Devoted to Advancing the Practice of Bank Supervision Vol. 12, Issue 1 Inside Strategic Planning in an Evolving Earnings Environment Bank Investment in Securitizations: The New Regulatory Landscape in Brief Regulatory and Supervisory Roundup Summer 2015 . Supervisory Insights Supervisory Insights is published by the Division of Risk Management Supervision of the Federal Deposit Insurance Corporation to promote sound principles and practices for bank supervision. Martin J. Gruenberg Chairman, FDIC Doreen R. Eberley Director, Division of Risk Management Supervision Journal Executive Board Division of Risk Management Supervision George E. French, Deputy Director and Executive Editor James C.

Watkins, Senior Deputy Director Brent D. Hoyer, Deputy Director Mark S. Moylan, Deputy Director Melinda West, Deputy Director Division of Depositor and Consumer Protection Sylvia H.

Plunkett, Senior Deputy Director Jonathan N. Miller, Deputy Director Regional Directors Michael J. Dean, Atlanta Region Kristie K.

Elmquist, Dallas Region Stan R. Ivie, San Francisco Region James D. La Pierre, Kansas City Region M.

Anthony Lowe, Chicago Region John F. Vogel, New York Region Journal Staff Kim E. Lowry Managing Editor Michael S.

Beshara Financial Writer Scott M. Jertberg Financial Writer Supervisory Insights is available on-line by visiting the FDIC’s Web site at www.fdic.gov. To provide comments or suggestions for future articles, request permission to reprint individual articles, or request print copies, send an e-mail to SupervisoryJournal@fdic.gov. The views expressed in Supervisory Insights are those of the authors and do not necessarily reflect official positions of the Federal Deposit Insurance Corporation.

In particular, articles should not be construed as definitive regulatory or supervisory guidance. Some of the information used in the preparation of this publication was obtained from publicly available sources that are considered reliable. However, the use of this information does not constitute an endorsement of its accuracy by the Federal Deposit Insurance Corporation. .

Issue at a Glance Volume 12, Issue 1 Summer 2015 Letter from the Director ........................................................................................................................................................ 2 Articles Strategic Planning in an Evolving Earnings Environment 3 The financial performance of banks is steadily improving; however, these institutions continue to face a challenging operating environment. This article provides an informal perspective on the strategic planning process and its importance for successful bank operations. The article concludes with a discussion of strategic planning in the context of issues bank boards and managements are dealing with today. Bank Investment in Securitizations: The New Regulatory Landscape in Brief 13 During the most recent financial crisis, many banks suffered significant losses on investment- grade securitizations thought to be low-risk investments.

Following enactment of the Dodd-Frank Act, federal bank regulatory agencies issued regulations and guidance to reduce the likelihood of this happening again. This article summarizes the most important new requirements related to investment in securitizations, including potential effects on capital, and explains how an investment decision process can be structured to help a bank remain compliant with these new requirements. Regular Features Regulatory and Supervisory Roundup 24 This feature provides an overview of recently released regulations and supervisory guidance. Supervisory Insights Summer 2015 1 . Letter from the Director T he articles in this issue of Supervisory Insights address topics of importance to bankers and bank examiners. Featured articles in this issue discuss the importance of strategic planning for banks in the current challenging operating environment, and provide an overview of new regulations pertaining to securitization investments. As always, the articles in Supervisory Insights should not be viewed as supervisory or regulatory guidance, but are intended as a resource that some bankers and examiners may find useful. Even though the financial performance and condition of banks have improved during recent years, the operating environment remains challenging. “Strategic Planning in an Evolving Earnings Environment” highlights the critical role bank corporate governance and strategic planning play in navigating a challenging operating environment.

The article provides an informal perspective on the strategic planning process, and concludes with a discussion of strategic planning as it relates to important issues that bank boards and managements are dealing with today. During the most recent financial crisis, many banks suffered significant losses on investment-grade securitizations thought to be low-risk investments. Following enactment of the Dodd-Frank Act, federal bank regulatory agencies issued regulations and guidance to reduce the likelihood of banks experiencing similar problems in the future. “Bank Investment in Securitizations: The New Regulatory Landscape in Brief” summarizes the most important new requirements related to investment in securitizations, including potential effects on capital, and discusses how an investment decision process can be structured to help a bank remain compliant with these new requirements. This issue also includes our regular overview of recently released regulations and supervisory guidance. We hope you find the articles in this issue to be informative and helpful.

We encourage our readers to provide feedback and suggest topics for future issues. Please e-mail your comments and suggestions to SupervisoryJournal@fdic.gov. Doreen R. Eberley Director Division of Risk Management Supervision .

Strategic Planning In An Evolving Earnings Environment R ecent years have seen a steady improvement in the financial performance and condition of small FDIC-insured depository institutions. The improvement has been driven by reductions in the volume of nonperforming loans and a recovery in loan growth that recently has gathered momentum. Yet as every banker knows, the operating environment remains highly competitive and challenging. In the FDIC’s experience, the plans and strategies of bank management and the approach to managing risk are the most important determinants of a bank’s ability to generate sustainable earnings.

External financial trends have an important influence on earnings, of course, but it is bank management that charts the course in the face of those trends and ultimately determines success. This article starts with an informal perspective on strategic planning and concludes by discussing strategic planning in the context of issues bank boards and managements are dealing with today. Strategic planning is a specific aspect of corporate governance that is of particular interest given the significant business decisions banks need to make regarding loan growth, asset-liability management, and other matters. The discussion is intended to provide food for thought, but should not be viewed as supervisory guidance.

Select existing FDIC guidance on corporate governance, including strategic planning, is summarized in a text box at the end of this article. Perspectives on governance and planning Successful bank operations require sound decision-making by a bank’s board of directors and executive officers and effective control of operations; this is the subject matter of corporate governance. Corporate governance can be more or less formal depending on the size and complexity of the bank, but the effectiveness of governance is always a critical determinant of the long-term health of the bank. Strategic planning involves setting the direction of the bank and the broad parameters by which it will operate. Doing this is a basic responsibility of boards of directors, with the assistance of executive officers. Indeed, setting the strategic objectives and future direction of the bank is a key theme running through FDIC guidance regarding corporate governance and is the initial step in a sound governance framework.

For example, the Pocket Guide for Directors states that the board of directors should “…establish, with management, the institution’s long- and short-term business objectives, and adopt operating policies to achieve these objectives in a legal and sound manner.”1 The FDIC’s Risk Management Manual of Examination Policies2 and the Interagency Guidelines Establishing Standards for Safety and Soundness (safety-and-soundness standards)3 also outline basic principles for a sound planning process. 1 See https://www.fdic.gov/regulations/resources/director/pocket.html 2 See for example the Management and Earnings sections https://www.fdic.gov/regulations/safety/manual/ See for example the Asset Growth and Earnings sections https://www.fdic.gov/regulations/laws/rules/2000-8630. html#fdic2000appendixatopart364 3 Supervisory Insights Summer 2015 3 . Strategic Planning continued from pg. 3 Often, banks will have a written strategic plan, but the importance of strategic planning goes beyond producing a piece of paper. Strategic planning can be viewed as a dynamic process for evaluating the bank’s current status, establishing appropriate business objectives, developing plans and risk tolerances, and ensuring policies and controls are in place to make sure the bank operates within the parameters established by the board. Such planning reflects an active and engaged board of directors. There is no one right way to conduct strategic planning, but a prerequisite is a solid understanding by directors and officers of the current operating environment; the bank’s condition, risk exposure, and business model; and key opportunities and challenges.

Such challenges could be external or could involve the bank’s own operational and risk management weaknesses, if applicable. Understanding the starting point can help ensure that planned initiatives are consistent with available expertise and resources. Management should also consider the potential risk impact, contingencies and unforeseen events when making strategic decisions, including the possibility that the economic environment may change unfavorably and unexpectedly.

Effective planning processes 22 20 18 16 14 12 10 8 6 4 Supervisory Insights cover at least a three-to-five year time horizon and provide for regular reviews of results to determine whether adjustments or other course corrections are needed. An important aspect of the planning process is managing the tradeoff between risk and return. This tradeoff is relevant to many strategic decisions including those regarding loans, investments, asset-liability management and initiatives regarding non-interest income. Generally speaking, capital, earnings and staff expertise should have a reasonable correlation to the institution’s risk profile.

This means, first, that banks must understand their own risk profile, including current credit risk and exposure to adverse future credit developments, asset-liability mismatches, and exposure to the potential for securities depreciation. Assessing risk involves not only understanding the bank’s loans, investments and deposits, but taking a macro view by considering possible adverse changes in the institution’s market area or to interest rates. When evaluating risk-return tradeoffs, the next key question is whether the bank is positioned for sustained performance given its risk profile. Higher-risk profiles should be balanced by greater resources in Summer 2015 .

terms of capital and reserves, reasonably sustainable income, and risk management expertise. Managing to earnings targets without regard to risk would be inadvisable. For example, a bank with peer average capital ratios and a one percent return-on-assets (ROA), but extremely high risk in the loan portfolio, might not have sufficient earnings and capital support for its activities, while average capital ratios and a lower ROA might be more than adequate for a bank with a low and stable risk profile. None of this discussion should be taken to suggest that the FDIC expects elaborate, consultant-driven strategic planning documents every time a small bank wants to try something new. What is important is a clear focus on the bank’s core mission, vision, and values; solid understanding of the institution’s current risks; proper due diligence and resource allocation before expanding into new lines of business; and an objective, frequent, and wellinformed follow-up process. Another critical aspect of managing the tradeoff between risk and return is the use of risk limits and riskmitigating strategies when limits are breached.

As part of their oversight of management, a board of directors is expected to establish risk limits for the bank’s material financial activities, including loans and investments, interest rate risk, funding sources, and other matters. Risk limits can allow for exceptions with appropriate vetting and approval, but generally speaking the limits should be set so mitigating steps are expected when limits are breached. Bank examiners and bank boards and management must concern themselves with risk-management issues relevant to the long-run health of banks. Accordingly, there is significant overlap between the risk-management factors examiners review when rating a bank, and the types of issues an engaged bank management team should be considering as part of the planning process. The text box illustrates this idea in the context of how examiners rate the quality of earnings. Supervisory Insights Summer 2015 5 .

Strategic Planning continued from pg. 5 Rating Earnings Knowing whether your earnings are adequate for current operations and sufficient to maintain capital and loan loss reserves going forward is an important responsibility for bank directors and management. Let’s consider two insured institutions, each with $500 million in total assets and each with an ROA of one percent. Earnings should be rated the same at each bank, right? Not necessarily.

Let’s first look at how examiners rate earnings. The Uniform Financial Institutions Rating System (UFIRS) was adopted by the Federal Financial Institutions Examination Council (FFIEC) on November 13, 1979, and was updated effective January 1, 1997.4 Under the UFIRS, each financial institution is assigned a composite rating based on an evaluation and rating of six essential components of an institution’s financial condition and operations. These component factors address the adequacy of capital, the quality of assets, the capability of management, the quality and level of earnings, the adequacy of liquidity, and the sensitivity to market risk. Evaluations of the components take into consideration the institution’s size and sophistication, the nature and complexity of its activities, and the institution’s risk profile. The UFIRS states that the rating of the earnings component reflects not only the quantity and trend of earnings, but also factors that may affect the sustainability or quality of earnings.

The quantity as well as the quality of earnings can be affected by excessive or inadequately managed credit risk that may result in loan losses, high administration costs, and require additions to the allowance for loan and lease losses (ALLL), or by high levels of market risk that may unduly expose an institution’s earnings to volatility in interest rates. The quality of earnings may also be diminished by undue reliance on non-recurring or volatile earnings sources, such as extraordinary gains on asset sales, nonrecurring events, or favorable tax effects. Future earnings may be adversely affected by an inability to forecast or control funding and operating expenses, improperly executed or ill-advised business strategies, or poorly managed or uncontrolled exposure to other risks. According to the UFIRS, the rating of an institution’s earnings is based on, but not limited to, an assessment of the following evaluation factors: „ The level of earnings, including trends and stability. „ The ability to provide for adequate capital through retained earnings. „ The quality and sources of earnings. „ The level of expenses in relation to operations. „ The adequacy of the budgeting systems, forecasting processes, and management information systems in general. „ The adequacy of provisions to maintain the allowance for loan and lease losses and other valuation allowance accounts. „ The earnings exposure to market risk such as interest rate, foreign exchange, and price risks. Now, let’s look at what Interagency Guidelines say about how a bank’s board and management should be evaluating earnings.

The FDIC issued Part 364 of its Rules and Regulations to implement standards for safety and soundness required by Section 39 of the FDI Act.5 Appendix A to Part 364 – Interagency Guidelines Establishing Standards for Safety and Soundness – sets forth the safety-and-soundness standards that we use to identify and address problems at insured depository institutions before capital becomes impaired.6 Appendix A outlines procedures that banks should employ to periodically evaluate and monitor earnings to ensure earnings are sufficient to maintain capital and loan loss reserves. At a minimum, this analysis should: „ Compare recent earnings trends relative to equity, assets, or other commonly used benchmarks to the institution’s historical results and those of its peers; „ Evaluate the adequacy of earnings given the size, complexity, and risk profile of the institution’s assets and operations; „ Assess the source, volatility, and sustainability of earnings, including the effect of nonrecurring or extraordinary income or expenses; „ Take steps to ensure earnings are sufficient to maintain adequate capital and reserves after considering asset quality and growth rate; and „ Provide periodic earnings reports with adequate information for management and the board of directors to assess earnings performance. Now, let’s return to our two $500 million banks that each have a one percent ROA, but this time, with a little more information. The first bank’s ROA had been hovering at about 0.8 percent for several years, but increased due to income from a new program of high yielding, but high-risk lending the bank launched about a year ago. The new lending program has grown rapidly.

The bank’s loan loss reserve has been dwindling due to increasing loan losses related to the program, and the capital ratio has been falling due to the growth. Also, the bank’s board has not placed limits on loan growth, and management has been unable or unwilling to forecast how large the high-risk loan portfolio will become. The second bank has not changed its lending product line for a number of years and has grown steadily, maintaining around a one percent ROA during that time, including through several business cycles. Management and the bank’s board have recently decided to launch a new product line and have forecasted the effects on earnings, the loan loss reserve, and capital over the next three years.

The board has placed limits on the size of the new product line and risk tolerance “circuit breakers” so new lending will stop if the income it produces isn’t sufficient to build the additional loan loss reserves and capital needed for the new activity. Now, would you rate earnings the same at both banks? No, and here’s why. Although these are just thumbnails and we don’t have all the facts, the first bank appears to have some credit-risk issues and risk-management problems that would indicate earnings may be falling short of what they need to support operations and build capital and reserves. And, they don’t appear to be doing an adequate job of monitoring the adequacy of earnings, contrary to the expectations in Appendix A to Part 364.

On the other hand, the second bank appears to have done a good job of maintaining earnings. Also, management’s decision to “look before they leap” into a new product shows they have considered the risk/return of the new strategy and have built in a contingency plan if it doesn’t work. 4 FDIC Statement of Policy, Uniform Financial Ratings System, January 1, 1997 https://www.fdic.gov/regulations/laws/rules/5000-900.html 5 Part 364 of the FDIC Rules and Regulations, Standards for Safety and Soundness. https://www.fdic.gov/regulations/laws/rules/2000-8600.html Appendix A to Part 364 – Interagency Guidelines Establishing Standards for Safety and Soundness, https://www.fdic.gov/regulations/laws/rules/2000-8630. html#fdic2000appendixatopart364 6 22 20 18 16 14 12 10 8 6 4 Supervisory Insights Summer 2015 . Navigating a changing environment The current earnings environment brings opportunities and challenges to small banks’ management teams. Community banks’ earnings continue to recover from the effects of the financial crisis (see Chart 1).7 As of first quarter 2015, year-over-year earnings grew 16 percent for community banks, driven by a recovery in loan growth and ongoing improvements in asset quality. Loan balances in all major categories at community banks increased year-over-year as of first quarter 2015 (see Chart 2), and noncurrent loan rates continued to trend downward (see Chart 3). Amid these positive developments, the earnings environment remains uncertain. Challenges include ongoing competitive pressure on net interest margin and non-interest income, the effects of a historically low interest-rate environment, and the risks posed by a potential future increase in interest rates. Given this challenging and everchanging business environment, sound governance and planning are prerequisites for sustained profitability that can and should provide signposts for business decisions.

In this section, we emphasize these points with reference to some of the critical strategic decisions small banks are facing today. Chart 1 Chart 2 Chart 3 There is an old saying that “failing to plan is planning to fail.” One important lesson we learned from the financial crisis is that poor planning can harm institutions, their communities, and the financial system as a whole. Many financial institution failures were traced to management engaging in a new or expanded business line without adequate planning, controls, and 7 Data for charts 1, 2 and 3 are from the FDIC Quarterly Banking Profile https://www2.fdic.gov/qbp/index.asp Supervisory Insights Summer 2015 7 . Strategic Planning continued from pg. 7 understanding of the risks related to the new activity. based on their lower incidence of credit loss. One of the most important current strategic planning questions for small banks is how to participate in the recent renewal of loan growth. The increase in lending is a welcome development that in broad terms signals ongoing recovery from the crisis. It is appropriate that small banks contribute to this recovery and benefit from the opportunities it creates.

At the same time, it is especially important for banks entering new areas of lending or considering significant expansion plans to do this pursuant to a prudent, diligently executed strategy. The business focus of many small banks on real estate lending, a lending sector whose performance has been highly cyclical, underscores the importance of prudent risk management of lending activities. Significant changes in lending activity are likely to require board-approved changes to the lending policy. Banks’ lending policies reflect strategic decisions about market area, underwriting standards, appropriate diversification, extent of planned growth and other matters.

