidance

The interview has been edited for brevity, clarity and flow.

download.png Download transcript for the full exclusive interview

2019 Risk Survey: Cybersecurity Oversight


risk-3-25-19.pngBank leaders are more worried than ever about cybersecurity: Eighty-three percent of the chief risk officers, chief executives, independent directors and other senior executives of U.S. banks responding to Bank Director’s 2019 Risk Survey say their concerns about cybersecurity have increased over the past year. Executives and directors have listed cybersecurity as their top risk concern in five prior versions of this survey, so finding that they’re more—rather than less—worried could be indicative of the industry’s struggles to wrap their hands around the issue.

The survey, sponsored by Moss Adams, was conducted in January 2019. It reveals the views of 180 bank leaders, representing banks ranging from $250 million to $50 billion in assets, about today’s risk landscape, including risk governance, the impact of regulatory relief on risk practices, the potential effect of rising interest rates and the use of technology to enhance compliance.

The survey also examines how banks oversee cybersecurity risk.

More banks are hiring chief information security officers: The percentage indicating their bank employs a CISO ticked up by seven points from last year’s survey and by 17 points from 2017. This year, Bank Director delved deeper to uncover whether the CISO holds additional responsibilities at the bank (49 percent) or focuses exclusively on cybersecurity (30 percent)—a practice more common at banks above $10 billion in assets.

How bank boards adapt their governance structures to effectively oversee cybersecurity remains a mixed bag. Cybersecurity may be addressed within the risk committee (27 percent), the technology committee (25 percent) or the audit committee (19 percent). Eight percent of respondents report their board has a board-level cybersecurity committee. Twenty percent address cybersecurity as a full board rather than delegating it to a committee.

A little more than one-third indicate one director is a cybersecurity expert, suggesting a skill gap some boards may seek to address.

Additional Findings

  • Three-quarters of respondents reveal enhanced concerns around interest rate risk.
  • Fifty-eight percent expect to lose deposits if the Federal Reserve raises interest rates by more than one hundred basis points (1 percentage point) over the next 18 months. Thirty-one percent lost deposit share in 2018 as a result of rate competition.
  • The regulatory relief package, passed in 2018, freed banks between $10 billion and $50 billion in assets from stress test requirements. Yet, 60 percent of respondents in this asset class reveal they are keeping the Dodd-Frank Act (DFAST) stress test practices in place.
  • For smaller banks, more than three-quarters of those surveyed say they conduct an annual stress test.
  • When asked how their bank’s capital position would be affected in a severe economic downturn, more than half foresee a moderate impact on capital, with the bank’s capital ratio dropping to a range of 7 to 9.9 percent. Thirty-four percent believe their capital position would remain strong.
  • Following a statement issued by federal regulators late last year, 71 percent indicate they have implemented or plan to implement more innovative technology in 2019 to better comply with Bank Secrecy Act/anti-money laundering (BSA/AML) rules. Another 10 percent will work toward implementation in 2020.
  • Despite buzz around artificial intelligence, 63 percent indicate their bank hasn’t explored using AI technology to better comply with the myriad rules and regulations banks face.

To view the full results of the survey, click here.

What You Should Know About M&A in 2019



Deal values have been rising, and economic factors—including regulatory easing and increased deposit competition—could drive more deals for regional acquirers, explains Deloitte & Touche Partner Matt Hutton in this video. He also shares how nontraditional acquisitions could impact deal structures, and the importance of due diligence and stress testing at this stage in the credit cycle.

  • Today’s M&A Environment
  • Deal Structure Considerations
  • Expectations for 2019
  • Advice for Boards and Management Teams

Prepare Your Portfolio for an Economic Downturn


portfolio-11-12-18.pngAs we reach the 10-year anniversary of the inflection point of the 2008 financial crisis, it’s the perfect time to reflect on how the economy has (and hasn’t) recovered following the greatest economic downturn since the Great Depression. If you’ve paid the slightest attention to recent news, you’ve probably heard or read about the speculation of when the nation’s next economic storm will hit. While some reports believe the next downturn is just around the corner, others deny such predictions.

Experts can posit theories about the next downturn, but no matter how strong the current economy is or how low unemployment may be, we can count on at some point the economy will again turn downward. For this reason, it’s important that we protect ourselves from risks, like those that followed the subprime mortgage crisis, financial crisis, and Great Recession of the late 2000’s.

In an interview with USA Today, Mark Zandi, chief economist for Moody’s Analytics, explained, “It’s just the time when it feels like all is going fabulously that we make mistakes, we overreact, we over-borrow.”

Zandi also noted it usually requires more than letting our collective guard down to tip the economy into recession; something else has to act as a catalyst, like oil prices in 1990-91, the dotcom bubble in 2001 or the subprime mortgage crisis in 2006-07.

As the number of predictions indicating the next economic downturn could be closer than we think continues to rise, it’s more important to prepare yourself and your portfolio for a potential economic shift.

Three Tips for Safeguarding Your Construction Portfolio In the Event of an Economic Downturn

1. Proactively Stress Test Your Loan Portfolio
Advancements in technology have radically improved methods of stress testing, allowing lenders to reveal potential vulnerabilities within their loan portfolio to prevent potential issues. Technology is the key to unlocking this data for proactive stress testing and risk mitigation, including geotracking, project monitoring and customizable alerts.

Innovative construction loan technology allows lenders to monitor the risk potential of all asset-types, including loans secured by both consumer and commercial real estate. These insights help lenders pinpoint and mitigate potential risks before they harm the financial institution.

2. Increase Assets and Reduce Potential Risk While the Market’s Hot
If a potential market downturn is in fact on the horizon, now is the best time for lenders to shore up their loan portfolios and long-term, end loan commitments before things slow. This will help ensure the financial institution moves into the next downturn with a portfolio of healthy assets.

By utilizing modern technologies to bring manual processes online, lenders have the ability to grow their construction loan portfolio without absorbing the additional risk or adding additional administrative headcount. Construction loan administration software has the ability to increase a lender’s administrative capacity by as much as 300 percent and reduce the amount of time their administrative teams spend preparing reports by upwards of 80 percent. These efficiency and risk mitigation gains enable lenders to strike while the iron’s hot and effectively grow their portfolio to help offset the effects of a potential market downturn.

3. Be Prudent and Mindful When Structuring and Pricing End Loans
As interest rates continue to trend upward, it’s crucial that lenders price and structure their long-term debts with increased interest rates in mind. One of the perks of construction lending, especially in commercial real estate, is the opportunity to also secure long-term debt when the construction loan is converted into an end loan.

Due to fluctuations in interest rates, it’s important for financial institutions to carefully consider how long to commit to fixed rates. For lenders to prevent filling their portfolio with commercial loan assets that yield below average interest rates in the future, they may find it more prudent to schedule adjustable-rate real estate loans on more frequent rate adjustment schedules or opening rate negotiations with higher fixed rate offerings (while still remaining competitive and fairly priced, of course).

Though we can actively track past and potential future trends, it’s impossible to know for sure whether we are truly standing on the precipice of the next economic downturn.

“That’s one of the things that makes crises crises—they always surprise you somehow,” said Tony James, Vice Chairman or Blackstone Group, in an interview with CNBC.

No matter the current state of the economy, choosing to be prepared by proactively mitigating risk is always the best course of action for financial institutions to take. Modern lending technology enables lenders to make smart lending decisions and institute effective policies and procedures to safeguard the institution from the next economic downturn—no matter when it hits.

Concentration Risk Management Remains an Exam Focus: Stress Tests are Vital


risk-9-4-18.pngMake no mistake about it: If your bank has concentrations that are at or above regulatory guidelines, examiners will expect to see a stress test that supports your concentration risk management plan.

Stress testing has never been mandated for community banks—but it is a tool examiners expect banks to use if they have concentration issues in their portfolio. And this isn’t going to change, no matter what Congress does to ease regulatory burden.

In the past year, many community banks have had regulators question their concentration risk management practices. Examiners have said the stress tests will be the primary focus, and in some cases the only focus, of the inquiry.

