BOG-FRS - Public Release, April 2023

Restricted - FR 

Transmitted via Secure Email 

November 19, 2019 

Board of Directors 

SVB Financial Group 

3003 Tasman Drive 

Santa Clara, California 95054 

Members of the Board: 

The Federal Reserve Bank of San Francisco (FRBSF) conducted a target inspection of SVB Financial Group 

(SVBFG) Corporate Governance/Global Risk Management activities beginning on July 29th; onsite work 

began on August 5th, and concluded on August 15th. Preliminary results were presented to 

Chief Executive Officer Greg Becker, Chief Risk Officer (CRO) Laura Izurieta, Chief Credit Officer (CCO) 

Marc Cadieux, and Chief Audit Executive John Peters during a September 23rd exit meeting. This letter 

communicates the inspection’s final conclusions and feedback provided to management that may assist 

in further strengthening risk management practices. 

Purpose and Scope 

The inspection’s objective was to assess SVBFG’s compliance with applicable provisions of Regulation YY 

and assess alignment with SR Letter 95-51 (Rating the Adequacy of Risk Management Processes and 

Internal Controls at State Member Banks and Bank Holding Companies). In doing so, we evaluated the 

skills, independence, stature, and maturity of the second line of defense (LoD) relative to the size and 

complexity of the institution. Furthermore, we assessed management’s remediation efforts for three 

Matters Requiring Attention (MRAs)1 outstanding from the 2017 supervisory cycle. 

Summary of Findings 

SVBFG’s board has established a risk committee and the organization’s risk-management program 

complies with the broad requirements of Regulation YY. Additionally, management continues to 

develop and implement a risk management framework as the organization grows in size and complexity; 

however, further enhancements are needed to ensure the effective implementation of an appropriate 

internal controls and risk oversight structure. While the second LoD has made notable progress and 

provides sufficient oversight of risk-taking activities, aggregate risks, and concentrations to ensure 

compliance with the board-approved risk appetite, concerns persist about certain aspects of the 

1 Matters Requiring Attention are matters that are important and the Federal Reserve is expecting a banking organization to address 

over time. 

101 Market Street, San Francisco, California 94105 

www.frbsf.org 

Page 1 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

Restricted – FR 

Federal Reserve Bank of San Francisco 

Board of Directors
 

SVB Financial Group
 

November 19, 2019
 

Page 2 of 5
 

structure, independence, and functional expertise within the risk-management framework. The most 

notable concerns surround the reporting line of the CCO, information technology expertise, and second 

LoD independence when participating in risk-taking activities. SVBFG has made reasonable progress 

remediating MRAs within the scope of this inspection; we are closing all three, but recasting two to 

reflect the remaining work needed to address the underlying supervisory concerns. 

Matters Requiring Attention 

Enterprise Risk Management (ERM) Controls Monitoring 

Issue: While the board and senior management have made significant progress designing and 

implementing certain aspects of the enterprise risk-management framework over the last couple of 

years, further enhancements are required to ensure that the second LoD has adequate oversight of the 

controls performed by the first LoD. 

Consequence of Issue: Without adequate insight into the effectiveness of first LoD control activities, 

the board and senior management may not have a sufficient view/perspective into aggregate residual 

risk exposures. 

Required Action: Management is required to complete the development of a control identification, 

self-testing, and monitoring program (Program) for implementation in the first LoD that periodically 

determines and documents the effectiveness of controls performed by the first LoD. In addition, the 

Program should include processes for the first LoD to manage self-identified issues and action plans, and 

report control testing and monitoring results to the second LoD. Furthermore, the second LoD is 

expected to provide effective oversight of the Program, including periodic risk-based monitoring that 

ensures the first LoD is meeting control-testing requirements. 