Important controls to implement the lending policy include, among other things, credit approval processes, ongoing credit monitoring and risk rating, management of exceptions, and handling of problem credits. The safety-and-soundness standards and Interagency Guidelines for Real Estate Lending Policies provide guidance on sound risk management and controls for the lending function.9 Strategic decisions regarding lending should be discussed in terms of the implications for the bank’s risk profile inherent in those decisions. For example, the bank may be considering pursuing a higher-yielding lending segment, but would need to carefully consider whether these loans are of a quality to assure either continued debt servicing or principal repayment.8 In other words, will the new lending segment contribute to sustainable earnings or have an unacceptably high risk of hurting the bank’s performance in the long term? Conversely, some lower-yielding lending segments may contribute more to earnings over time The real-estate crises of the late 1980s and early 1990s, and the more recent crisis, provide striking examples of the importance of maintaining prudent risk management of lending activities.10 A good example is the experience of ADC lenders during the crisis. Studies conducted by the FDIC Office of Inspector General (OIG) based on Material Loss Reviews11 indicate that during the recent crisis, the level of ADC concentrations, the risk management of those concentrations, and the responsiveness to supervisory concerns where applicable, all mattered greatly in separating the survivors from those that failed. See “Quality of Bank Earnings” in FDIC, Risk Management Manual of Examination Policies, page 5.1-6, for further discussion. 8 See https://www.fdic.gov/regulations/laws/rules/2000-8630.html#fdic2000appendixatopart364 and https://www.fdic.gov/regulations/laws/rules/2000-8700.html#fdic2000appendixatosubapart365 9 Information about the banking crisis of the 1980s and early 1990s can be found, for example, in Federal Deposit Insurance Corporation, History of the Eighties: Lessons for the Future, Federal Deposit Insurance Corporation, 1997. 10 11 The Inspector General of the appropriate federal banking agency must conduct a Material Loss Review when losses to the Deposit Insurance Fund from failure of an insured depository institution exceed certain thresholds. See http://www.fdicoig.gov/mlr.shtml for further details. 22 20 18 16 14 12 10 8 6 4 Supervisory Insights Summer 2015 .

In describing the characteristics of a sample of ADC specialists that remained in satisfactory condition between year-end 2007 and April 2011, a 2012 OIG report12 stated, “Ultimately, the strategic decisions and disciplined, values-based practices and actions taken by the Boards and management helped to mitigate and control the institutions’ overall ADC loan risk exposure and allowed them to react to a changing economic environment.”13 In particular, the report stated that ADC specialists that remained in satisfactory condition throughout the period were more likely to have implemented more conservative growth strategies, relied on core deposits and limited net non-core funding dependence, implemented prudent risk-management practices and limited speculative lending, loan participations, and out-of-area lending, and maintained stable capital levels and access to additional capital if needed. Recent improvements in small banks’ earnings highlight the importance of maintaining an adequate ALLL. ALLL ratios at small banks currently are trending downward with provisions near historic lows. The ALLL, which is intended to measure probable credit losses on loans or groups of loans, is one of the most significant management estimates in an institution’s financial statements.14 Moreover, the processes for determining the ALLL are an important part of the overall risk management of the loan portfolio and should generate important information for the board and senior management about financial conditions and trends facing the institution. The processes include regular and consistent risk analysis, effective loan review that identifies and addresses problem assets in a timely manner, prompt charge-off of loans or portions of loans that are uncollectible, and a regular review of the ALLL methodology by a party independent of the credit approval and ALLL estimation process. This review by a second set of eyes should help ensure the ALLL methodology is credible and not influenced by a desire to bolster reported earnings. Another important area of strategic focus is the response to the historically low interest rate environment and preparedness for potential future increases in interest rates.

The interest rate environment has been challenging for small banks’ earnings during the post-crisis period and poses strategic challenges for bank management teams going forward. Dimensions of the issue include the downward trend in NIM and increase in maturities of assets, the changing composition of liabilities, and the potential impact of a rising-rate environment on interest income and expense and the value of investment portfolios. The possibility of interest rates transitioning away from historically low levels raises strategic questions about preparedness and highlights the importance of the whatif questions bankers can and should be posing to their interest rate riskmanagement staff and systems. Supervisory guidance and technical resources on interest rate risk are readily available to every small bank. The last issue of Supervisory Insights, for example, was devoted to practical advice on interest rate risk management for small banks.

Perhaps the most important advice is that planning for the potential impact of rising FDIC Office of Inspector General, “Acquisition, Development and Construction Loan Concentration Study,” Report No. EVAL-13-001, October, 2012. 12 13 Ibid, page iii. 14 See “Interagency Policy Statement on the Allowance for Loan and Lease Losses,” 2006. Supervisory Insights Summer 2015 9 . Strategic Planning continued from pg. 9 interest rates is too important to be left entirely to those who run the interest rate risk-management systems and models. Senior management and the board should actively question how the bank would fare under rising interest rates, including what would happen if depositors prove more ratesensitive than expected, the extent of securities depreciation that would be expected, and whether risk-mitigation steps are needed. An intensely competitive financial services marketplace continues to place ongoing pressure on noninterest income. Pressures on interest and non-interest income, in turn, put pressure on banks to reduce overhead expense.

Consequently, many small institutions would likely give strategic attention to opportunities that might arise to increase non-interest income or reduce non-interest expense. As a general matter, banks should be thorough in their due diligence with regard to planned new activities to increase fee or other non-interest income, including identifying and vetting in advance the potential risks of the activity and the expertise and resources needed for success. Expense reductions should be carefully reviewed to ensure they do not compromise franchise value or the ability to conduct important functions in a safe-and-sound manner and in compliance with applicable laws and regulations. As a general rule, even more care is warranted when the bank has been approached with unsolicited opportunities to boost income or cut expense. Finally, we recognize that strategic planning choices that are straightforward in principle may not be easy to implement when the operating environment changes continuously and sometimes dramatically.

A good example of this is cybersecurity risk, the importance of which has become increasingly evident over time. We have always expected business continuity and disaster recovery considerations to be incorporated in an institution’s business model. However, in addition to preparing for natural disasters and other physical threats, continuity now also means preserving access to customer data and the integrity and security of that data in the face of cyberattacks. For this reason, the FDIC encourages banks to practice responses to cyber risk as part of their regular disasterplanning and business-continuity exercises.

They can use the FDIC’s Cyber Challenge program, which is available on our public web site at www.fdic. gov.15 Cyber Challenge was designed to encourage community bank directors to discuss operational risk issues and the potential impact of information technology disruptions. The FDIC also works as a member of the FFIEC to implement actions to enhance the effectiveness of cybersecurity-related supervisory programs, guidance, and examiner training. The FFIEC recently released a Cybersecurity Assessment Tool to help institutions identify risks and assess their cybersecurity preparedness.16 15 22 20 18 16 14 12 10 8 6 4 Supervisory Insights https://www.fdic.gov/regulations/resources/director/technical/cyber/purpose.html 16 The Assessment and other resources are available at https://www.ffiec.gov/cybersecurity.htm Summer 2015 .

Conclusion Banking is an intensely competitive business that is subject to significant and unexpected economic change. The return of loan growth and an uncertain future interest-rate environment pose important strategic questions for bank directors and executive managers. In this challenging environment, a disciplined approach to identifying opportunities and risks, planning for the achievement of goals within acceptable risk tolerances, and staying on course with an appropriate control framework are pre-requisites for success. Long-standing corporate governance principles, sensibly applied based on the size and complexity of operations, are the starting point for an engaged bank management team to achieve these goals. Policy staff of the Division of Risk Management Supervision Supervisory Insights Summer 2015 11 . Strategic Planning continued from pg. 11 Select Concepts and Existing Guidance on Corporate Governance Corporate governance broadly refers to the set of relationships, policies and processes that provide strategic direction and control in a company. For a bank, corporate governance determines the effectiveness and safety and soundness of operations. The appropriate scope and formality of governance depends on the volume, scope, and complexity of activities.

For a small, non-complex bank, governance does not necessarily need to be complicated: what is needed is a board and senior management that are fully engaged in understanding and managing the bank and its risks. The governance responsibilities of banks’ managements and boards of directors are different. The UFIRS,17 effective January 1, 1997, states: “Generally, directors need not be actively involved in day-to-day operations; however, they must provide clear guidance regarding acceptable risk exposure levels and ensure that appropriate policies, procedures, and practices have been established. Senior management is responsible for developing and implementing policies, procedures, and practices that translate the board’s goals, objectives, and risk limits into prudent operating standards.” Directors and officers may work toward a common goal, but ultimately the board is responsible for monitoring management and business operations. The duties and responsibilities of directors of state nonmember banks are summarized in the FDIC’s Pocket Guide for Directors and the Statement Concerning the Responsibilities of Bank Directors and Officers.

These include important common law duties of loyalty and care. The Pocket Guide for Directors also indicates that bank boards should “establish, with management, the institution’s long- and short-term business objectives, and adopt operating policies to achieve these objectives in a legal and sound manner.” This critical planning function is discussed further below. Among the other duties of the board specifically described in the Pocket Guide are monitoring bank operations to ensure they are controlled adequately and are in compliance with laws and policies, keeping informed of the activities and condition of the institution and its operating environment, appointing qualified management, and supervising management.

Supervising management includes, at a minimum, establishing policies regarding loans, investments, capital planning, profit planning and budget, internal audit and controls, and compliance, among other things; monitoring implementation of boardapproved policies; providing for third-party review and testing of compliance with policies; heeding supervisory reports and recommendations; and avoiding preferential transactions. An authoritative source of guidance on bank governance is the Interagency Guidelines Establishing Standards for Safety and Soundness. Section 39 of the FDI Act required each federal banking agency to establish certain safety-andsoundness standards for insured depository institutions.18 These interagency guidelines are detailed in Appendix A to Part 364 of the FDIC Rules and Regulations,19 published in 1995, and provide institutions with supervisory expectations for internal controls and information systems, internal audit, loan documentation, credit underwriting, interest-rate exposure, asset growth, asset quality, earnings and compensation, fees, and benefits. The safety-and-soundness standards provide a framework for sound risk management, corporate governance, and the supervision of operations for many of the most important areas of the bank. These standards are intended to guide riskmanagement practices and identify emerging problems and deficiencies before capital becomes impaired.

Bank directors should be aware of these standards and ensure that bank management has established appropriate risk-management procedures and policies for each area. 17 FFIEC Policy Statement on Uniform Financial Institutions Rating System. https://www.fdic.gov/regulations/laws/rules/5000-900.html 18 https://www.fdic.gov/regulations/laws/rules/1000-4100.html 19 https://www.fdic.gov/regulations/laws/rules/2000-8630.html#fdic2000appendixatopart364 22 20 18 16 14 12 10 8 6 4 Supervisory Insights Summer 2015 . Bank Investment in Securitizations: The New Regulatory Landscape in Brief T he recent financial crisis provided a reminder of the risks that can be embedded in securitizations and other complex investment instruments. Many investment grade securitizations previously believed by many to be among the lowest risk investment alternatives suffered significant losses during the crisis. Prior to the crisis, the marketplace provided hints about the embedded risks in these securitizations, but many of these hints were ignored. For example, highly rated securitization tranches were yielding significantly greater returns than similarly rated non-securitization investments. Investors found highly rated, highyielding securitization structures to be “too good to pass up,” and many investors, including community banks, invested heavily in these instruments.

Unfortunately, when the financial crisis hit, the credit ratings of these investments proved “too good to be true;” credit downgrades and financial losses ensued. In the aftermath of the financial crisis, interest rates have remained at historic lows, and the allure of highly rated, high-yielding securitization structures remains. Much has been done to mitigate the problems experienced during the financial crisis with respect to securitizations. Congress responded with the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and regulators developed and issued regulations and other guidance designed to increase investment management standards and capital requirements. The gist of these new requirements is simple: banks should understand the risks associated with the securities they buy and should have reason- Supervisory Insights able assurance of receiving scheduled payments of principal and interest. This article summarizes the most pertinent of these requirements and provides practical advice on how the investment decision process can be structured so the bank complies with the requirements. The guidance and regulations applicable to bank investment activities reviewed in this article are: „ Office of the Comptroller of the Currency (OCC): 12 CFR, Parts 1, 5, 16, 28, 60; Alternatives to the Use of External Credit Ratings in the Regulations of the OCC.

http:// www.gpo.gov/fdsys/pkg/FR-2012-0613/pdf/2012-14169.pdf „ OCC: Guidance on Due Diligence Requirements to determine eligibility of an investment (OCC Guidance); http://www.gpo.gov/fdsys/pkg/ FR-2012-06-13/pdf/2012-14168.pdf „ Federal Deposit Insurance Corporation (FDIC): 12 CFR Part 362, Permissible Investments for Federal and State Savings Associations: Corporate Debt Securities; https:// www.fdic.gov/regulations/laws/ federal/2012/2012-07-24_final-rule. pdf „ FDIC: 12 CFR Part 324, Regulatory Capital Rules; Implementation of Basel III (Basel III); http://www. gpo.gov/fdsys/pkg/FR-2013-09-10/ pdf/2013-20536.pdf „ FDIC: 12 CFR Part 351, Prohibitions on certain investments (The Volcker Rule); (https://www.fdic. gov/news/board/2013/2013-1210_notice_dis-a_regulatory-text.pdf) Summer 2015 13 . Bank Investment in Securitizations continued from pg. 13 The OCC’s 12 CFR, Parts 1, 5, 16, 28, and 160. Alternatives to the Use of External Credit Ratings in the Regulations of the OCC This OCC regulation implemented Section 939A of the Dodd-Frank Act, which required bank regulators to remove references to credit ratings in regulations pertaining to investments and substitute alternative standards of creditworthiness. The final rule was published in the Federal Register on June 13, 2012 and became effective on January 1, 2013.

This rule did not drastically shift prescribed bank practice, but rather clarified examiners’ intent to focus on pre-purchase analysis and credit monitoring. This subject was addressed in a Supervisory Insights article titled, “Credit Risk Assessment of Bank Investment Portfolios.”1 Prior to the changes implemented by the Dodd-Frank Act, the top four rating bands assigned by nationally recognized statistical ratings organizations for fixed-income securities were generally considered “investment grade” by bank regulators. With some exceptions outlined below, bank management is now required to perform appropriate due diligence, and conclude that the risk of default is low and the issuer has adequate capacity to pay the principal and interest as scheduled.

The rule also requires banks to understand and evaluate the risks of investment securities. For example, the rule states, “Fundamentally…banks should not purchase securities for which they do not understand the risks.”2 The OCC’s Guidance on Due Diligence Requirements to Determine Eligibility of an Investment Concurrent with the final rule, the OCC published guidance on due diligence requirements. The OCC guidance states that the following investment securities are generally not subject to the investment grade determination: „ U.S.

Treasury obligations; „ U.S. agency obligations; „ Municipal government general obligations; and „ Municipal revenue bonds—when the investing bank is considered well-capitalized. For these types of securities, there is no requirement for the investing bank to determine that default risk is low and the issuer has capacity to make scheduled payments. Management is required to assess the potential risks in the pre-purchase analysis and ongoing monitoring. For municipal general obligation bonds and municipal revenue bonds (in the case of well-capitalized banks), an initial credit assessment and regular credit review are required, but the review is not required to meet the test of determining low default risk and adequate payment capacity.

Other types of municipal bonds such as Certificates of Participation (COPs) and Tax Increment Financing (TIFs) are neither general obligations nor revenue bonds and, consequently, banks investing in these instruments are required to determine that default 1 See “Credit Risk Assessment of Bank Investment Portfolios,” Supervisory Insights, Volume 10, Issue 1, Summer 2013. 2 22 20 18 16 14 12 10 8 6 4 Supervisory Insights 12 CFR Parts 1, 5, 16, 28, and 160. Federal Register, Vol. 77, No.

114, Wednesday, June 13, 2012, page 35254. Summer 2015 . risk is low and payment capacity is adequate in the pre-purchase analysis and ongoing monitoring. The OCC’s guidance stipulates that bank management must understand the inherent risks posed by a security before investing. Specifically, the guidance elaborates on expectations of pre-purchase analysis of structured investments, and declares it unsafe and unsound to purchase a complex security without understanding the structure and analyzing the performance under stressed scenarios. Management’s analysis of a particular investment should be documented; the type of documentation varies with the complexity of the investment instrument. For example, a mediumterm note with no call features may be evaluated with comparatively less documentation, while a mezzanine class of a collateralized loan obligation would require substantial documentation to demonstrate an understanding of the instrument and its anticipated performance in stressed scenarios. The Supervisory Insights article3 mentioned above addresses this subject in greater depth. The FDIC’s Part 362, Activities of Insured State Banks and Insured Savings Associations This rule was published December 1, 1998 and became effective January 1, 1999.

The FDIC has published various amendments to the regulation since its original effective date, but the general theme of the rule remains the same: to restrict, without the prior approval of the FDIC, insured state banks and savings associations from engaging in activities and investments that are not permissible for national banks or federal savings associations, respectively. Generally, in applying Part 362, the FDIC considers regulatory restrictions imposed by the OCC on national banks and federal savings associations to apply to state banks and state savings associations engaged in the same activities and investments. As such, provisions in the OCC’s regulation on credit ratings applicable to national banks also apply to state banks.

Similarly, provisions in the OCC’s regulation on credit ratings applicable to federal savings associations also apply to state savings associations. See “Credit Risk Assessment of Bank Investment Portfolios,” Supervisory Insights, Volume 10, Issue 1, Summer 2013. 3 Supervisory Insights Summer 2015 15 . Bank Investment in Securitizations continued from pg. 15 The most recent update to this rule specifically applies the OCC’s rule on credit ratings to state savings associations’ investments in corporate debt. Specifically, state thrifts are prohibited from acquiring a corporate debt security before determining the issuer has adequate capacity to repay the debt according to the original terms. The rule requires ongoing periodic determinations of the issuer’s ability to perform according to the terms of the security; the rule applies to corporate debt purchased before the effective date. The Basel III Capital Rule The FDIC issued an interim final rule on September 10, 2013 and later issued a final rule on April 8, 2014. For the risk-based capital requirements of most banks, the final rule was effective on January 1, 2015; banks applying the advanced approaches risk-based capital framework were required to comply with certain aspects of the final rule (including the advanced approaches risk-based capital requirements) by January 1, 2014. The FDIC’s Part 324 implements changes required by the Dodd-Frank Act and elements of the international agreement titled “Basel III: A Global Regulatory Framework for More Resilient Banks and Banking Systems” (December 2010, as revised June 2011).