In several cases, regulators downgraded the bank’s CAMELS score for not having adequate stress testing in place. Regulators are most focused on the management’s command of the tests, and how they make real and critical decisions related to capital and strategic planning.

Banks with New Concentration Issues of Interest
Commercial real estate (CRE) concentration risk management is not a new issue, but regulators are especially targeting banks without a long history of managing CRE concentrations, and are growing their CRE book at excessive rates. 

A BankGenome™ analysis shows that 2,004 banks have grown their CRE portfolios by more than 50 percent in the last three years, a level that has regulators concerned. As of the first quarter of 2018, 293 banks were over the 100 percent construction threshold and 420 banks exceeded the 300 percent total CRE guidelines. Of banks exceeding the thresholds, 54 banks also had 50 percent or more growth within the last three years – a sure sign they will face increased scrutiny under current guidance.

Anticipate Exam Scrutiny
If you are one of these banks, the worst thing you can do is overlook your next safety and soundness exam. Regulators will come in guns blazing, and you should prepare yourself accordingly.

There will be findings and perhaps even formal Matters Requiring Attention (MRAs), no matter how prepared you are.

Make Minor Findings a Goal
However, the key is to manage those findings. You want only minor infractions, such as not having enough loans with Debt-Service Coverage Ratios (DSCRs) in your core, or having to deal with model risk and model validation. Those are easy to address, while allowing examiners to show their boss that they extracted blood from you. 

You do NOT want examiners to say management doesn’t understand or use the stress test. Those type of findings are far more serious and could lead to CAMELS rating downgrades or worse.

Regulators Expect Stress Tests
Examiners expect banks with CRE concentrations to conduct portfolio stress testing, so bank management and the board can determine the correct level of capital the bank needs. 

Banks with concentrations would be smart to follow the stress testing best practices outlined by the Federal Reserve Bank of Richmond’s Jennifer Burns. Those include:

  • Running multiple scenarios to understand potential vulnerabilities
  • Making sure assumptions for changes in borrower income and collateral values are severe enough
  • Varying assumptions for what could happen in a downturn instead of just relying on what happened to a bank’s charge-off rates during the recession
  • Using the stress test results for capital and strategic planning
  • Changing the stress test scenarios to stay in sync with the bank’s current strategic plan

Burns’ article also notes that one new area of concern is owner-occupied CRE loans, which for years were considered extremely safe.

Report Finds Increased Scrutiny and Risk
The Government Accountability Office issued a report in March that warned of increased risk from CRE loan performance, though still lower than levels associated with the 2008 financial crisis. The GAO found that banks with higher CRE concentration were subject to greater supervisory scrutiny. Of 41 exams at banks with CRE concentrations, examiners documented 15 CRE-related risk management weaknesses, most often involving board and management oversight, management information systems and stress testing.

Prudential regulators acknowledge that proper concentration risk management is a supervisory concern for 2018.
The Office of the Comptroller of the Currency’s latest semi-annual risk perspective noted that “midsize and community banks continued to experience strong loan growth, particularly in CRE and other commercial lending, which grew almost 9 percent in 2017. Such growth heightens the need for strong credit risk management and effective management of concentration risk.”

A Multifaceted Approach to Managing CRE Concentration Risk


Concentration risk is drawing scrutiny from financial regulators, who are focusing on lenders’ commercial real estate (CRE) concentrations. Financial services organizations are responding to this by looking for ways to improve their CRE risk management and credit portfolio management capabilities.

Lending institutions with high CRE credit concentrations and weak risk management practices are exposed to a greater risk of loss. If regulators determine a bank lacks adequate policies, credit portfolio management, or risk management practices, they may require it to develop more robust practices to measure, monitor, and manage CRE concentration risk.

For several years, federal regulatory agencies have issued updated guidance to help banks understand the risks. In 2006, the Federal Reserve, the Federal Deposit Insurance Corp. and the Office of the Comptroller of the Currency issued a guidance related to CRE concentrations followed by a statement in 2015 titled “Statement on Prudent Risk Management for Commercial Real Estate Lending.” Noting that CRE asset and lending markets are experiencing substantial growth, the 2015 guidance pointed out that “increased competitive pressures are contributing significantly to historically low capitalization rates and rising property values” and said “many institutions’ CRE concentration levels have been rising.”

Since the 2006 guidance, additional regulatory publications related to CRE concentrations have been released. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) in 2010 began a shift, as banks with less than $10 billion in assets were exempt from more stringent requirements, according to a Crowe timeline analysis.

CRE-concentrations-small.png

Looking forward, the 2020 transition to the current expected credit loss (CECL) model for estimating credit losses will likely affect loan portfolio concentrations as well.

At the community bank level, CRE concentrations have been increasing. In 2016, CRE concentrations in smaller organizations had reached levels similar to mid-2007, according to Crowe’s analysis.

Comparison-small.png

These trends led regulators to sharpen their focus on CRE concentrations.

In one Crowe webinar earlier this year, 76 percent of the participants said their banks had some concern over how to better mitigate the risks associated with growing CRE concentrations.

In addition, 77 percent reported they received feedback within the past two years from regulators or auditors about CRE concentrations. The number of banks concerned about CRE concentration growth will likely continue to rise.

Approach to CRE Concentration Risk
The most effective methods for addressing concentration risk involve an integrated, holistic approach, which encompasses four steps:

  1. Validate CRE data. Banks must examine loan portfolio databases and verify the information is classified correctly. Coding errors and other inaccuracies often present a distorted picture of CRE concentrations.
  2. Analyze concentration risk. Banks can perform a risk analysis to expose both portfolio and loan sensitivity. Well-planned and carefully executed loan stratification can help management have a deeper understanding of their concentrations. Banks, even those not required to perform stress testing, should incorporate stress testing at the loan and portfolio levels.
  3. Mitigate CRE risk. Banks should establish policies and processes to monitor CRE loan performance and to adjust the mix of the portfolio as their risk appetite changes. Oversight of credit portfolio management is critical, as is an effective management information system.
  4. Report to management and the board. Reporting on a regular basis should include an update on mitigation efforts for any identified concentrations. Banks with higher levels of CRE loan activity might invest in dashboard reporting systems. The loan review and internal audit departments also should present additional reporting.

Loan Review and Stress Testing
Benefits can be gained by implementing a more dynamic loan review function that takes advantage of technology to identify portfolio themes and trends. The loan review function should identify if management reporting lacks granularity or other forms of risk associated with appraisal quality and underwriting practices.

Stress-testing practices can offer additional understanding of the effects economic variables might have on the portfolio. Tweaking several inputs can reveal how sensitive the bank’s models are to various scenarios. Stress testing can help facilitate discussions to better understand the loan portfolio and to identify better-performing borrowers and segments.

Other Best Practices
Other effective practices include establishing a CRE committee, creating a CRE dashboard, and adapting reporting functions to incorporate the loan pipeline. This approach can help management envision what concentrations will look like in the future if potential opportunities are funded. As CRE concentrations continue to attract regulatory scrutiny, risk management practices will become even more important to banking organizations.

Maximizing the Power of Predictive Analytics



Data analytics affects all areas of the bank, from better understanding the customer to addressing regulatory issues like stress testing. However, organizations face several barriers that prevent unlocking the power of predictive analytics. John Sjaastad, a senior director at SAS, outlines these barriers, and shares how bank management teams and boards can address these issues in this video.

  • The Importance of Predictive Analytics
  • Barriers to Using Predictive Analytics
  • Considerations for Bank Leaders

A Timely Reminder About the Importance of Capital Allocation


capital-7-6-18.pngCapital allocation may not be something bank executives and directors spend a lot of time thinking about—but they should. To fully maximize performance, a bank must both earn big profits and allocate those profits wisely.

This is why the annual stress tests administered each year by the Federal Reserve are important, even for the 5,570 banks and savings institutions that don’t qualify as systemically important financial institutions, or SIFIs, and are spared the ritual. The widely publicized release of the results is an opportunity for all banks to reassess whether their capital allocation strategies are creating value.

