RESTRICTED FR // FRSONLY 

MEMORANDUM OF UNDERSTANDING 

by and among 

SVB FINANCIAL GROUP 

Santa Clara, California 

SILICON VALLEY BANK 

Santa Clara, California 

FEDERAL RESERVE BANK OF SAN FRANCISCO 

San Francisco, California 

and 

CALIFORNIA DEPARTMENT OF 

FINANCIAL PROTECTION AND INNOVATION 

Sacramento, California 

WHEREAS, SVB Financial Group, Santa Clara, California ("SVBFG") is a registered 

bank holding company that owns and controls Silicon Valley Bank, Santa Clara, California (the 

"Bank" and collectively with SVBFG, the "Firm"), a state member bank, and various nonbank 

subsidiaries; 

WHEREAS, the California Department of Financial Protection and Innovation (the 

"Department") is the appropriate state supervisor for SVBFG and the Bank and the Board of 

Governors of the Federal Reserve System (the "Board of Governors") is the appropriate federal 

supervisor of SVBFG and the Bank; 

WHEREAS, SVBFG has a number of separate business lines and legal entities that must 

comply with a wide range of applicable laws, rules, and regulations; 

BOG-FRS - Public Release, April 2023 
WHEREAS, SVBFG has adopted a firm-wide risk management program designed to 

identify and manage risks across the consolidated organization; 

WHEREAS, the Reserve Bank and the Department (collectively, the "Supervisors") 

conducted supervisory assessments of SVBFG and the Bank in 2020, 2021, and 2022 that, 

identified significant deficiencies in SVBFG's and the Bank's oversight by their respective 

boards of directors and senior management and the Firm's risk management program, 

information technology program, liquidity risk management program, third-party risk 

management program, and internal audit program; 

WHEREAS, it is the common goal of SVBFG, the Bank, the Reserve Bank, and the 

Department that SVBFG and the Bank comply with all applicable federal and state laws, rules, 

and regulations; 

WHEREAS, SVBFG, the Bank, the Reserve Bank, and the Department have mutually 

agreed to enter into this Memorandum of Understanding (the "MOU"); and 

WHEREAS, the boards of directors of SVBFG and the Bank have authorized the 

undersigned to enter into this MOU on behalf of SVBFG and the Bank and consent to 

compliance with each and every applicable provision of this MOU by SVBFG and the Bank. 

NOW, THEREFORE, the Reserve Bank, the Department, SVBFG, and the Bank agree as 

follows: 

Source of Strength 

1. The board of directors of SVBFG shall take appropriate steps to fully utilize 

SVBFG's financial and managerial resources, pursuant to section 38A of the FDI Act (12 U.S.C. 

§ 183 1o-1) and section 225.4(a) of Regulation Y of the Board of Governors of the Federal 

Reserve System (the "Board of Governors") (12 C.F.R. § 225.4(a)), to serve as a source of 
strength to the Bank, including, but not limited to, taking steps to ensure that the Bank complies 

with any supervisory action taken by its federal or state regulators. 

Board Oversight 

2. Within 90 days of the effective date of this MOU, SVBFG's board of directors 

shall submit a written plan acceptable to the Supervisors to strengthen its effectiveness in 

overseeing the Firm's operations and senior management. The plan shall include the following 

five items: 

(a) an assessment of the current structure, qualifications, and composition of 

SVBFG's board of directors and its committees to ensure that an appropriate number of directors 

possess the requisite risk management experience commensurate with the complexity and size of 

SVBFG; 

(b) actions to establish a risk management committee and an audit committee, 

comprised of individuals with the qualifications, experience, knowledge, and training necessary 

to fulfill their duties and responsibilities, which will meet pursuant to an established regular 

schedule with SVBFG's senior executives to provide oversight, discuss remediation of 

deficiencies, and serve as the appropriate escalation forum; 

(c) measures to hold SVBFG and the Bank's senior management accountable 

for remediating the deficiencies identified by this MOU and maintaining a risk-management and 

controls framework that meets the requirements of this MOU, including ensuring that 

compensation and other incentive compensation is consistent with risk management objectives 

and measurement standards; 
(d) measures to ensure that the individuals or groups charged with carrying 

out SVBFG's risk management program are supported by adequate resources and staffing levels 

with the requisite stature, authority, and expertise; and 

(e) steps to ensure comprehensive reporting provided to SVBFG's board of 

directors and its committees charged with oversight of risk management and internal audit 

include information of sufficient quality, granularity, and reliability to ensure the board of 

directors' and its committees' effective oversight of SVBFG's risk identification and assessment 

and adequate and timely remediation of regulatory deficiencies. 