This rule is generally known as the “Basel III Capital Rule.” The rule addresses capital calculations and assigns risk weights to bank assets and exposures used to determine capital ratios. The supplementary information accompanying the rule explains that a securitization is a 22 20 18 16 14 12 10 8 6 4 Supervisory Insights credit exposure that results from separating an underlying exposure into at least two tranches with differing levels of seniority. Simply stated, if there is tranching of credit risk, the exposure is a securitization.

The rule uses the term “exposure” rather than “asset” because the rule addresses on- and off-balance sheet risks; “exposure” encompasses both. The rule’s impact on operational requirements for securitization exposures of banks is contained in Section 324.41(c), which covers due diligence requirements for securitization exposures. Section 324.42 of the rule states, in effect, that the FDIC (or other applicable bank regulatory agency) may require a supervised institution to assign a 1,250 percent risk weight to a securitization exposure if the institution does not understand the features of a securitization exposure that would materially affect its performance. The nature of the institution’s analysis in this respect “must be commensurate with the complexity of the securitization exposure and the materiality of the exposure in relation to its capital.” Assigning a 1,250 percent risk weight with an eight percent capital requirement would have the economic effect of requiring the bank to hold one dollar of capital for every dollar invested in that particular investment security. Consider a $1 million investment in the mezzanine tranche of a residential mortgage-backed security (MBS).

Assume the underlying loans are exhibiting no significant financial stress, and the subordinate tranche reasonably supports the mezzanine tranche. The exact risk weighting is a function of either the simplified supervisory formula approach Summer 2015 . (SSFA) or the “gross up approach.” For additional information on the SSFA and a calculation tool, consult Financial Institution Letter, 7-2015, (https://www.fdic.gov/news/news/financial/2015/fil15007.html). The nuances of the calculation are not the focus of this article; this example will use a 150 percent risk weight—a plausible risk weight for a mezzanine tranche. Applying a 150 percent risk weight and an eight percent capital requirement results in a capital charge of $120,000 (150 percent risk weight * $1 million investment * 8 percent capital requirement = $120,000). Failing to meet the due diligence requirements described above would force the capital charge to $1 million (1,250 percent risk weight * $1 million investment * 8 percent capital requirement = $1 million). The FDIC’s Part 351, Prohibitions and Restrictions on Proprietary Trading and Certain Interests in, and Relationships with, Hedge Funds and Private Equity Funds The FDIC’s Part 351 was issued on January 31, 2014, and implements Section 619 of the Dodd-Frank Act. The rule is widely known as the Volcker Rule. Among other things, the Volcker Rule prohibits banks from investing in or sponsoring hedge funds and private equity funds; the rule refers to these as “covered funds.” The rule defines a covered fund as an issuer that is exempt from registration as an investment company under the Investment Company Act of 1940 (often referred to as the “ ‘40 Act”) Supervisory Insights by way of Section 3(c)(1) or Section 3(c)(7) of the ‘40 Act. Section 3(c) (1) and 3(c)(7) exemptions are applicable when the number of investors is limited and the investors meet either an income test or a net worth test, respectively.

Banks, thrifts, and bank holding companies are typically considered qualified investors under 3(c)(7). The effective date of the final rule was April 1, 2014; however, banking entities generally had until the end of the conformance period, July 21, 2015, to comply with most provisions of the Volcker Rule. However, the compliance deadline for investments in and relationships with covered funds that were in place prior to December 31, 2013 has been extended to July 21, 2016, and the Board of Governors of the Federal Reserve System has publicly indicated that it anticipates further action to extend the conformance period for these covered funds to July 21, 2017. The Volcker Rule specifically excepted loan securitizations from the definition of covered funds. As a result, many traditional securitizations held by banks will be excepted from the Volcker Rule as loan securitizations, provided that the underlying assets are limited to loans and certain other credit-related assets. However, introducing even a minimal allocation to equities, bonded debt, commodities, or other non-qualifying assets could result in the securitization investment being considered a restricted covered fund investment.

As such, banks need to understand the assets that underlie the loan securitizations in which they invest. Summer 2015 17 . Bank Investment in Securitizations continued from pg. 17 The Investment Decision: Merging the Various Rules Into a Decision Process Although each rule described above has a distinct objective, one common element is required for complying with each rule: understanding the key features and risks of the investment. „ Complying with the OCC’s Rule on Alternatives to Credit Ratings and the FDIC’s Part 362 requires a determination that default risk is low and the issuer has the capacity to perform according to the terms of the debt. „ Complying with the Basel III capital rule for securitizations requires an understanding of the features of a securitization exposure that would materially affect the performance. „ Determining the Basel III risk weighting for a securitization tranche requires knowledge of the tranche’s specific position in the cash flow waterfall of the securitization and the performance metrics of the underlying loans (all of which is available initially from the offering circular or prospectus and on an ongoing basis from servicer or trustee reports). „ Complying with the Volcker Rule requires knowledge of the investment’s registration status and asset composition. If the investment is exempt from registration under the Investment Company Act of 1940, management must determine which section was relied upon for exemption. If Section 3(c)(1) or 3(c)(7) were relied upon, the investment is prohibited by the Volcker Rule unless the underlying assets consist only of loans and other qualifying assets. 22 20 18 16 14 12 10 8 6 4 Supervisory Insights In each of these cases, understanding the structure and risk characteristics of the investment is required to comply with the rules, and the decision to invest should be supported by appropriate documentation as discussed below. Demonstrating an understanding of an investment security requires a knowledge of the details of the instrument (purpose, rate, index/margin for adjustable rate issues, maturity, possible extensions, payments in kind, allowable payment deferrals, repayment source, etc.) and consideration of risk factors that could adversely affect performance.

A thorough analysis of the performance resulting from interest rate environments ranging from down 300 - 400 basis points to up 300 - 400 basis points is appropriate. (In the present lowrate environment, down 300 - 400 basis points is not a relevant scenario for many securities). The analysis should consider the possibility of a deterioration in the credit quality of the issuer(s) and downturns in the industry and the economy.

Different types of securities warrant different analyses. Risks should be considered in light of the bank’s portfolio risk. For instance, a single investment in a collateralized loan obligation (CLO) may not present a concentration of risk; however, when the investment is considered alongside other CLO investments in the bank’s portfolio, a concentration in a single name underlying different CLOs may arise. The plausible adverse scenarios should be considered, and management should be confident that the security’s performance is not unduly exposed to plausible adversities. Summer 2015 .

Often the window to make an investment decision is small; however, urgency to act does not eclipse the need for a prudent evaluation. The over-arching question can be answered immediately: “Is bank management familiar with this investment class?” If a bank investment officer is not familiar with the proposed security, the immediate decision should be to defer the investment decision until management has developed an understanding of the security and its associated risks. These instances should be rare because the bank’s investment policy should connect the expertise of management with the permissible investment strategies. If the bank’s board of directors adopts a new investment strategy for its investment policy, the board should ensure the management team possesses the expertise to execute the strategy. In addition, management can construct a decision framework that implements the board’s investment policy and streamlines the investment selection process.

One example is an investment’s expected average life. If the board’s investment policy permits mortgage-backed securities, the policy should also address maximum average expected life of the security and set tolerances for variation in the average life. If the policy requires an investment’s average life to be less than ten years in the current interest rate environment and to extend no more than five years in all interest rate scenarios ranging from down four percent to up four percent, that metric could be incorporated into the decision framework. Some banks use third-party analytics as inputs to their investment deci- Supervisory Insights sion process.

Regulatory guidance regarding due diligence specifies that management may delegate analysis to third parties, but cannot delegate responsibility for decision-making. Management should be satisfied that third-party providers are independent (the broker selling the security is not independent), reliable, and qualified. Projections and analysis from thirdparty providers should be subjected to hindsight analysis. For example, did the analyst’s projected changes in average life prove to be accurate when a change in interest rates was actually observed? The board of directors should review the decision-making process and ensure that the process adequately implements the investment policy. Presuming the bank’s investment policy permits the proposed investment, and management understands the basic structure and risks of the investment, the next step is to determine whether the investment requires an investment grade determination. If the investment is issued by the U.S. Treasury or an agency of the U.S. government, an investment grade determination is not required, and the decision can proceed to determining the suitability of the investment for the bank.

Although the OCC’s regulation on Alternatives to the Use of Credit Ratings does not require municipal general obligation bonds to satisfy the investment grade criteria to be eligible for investment, the guidance does require an initial credit assessment and ongoing reviews consistent with the risk characteristics of the bond and the overall risk of the portfolio. Summer 2015 19 . Bank Investment in Securitizations continued from pg. 19 If the investment is not a U.S. Treasury, agency, or municipal general obligation bond, or municipal revenue bond (in the case of well-capitalized banks), the next concern should be determining whether the investment is a securitization. Recall that, for purposes of the Basel III Capital Rule, any tranching of credit risk results in a securitization.

If the proposed investment is not a securitization, the decision can move to determining default risk and ability to perform. If the investment is a securitization, a reasonable first question would be, “Is the issue registered with the SEC as an investment company?” If so, the decision-maker can determine whether the instrument is investment grade. If the issue is not registered, the next question should be, “What section of the ‘40 Act is invoked to avoid registration?” If either Section 3(c)(1) or 3(c)(7) is used, the investment may be a covered fund under the Volcker Rule. The next step is to assess the underlying assets.