There are two phases to the stress tests. In the first phase, the results of which were released on June 21, the Fed projects the impact of an acute economic downturn on the participating banks’ balance sheets. This is known as the Dodd-Frank Act stress test, or DFAST. So long as a bank’s capital ratios remain above the regulatory minimum through the nine-quarter scenario, then it passes this phase, as was the case with all 35 banks that completed DFAST this year.

The second phase is the Comprehensive Capital Analysis and Review, or CCAR. In this phase, banks request permission from the Fed to increase the amount of capital they return to shareholders by way of dividends and share buybacks. So long as a bank’s proposed capital actions don’t cause its capital ratios from the first phase to dip below the regulatory minimum, and assuming no other deficiencies in the capital-planning process are uncovered by the Fed during CCAR, then the bank’s request will, presumably, be approved.

There’s reason to believe the participating banks in this year’s stress tests will seek permission to release an increasingly large wave of capital. Banks have more capital than they know what to do with right now, which causes consternation because it suppresses return on equity—a ratio of earnings over equity. And last year’s corporate income tax cut will only further fuel the buildup going forward, as profits throughout the industry are expected to climb by as much as 20 percent.

We probably won’t know exactly how much capital the SIFIs as a group plan to return over the next 12 months until, at the soonest, second-quarter earnings are reported in July. But early indications suggest a windfall from most banks. Immediately after CCAR results were released on June 28, for example, Bank of America Corp. said it will increase its dividend by 25 percent and repurchase $20.6 billion worth of stock over the next four quarters, nearly double its repurchase request over last year.

The importance of capital allocation can’t be overstated. It’s one of the most effective ways for a bank to differentiate its performance. Running a prudent and efficient operation is necessary to maximize profits, but if a bank wants to maximize total shareholder return as well, it must also allocate those profits in a way that creates shareholder value.

One way to do so is to repurchase stock at no more than a modest premium to book value. This is easier said than done, however. The only time banks tend to trade for sufficiently low multiples to book value is when the industry is experiencing a crisis, which also happens to be when banks prefer to hoard capital instead of return it to shareholders.

As a result, the best way to add value through capital allocation is generally to use excess capital to make acquisitions. And not just any ole’ acquisition will do. For an acquisition to create value, it must be accretive to a bank’s earnings per share, book value per share or both, either immediately or over a relatively brief period of time.

If you look at the two best-performing publicly traded banks since 1980, measured by total shareholder return, this is the strategy they have followed. M&T Bank, a $119 billion asset bank based in Buffalo, New York, has made 23 acquisitions since then, typically doing so at a discount to prevailing valuations. And Glacier Bancorp, a $12 billion asset bank based in Kalispell, Montana, has bolstered its returns with two dozen bank acquisitions throughout the Rocky Mountain region.

The point is that capital allocation shouldn’t be an afterthought. If you want to earn superior returns, the process of allocating capital must be approached with the same seriousness as the two other pillars of extraordinary performance—prudence and efficiency.

Now Is The Time to Use Data The Right Way


data-6-29-18.pngMost bankers are aware of the changes that are forthcoming in accounting standards and financial reporting for institutions of all sizes, but few are fully prepared for the complete implementation of all of the details in the new current expected credit loss (CECL) models that will take effect over the next few years.

Banks that act now to effectively and strategically collect, manage and utilize data for the benefit of the institution will be better positioned to handle the new accounting requirements under CECL and evolving regulations with state and federal agencies.

Here are three articles that cover key areas where your board should focus its attention before the rules take effect.


credit-data-6-29-18.pngCredit Data Management
Under Dodd-Frank, the law passed in the wake of the financial crisis, banks of all sizes and those especially in the midsize range of $10 billion to $50 billion in assets were required to do additional reporting and stress testing. Those laws have recently been changed, but many institutions in that asset category are opting to continue some form of stress testing as a measure of sound governance. Managing credit data is a key component of those processes.

management-6-29-18.pngCentralizing Your Data
Bank operations are known to be siloed in many cases as a matter of habit, but your data management can be done in a much more centralized manner. Doing so can benefit your institution, and ease its compliance with regulations.

