Communication: The Oft Forgotten Component of Bank Compliance

June 26, 2018 ~ Mary Crotty ~ Leave a comment

green headphones near laptop and microphone — Photo by samer daboul on Pexels.com

Banks spend enormous sums of money each year to meet their federal and state regulatory compliance requirements. They hire professionals with the requisite experience to tackle things like their Bank Secrecy Act and Information Security programs; they invest significant budget dollars in today’s sophisticated compliance software tools; and they spend countless hours developing policies, processes, and procedures to stay compliant.

But despite all that time, money, and effort, the one thing that often gets overlooked when it comes to bank compliance is communicating about it often and to everyone in the organization.

A Steady Stream of Communication

Several years ago, the Financial Crimes Enforcement Network (FinCEN) issued an Advisory to U.S. Financial Institutions on Promoting a Culture of Compliance. While this publication was geared toward BSA programs in 2014, its logic still applies today to a bank’s enterprise approach to compliance. Just as FinCen suggested then, it still is today: “The culture of an organization is critical to its compliance.”

Building a culture of compliance requires a steady stream of communication.

Upstream Communication

Ever since the 2008 financial crisis, federal banking regulators have emphasized that bank boards are ultimately responsible for all business operations, including compliance. Often, board members come from a variety of industries. Even those with a background in financial services often do not have particular compliance expertise.

That’s why they rely on those within the Compliance or Risk Management Office with the requisite expertise to keep them abreast of changes to regulatory guidance and laws, as well as to internal or external environmental changes that could impact the bank’s ability to comply with existing or changing regulations.

Cross-stream Communication

The Compliance Office is an interdependent function of almost every other bank area, including individual business units, corporate communications, e-commerce, finance, information technology, legal, marketing, product development, operations, risk management, and even third-party service providers. An institution’s ability to effectively comply with their regulatory requirements demands an open and healthy back-and-forth line of communication between the Compliance Office and these other areas.

For instance, if marketing is working with product development to roll out a new product and its corresponding marketing collateral, the Compliance Office should be in the loop. Conversely, if a new regulation is going into effect, such as the General Data Protection Regulation did in May, then it is incumbent upon the Compliance Office to provide timely details and periodic updates to the managers of all directly and indirectly impacted functions.

Downstream Communication

The everyday task of complying with many banking regulations falls on the shoulders of employees in either customer-facing or operations roles. They cannot be expected to do a good job at such compliance if they do not have the support and information they need.

Support comes in the form of senior management emphasizing their dedication to a culture of compliance in every word and action they take. Employees only buy-in when they believe senior management is on board and leading the way.

Information should come from the Compliance Office on a timely and routine basis, so that employees understand their responsibility to specific regulations, the importance of complying with them to the overall health of the institution and its customers, and where to go for help if they don’t understand either.

Don’t Let a Failure to Communicate Undermine Your Compliance Efforts

Sophisticated technology has certainly helped streamline bank compliance efforts, but it shouldn’t be considered a replacement for good, old-fashioned communication, which today, thanks to such technology, can be delivered in any number of ways to those who need it, so that it is at their fingertips at all times.

And by good, old-fashioned communication, I mean exactly what your sixth grade English teacher taught you. Explain the who, what, where, when, and why of the situation as concisely and yet comprehensively as possible.

The by-product of such communication is proof to bank examiners of your commitment to building a culture of compliance.

Federal Banking Regulators Mete Out $1.078 Billion in CMPs Since April

May 31, 2018May 31, 2018 ~ Mary Crotty ~ Leave a comment

On May 25, the Federal Deposit Insurance Corporation (FDIC) published its April enforcement actions, which included four orders to pay civil money penalties (CMPs), totaling $160,000. That’s not much of a story, but further digging reveals that between the FDIC, the Office of the Comptroller of the Currency (OCC), the Financial Crimes Enforcement Network (FinCEN), the Consumer Financial Protection Bureau (CFPB), and the Federal Reserve Board (FRB), federal banking regulators handed out $1,078,384,245 in CMPs from early April to early May.

(No enforcement actions were found for this time period on the National Credit Union Administration’s website.)

A closer look at these enforcement actions adds interesting context to the hefty fine total.

Both Individuals and Institutions Fined

In addition to the FDIC’s four orders to pay a CMP, the OCC issued seven such enforcement actions, while FinCEN and the CFPB issued one each, and the FRB issued two, for a total of 17 enforcement actions involving monetary fines. Those actions break down as follows:

Seven levied against institution-affiliated individuals: These current and former executives and/or directors were fined a total of $410,000, with CMPs ranging from $5,000 to $175,000.
Seven levied against traditional financial institutions: PNC Bank and Wells Fargo were each fined twice and three other banks were fined once by various agencies for a total of $1,069,974,245 in CMPs. The OCC and CFPB-combined $1 billion fine against Wells Fargo represents the majority of the bank fines. However, two other banks were still hit with significant fines: The OCC fined PNC $15 million and the FRB fined Goldman Sachs $54.75 million.
One levied against a casino: Per the USA PATRIOT Act’s broader definition of “financial institution,” FinCEN fined a casino (or card club) $8 million.

The Alleged and Admitted Violations

The seven institution-affiliated individuals were fined for a variety of reasons, including conducting unsafe and unsound practices, such as masking reporting losses; violating previous consent orders or failing to correct deficiencies cited in them; understating the allowance for loan and lease losses (ALLL) leading to a false or misleading CALL Report; and causing “the Bank to pay for personal expenditures without disclosure or authorization.”

The remaining CMPs levied against institutions involve the following laws or regulations:

Three institutions allegedly violated flood-related regulations: This includes a $5,000 fine from the FDIC, a $12,000 fine from the FRB, and a $207,245 fine from the OCC.
Two institutions allegedly violated the Federal Trade Commission Act (FTCA): The OCC fined PNC $15 million for deceptive acts or practices in violation of the FTCA, and it fined Wells Fargo $500 million for unsafe and unsound practices in violation of the same.
One institution allegedly violated the Consumer Financial Protection Act (CFPA): The CFPB fined Wells Fargo $1 billion for unfair and deceptive acts in violation of the CFPA, however it credited the OCC’s $500 million CMP towards the satisfaction of its own fine.
One institution admittedly violated the Bank Secrecy Act (BSA): FinCEN’s $8 million enforcement action against the above-referenced casino was due to its failure to establish and implement an effective anti-money laundering program as per the BSA.
One institution allegedly conducted unsafe and unsound practices in its Foreign Exchange Trading Business: The FRB fined Goldman Sachs “for deficiencies in Goldman’s internal controls and oversight of traders who buy and sell U.S. dollars and foreign currencies for the firm’s own accounts and for customers.”

The Million and Billion Dollar Fines

If you haven’t kept count, of the eight institutional fines, five of them exceeded a million dollars, three of them consisted of multi-million dollar CMPs, and Wells Fargo’s total fine hit the $1 billion mark.

Perhaps it is worth noting that the other three institutional fines ($5,000, $12,000 and $207,245) were the flood-related violations.

While the Trump administration’s deregulation stance is providing some much welcomed regulatory relief, this month’s worth of CMPs indicates that compliance with remaining laws and regulations is still a priority for federal banking regulators.

The OCC’s Risk Outlook

May 25, 2018 ~ Mary Crotty ~ Leave a comment

This week the Office of the Comptroller of the Currency (OCC) published its Semiannual Risk Perspective, which gives bank compliance officers and risk managers an important glimpse into the federal banking agency’s current outlook on risk.

Here is a brief summary of the report.

The Basics of the OCC’s Semiannual Risk Perspective

Every six months, the OCC’s National Risk Committee (NRC) issues the agency’s Semiannual Risk Perspective. According to the introduction to the Perspective, the NRC is made up of senior OCC supervisory and policy officials who meet quarterly.

The NRC is responsible for monitoring “the condition of the federal banking system and identifying key risks,” as well as monitoring emerging threats.

This Spring 2018 Semiannual Risk Perspective was published on May 24, 2018, and is based on data as of March 31, 2018, except where otherwise noted.

Overall Report Card

The Perspective’s Executive Summary provides an overall status of the banking system:

Condition of Federal Banking System: Strong
Comparison of System’s Condition: 2017 and 2018 show improvement over 2016
Economic Environment: Supports loan growth and profitability
Asset Quality: Sound
Capital and Liquidity: Near historical highs
Earnings: Improving
Overall Risk Management Practices: Incrementally improving

On Operational Risk

The OCC reports that “Operational Risk is elevated as banks adapt business models, transform technology and operating processes, and respond to evolving cyber threats.”

Specific threats to operational risk include the following:

Ever increasing threat of cyber attacks
Growing bank reliance on third-party vendors to perform critical functions
Concentration of third-party risk due to the “consolidation among large technology service providers”
Evolving business and operating models that include new delivery channels, products, and services

On Compliance Risk

The OCC warns that Compliance Risk “remains elevated,” with particular concern in the following areas:

Bank Secrecy Act (BSA) Compliance Challenges: The combination of the “dynamic nature” of money laundering along with “evolving delivery channels” makes complying with the BSA difficult. The OCC warns banks that are “engaging in such offerings” to refine and update their BSA compliance programs to ensure they are adequately mitigating the associated risks.
BSA and Anti-Money Laundering (AML) Compliance Risk Management Systems: The OCC notes that, such BSA/AML risk management systems “often do not keep pace with evolving risks, resource constraints, changes in business models, and regulatory changes.”
OFAC Sanctions: The OCC questions whether bank OFAC compliance programs are keeping pace with the increasing number and complexity of sanctions programs.
Overall Regulatory Complexity: The number of amended regulations and/or highly complex requirements continue to present challenges for banks.
Specific Complexity of TRID: The OCC acknowledges the continued bank struggle to incorporate the Truth-in-Lending RESPA Integrated Disclosure (TRID) forms.

On Interest Rate Risk

The OCC states that, “There is uncertainty in how bank deposits will react to increasing interest rates. Banks may experience unexpected adverse shifts in liability mix or increasing costs that may adversely affect earnings or increase liquidity risk.”

Read the OCC’s complete Semiannual Risk Perspective for Spring 2018 for an even more in-depth analysis of the current state of banking in the United States.

OCC Warns Banks Against Complacency

January 22, 2018January 23, 2018 ~ Mary Crotty ~ Leave a comment

By Mary Crotty, Freelance Writer for Banks and Third-Party Service Providers

Twice a year the Office of the Comptroller of the Currency (OCC) releases a summary of current and emerging risk trends for the banking system. The OCC’s latest “Semiannual Risk Perspective for Fall 2017” (Perspective) was published last Friday, January 18, and is based on financial data compiled and analyzed through June 30, 2017.

While noting a strong economy and continued improvement in overall bank performance, the Perspective does sound some warning bells. “The current operating environment presents strategic risk for many banks in increasingly diverse ways. Thus, this report emphasizes the need for vigilance by bank management at this point in the economic cycle.”

OCC-Noted Risk Areas

Credit Policy and Practices: The OCC warns that banks are slowly loosening their commercial credit underwriting practices due to increased competition. It also noted an increased concentration in Commercial Real Estate (CRE), a trend it noted could hurt the entire financial system if not monitored and checked.
Cybersecurity Programs: Cyber criminals continue to evolve their methods and tools faster than bank cybersecurity programs can keep up.
Vendor Management Programs: Banks’ increasing reliance on third-party service providers, especially for critical functions, continues to concern the OCC.
Bank Secrecy Act (BSA) Compliance: Just like cybercrime, money laundering continues to evolve into an ever more complex crime that creates significant problems for banks. The OCC warns that banks are struggling to comply with the BSA, even before the related Customer Due Diligence (CDD) Final Rule goes into effect on May 11, 2018.
Consumer Protection Compliance: According to the Perspective, consumer compliance risk management continues to be an issue for banks “due to the increasing complexity in consumer compliance regulations.”
Current Expected Credit Loss (CECL) Model: The OCC also warns that the “current expected credit losses standard for which implementation begins in 2020 may pose operational and strategic risk to some banks when measuring and assessing the collectability of financial assets.”

Avoid Complacency

The Perspective reads like a road map for determining what areas will receive the most attention during upcoming regulatory examinations. There are two things your bank can do right now to improve its performance on such examinations:

Review the following policies and make sure processes and procedures reflect any updates: Credit Policy, Cybersecurity Policy, Vendor Management Policy, Bank Secrecy Act Policy, UDAAP Policy and other consumer protection policies.
Reiterate your bank’s policy stances by communicating them with your employees.