If the securitization consists entirely of loans, it is not considered a covered fund for purposes of the Volcker Rule. If any asset class other than loans or other qualifying assets is represented, the security may be deemed a covered fund in which case it would be a restricted investment under the Volcker Rule. 4 22 20 18 16 14 12 10 8 6 4 Supervisory Insights Presuming the previous determinations deem the security acceptable to this point, the analysis can move to judging the default risk and the issuer’s capacity to perform according to the stated terms. Regulatory guidance describes “key factors” to consider when gauging credit risk of corporate bonds, municipal bonds, and structured securities. An example of the type of analysis that could be conducted was described in the Supervisory Insights article4 mentioned above.

Finally, periodic reviews are required over the life of the investment. The frequency and intensity of the review should be appropriate in light of the risk posed by the specific investment and overall risk of the bank’s portfolio. An overview of the information contained in this article regarding the pre-purchase analysis of potential securitization investments is contained in the accompanying flow chart (see page 11), “Pre-purchase Considerations for Prospective Securitization Investment.” A footnote to the flow chart refers to the technical assistance available from the FDIC regarding identifying permissible vs. impermissible investments under the Volcker Rule, and calculating securitization capital requirements using the SSFA. Ibid Summer 2015 .

Pre-purchase considerations for prospective securitization investment: Step 1: Is the securitization a permitted investment under the Volcker Rule?* Does the securitization rely on the exclusions contained in sections 3(c)(1) or 3(c)(7) of the Investment Company Act of 1940?* No Yes Does the securitization qualify for a loan securitization exemption under Section _.10(c)(8) of the Volcker Rule?* No Yes Does the securitization qualify for any other exemption contained in the Volcker Rule?* No Do not invest. No Do not invest. Yes Step 2: Do you have a comprehensive understanding of the securitization? Have you performed the proper due diligence to attain a comprehensive understanding of the features of the securitization exposure that would materially affect the performance of the exposure and to determine if the securitization is investment grade?¹ Yes Step 3: Determine regulatory capital requirement. Apply either the SSFA or the Gross-Up approach to determine risk weight.² Alternatively, may apply a 1,250% risk weight.³ *Technical assistance in identifying permissible vs. impermissible investments under the Volcker Rule is available on the FDIC’s website or by contacting CapitalMarkets@fdic.gov. ¹ Due diligence requirements can vary by security type. For example, an investment grade determination is generally not required for securities issued or guaranteed by the U.S. Treasury or an Agency of the U.S.

government, municipal general obligation bonds or, if your bank is well-capitalized, municipal revenue bonds. See OCC Guidance on Due Diligence Requirements. ² A SSFA Securitization Tool is available on the FDIC’s website to assist institutions that use the SSFA approach to calculate the applicable risk weights for securitization exposures. ³ A 1,250% risk weight may be required for existing security holdings where an institution cannot demonstrate a comprehensive understanding of the features of the securitization exposure that would materially affect the performance of the exposure. Supervisory Insights Summer 2015 21 . Bank Investment in Securitizations continued from pg. 21 Documenting Analysis Demonstrating adherence to the various rules will require documentation, but the documentation is no more than that required to effectively execute management’s responsibilities to acquire and monitor the bank’s investments. Management must demonstrate an understanding of the relevant risks, and, in the case of a securitization, of the features that would materially affect the performance of the investment. Management must consider the impact that changes in average life will have on the results realized on an investment. Realized returns on mortgage-backed securities (MBS) can be particularly sensitive to changes in average life.

The extreme examples are “principal-only MBS” and “interest-only MBS.” Extending the average life of a principal-only MBS can drastically erode the realized return. Shortening the life of an interest-only MBS can result in losses. To a lesser degree, every MBS purchased at a premium or discount is subject to similar extension or acceleration risk. A critical pre-requisite to understanding the risks and features of any given investment is being aware of them.

The most authoritative source of this information is the original offering document. In the case of registered corporate bonds, it is a Prospectus; for municipal bonds it is an Official Statement; for securitizations exempt from registration, it is an Offering Circular. The offering document will describe in detail the structure of the security and the known risks confronting it.

Financial statements are required to determine capacity to perform for corporate bonds and municipal bonds. For 22 20 18 16 14 12 10 8 6 4 Supervisory Insights structured investments, the periodic trustee reports are required to adequately monitor the investment’s performance. The same document is required to determine whether the issue complies with the Volcker Rule and to gather the necessary data to risk weight the asset. Collectively, the rules described in this article call for the same documentation that prudent investment management requires.

Management may rely on additional documentation or third-party research to support the decision to purchase, retain, or sell a particular investment. Examples are indentures, pooling and servicing agreements, special servicer reports, third-party research, and analytical services. Third-party research lacking independence, such as research authored by the broker selling the security, should be verified with independent sources.

All documentation should be included in the investment file along with evidence that management has weighed the information when making a decision. When documentation is incomplete, examiners may cite the deficiency in the examination report on the schedule of “Assets with Credit Data or Collateral Documentation Exceptions.” If acceptable credit quality is not evident, examiners may determine a security, or portfolio of securities, is subject to Adverse Classification. If warranted, the deficiency may be included on the “Examination Conclusions and Comments” page or the “Risk Management Assessment” page. Deficient documentation practices, and/or inadequate credit quality, if sufficiently material, may affect the Asset Quality rating and the Management rating.

A poor performing securities portfolio can erode the other rating elements as well. Summer 2015 . Conclusion The adversity of the financial crisis has forced investors and regulators from a comfortable perch of relying on credit ratings. Regulators recognize that credit judgment and analytical talent have long existed in successful banks; the rules discussed in this article remind bank boards of directors to exercise similar credit judgment and analytical skill with respect to the bank’s investment portfolio. Regulators crafted rules to establish standards of evaluation and documentation. Bank boards and managers are expected to implement prudent practices and make well-informed investment decisions that can be reasonably forecasted to withstand inevitable adversities such as deteriorating sectors, general economic downturns, and adverse interest rate movements. Robert G. Hendricks Capital Markets Policy Analyst Division of Risk Management Supervision robhendricks@fdic.gov Supervisory Insights Summer 2015 23 .

Overview of Selected Regulations and Supervisory Guidance This section provides an overview of recently released regulations and supervisory guidance, arranged in reverse chronological order. Press Release (PR) and Financial Institution Letter (FIL) designations are included so the reader can obtain more information. ACRONYMS and DEFINITIONS CFPB Consumer Financial Protection Bureau FDIC Federal Deposit Insurance Corporation FFIEC FRB NCUA OCC Federal bank regulatory agencies Federal financial institution regulatory agencies Federal Financial Institutions Examination Council Federal Reserve Board National Credit Union Administration Office of the Comptroller of the Currency FDIC, FRB, and OCC CFPB, FDIC, FRB, NCUA, and OCC Subject Summary Federal Bank Regulatory Agencies Finalize Revisions to the Capital Rules Applicable to Advanced Approaches Banking Organizations (PR-51-2015, June 16, 2015) The federal bank regulatory agencies finalized revisions to the regulatory capital rules adopted in July 2013. The final rules apply only to large, internationally active banking organizations that determine their regulatory capital ratios under the advanced approaches rule (generally those with at least $250 billion in total consolidated assets or at least $10 billion in total on-balance sheet foreign exposures). The agencies published changes to the rules affecting these organizations on December 18, 2014, and the final rules adopt these changes substantially as proposed. See https://www.fdic.gov/news/news/press/2015/pr15051.html FDIC Approves Notice of Proposed Rulemaking Regarding Small Bank Pricing (FIL-25-2015, June 16, 2015, PR-50-2015) The FDIC approved a Notice of Proposed Rulemaking (NPR) and concurrently requested comment on proposed refinements to the deposit insurance assessment system for small insured depository institutions (generally, those institutions with less than $10 billion in total assets).

The NPR proposes that the refinements would become operative the quarter after the reserve ratio of the Deposit Insurance Fund reaches 1.15 percent. Comments on the NPR are due by September 11, 2015. See https://www.fdic.gov/news/news/financial/2015/fil15025.html FDIC Consumer Newsletter Features Tips for Teaching Young People About Money (PR-48-2015, June 15, 2015) This issue of FDIC Consumer News features tips to help children and young adults from pre-kindergarten through college learn how to be smart about their finances. The Spring 2015 edition also includes a checklist of computer security tips for bank customers, an article about changes in credit reporting that could help some consumers improve their credit scores, and information about a new tax-advantaged savings option for families with a child with disabilities. See https://www.fdic.gov/news/news/press/2015/pr15048.html 24 .

Subject Summary Agencies Issue Final Standards for Assessing Diversity Policies and Practices of Regulated Entities (PR-47-2015, June 9, 2015) Federal financial institution regulatory agencies issued a final interagency policy statement establishing joint standards for assessing the diversity policies and practices of the entities they regulate. Section 342 of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) requires the federal financial institution regulatory agencies to establish an Office of Minority and Women Inclusion (OMWI) at each agency to be responsible for all matters relating to diversity in management, employment, and business activities. The DoddFrank Act also instructed each OMWI director to develop standards for assessing the diversity policies and practices of the agencies’ regulated entities. See https://www.fdic.gov/news/news/press/2015/pr15047.html Federal Bank Regulatory Agencies Release Statement on Dodd-Frank Act Company-Run Stress Tests at Medium-Sized Financial Companies (PR-45-2015, June 2, 2015) The federal bank regulatory agencies reiterated the disclosure requirements for the annual stress tests conducted by financial institutions with total consolidated assets between $10 billion and $50 billion. These medium-sized companies are required to conduct annual, company-run stress tests, with the results disclosed to the public for the first time this year. Federal Bank Regulatory Agencies Seek Further Comment on Interagency Effort to Reduce Regulatory Burden (PR-44-2015, May 29, 2015) The federal bank regulatory agencies approved a notice requesting comment on a third set of regulatory categories as part of their review to identify outdated or unnecessary regulations applied to insured depository institutions. See https://www.fdic.gov/news/news/press/2015/pr15045.html The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) requires the federal bank regulatory agencies to review their regulations at least every 10 years. The agencies also are required to categorize and publish the regulations for comment, and submit a report to Congress that summarizes any significant issues raised by the comments and the relative merits of such issues. See https://www.fdic.gov/news/news/press/2015/pr15044.html Federal Financial Institution Agencies Issue Final Rule on Minimum Requirements for Appraisal Management Companies (FIL-19-2015, PR-37-2015, April 30, 2015) The federal financial regulatory agencies issued a final rule that implements minimum requirements for state registration and supervision of appraisal management companies.

The final rule implements amendments to Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 made by the Dodd-Frank Act. FDIC Implements New Resources for Teachers, Parents, and Caregivers to Strengthen Youth Financial Education (PR-35-2015, April 23, 2015) The FDIC launched Money Smart for Young People, a series of lesson plans for teachers and new resources for parents to help them teach children about managing money. The free resources are designed to improve financial education and decision-making skills among young people from pre-K through age 20. The FDIC worked in partnership with the CFPB to develop these educational tools. See https://www.fdic.gov/news/news/financial/2015/fil15019.html See https://www.fdic.gov/news/news/press/2015/pr15035.html Supervisory Insights Summer 2015 25 .

Regulatory and Supervisory Roundup continued from pg. 25 Subject Summary FDIC Announces Industry Call Regarding Guidance on Identifying, Accepting, and Reporting Brokered Deposits (FIL-17-2015, April 21, 2015) The FDIC is hosting an informational call for FDIC-insured institutions on April 22, 2015 to discuss the Brokered Deposit Frequently Asked Questions (FAQs) issued in FIL-2-2015 FDIC staff will discuss and respond to questions received about the FAQs, which provide guidance on identifying brokered deposits, accepting deposits, listing services, and other brokered deposit-related matters. See https://www.fdic.gov/news/news/financial/2015/fil15017.html FDIC Seeks Comment on Potential New Deposit Account Records Requirements for Banks with a Large Number of Deposits (PR-342015, April 21, 2015) The FDIC seeks input on potential new recordkeeping standards for a limited number of FDICinsured institutions with a large number of deposit accounts. In an advanced notice of proposed rulemaking, the FDIC emphasizes that it does not expect that any of the responsibilities discussed in the proposal would apply to community banks and suggests a threshold for inclusion could be more than 2 million deposit accounts at an institution. See https://www.fdic.gov/news/news/press/2015/pr15034.html FDIC Announces Phase II of the Youth Savings Pilot Program (FIL-182015, PR-33-2015, April 20, 2015) The FDIC is seeking expressions of interest from institutions to participate in the second phase of the Youth Savings Pilot through June 18, 2015. This program is designed to foster financial education through the opening of safe, low-cost savings accounts by school-age children. These banks should be interested in expanding existing youth savings programs or developing new programs during the upcoming (2015-2016) school year. See https://www.fdic.gov/news/news/financial/2015/fil15018.html Federal Bank Regulatory Agencies Announce Additional EGRPRA Outreach Meetings (PR-32-2015, April 6, 2015) The federal bank regulatory agencies scheduled an outreach meeting on May 4, 2015, at the Federal Reserve Bank of Boston, as part of their regulatory review under EGRPRA. This is the third in a series of outreach meetings being held throughout the country.

The agencies have decided to expand the scope of EGRPRA to cover more recent regulations. See https://www.fdic.gov/news/news/press/2015/pr15032.html Regulatory Capital Rules: Frequently Asked Questions (FAQ) (FIL-16-2015, April 6, 2015) The FDIC issued a FAQ related to the revised regulatory capital reporting rules. The FAQ is derived from questions received from the banking industry, and furthers the FDIC’s efforts to provide technical assistance during the implementation of the new regulatory capital reporting requirements. See https://www.fdic.gov/news/news/financial/2015/fil15016.html FDIC Announces Advisory Committee on Community Banking Meeting (PR-30-2015, April 1, 2015) The FDIC announced that it will hold an Advisory Committee on Community Banking meeting on April 2, 2015. The agenda for the meeting includes discussion on community bank initiatives, regulatory review under the EGRPRA, the FDIC’s Professional Liability Program, and cyber security issues. See https://www.fdic.gov/news/news/press/2015/pr15030.html 26 Supervisory Insights Summer 2015 .

Subject Summary FFIEC Joint Statements on Destructive Malware and Compromised Credentials (FIL-132015, March 30, 2015) The FFIEC issued joint statements to alert banks to specific risk mitigation techniques related to preventing destructive malware attacks and attacks that compromise credentials. Regulatory Capital Rules: Accumulated Other Comprehensive Income (AOCI) Opt-Out Election (FIL12-2015, March 23, 2015) The FDIC issued a reminder to FDIC-regulated institutions that those banks not subject to the advanced approach regulatory capital rules could make a one-time, permanent election to opt-out of including AOCI in regulatory capital calculations. FDIC Newsletter Features Practical Ideas on Paying for a Home or a Car (PR-26-2015, March 12, 2015) The Winter 2015 edition of the FDIC Consumer News features tips to help people make what could be two of their biggest financial decisions -- financing their home and getting an auto loan. This issue also features an overview of options for using smartphones to pay at shops and restaurants, as well as articles on avoiding telemarketing scams, getting help with complaints against banks, and saving money. See https://www.fdic.gov/news/news/press/2015/pr15026.html Federal Financial Institution Regulatory Agencies Issue Guidance Encouraging Youth Savings Programs (FIL-11-2015, PR-21-2015, February 24, 2015) The federal financial institution regulatory agencies issued guidance encouraging federally insured depository institutions to offer youth savings programs to expand the financial capability of young people. See https://www.fdic.gov/news/news/financial/2015/fil15011.html FFIEC Approves Revisions to Regulatory Capital Reporting Guidelines (FIL-10-2015, February 23, 2015) The FFIEC has approved revisions to regulatory capital reporting guidelines, specifically revising the manner in which risk-weighted assets are reported in Schedule RC-R. This revision applies to all FDIC-insured banks and savings associations. See https://www.fdic.gov/news/news/financial/2015/fil15010.html Federal Bank Regulatory Agencies Seek Comment on Effort to Reduce Regulatory Burden (PR-19-2015, February 20, 2015) The federal bank regulatory agencies requested comment on a second set of regulatory categories as part of the process to review outdated or unnecessary regulations. This effort is undertaken by the federal bank regulatory agencies in concert with the EGRPRA, which requires the agencies to review their regulations at least every ten years.

The deadline to submit comments was May 14, 2015. See https://www.fdic.gov/news/news/press/2015/pr15019.html Supervisory Insights See https://www.fdic.gov/news/news/financial/2015/fil15013.html See https://www.fdic.gov/news/news/financial/2015/fil15012.html Summer 2015 27 . Regulatory and Supervisory Roundup continued from pg. 27 Subject Summary Branch Banking Remains Prevalent Despite the Growth of Online and Mobile Banking (PR-18-2015, February 19, 2015) The FDIC released a study showing that brick-and-mortar banking offices continue to be the primary means through which FDIC-insured institutions deliver services to their customers, despite the growth in online and mobile banking. The study is entitled Brick-and-Mortar Banking Remains Prevalent in an Increasingly Virtual World and is available at the link below. See https://www.fdic.gov/news/news/press/2015/pr15018.html FDIC Releases Additional Technical Assistance Video On CFPB Mortgage Rules (PR-15-2015, February 13, 2015) The FDIC released the third in a series of three videos addressing compliance with certain mortgage rules issued by the CFPB. This third video covers the Mortgage Servicing Rules. See https://www.fdic.gov/news/news/press/2015/pr15015.html FDIC Encourages Consumers To Develop A Plan To Save Toward Their Goals (PR-14-2015, February 12, 2015) The FDIC encouraged consumers to use America Saves Week (February 23 through February 28) as a time to begin or continue saving toward financial goals.

America Saves Week is an annual opportunity for organizations to encourage consumers to make a savings commitment, and then provide access to ideas, tools, and other helpful resources to help consumers develop a plan to achieve their goal. See https://www.fdic.gov/news/news/press/2015/pr15014.html FDIC Publishes Regulatory Capital Tool For Securitization Exposures (FIL-7-2015, February 11, 2015) The FDIC published a simplified supervisory formula approach (SSFA) tool as part of its continued outreach efforts to help institutions implement the revised capital rules. The SSFA is a new method banks may use to calculate capital requirements for securitization exposures. It is a formula-based approach designed to apply relatively higher capital requirements to the more risky junior tranches that are the first to absorb losses, and relatively lower requirements to the most senior tranches. See https://www.fdic.gov/news/news/financial/2015/fil15007.html Regulators Release Guidance on Private Student Loans With Graduated Repayment Terms at Origination (PR-10-2015, January 29, 2015, FIL-6-2015, February 2, 2015) Federal bank regulatory agencies in partnership with the State Liaison Committee of the FFIEC issued guidance for financial institutions on private student loans with graduated repayment terms at origination. This guidance provides principles that financial institutions should consider in their policies and procedures for originating private student loans with graduated repayment terms. See https://www.fdic.gov/news/news/financial/2015/fil15006.html 28 Supervisory Insights Summer 2015 .

Subject Summary FDIC Encourages Institutions to Consider Customer Relationships on a Case-By-Case Basis (PR-9-2015, FIL-5-2015, January 28, 2015 ) The FDIC is encouraging supervised institutions to take a risk-based approach in assessing individual customer relationships, rather than declining to provide banking services to entire categories of customers without regard to the risks presented by an individual customer or the financial institution’s ability to manage the risk. Financial institutions that properly manage customer relationships and effectively mitigate risks are neither prohibited nor discouraged from providing services to any category of customer accounts or individual customers operating in compliance with applicable laws. FDIC examiners must provide notice in writing for any case in which an institution is directed to exit a customer relationship. The FDIC has a new, dedicated toll-free number and email box for the Office of the Ombudsman for institutions concerned that FDIC personnel are not following FDIC policies on providing banking services. See https://www.fdic.gov/news/news/financial/2015/fil15005.html FDIC Releases Additional Technical Assistance Video on CFPB Mortgage Rules (PR-8-2015, January 27, 2015) The FDIC released the second in a series of three videos addressing compliance with certain mortgage rules issued by the CFPB.

This second video covers the Loan Originator Compensation Rule. See https://www.fdic.gov/news/news/press/2015/pr15008.html Agencies Release Public Sections of Resolution Plans (PR-4-2015, January 15, 2015) The FDIC and the FRB made available the public portions of resolution plans for firms with less than $100 billion in qualifying nonbanking assets, as required by the Dodd-Frank Act. This generally is the second set of resolution plans submitted for this group. The public portions of the resolution plans, as well as previously filed resolution plans, are available on the FDIC and FRB web sites. See https://www.fdic.gov/news/news/press/2015/pr15004.html FDIC Launches Web Site To Promote Marketing of Failed Financial Institutions (FIL-4-2015, January 15, 2015) The FDIC launched a Failing Bank Acquisitions Web page on www.fdic.gov.

This Web page will allow institutions to better understand how the FDIC markets failing financial institutions and provides information about acquiring a failing financial institution, including regulatory qualification guidance, performing due diligence, and general transaction terms. See https://www.fdic.gov/news/news/financial/2015/fil15004.html Agencies Announce Additional EGRPRA Outreach Meetings (PR-32015, January 14, 2015) Federal bank regulatory agencies will hold an outreach meeting on February 4, 2015, at the Federal Reserve Bank of Dallas as part of their regulatory review under the EGRPRA. The meeting is the second in a series of outreach sessions the FDIC, OCC, and FRB are holding throughout the country. See https://www.fdic.gov/news/news/press/2015/pr15003.html Supervisory Insights Summer 2015 29 . Regulatory and Supervisory Roundup continued from pg. 29 Subject Summary FDIC Issues Guidance On Identifying, Accepting, and Reporting Brokered Deposits (FIL-22015, January 5, 2015) The FDIC issued guidance in the form of Frequently Asked Questions to promote consistency by insured depository institutions in identifying, accepting, and reporting brokered deposits. The FDIC has explained the requirements for identifying, accepting, and reporting brokered deposits in published advisory opinions and in the Study on Core Deposits and Brokered Deposits (issued in July 2011). However, questions continue to arise about whether certain types of deposits are considered brokered deposits. This FAQ document addresses identifying brokered deposits, accepting deposits, listing services, interest rate restrictions, and other brokered deposit-related matters. See https://www.fdic.gov/news/news/financial/2015/fil15002.html Federal Bank Regulatory Agencies Issue Guidance on Consolidated Reports of Condition and Income (FIL-1-2015, January 2, 2015 / FIL-32015, January 6, 2015) The federal bank regulatory agencies issued a guide to submitting the December 31, 2014 Call Reports.

This reminder stressed specific year-end guidelines, such as reporting the amount of preferred deposits (Memorandum item 1.e of Schedule RC-E) and information about bank involvement with reverse mortgages (Memorandum item 15 of Schedule RC-C, part I, and item 1.a of Schedule RC-L). See https://www.fdic.gov/news/news/financial/2015/fil15001.html FDIC Newsletter Features a Financial Checklist for Consumers (PR-114-2014, December 23, 2014) Banking Agencies’ Statement Regarding The Basel Committee’s Consultative Paper “Revisions to the Standardized Approach for Credit Risk” (PR-113-2014, December 22, 2014) The Basel Committee on Banking Supervision published a consultative paper entitled Revisions to the Standardized Approach for Credit Risk. These proposed revisions are intended to apply primarily to large, internationally active banking organizations and not community banking organizations. A key objective of the paper is to seek comment on preliminary alternatives to internal models and external credit ratings for calculating risk-weighted assets. See https://www.fdic.gov/news/news/press/2014/pr14113.html Agencies Release Annual CRA-Asset Size Threshold Adjustments for Small and Intermediate Small Institutions (PR-111-2014, December 19, 2014) 30 The Fall 2014 edition of the FDIC Consumer News features a checklist of questions and suggestions that can help individuals achieve their financial goals. See https://www.fdic.gov/news/news/press/2014/pr14114.html The federal bank regulatory agencies announced the annual adjustment to the asset-size thresholds used to define small bank, small savings association, intermediate small bank, and intermediate small savings association under the Community Reinvestment Act (CRA) regulations.

Financial institutions are evaluated under different CRA examination procedures based on their asset-size classification. Those meeting the small and intermediate small assetsize threshold are not subject to the reporting requirements applicable to large banks and savings associations. See https://www.fdic.gov/news/news/press/2014/pr14111.html Supervisory Insights Summer 2015 . Subject Summary FDIC Publication Focuses on Interest Rate Risk (PR-110-2014, December 18, 2014) The Winter 2014 issue of Supervisory Insights looks at key aspects of interest rate risk (IRR) management, including the implementation of effective governance processes, the development of key assumptions for analyzing IRR, the development of an in-house independent review of IRR management systems, and what to expect during an IRR review. See https://www.fdic.gov/news/news/press/2014/pr14110.html FDIC Issues Guidance for the Resolution Plans of Large Banks (PR-109-2014, December 17, 2014) The FDIC issued guidance for resolution plans that insured depository institutions with assets greater than $50 billion must submit periodically to the FDIC. These plans are required by an FDIC rule approved in January 2012 and complement those required from certain entities, such as covered bank holding companies under the Dodd-Frank Act. The FDIC rule requires each covered institution to provide a resolution plan that should enable the FDIC as receiver under the Federal Deposit Insurance Act to resolve the institution in an orderly manner that enables prompt access of insured deposits; maximizes the return from the failed institution’s assets; and minimizes losses realized by creditors and the Deposit Insurance Fund. See https://www.fdic.gov/news/news/press/2014/pr14109.html FFIEC Releases Revised Bank Secrecy Act / Anti-Money Laundering (BSA/AML) Examination Manual (FIL-60-2014, December 3, 2014) The FFIEC has released the 2014 version of the BSA/AML Examination Manual. The revised manual reflects the FFIEC’s ongoing commitment to incorporate guidance issued since 2010 into one manual for the FFIEC agencies’ examination staff. FDIC Issues Final Rules On Assessments (FIL-57-2014, November 24, 2014) The FDIC Board of Directors adopted the Assessments Final Rule, which revises the FDIC’s risk-based deposit insurance assessment system to reflect changes in the regulatory capital rules that take effect in 2015 and 2018. See https://www.fdic.gov/news/news/financial/2014/fil14057.html Supervisory Insights See https://www.fdic.gov/news/news/financial/2014/fil14060.html Summer 2015 31 .

FIRST CLASS MAIL Federal Deposit Insurance Corporation Postage & Fees Paid FDIC Permit No. G-36 Washington, DC 20429-9990 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300 Subscription Form To obtain a subscription to Supervisory Insights, please print or type the following information: Institution Name Contact Person Telephone Street Address City, State, Zip Code Please fax or mail this order form to: FDIC Public Information Center 3501 North Fairfax Drive, Room E-1022 Arlington, VA 22226 Fax Number (703) 562-2296 Subscription requests also may be placed by calling 1-877-ASK-FDIC or 1-877-275-3342 or go to https://service.govdelivery.com/service/multi_subscribe.html?code=USFDIC .