CECL-6-29-18.pngGet Ready for CECL Now
The upcoming implementation of new CECL standards has many banks in a flurry to determine how those calculations will be developed and reported. Few are fully ready, but it is understood that current and historical loan level data attributes will be integral to those calculations.

M&A Readiness: Making Sure Your Bank Can Do Acquisitions


acquisitions-5-10-17.pngWith many financial institutions benefiting from increased stock values and renewed optimism following the November election, merger activity for community banks is on the uptick. Successful acquirers must remain in a state of readiness to take advantage of opportunities as they present themselves.

Whether a prolonged courtship or a pitch book from an investment banker, deals hardly, if ever, show up when it is most convenient for a buyer to execute on them. As a result, buyers need to develop a plan as to what they want, where they want it and what they are willing to pay for it, long before the “it” becomes available. M&A readiness equates to the board of directors working with management to have a well-defined M&A process that includes the internal and external resources ready to jump in to conduct due diligence, structure a transaction and map out integration. Also, M&A readiness requires that buyers have their house in order, meaning that their technology is scalable, they have no compliance issues and the capital is on hand or readily available to support an acquisition.

Technology. In assessing the scalability of an institution’s technology for acquisitions, a buyer should review its existing technology contracts to see if it has the ability to mitigate or even eliminate termination fees for targets that utilize the same core provider. Without this feature, some deals cannot happen due to the costs of terminating the target’s data processing contracts. Cybersecurity is another key element of readiness. As an institution grows, its cybersecurity needs to advance in accordance with its size. Buyers need to understand targets’ cybersecurity procedures and providers in order to ensure that their own systems overlap and don’t create gaps of coverage, increasing risk. Additionally, buyers should understand existing cybersecurity insurance coverage and the impact of a transaction on such policies.

Compliance. Compliance readiness, or lack thereof, are the rocks against which even the best acquisition plans can crash and sink. Ensure that your Bank Secrecy Act/anti-money laundering programs are above reproach and operating effectively, and that your fair lending and Community Reinvestment Act policies, procedures and practices are effective. Running into compliance issues will cause missed opportunities as the regulators prohibit any expansion activities until any issues are resolved.

Conducting a thorough review of compliance programs of a target is critical to an efficient regulatory and integration process. A challenge to overcome is the regulators’ prohibition on buyers reviewing confidential supervisory information (CSI), including exam reports as part of due diligence. While the sharing of this information has always been prohibited, the regulatory agencies have become more diligent on enforcement of this prohibition. Although it is possible to request permission from the applicable regulatory agency to review CSI, the presumption is that the regulators will reject the request or it will not be answered until the request is stale. As such, buyers should enhance their discussions with target’s management to elicit the same type of information without causing the target to disclose CSI. A simple starting point is for the buyer to ask how many pages were in the last exam report.

While stress testing may officially apply to banks with $10 billion or more in assets, regulators are expecting smaller banks to prevent concentrations of risk from building up in their portfolios. The expectation is for banks to conduct annual stress tests, particularly among their commercial real estate (CRE) loans. Because of these expectations, buyers need to know the interagency guidance governing CRE concentrations and how they will be viewed on a combined basis. Reviewing different stress-test approaches can help banks better understand the alternatives that are available to meet their unique requirements.

Capital. An effective capital plan includes triggers to notify the institution’s board when additional capital will be needed and contemplates how it will obtain that capital. Ideally, the buyer’s capital plan works in tandem with its strategic plan as it relates to growth through acquisitions. Recently the public capital markets have become much more receptive to sales of community bank stock, but this has not always been the case. In evaluating an acquisition, the regulators will expect to see significant capital to absorb the target as well as continue to implement the buyer’s strategic plan.

The increase in financial institution stock prices has increased acquisition opportunities and M&A activity since the election. Opportunistic financial institutions have plans in place and solid understandings of their own technology needs and agreements, regulatory compliance issues and capital sources. Although it sounds simple, a developed acquisition strategy will aid buyers in taking advantage of opportunities and minimizing risk in the current environment.