[Background]{.underline}

These guidelines presume that the bank maintains adequate asset quality
reserves, including the Allowance for Loan and Lease Losses, and that
examiners consider the quality of credit risk management in assessing
reserve adequacy. Evaluation of asset quality and transfer risk on cross
border transactions, when appropriate, should be considered in assessing
capital adequacy.

Examiners should determine whether additional capital is needed to
support interest rate, foreign exchange rate, fiduciary, and operational
risks; as well as other risks identified as significant. In reaching
those conclusions, examiners should assess the quality of risk
management and the current level of risk for each risk area.

Examiners should rate the quality of risk management as **GOOD, IN NEED
OF IMPROVEMENT**, or **INADEQUATE**. In addition, the level of risk will
be rated **as LOW, MEDIUM,** or **HIGH**. Examiners should also assess
the effect of specific concentrations on capital levels. Other factors
considered in evaluating capital adequacy include the overall quality of
senior management and board supervision, the bank\'s strategic
direction, and the level of compliance risk.

[I. QUALITY OF RISK MANAGEMENT]{.underline}

The following ratings should be used to assess management quality.

**A. GOOD MANAGEMENT**

These banks have comprehensive risk management policies and systems.
Management demonstrates both an understanding of the sources and levels
of exposure and the ability to measure and control it.

To determine if management is **GOOD**, consider if:

-   The bank has well defined written policies that address
    responsibility, authority, limits, compliance responsibilities, and
    contingency plans. The policies must be approved by the board of
    directors, which reviews and updates them regularly.

```{=html}
<!-- -->
```
-   The bank complies with its policies, unless a properly documented
    and approved exception is granted in accordance with policy.

-   Procedures for policy implementation are stated clearly and are
    followed.

```{=html}
<!-- -->
```
-   The level of acceptable risk exposure is defined. Limits have been
    adopted and are reviewed periodically by the board.

```{=html}
<!-- -->
```
-   The identification of and measurements of risk are clear and
    appropriate for the bank\'s risk characteristics. All major sources
    of exposure are captured, including those arising from materially
    significant subsidiaries and operating units.

-   Risk measurements express exposures in terms compatible with the
    risk limits.

```{=html}
<!-- -->
```
-   Management Information Systems (MIS) data are accessible, timely,
    and accurate; internal controls, internal and external audit
    coverage, and contingency plans are in place and are effective.

```{=html}
<!-- -->
```
-   The bank has established a process to address new products and
    services.

```{=html}
<!-- -->
```
-   Senior management is well informed and has access to the information
    necessary to make sound decisions.

```{=html}
<!-- -->
```
-   Senior management has assigned adequate resources to the measurement
    and management of relevant risk.

-   Risk managers understand the nature of the risk area, maintain
    up-to-date knowledge of external factors affecting it, and can
    effectively manage the level of risk.

-   Those responsible for identifying and controlling risks and
    implementing decisions are properly trained.

-   Management acts decisively to control or mitigate a situation when
    excessive risk or adverse trends are identified.

-   Management implements appropriate corrective action when
    deficiencies are identified.

B. MANAGEMENT IN NEED OF IMPROVEMENT

These banks possess the basic elements of good risk management, but must
devote additional resources or efforts to improve their risk management
practices. Management has the ability, and has demonstrated the
willingness, to make the necessary corrections.

To determine if management is **IN NEED OF IMPROVEMENT**, consider if:

-   Policies exist, but are unwritten, incomplete, out dated, or have
    not received board approval or periodic review.

-   Policies are neither followed consistently, nor are exceptions
    properly documented or approved.

-   Procedures for policy implementation are not stated clearly, are not
    comprehensive, or are not followed consistently.

-   The level of acceptable risk exposure has not been established
    clearly, nor has clearly defined limits.

-   Risk measures do not capture all major sources of exposure.

-   Risk measurements do not express exposures in terms compatible with
    the risk limits.

-   The MIS produces only limited data where accessibility, accuracy,
    and timeliness need improvement.

-   Internal controls, internal and external audit coverage, or
    contingency plans need enhancement.

-   The risk assessment process to address new products and services is
    deficient or is not followed.

-   Senior management is neither well informed nor has access to the
    information necessary to make sound decisions.

-   Additional resources and effort must be devoted to the measurement
    and management of the relevant risk area.

-   Risk managers do not understand completely the nature of the risks,
    are limited in their ability to manage the risks effectively, and do
    not routinely maintain current knowledge of external factors
    affecting the risk area.

-   Training is sometimes deficient for those responsible for
    identifying and controlling risks and implementing decisions.

-   Management does not always act decisively when excessive risk is
    identified.

-   Management does not routinely correct identified deficiencies.

## C. INADEQUATE MANAGEMENT

These banks have serious deficiencies that management may be unable to
correct. Risks may not be understood, recognized, managed, or
controlled.

To determine if management is **INADEQUATE**, consider if:

-   Formal policies do not exist, are incomplete, or are out dated.
    Existing policies are not followed.

-   Implementation procedures are missing, incomplete, or are not
    followed.

-   Management has not established the level of acceptable risk exposure
    nor has it established risk limits. If limits exist, they are not
    followed.

-   The bank does not measure risk, significant exposures are omitted,
    or measurement methods are undefined.

-   Data produced by MIS are not accessible, timely, or accurate.

-   Serious weaknesses exist in internal controls, internal and external
    audit coverage, or contingency plans.

-   The risk assessment process to address new products and services is
    nonexistent or needs clarification.

-   Senior management is neither properly informed nor has the
    information necessary to make sound decisions.

-   Resources devoted to measuring and managing relevant risk are
    deficient, and management has not demonstrated a commitment to make
    the corrections required to improve risk management.

-   Risk managers do not understand the nature of the risk, cannot
    manage it, or do not know the external factors affecting the risk
    area.

-   Those responsible for identifying and controlling risks and
    implementing decisions are not adequately trained.

-   Management is unable or unwilling to mitigate or control risks.

-   Management is uncooperative or unwilling to correct deficiencies.

### II. LEVEL OF RISK

[Interest Rate Risk]{.underline}

Interest rate risk is a complex risk. There is no standard approach to
define, measure, or control it. Appropriate risk management systems will
vary among banks. The use of sophisticated computer models will not
necessarily imply good risk management, nor will their absence indicate
that management is inadequate.

To be rated as GOOD, management should measure and limit risk in terms
of:

\(1\) the exposure to capital from the institution\'s longer term
positions, and

> \(2\) earnings at risk from historic cost accounts (net interest
> income) and, when engaged in trading activities, investment risk from
> accounts carried on a market value basis.

[Foreign Exchange Rate Risk]{.underline}

Assessment of management should include a review of the risk measurement
systems. It should determine that systems quantify risk in terms of the
earnings at risk and the effect of risk on the bank\'s economic value.

[Fiduciary Risk]{.underline}

Fiduciary activities should be managed by a capable, well trained staff
versed in trust and securities law and in trust investments, and
supported by adequate resources. Their performance should comply with
written policies and procedures and their planning should accompany
innovations in fiduciary services.

[Operational Risk]{.underline}

Key to the assessment of operational risk is the planning and
implementation process for ongoing, new, or the expanding products and
services. Written policies, procedures, contingency plans, and backup
systems must be reviewed.

**A. INTEREST RATE RISK ASSESSMENT**

All banks assume interest rate risk in their normal banking operations.
Often they undertake interest rate risk to enhance profitability.
Interest rate risk, however, can introduce volatility to the bank\'s
economic value and its earnings.

Exposure to interest rate risk may be viewed from two different, but
related, perspectives:

The \"economic perspective\" focuses on the sensitivity to the economic
value (market value of portfolio equity) of the institution. The values
of most financial instruments change with interest rates. These changes
in value can be particularly large for long-term fixed rate instruments.

The \"earnings perspective\" views interest rate risk as the exposure to
reported earnings. This includes: (1) the exposure to net interest
income arising from repricing imbalances among historic cost accounts,
and (2) the exposure to changes in market values of instruments carried
on a market valuation basis.

For additional information on these two topics, see the OCC staff paper
entitled, An Overview of Interest Rate Risk dated December 1989.

[Risk Levels]{.underline}

In assessing the level of interest rate risk for capital adequacy,
examiners should focus on exposures that can seriously impair capital
value. Often they arise from longer term positions that may not pose a
risk in the near term. The \"economic perspective\" best identifies and
evaluates this type of exposure. Examiners and bank management should
not, however, ignore the \"earnings perspective.\" Earnings exposure
should be considered by examiners when assessing the stability of future
earnings that contribute to capital. Such an assessment is relevant to
determining whether the bank can maintain capital at adequate levels in
the future.

Measurement of the market value exposure of portfolio equity can be
complex. However, management is expected to assess any significant
exposures arising from long-term fixed rate positions and to understand
the risks inherent in the bank\'s product mix.

The bank\'s interest rate risk is not merely the risk inherent in
individual products. An evaluation of bank activities is required.
Various levels of interest rate risk may occur as follows.

To determine if the level of interest rate risk is **LOW**, consider if:

-   The bank has limited exposure to interest rate changes.

-   The bank\'s business mix generates few repricing imbalances.

-   Long-term fixed rate assets comprise a small portion of the balance
    sheet and are funded with liabilities that have similar repricing
    characteristics.

-   Existing interest rate exposure is hedged prudently.

-   Trading activity in longer term instruments is limited or
    nonexistent.

-   The bank holds neither large pools of derivative mortgage products
    or mortgage-backed securities, nor long-term off-balance sheet
    interest rate contracts.

-   The volume of off-balance sheet commitments is moderate, and they do
    not amplify repricing imbalances.

-   The bank\'s off-balance sheet commitments are hedged prudently.

To determine if the level of interest rate risk is **MEDIUM**, consider
if:

-   The bank has a moderate exposure to interest rate changes.

-   Some small longer term repricing imbalances exist.

-   Fixed rate loans, mortgages, derivative mortgage products,
    mortgage-backed securities, and long-term securities do not
    represent a significant portion of the balance sheet (or if they do,
    they are hedged effectively or matched-funded).

-   The bank\'s portfolio does not contain any high risk mortgage backed
    securities as defined in BC 228.

-   Trading in longer term instruments is not substantial.

-   Options and long-term swaps are limited and used only as hedging
    vehicles.

-   The volume of off balance sheet commitments is low, but they amplify
    repricing imbalances.

-   The bank has a high volume of off-balance sheet commitments, which
    are only partially hedged.

To determine if the level of interest rate risk is **HIGH**, consider
if:

-   The bank exhibits significant exposure to rate changes.

-   The bank\'s business mix generates significant longer term repricing
    imbalances.

-   Fixed rate assets significantly exceed fixed rate funding sources.

-   The investment portfolio is sizeable and funded primarily with
    short-term borrowings or deposits. This portfolio contains
    concentrations in longer maturities (beyond five years),
    mortgage-backed securities or derivative mortgage products that are
    not effectively managed, hedged.

-   The bank\'s portfolio contains high risk mortgage-backed securities
    as defined in BC 228.

-   The bank has large, unmatched options, or long-term swap positions.

-   The bank has either large trading positions in long-term instruments
    or allows individuals to create large positions that speculate on
    future interest rate movements.

-   Short-term positions are vulnerable to rate swings, and the bank
    lacks flexibility to compensate for adverse rate movements.

-   The volume of off-balance sheet commitments is moderate, and they
    amplify repricing imbalances.

-   The bank has a high volume of off-balance sheet commitments, which
    are not hedged.

Management of banks whose focus is limited to near term earnings
exposure may fall into the **INADEQUATE** category. These banks
generally must broaden the scope of their measurement and limit systems
to include exposures from longer term positions that could potentially
threaten the market value of portfolio equity.

Bank management may be rated as **IN NEED OF IMPROVEMENT** when their
risk measurement and data systems have lagged behind their growth or
increasing complexity. External or internal models may contain
deficiencies that significantly impair their effectiveness.

## B. FOREIGN EXCHANGE RATE RISK

(Applicable only to banks with foreign exchange positions)

Foreign exchange rate risk is the risk incurred by a bank that has on-
and off-balance sheet positions denominated in foreign currencies. These
positions are exposed to movements in foreign exchange rates. Movements
may result from customer dealing activities, market making activities,
strategic positioning, or structural exposures (investments, capital).
Banks with substantial open foreign exchange positions should hold
additional capital to support these risk exposures.

[Risk Levels]{.underline}

To determine if the level of foreign exchange rate risk is **LOW**,
consider if:

-   The bank\'s foreign exchange activity is limited to handling
    requests from corporate customers or covering foreign currency
    positions arising from other bank business (e.g., foreign currency
    denominated loans, deposits, and investments).

-   Active trading for the bank\'s own account is limited.

-   Intra-day and overnight positions are small and limited to major,
    liquid currencies.

-   The bank does not engage in forward market activity, except to cover
    forward foreign currency exposure.

-   Currency options are used only for hedging.

To determine if the level of foreign exchange rate risk is **MEDIUM**,
consider if:

-   The bank engages in some foreign exchange trading activities, but
    the potential earnings effect of its open risk positions (both
    intra-day and overnight) is minimal.

-   The bank takes small positions in the spot market in major
    currencies.

-   Activity in the forward market, currency options, and cross-currency
    interest rate swaps is limited.

To determine if the level of foreign exchange rate risk is **HIGH**,
consider if:

-   The bank runs large open risk positions (both intra-day and
    overnight) that have a potentially major effect on earnings.

-   Trading activities historically have affected overall bank earnings
    significantly.

-   The bank is an active market maker in numerous currencies, including
    less liquid currencies, in the spot market; the long-dated forward
    market; the written currency options market; or the cross-currency
    interest rate swap market.

**C. FIDUCIARY RISK**

Fiduciary risk may result from:

-   [Processing services]{.underline} \-- fiduciary accounting and
    recordkeeping; asset custody and control; fiduciary tax preparation;
    participant recordkeeping; asset custody; securities trade
    processing system reconcilement and control; securities lending
    processing; mutual fund processing; global custody processing; and
    transfer agent functions.

-   [Investment Management]{.underline} \-- individual accounts;
    collective investment funds (particularly GIC funds, real estate and
    other illiquid asset funds); securities trading and lending; closely
    held business management; and mutual fund advisor.

-   [Fiduciary Administration]{.underline} \-- estate settlement; living
    and testamentary trusts; employee benefit trusts (including ESOP\'s
    and master trusts); trustee for LBO\'s/securitized assets; and bond
    indenture trustee.

Processing services support investment management and fiduciary
administration. Thus, processing problems may result in both operational
and fiduciary risks. Processing system weaknesses can affect: the
timeliness of investment decisions; reliability of customer information;
safety and control of fiduciary assets; and the ability to incorporate
new products and services, as well as future growth.

Fiduciary service wholesalers offer advanced processing and investment
management services to other financial institutions. The complexity of
those services and the number of institutions employing them increases
risks to the wholesalers and their users.

[Risk Levels]{.underline}

To determine if the level of fiduciary risk is **LOW**, consider if:

-   The bank offers only basic personal trusts and estate services.

-   The bank does not ordinarily engage in more complex products, such
    as employee benefit and bond trusteeships.

-   The bank has a stable or low fiduciary growth pattern.

-   Traditional investment strategies are used primarily with low risk
    assets (U.S. Governments, insured deposits, blue chip stocks).

-   The bank generally employs a nationally recognized vendor to provide
    operational support.

-   Wholesalers of complex fiduciary services are not often used.

To determine if the level of fiduciary risk is **MEDIUM**, consider if:

-   Greater emphasis is placed on developing new fee-based products and
    services.

-   The bank expands fiduciary activity beyond traditional personal
    trusts and estates.

-   The bank competes in markets that require specialized knowledge,
    such as employee benefit and bond trusteeships.

-   Products offered include private label mutual funds, specialized
    collective funds, or sophisticated processing services, and other
    institutions act as fiduciary service wholesalers for these
    products.

To determine if the level of fiduciary risk is **HIGH**, consider if:

-   The bank has experienced rapid fiduciary growth or has made radical
    changes in fiduciary management.

-   Fiduciary activities are consolidated into a larger, more complex
    operation or are disbursed throughout the organization. Either makes
    oversight more critical and difficult.

-   Consolidation of fiduciary functions, or imprudent cost cutting to
    reduce overhead, has resulted in insufficient operational or
    administrative capabilities.

-   The bank offers more complex products and services, such as private
    label mutual funds, securities lending, or asset securitization
    involving the fiduciary department.

-   The bank is a fiduciary product wholesaler, offering asset
    management, processing or other services to other institutions.

-   Processing services include global custody or mutual fund
    accounting.

-   Nonbank affiliates provide support services, such as investment
    management and discount brokerage. Affiliate officers or employees
    may be unfamiliar with fiduciary laws and principles and take
    excessive risks to enhance investment performance.

-   Investment strategies tend to involve more complex techniques that
    emphasize nontraditional, higher risk vehicles.

-   The bank is involved in fiduciary litigation exposing it to
    significant risk of loss.

**D. OPERATIONAL RISK**

Operational risk is the risk of bank loss because of its failure to
process a transaction properly. The failure may be caused by inadequate
controls, employee error or malfeasance, a breakdown in the bank\'s
computer system, or a natural catastrophe. Operational risk is inherent
in every bank service, whether accepting a deposit, paying a check,
disbursing a credit, processing a loan payment, operating an automated
teller machine, or providing wire transfer services. Banks that provide
specialized and more complex services, and high volume transaction
processing, incur greater operational risks and normally should maintain
higher capital.

[Risk Levels]{.underline}

Operational risk rises with an increase in the number and complexity of
transactions processed, including those completed for outsiders, the
size of those transactions, and insurance coverage deductibles. It falls
when processing services are contracted and limits of insurance coverage
are maximized.

To determine if the level of operational risk is **LOW**, consider if:

-   The bank processes limited basic banking services, such as routine
    deposit, lending, and collection services. It offers only minimal
    custodial and wholesale or correspondent services.

-   The growth of new accounts is modest and conforms to plan.

-   The bank is a net user of transactions processing by outside
    institutions.

-   Insurance coverage is adequate, with low deductibles and high
    limits.

To determine if the level of operational risk is **MEDIUM**, consider
if:

-   The bank processes varied banking products and moderately complex
    services, and participates in an automated clearing house system.

-   Account activity, transaction processing requirements, and the
    aggregate volume of transactions are higher than average for a bank
    of its size.

-   The growth of new services and new accounts is moderate.

-   The bank provides processing for other institutions.

-   Insurance coverage is adequate, with low deductibles and high
    limits.

To determine if the level of operational risk is **HIGH**, consider if:

-   The bank processes broad specialized and complex activities,
    including highly sophisticated products and services with complex
    and high volume transaction processing requirements. Examples are
    mortgage or student loan servicing operations; agent services for
    large loan and bond syndications; and significant wire transfer
    activities.

-   The bank provides complex financial or extensive processing services
    to other institutions, such as the operation of a credit card
    sales-draft processing center.

-   The growth of new services and new accounts is rapid.

-   Insurance coverage is not sufficient to cover higher risk
    operations.

**E. CONCENTRATION RISK**

The size and type of concentrations in a bank may affect its condition
significantly. When assessing capital adequacy, the extent and nature of
concentrations must be determined. Concentrations depend upon a unique
characteristic and, when weaknesses develop in that characteristic, each
loan in the concentration may be adversely affected. Most banks exhibit
concentrations that require additional capital.

[Geographic Concentrations]{.underline} exist when the bank derives a
significant portion of its business from a specific market. The bank is
exposed to a market\'s economic fluctuations, even if it diversifies its
sources of revenue, lending, and investment throughout that market. A
bank that operates in a smaller geographic market may find it harder to
diversify against significant exposures and serve its community.
Therefore, those banks probably should hold more capital.

[Industry Concentrations]{.underline} involve one borrower, an
affiliated group of borrowers, or borrowers engaged in or dependent upon
one industry. A concentration may result from the acquisition of a
volume of loans from a single source, despite the diversity of the
individual borrowers. Loans concentrated in one source are centered
mainly in and predicated on, the financial capability and character of
the individual or entity. Loans centered in an affiliated group are
susceptible to a domino effect if one or a few group members experience
financial problems.

[Dominant Industry Concentrations]{.underline} also occur in banks
located in towns economically dominated by one or several businesses.
Those banks typically grant a substantial percentage of their loans to
those businesses and their employees. Heavy unemployment could result
from the curtailment of operations, if other job opportunities are
nonexistent, and pose a serious threat to the economy of the entire
town. The bank should be aware of the loans of businesses, such as local
merchants, that rely heavily on those dominant companies.

[Foreign Concentrations]{.underline} involve extensions of credit to a
foreign government, its agencies, and majority-owned or controlled
entities. Credit to specific private enterprises may be included in such
concentrations if an interrelationship exists in the form of guarantees,
moral commitments, significant subsidies, or other factors that suggest
dependence on the public sector.

**F. OTHER CONSIDERATIONS**

An assessment of capital adequacy should not be limited only to the
specific risks listed in this paper. Examiners may determine that other
factors are relevant. Such factors will vary from bank to bank and
circumstances within each. Among the most common are examiners\'
assessments of the quality of senior management and board supervision,
the possible consequences of strategic planning, transfer risk, and
compliance risk.

[Overall Management and Board Supervision Quality]{.underline}

The quality of senior management and board supervision is essential to
an assessment of capital adequacy. When serious deficiencies exist in
senior management or board supervision, examiners may determine that the
bank should hold capital above the level suggested in their assessments
of the specific risks. Conversely, examiners may determine that a lower
level of capital is adequate when senior management and board
supervision is strong.

[Strategic Direction]{.underline}

A bank\'s strategic direction can indicate potential for significant
changes in its risk profile. Capital must be sufficient to support the
level of risk likely to result from implementation of the bank\'s
strategic plan.

Often the bank\'s strategic direction will suggest that no more capital
is needed than is determined appropriate to support the bank\'s inherent
risks. In such banks strategies for expansion in diverse activities may
reflect their strengths and weaknesses. They may also have sound plans
to ensure capital adequacy.

Banks that pursue an expansive strategy may need additional capital:

-   To support the effect of new activities and acquisitions.

-   When expansion is rapid or occurs in activities where high earnings
    volatility can be expected.

-   When a bank attempts to compete in businesses or markets where it
    lacks strong management skills and experience or does not have an
    inherent competitive advantage.

[Compliance Risk]{.underline}

Compliance risk and its management must be considered when assessing
capital adequacy. This assessment should be sensitive to the risk of
capital dissipation because of reimbursements, restitutions, fines,
asset forfeitures, and civil or criminal liabilities. Bank earning power
can also be eroded by potential adverse publicity.

[FOR ADDITIONAL GUIDANCE]{.underline}

Questions about assessing capital adequacy should be directed to the
Chief National Bank Examiner\'s Office at 202-874-5170.