Risk Management Program 

3. Within 90 days of the effective date of this MOU, SVBFG and the Bank shall 

submit a written plan acceptable to the Supervisors to strengthen the Firm's enterprise-wide risk 

management program to be consistent with the requirements set forth in section 252.33 of 

Regulation YY of the Board of Governors (12 C.F.R. § 252.33). The plan shall provide for a 

sustainable risk management framework that includes the following four items: 

(a) enhanced written policies and procedures, including regular training 

thereon, to facilitate compliance with Regulation YY; 

(b) clearly defined roles and responsibilities for risk management personnel in 

the business lines and risk functions, including periodic assessments that ensure personnel are 

functioning effectively; 

(c) steps to enable the timely identification, assessment, mitigation, 

monitoring, and reporting of risk exposures, including: 

(i) improvements to the information, reports, and data provided to 

senior management concerning identified and developing risks; and 
(ii) enhancements to the escalation and challenge processes for the 

business lines and the risk functions to ensure each exercises responsibility for risk identification, 

mitigation, monitoring, acceptance and reporting; and 

(d) an effective testing and validation process to assess compliance with 

internal controls. 

Internal Audit 

4. Within 90 days of the effective date of this MOU, SVBFG and the Bank shall 

submit a written plan acceptable to the Supervisors to improve the Firm's internal audit program. 

The plan shall provide for a sustainable internal audit framework consistent with relevant 

supervisory guidelines including the Interagency Policy Statement on the Internal Audit Function 

and its Outsourcing, dated April 22, 2003 (SR 03-5) and the Supplemental Policy Statement on 

the Internal Audit Function and its Outsourcing, dated January 23, 2013 (SR 13-1 (Sup)) that 

includes the following five items: 

(a) measures to establish an appropriate complete audit universe and a 

comprehensive risk assessment methodology based on the size and complexity of the Firm; 

(b) steps to develop and establish an appropriate audit coverage based on risk 

assessments; 

(c) measures to affect a continuous monitoring program for identification of 

emerging risks, changes in business strategy, and organizational structure to ensure appropriate 

updates to internal audit's plans; 

(d) steps to ensure audits are executed in alignment with supervisory and 

industry standards; and 
(e) timely resolution of findings from audits and follow-up reviews to ensure 

implementation of collective measures. 

Information Technology Risk Management 

5. Within 90 days of the effective date of this MOU, the SVBFG and the Bank's 

senior management shall submit a written plan acceptable to the Supervisors to strengthen the 

Firm's information technology ("IT") risk management program. The plan shall provide for a 

sustainable risk management framework that includes the following six items: 

(a) measures to enhance SVBFG and the Bank's boards of directors and 

senior management oversight to ensure that the Firm's IT risk management program is 

commensurate with its size, complexity, and risk profile; 

(b) steps to ensure that those with responsibility for IT risk management at 

SVBFG and the Bank have clearly defined roles and responsibilities, possesses the appropriate 

subject matter expertise and stature, and are supported by adequate resources and staffing; 

(c) steps to ensure that SVBFG and the Bank maintain a comprehensive, 

adequately detailed, and accurate inventory of IT assets, and shall include enhanced end-of-life 

IT processes; 

(d) measures to ensure that SVBFG and the Bank maintain an effective 

identity and access management governance program; 

(e) an effective testing and validation process to assess the effectiveness of 

internal controls and identify any deficiencies; and 

(f) measures to ensure management information systems appropriately 

identify, track, and report deficiencies in vulnerability management to SVBFG and the Bank's 
boards of directors and senior management, as applicable, with sufficient granularity to enable 

oversight of remediation and any delays. 

Third Party Risk Management 

6. Within 90 days of the effective date of this MOU, SVBFG and the Bank shall 

submit a written plan acceptable to the Supervisors to improve the Firm's third-party risk 

management program. The plan shall provide for a sustainable third-party risk management 

framework, in alignment with applicable supervisory expectations, that include the following 

three items: 

(a) enhanced written policies and procedures, including regular training 

thereon, related to: 

(i) ensuring that the inventory of third-party vendors is complete and 

reviewed on a quarterly basis; 

(ii) ensuring that risk assessments and ratings for third-party vendors 

are reviewed and updated according to an established and regular schedule; 

(iii) enhancing the ongoing monitoring of third-party vendors; and 

(iv) establishing a formal governance program relating to third-party 

vendor life cycle within the Firm-wide risk management program; 

(b) clearly defined roles and responsibilities for risk management personnel in 

business lines and risk functions, including periodic assessments that ensure the defined roles 

and responsibilities are functioning effectively; and 

(c) measures to enable the timely identification, assessment, mitigation, 

monitoring, and reporting of risk exposures, including: 
(i) improvements to the information, reports, and data provided to 

senior management concerning identified and developing risks; 

(ii) enhancements to the escalation and challenge processes for the 

business lines and the risk functions to ensure each exercises responsibility for risk identification, 

mitigation, monitoring, and reporting; and 

(iii) an effective testing and validation process to assess compliance 

with internal controls. 