Model Overlay/Assumption Governance 

Issue: Management continues to use a capital stress testing methodology as a key component in 

assessing capital adequacy and in setting various capital risk limits. Within the stress-testing process, 

management has a well-defined governance process that remains similar to the previous Dodd-Frank 

Act Stress Testing (DFAST) process. Through the process followed in 2019, two large model 

overlay/assumptions were made regarding the Sponsor Led Buyout portfolio in the idiosyncratic stress 

scenario. These overlays were not appropriately identified in presentation materials provided to senior 

management committees and examiners. Without appropriate disclosure, the modeled loss results 

were unintuitive and hard to explain. 

Consequence of Issue: Without a transparent and repeatable process for setting capital limits and 

buffers, the board and senior management may rely on stress testing results that do not accurately 

reflect the risk appetite. 

Required Action: Management is required to ensure that all significant assumptions, model 

adjustments, and management overlays are clearly identified and discussed when disclosing stressPage 2 of 5 
BOG-FRS - Public Release, April 2023

testing results. In the case where stress testing results are unintuitive, the presentation must include a 

clear narrative explanation. 

Summary of Outstanding MRAs within the Inspection Scope 

Issue Status (Date Opened) Comments 

Risk ManagementCompliance and 

Independent Oversight 

Close 

(October 2017 Silicon 

Valley Bank Roll-Up) 

Management has taken significant action to 

address concerns about the Corporate 

Compliance and ERM functions by completing 

18 of the 19 agreed upon action plans; 

therefore, this MRA is being closed. However, 

further enhancements are required to ensure 

the first LoD implements effective internal 

controls and the second LoD provides adequate 

oversight of the control environment. (See 

above MRA titled Enterprise Risk Management 

Controls Monitoring.) 

Rationale & Support of 

DFAST Framework 

Close 

(October 2017 DFAST) 

DFAST is no longer a requirement for firms of 

SVBFG's size due to the passage of The 

Economic Growth, Regulatory Relief and 

Consumer Protection Act. As such, this MRA is 

being closed. Nevertheless, given that stresstesting results are key to setting capital limits, 

safety and soundness concerns dictate that 

expectations for a sound and transparent 

process remain. (See above MRA titled Model 

Overlay/Assumption Governance.) 

Internal Capital 

Adequacy Assessment 

Close 

(October 2017 Silicon 

Valley Bank Roll-Up) 

Management has revised the capital planning 

and stress testing process in the absence of the 

DFAST requirement to focus on two scenarios. 

The capital stack now specifically allocates 

capital buffers to the risk categories of credit, 

interest rate risk, and operational risk. While 

specificity in risk attribution could be further 

improved, management has addressed the 

MRA's key requirements. 

Regulation YY 

SVBFG complies with the specific risk-management requirements of section 252.33 of Regulation YY, 

subpart D. The Risk Committee (RC), a chartered independent committee of the board, approves and 

periodically reviews the risk-management policies and oversees the operation of the global riskmanagement framework. The firm's ERM framework is commensurate with its current structure, risk 

profile, complexity, activities, and size. SVBFG has adopted a three lines of defense model, and 

appropriately delineated roles and responsibilities in the ERM Policy, ERM Framework, and the ERM 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

Restricted – FR 

Federal Reserve Bank of San Francisco 

Board of Directors
 

SVB Financial Group
 

November 19, 2019
 

Page 4 of 5
 

Program 2019 Annual Program Document. CRO Izurieta has experience in identifying, assessing, and 

managing risk exposures of large, complex financial institutions; she is responsible for overseeing the 

ERM program and reporting risk-management deficiencies and emerging risks to the RC. Nevertheless, 

as the firm continues to build-out the corporate and risk governance framework with respect to 

management committees, SVBFG may want to consider developing a principles-based approach to 

promote consistency in defining what constitutes a management committee and how second LoD 

independence is appropriately maintained when participating in/voting on risk-taking decisions. In 

addition, the board and senior management may benefit in documenting their understanding of the 

potential conflicts/independence concerns inherent in the second LoD’s roles and responsibilities within 

management committees. 

Risk Management Framework 

SVBFG’s risk-management framework continues to mature on pace with its size and complexity. The 

framework defines key elements including roles and responsibilities across the three lines of defense; 

risk appetite metric identification, measurement, and monitoring processes; risk and control selfassessment, and risk event reporting processes. The RC has adopted a formal risk appetite statement, 

and related metrics for credit, operational, market, and liquidity risks are approved annually by the 

board. Risk issues, including metric breaches, are escalated to the board and senior management 

through the Quarterly Risk Report. Nevertheless, when addressing the ERM Controls Monitoring MRA 

noted above, the ERM function may want to ensure risk-metric owners have appropriate controls and 

testing in place to ensure data accuracy. Additionally, in continuing to drive first LoD accountability in its 

risk culture, SVBFG may benefit by further defining ERM’s roles and responsibilities in the issues 

management process to include a risk-based approach for validating management action plans to 

address issues identified through risk appetite breaches, risk and control self-assessments, and 

operational risk events. 

The second LoD has adequate stature and provides sufficient management oversight of risk-taking 

activities, aggregate risks, and concentrations to ensure compliance with the risk appetite. In addition, 

appropriate action plans have been developed to more closely align SVBFG’s risk-management 

framework with the company’s risk profile. However, concerns remain about certain aspects of the 

structure, independence, and functional expertise within the risk-management framework. 

The current structure of the credit risk-management framework does not fully align with the ERM 

framework description of the three lines of defense model, as the first LoD remains the owner of the 

credit policies. In addition, there is no discernable challenge from the second LoD; however, the CCO 

and credit administration, while in the first LoD, have provided credible challenge to the business line 

risk-takers. Nevertheless, the board‘s Credit Committee recently approved a plan transitioning the CCO 

into the second LoD. As the details of this plan are further developed, the board and senior 

management may want to consider evaluating potential independence concerns related to loan 

approvers reporting to the CCO and the CCO’s approval authority in, as of yet, undefined escalation 

situations. 

While the Risk Leadership Team reporting to CRO Izurieta is generally qualified to oversee the ERM 

program, personnel within the second LoD lack sufficient technical expertise to provide effective 

Page 4 of 5 
BOG-FRS - Public Release, April 2023

oversight of systems/technology and business disruption risks; this situation resulted in an MRA at the 

2019 Information Technology examination.2

 In addition, given that, the complexity and risk profile of 

SVBFG continues to increase and the second LoD is not fully mature, the second LoD may want to 

consider conducting periodic skills and staffing assessments to ensure it possesses sufficient resources 

to provide effective review and challenge of front-line assessments. 

A response to this letter3

 is requested. Please provide SVBFG's issue remediation and audit validation 

plans by December 20th. We welcome the opportunity to discuss any aspect of this letter or our 

supervisory process with members of the board or management. Please direct any such requests to 

central Point of Contact Redacted at Redacted . 

Sincerely, 

Redacted 

Redacted 

Examiner in Charge 

Federal Reserve Bank of San Francisco 

2

 Results of the target examination were provided by letter and Report of Examination transmitted on June 6th. 3

 This document has been prepared by an examiner selected or approved by the Board of Governors of the Federal Reserve 

System. The document is the property of the Board of Governors and is furnished to directors and management for their 

confidential use. The document is strictly privileged and confidential under applicable law, and the Board of Governors has 

forbidden its disclosure in any manner without its permission, except in limited circumstances specified in the law (12 U.S.C 

1817(a) and 1831m) and in the regulations of the Board of Governors (12 C.F.R. 261.20). Under no circumstances should the 

directors, officers, employees, trustees or independent auditors disclose or make public this document or any portion thereof 

except in accordance with applicable law and the regulations of the Board of Governors. Any unauthorized disclosure of the 

document may subject the person or persons disclosing or receiving such information to the penalties of Section 641 of the U.S. 

Criminal Code (18 U.S.C. 641). Each director or trustee, in keeping with his or her responsibilities, should become fully informed 

regarding the contents of this document. In making this review, it should be noted that this document is not an audit, and 

should not be considered as such.