On April 28th, 2023, the Federal Reserve, FDIC, Government Accountability Office (GAO) and New York Department of Financial Services (NYDFS) released reports on the supervision and regulation of Silicon Valley Bank (SVB) and Signature Bank. The reports outline factors that the regulators and the GAO believe contributed to the failures, including the quality of bank supervision and the impact of the 2018 regulatory relief law and subsequent tailoring framework.
The reports send two clear messages: regulators will enhance regulations over the coming years and promptly intensify supervision for banks of all sizes. Changes across the following four themes will raise the regulatory bar for banks and increase costs as they make investments in people, processes and technology.
- Intensifying supervision
- Shortening remediation timelines
- Revising regulatory tailoring
- Strengthening regulation
Intensifying supervision
The reports describe delays in issuing supervisory findings and ratings downgrades until well after weaknesses were first identified. The FDIC and NYDFS reports cite resource limitations as a contributing factor while the Fed suggests that the delayed issuance of findings resulted in part from the (i) the effects of regulatory relief that reduced standards, increased complexity, and promoted a “less assertive supervisory approach,” (ii) pressure to reduce burdens and (iii) heightened proof required for supervisory conclusions. In response, all bank regulators have already initiated a course correction to increase the speed and impact of supervision by:
Empowering and upgrading examination teams resulting in faster findings. Addressing the cultural and structural sources of slow supervisory actions will be a top priority for the regulators. In doing so, they will examine the capability, capacity, tools, training, communication and decision-making authority of examination staff. Supervisory leadership will also be sending strong messages to examination teams to take a more aggressive posture and more quickly issue supervisory findings when they observe weaknesses. In addition to decision-making, regulators will be upgrading staffing and training, especially around the root causes of the failures (e.g., interest rate risk management, liquidity risk in a digital economy), and could make greater use of horizontals and system specialist resources to conduct more thorough examinations. All of these changes will mean an increase in findings and possibly enforcement actions which will in turn have a marked impact on bank ratings.
Smoothing the transition between supervisory portfolios. The reports describe ineffective shifts between supervisory portfolios and examination teams as the banks grew. For example, the Fed report identifies a view that the bank’s new exam team had to spend time developing its own understanding and building sufficient evidence before issuing findings. We believe the regulators will take steps to streamline the transition between supervisory portfolios, improve information sharing between examination teams, and ramp-up supervisory expectations/require banks to meet higher supervisory standards as they approach transition thresholds.
Increasing focus on new risk characteristics for heightened scrutiny. While revising categories in the tailoring framework will take time to work through the rulemaking process, the regulators will be able to more quickly direct supervisory attention to banks showing risk factors illuminated by the recent bank failures. Specifically, the Fed’s report cites its new supervisory group for novel activities, such as fintech or crypto, in the context of its plans to pay closer attention to firms that are growing rapidly and have unique, concentrated business models.
Shortening remediation timelines
All three reports are critical of the failed banks’ responsiveness to supervisory findings as well as the actions of the regulators to encourage faster remediation. The Fed report identifies a number of options to increase expectations and add real economic incentives to shorten timelines to remediate deficient practices:
Faster escalations and ratings downgrades. The Fed and FDIC reports indicate examiners will be expected to downgrade banks’ management ratings in response to slow remediation of supervisory findings. The Fed report also notes that “supervisors could also systematically elevate focus on long-dated, material issues to promote more rapid remediation.” This suggests that Vice Chair for Supervision (VCS) Michael Barr will set a tone from the top for faster escalation and exercise greater use of enforcement powers for unresolved supervisory findings.
Supplemental capital and liquidity charges for inadequate risk management, governance and controls. One of the most notable suggestions is the possibility that US regulators could mandate increased capital or liquidity levels as a means to drive faster management action in response to supervisory findings. Raising interim capital and liquidity requirements is a practice that has been adopted by a number of foreign regulators via Pillar II of the Basel framework, but US regulators have thus far limited their use of this approach.
- Limitations on incentive compensation and capital distributions. While implementing Pillar II would require rulemaking, the regulators may be able to more quickly add limitations on incentive compensation and capital distributions, which VCS Barr noted “could be appropriate and effective in some cases.” Each report highlights a lack of responsiveness by the failed banks’ Boards and senior management, which may drive consideration of using economic incentives to prompt a more serious response to regulatory remediation. The regulators may also devote greater attention to the standards for banks’ incentive compensation programs, as the Fed’s report noted that SVB’s compensation decisions were primarily based on financial performance and did not include risk metrics.
Revising regulatory tailoring
The Fed report is critical of both the definitions of the bank categories in the tailoring framework and the length of the transition to new requirements as a bank grows. As such, it is all but certain that the Fed will revise the tailoring framework categories, transition periods and the requirements that apply to each category:
- Criteria for categories. Currently, the tailoring categories are defined by different thresholds for banks’ asset size, cross-jurisdictional activity, nonbank assets, weighted short-term wholesale funding (STWF) and off-balance sheet exposure. The Fed report indicates it will reevaluate the thresholds for these existing criteria and also consider new risk indicators to better capture potential vulnerabilities and sources of contagion. Given the nature of the recent stress, potential new category indicia could include concentrated business models, levels of uninsured deposits, pace of growth or other criteria indicating a “novel business model.” In his statement accompanying the Fed’s report, VCS Barr stated the review of the tailoring framework would cover “a range of rules for banks with $100 billion or more in assets,” but it’s an open question whether the Fed will consider options to elevate banks below that threshold to a greater level of scrutiny. Separately, the FDIC has a different tailoring framework with higher asset thresholds than the Fed for tougher capital and liquidity requirements. Given the recent failures of FDIC-regulated banks, the FDIC will reconsider if lower asset thresholds are more appropriate.
- Transition periods. The Fed report highlights the recently failed banks crossed the $100 billion asset threshold for Category IV under the tailoring framework as early as 2021, but the transition period in the rules meant the banks were not yet mandated to meet Category IV requirements at the time of their failure. We expect any revision of the tailoring framework to shorten these transition periods and require growing banks to prepare to meet enhanced prudential standards as they approach the next threshold.
- Requirements. As the tailoring framework was intended to scale back regulatory requirements for smaller and less complex banks, it reduced the scale of capital and liquidity standards as well as the frequency of stress testing and resolution planning for banks in the lowest two categories. We expect the review of the tailoring framework to once again raise the bar for these categories, for example by revisiting the frequency of stress testing and reducing the ability for these banks to opt out of recognizing unrealized gains or losses on available-for-sale securities in calculating their regulatory capital through accumulated other comprehensive income (AOCI). For a summary of potential changes to regulatory requirements across the tailoring framework, see Appendix A.
Strengthening regulation
The Fed’s report confirms that it will not only continue its work to enhance regulatory requirements for large regional banks, but it will strengthen a number of pillars of its regulatory framework in a way that could impact banks of all sizes. We expect to see changes in the following areas:
Elevating standards for liquidity ratios and liquidity stress testing. The reports identify weaknesses in managing liquidity risk and interest rate risk as two primary factors contributing to the bank failures. As part of the revision of requirements across the tailoring framework, regulators will evaluate increases to the liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) standards as well as the frequency of liquidity reporting for Category III and IV banks. While such revisions work through the rulemaking process, the regulators will increase supervisory expectations with a particular focus on banks with high concentrations in uninsured deposits and idiosyncratic balance sheet profiles perceived as higher risk. In addition, we expect heightened scrutiny around internal liquidity stress testing assumptions and the operational capacity to execute contingency funding plans.
Determining new requirements for interest rate risk management. Unlike liquidity risk, there are no standardized rules that govern interest rate risk management for US banks. Regulators instead rely on supervision and guidance to set expectations for sound practices. Interagency guidance for interest rate risk was last published in 2010, and simply reaffirmed practices outlined in guidance issued nearly three decades ago. With recent events shining a spotlight on interest rate risk management, regulators will take a close look at introducing new rules including prescriptive requirements on modeling, assumptions, limits and disclosures. New rulemaking would be a reconsideration by US regulators of their decision to not implement the full suite of requirements recommended by the Basel Committee on Banking Supervision (BCBS) in its 2016 publication of Interest Rate Risk in the Banking Book.
Expanding capital stress testing scenarios. Before the bank failures, the Fed was considering ways to expand its Comprehensive Capital Analysis and Review (CCAR) scenarios and announced a new “exploratory market shock” for the largest US banks as part of its 2023 scenarios. These additional scenarios are intended to stress a wider variety of risks – both that have already been observed in recent years and more novel situations. It is important to note that, even if a rising rate scenario had been included in recent stress tests, its impact on capital would have been limited for banks using the AOCI opt-out for AFS securities.
Implementing Basel III Endgame. The report is explicit that, while the proximate cause of the bank failures was a bank run, the underlying issue was insolvency, and VCS Barr reiterated plans for a holistic review of the capital framework, including as part of the anticipated Basel III Endgame rulemaking. By framing the holistic review and work on Basel III Endgame with the statement that “strong bank capital matters,” VCS Barr leaves little doubt that regulatory capital requirements will materially increase, which was expected even prior to the release of the Fed’s report. US bank regulators are expected to issue this spring a notice of proposed rulemaking implementing Basel III Endgame, a suite of rules that will change how much capital firms need to hold against credit, market and operational risk exposures. While efforts to design its implementation in the US have been underway for several years, recent events could expand the proposed group of banks subject to this new capital regime.
Enhancing resolution planning and long-term debt requirements. The reports highlight that both failed banks were not required to file a resolution plan at the holding company level due to regulatory tailoring and had three-year transition periods to file plans at the depository institution level. As such, it is reasonable to expect that regulators will reevaluate the timing and scope of resolution planning requirements for banks with under $250 billion in assets. Separately, the regulators had already issued an Advance Notice of Proposed Rulemaking on adding long-term debt requirements for large regional banks and announced last September that they will issue new resolution plan guidance for Category II and III banks. Although both failed banks were in Category IV, the FDIC’s recent experience with their resolution may prompt a re-evaluation and augmentation of the planned guidance for larger banks.
What should banks do to prepare for supervisory and regulatory change?
Changes to supervision and regulation will require banks of all sizes to enhance their risk management practices and governance across each of the following areas:
- 1. Boards
- 2. CEOs
- 3. Finance and Business Lines
- 4. Risk
- 5. Internal Audit
- 6. Exam Management and Regulatory Response
1. Boards
- Affirm the stature of risk, compliance and internal audit functions
- Evaluate Board composition, experience, and committee structure
- Evaluate and enhance practices for holding management accountable including how risk and compliance outcomes factor into incentive compensation and performance decisions
- Review risk appetite statements and risk oversight capabilities to make sure they are commensurate with the bank’s scale, strategic plans, risk profile and risk management capabilities
- Demand thorough, digestible and actionable analysis and reporting on risk management across all stripes, with a particular focus on liquidity and interest rate risk
2. CEOs
- Set a tone from the top on the importance of a strong risk culture to improve oversight, governance, and accountability within the business strategy.
- Hold teams accountable for sustainable, cost effective solutions to improve the risk and control environment
- Analyze potential business impact of higher capital and liquidity charges as well as resulting implications on competitive positioning and strategy
3. Finance and Business Lines
- Review and strengthen models, assumptions and sensitivity testing for liquidity stress testing with enhanced scenarios for rapid deposit outflows, impact of social media/digital platforms, and rising interest rates
- Refine contingency funding plans and improve operational readiness including more thorough testing of contingent liquidity sources and management actions
- Conduct pro-forma impact analysis and begin positioning governance and decision-making frameworks for expected changes to capital and liquidity requirements (e.g., Basel III Endgame, removal of AOCI opt-out and LCR outflow rates for uninsured deposits)
- Make upgrades to data and technology infrastructure to support new capital, liquidity and interest rate risk requirements
4. Risk
- Make sure risk identification programs fully capture inherent risks and related controls, and that there are linkages between risks and liquidity and capital stress testing
- Review frameworks for managing risk including the development of controls, metrics, limits and responses to limit breaches as well as through ongoing monitoring.
- Enhance staffing, training and technology for risk monitoring and aggregation
5. Internal Audit
- Assess the audit plan and re-evaluate the reasonableness of risk assessments, audit scopes and timing in root cause areas (e.g., liquidity, interest rate risk)
- Review the rigor and effectiveness of issues validation, risk monitoring and escalation processes
- Evaluate and enhance capabilities and skills in highly technical financial and operational risk areas
- Perform specialized audits of the design and execution of incentive compensation programs to see whether they sufficiently consider risk metrics and regulatory remediation
6. Exam Management and Regulatory Response
- Review upcoming examination schedule and conduct readiness assessments to prepare for more thorough examinations
- Strengthen issues management processes including escalation, reporting and technology capabilities
- Re-assess status and current timing of existing regulatory commitments in anticipation of possible changes in dates driven by supervisory actions
Appendix B
Appendix B: Summary of increased supervisory expectations
As described in previous sections, we expect to see more forceful supervision with more thorough examinations and faster escalation of persisting supervisory issues. The table below outlines specific areas where we expect greater supervisory attention.