Liquidity Risk Management 

7. Within 90 days of the effective date of this MOU, SVBFG and the Bank shall 

submit a written plan acceptable to the Supervisors to improve the Firm's liquidity risk 

management program. The plan shall provide for a sustainable liquidity risk management 

framework that includes the following two items: 

(a) enhancements to the Firm's liquidity stress testing framework including 

enhanced deposit segmentation, scenario design, and key assumptions to ensure the stress test 

includes appropriate level of stress and well-supported assumptions that are reflective of 

SVBFG's stress scenarios and vulnerabilities; and 

(b) procedures for effective independent review, oversight, and challenge of 

the Firm's liquidity risk management framework, including the underlying assumptions utilized 

in various scenarios and the processes to monetize the liquidity buffer in times of stress, 

consistent with the requirements set forth in Regulation YY (12.C.F.R. Part 252). 

Progress Reports 

8. Within 45 days of the end of each calendar quarter following the effective date of 

this MOU, the board of directors of SVBFG. the Bank, or authorized committees thereof, shall 
submit to the Supervisors written progress reports detailing the form and manner of all actions 

taken to secure compliance with this MOU, a timetable and schedule to implement specific 

remedial actions to be taken, and the results thereof. 

Approval and Implementation 

9. (a) SVBFG and the Bank shall submit written plans that are acceptable to the 

Supervisors within the applicable time periods set forth in paragraphs 2 through 7 of this MOU. 

Each plan shall contain a timeline for full implementation of the plan with specific deadlines for 

completion of each component of the plan. 

(b) Within 10 days of approval by the Supervisors, SVBFG and the Bank 

shall adopt the approved plans. Upon adoption, SVBFG and the Bank shall implement the 

approved plans and thereafter fully comply with them. 

(c) During the term of this MOU, the approved plans shall not be amended or 

rescinded without the prior written approval of the Supervisors. 

Communications 

10. All communications regarding this MOU shall be sent to the Reserve Bank's 

centralized mailbox at Redacted@sf.ftb.org and to the following individuals: 

(a) Redacted 

Central Point of Contact 

Federal Reserve Bank of San Francisco 

950 S. Grand Avenue 

Los Angeles, California 90115 

Redacted 

(b) Redacted 

California Department of Financial 

Protection and Innovation 

2101 Arena Boulevard 

Sacramento, California 95834 

Redacted@dfpi.ca.gov 

(c) [NAME] 
[TITLE] 

SVBFG Financial Group 

3003 Tasman Drive 

Santa Clara, California 95054 

(d) [NAME] 

[TITLE] 

Silicon Valley Bank 

3003 Tasman Drive 

Santa Clara, California 95054 

Miscellaneous 

11. Notwithstanding any provision of this MOU, the Supervisors may in their sole 

discretion, giant written extensions of time to SVBFG and the Bank to comply with any 

provision of this MOU. 

12. The provisions of this MOU shall be binding upon SVBFG, the Bank, and their 

institution-affiliated parties, as defined in sections 3(u) and 8(b)(3) of the FDI Act (12 U.S.C. §§ 

1813(u) and 1818(b)(3)), in then capacities as such, and their successors and assigns. 

13. Each provision of this MOU shall remain effective and enforceable until stayed, 

modified, terminated, or suspended in writing by the Supervisors. 

14. The provisions of this MOU shall not bar, estop, or otherwise prevent the Board 

of Governors, the Reserve Bank, the Department, or any other federal or state agency from 

taking any other action affecting SVBFG, the Bank, any of their subsidiaries, or any of their 

current or former institution-affiliated parties and their successors and assigns. 

15. This MOU is not a "Written Agreement" pursuant to Pursuant to section 8 of the 

FDI Act (12 U.S.C. § 1818). 
IN WITNESS WHEREOF, the parties have caused this MOU to be executed as of the 

day of 2023. 

SVBFG FINANCIAL GROUP FEDERAL RESERVE BANK OF 

SAN FRANCISCO 

By: By: 

NAME: NAME: 

TITLE: TITLE: 

SILICON VALLEY BANK CALIFORNIA DEPARTMENT OF 

FINANCIAL PROTECTION AND 

INNOVATION 

By: By: 

NAME: NAME: 

TITLE: TITLE: