BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

CALIFORNIA DEPARTMENT OF 

FINANCIAL PROTECTION AND INNOVATION 

FEDERAL RESERVE BANK OF 

SAN FRANCISCO 

2101 ARENA BOULEVARD 

SACRAMENTO, CALIFORNIA 95834 

(916) 576-4941 

101 MARKET STREET 

SAN FRANCISCO, CALIFORNIA 94108 

(415) 974-2000 

May 31, 2022 

BY SECURE EMAIL 

Board of Directors 

Silicon Valley Bank/Silicon Valley Bank Financial Group 

3003 Tasman Drive 

Santa Clara, California 95054 

Members of the Board: 

The Federal Reserve Bank of San Francisco (FRBSF) and the California Department of Financial 

Protection and Innovation (CDFPI) jointly completed an assessment of Governance and Risk 

Management practices at SVB Financial Group and its subsidiary bank, Silicon Valley Bank 

(SVB or the Firm). The review focused on the Firm’s board effectiveness1

 and the Firm's risk 

management program. The board effectiveness portion of the review focused on (1) board 

oversight centered on how senior management is held accountable and (2) governance 

centered on the board’s composition, committee structure and quality of reporting presented 

to board. The risk management program portion of the review focused on (1) risk oversight 

and governance across the firm’s three lines of defense and (2) risk monitoring and reporting. 

This letter serves to formalize the supervisory findings discussed with the Firm’s board and 

Internal Audit on May 23, 2012, and management on May 27, 2022. 

Executive Summary 

The Firm's governance and risk management practices are below supervisory expectations. 

The board has not provided effective oversight to ensure senior management implements risk 

management practices commensurate with the Firm’s size and complexity. The board did not 

provide effective oversight of management’s responsibility to implement the large financial 

institution (LFI) readiness initiatives or the foundational risk management program principles 

applicable for all banks, irrespective of size. When risk management weaknesses were 

indicated by breaches of internal risk metrics, internal audits and past regulatory 

1

 As set forth in the Federal Reserve’s Supervisory Guidance on Board of Directors' Effectiveness (SR 21-03) and Enhanced 

Prudential Standards (Regulation YY) 

Page 1 of 10
 
BOG-FRS - Public Release, April 2023

examinations, the board did not hold senior management accountable to remediate these 

issues. In addition, performance objectives and incentive compensation practices do not 

clearly incorporate risk management objectives. 

The lack of effective board oversight has resulted in the Firm missing several elements of a 

sound three lines of defense risk management program. The long-dated supervisory findings 

related to enterprise risk management, technology risk management, and information 

security risk management, coupled with additional findings related to liquidity risk 

management in the third quarter 2021, indicate weaknesses in the Firm's ability to self-identify 

internal control weaknesses and manage risks proactively. Moreover, the Firm's internal audit 

department has not provided appropriate coverage of the firm's LFI readiness initiatives or 

second line independent risk function. 

The concerns noted in board oversight coupled with the risk management weaknesses raise 

concerns about the Firm's governance and controls. The Firm needs effective governance 

and controls for sustained safety and soundness. The board is directed to ensure appropriate 

resources are immediately dedicated toward remediation of the concerns noted in prior 

supervisory cycles as well the findings noted in this supervisory letter. 

This review identified three Matters Requiring Immediate Attention2

 (MRIAs) which are 

further detailed in the Appendix: 

New MRIAs Due Date for Completion 

1. Board Effectiveness August 31, 2022 

2. Risk Management Program August 31, 2022 

3. Internal Audit Effectiveness August 31, 2022 

2

 Matters Requiring Immediate Attention (MRIAs) arising from an examination, inspection, or any other supervisory activity are 

matters of significant importance and urgency that the FR requires organizations to address immediately and include: (1) matters 

that have the potential to pose significant risk to the organization's safety and soundness; (2) matters that represent significant 

noncompliance with applicable laws and regulations; (3) repeat criticisms that have escalated in importance due to insufficient 

attention or inaction by the organization; and (4) in the case of consumer compliance examinations, matters that have the 

potential to cause significant consumer harm. 

Matters Requiring Attention (MRAs) constitute matters that are important, and that the FR is expecting an organization to 

address over a reasonable period of time, but when the timing need not be "immediate" as the threat to safety and soundness is 

less immediate than with issues giving rise to MRIAs. An MRA typically will remain an open issue until resolution and confirmation 

by examiners that the banking organization has taken corrective action. If a banking organization does not adequately address 

an MRA in a timely manner, examiners may elevate an MRA to an MRIA. Similarly, a change in circumstances, environment, or 

strategy can also lead to an MRA becoming an MRIA. 
       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

Board Effectiveness 

Board oversight does not meet supervisory expectations. The board did not provide effective 

oversight of the Firm’s LFI transition plan implementation or the foundational risk management 

program execution. Oversight weaknesses have resulted in management performing a 

second risk management gap assessment and transformation plan over two years after an 

initial risk assessment was performed in 2020. Additionally, the Firm still has a significant 

number of resources to hire as part of addressing the existing deficiencies across all three 

lines of defense. Effective oversight has been hindered by the board lacking members with 

relevant large financial institution risk management experience. 

The board and board committees have not held senior management accountable for 

executing a sound risk management program, nor sufficiently challenged management on the 

content of the risk information reported to the board to achieve effective oversight. Senior 

management performance evaluation and compensation programs are not linked to the 

Firm’s risk management objectives. Risk management deficiencies, identified by independent 

risk functions or through regulatory examinations, have not been meaningfully considered in 

the Firm’s incentive compensation program. 

The second line independent risk function either lacks or has not effectively used its authority 

and stature. The board’s Risk Committee has not held executive sessions with the Chief Risk 

Officer (CRO). The lack of direct executive committee sessions between the Risk Committee 

and the CRO contributes to the underdevelopment of the Firm’s second line independent risk 

function. The Risk Committee is not directly engaged in its primary function, ensuring an 

appropriate state of risk management with a full understanding of the root causes associated 

with existing internal control issues. Both the Risk Committee and Audit Committee rely heavily 

on the Chief Executive Officer (CEO) for assessing the CRO’s and Chief Auditor’s (CA) 

performance rather than the feedback being provided directly from the Committee Chairs. 

The lack of direct feedback provided by the Committee Chairs reflects negatively on the 

board’s oversight, particularly with respect to control functions such as second line 

independent risk and third line internal audit. 

Risk Management Program 

The Firm’s risk management program is not effective. The weaknesses described below 

impact the effectiveness of the independent risk management functions and the execution of 

the risk management programs. 

The current risk management framework is not comprehensive, does not incorporate 

coverage for all risk stripes, and does not address foundational enterprise level risk 

management matters, such as issues management and escalation. Moreover, the risk 

management framework is not commensurate to the Firm's size and complexity as required 

under Section 252.33 Risk Management and Risk Committee Requirements under Regulation 

Page 3 of 10
 
       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

YY (Enhanced Prudential Standards). The lack of an effective risk management framework 

and policy has resulted in inconsistent core risk management activities and ultimately a 

reactive/patched, rather than holistic/integrated, approach to risk management. Second line 

independent risk management has not clearly defined requirements to achieve an effective 

state. The lack of qualified leadership and project management discipline, without clear 

deliverables and milestones to execute on planned risk management work streams, are 

factors contributing the firm’s ineffective risk management program. 

Risk management framework weaknesses have resulted in inadequate risk monitoring and 

reporting to senior management and the board. The framework, policies, and standards do 

not clearly define ownership, reporting, escalation, and approval of risk limits. The current 

framework for risk appetite statement (RAS)-level breaches is broad and does not indicate 

who is responsible for reviewing and approving the business risk owner’s remediation plan. 

Risk metrics are limited to RAS metrics and do not include comprehensive key risk indicators 

and early warning indicators. The current framework does not incorporate sufficient RAS 

metrics for model risk, third party management risk, and human capital risk. Additionally, the 

framework does not effectively specify the responsibilities for the second line independent 

risk function. 

The management level risk committee structure does not deliver on foundational risk 

management committee practices. In the current structure, the Firm’s risk management 

committees are advisory in nature, do not make decisions, are not required to have charters, 

and do not include a clear path of escalation for all risk stripes. The current structure relies 

heavily on business line committees for risk management decisions with no clear mechanism 

for second line independent risk management to provide effective challenge. The risk 

management framework lacks a centralized risk committee to oversee risks enterprise-wide, 

across risk domains, businesses, and entities. While the Risk Management Advisory 

Committee (RMAC) and Executive Committee (EC) could serve the purpose of holistic risk 

oversight, the RMAC is advisory in nature and does not include all senior executives while risk 

discussions at the EC are isolated and ancillary to discussions of core businesses or products. 

Neither the RMAC nor the EC provide effective holistic risk oversight. 

Internal Audit (IA) 

IA's coverage of risk management is less than effective. IA did not hold SVB senior 

management accountable despite indicators of an ineffective risk management program. IA 

exhibited a slow and reactive approach to testing the Firm’s LFI readiness transition plan, risk 

management programs and functions, and integration of acquired entities, such as Leerink 

Partners. Additionally, IA does not provide sufficient information to allow the Audit Committee 

to fulfill its oversight responsibilities, nor is IA's reporting consistent with other large complex 

institutions or Audit Committee reporting guidance set forth under Supervision and Regulation 

Letter 13-1 Supplemental Policy Statement on the Internal Audit Function and Its Outsourcing. 

Page 4 of 10
 
       

 

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

Despite the indicators of weaknesses in the second line independent risk management, the CA 

did not include coverage of this area in the 2020 or 2021 audit plans. IA’s risk assessment 

methodology and oversight processes were not effective as areas with known weaknesses 

were not subject to audit despite their ineffective state. Moreover, the Audit Committee did 

not effectively challenge the CA on the adequacy of IA coverage. 

Next Steps 

Within 90 days of receipt of this letter3

, management is required to submit written remediation 

plans the Firm has taken or will take to address the supervisory findings described above and, 

in the Appendix. The remediation plans should contain sufficient detail on the completion 

milestones, including validation of corrective actions by Internal Audit, within timeframes that 

have been reviewed and approved by the board. Please send all supervisory 

correspondence from your institution in electronic format only, copying our centralized 

mailbox as a recipient at 


Redacted .

Please note that this letter contains confidential material and should be treated accordingly 

by your organization.4

 As such, the contents of this letter are subject to the rules of the Board 

of Governors of the Federal Reserve System regarding disclosure of confidential supervisory 

information as well as California Financial Code 452. Please direct any comments or questions 

to 

. 

Redacted

3

 Any institution about which the Federal Reserve makes a written material supervisory determination is eligible to utilize the 

appeals process as described in Internal Appeals Process for Material Supervisory Determinations and Policy Statement 

Regarding the Ombudsman for the Federal Reserve System, 85 Fed. Reg. 15175 (March 17, 2020). An appeal under this process 

may be made of any written material supervisory determination, as defined in the policy statement. The Board’s Ombudsman 

(Ombudsman) can provide assistance regarding questions related to the System’s material supervisory determination appeals 

process and claims of retaliation. The Ombudsman can also provide assistance to facilitate the informal resolution of concerns 

prior to the filing of a formal appeal. An institution may contact the Ombudsman at any time by calling 1-800-337-0429, by 

sending a facsimile to 202-530-6208, by writing to the Office of the Ombudsman, Board of Governors of the Federal Reserve 

System, Washington, D.C. 20551, or by sending an e-mail to ombudsman@frb.gov. 

4

 THIS DOCUMENT IS STRICTLY CONFIDENTIAL: This document has been prepared by an examiner selected or approved by the 

Board of Governors of the Federal Reserve System. The document is the property of the Board of Governors and is furnished to 

directors and management for their confidential use. The document is strictly privileged and confidential under applicable law, 

and the Board of Governors has forbidden its disclosure in any manner without its permission, except in limited circumstances 

specified in the law (12 U.S.C 1817(a) and 1831m) and in the regulations of the Board of Governors (12 C.F.R. 261.20). Under no 

circumstances should the directors, officers, employees, trustees or independent auditors disclose or make public this document 

or any portion thereof except in accordance with applicable law and the regulations of the Board of Governors. Any 

unauthorized disclosure of the document may subject the person or persons disclosing or receiving such information to the 

penalties of Section 641 of the U.S. Criminal Code (18 U.S.C. 641). Each director or trustee, in keeping with his or her responsibilities, 

should become fully informed regarding the contents of this document. In making this review, it should be noted that this 

document is not an audit and should not be considered as such. 

Page 5 of 10
 
       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

Sincerely, 


Redacted

Redacted

Department of Financial Protection and Innovation LFBO Dedicated Supervisory Team Lead 

Federal Reserve Bank of San Francisco 

Redacted

cc: Greg Becker, Chief Executive Officer 

John Peters, Chief Auditor 

Redacted

, FDIC 

Page 6 of 10
 
       

 

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

Appendix I: New Matters Requiring Immediate Attention (MRIAs) 


MRIA #1: BOARD EFFECTIVENESS 

Issue: The Board’s oversight over the Firm’s risk management practices is not adequate and 

has contributed to an ineffective risk management program. The lack of an effective risk 

management program increases the potential that emerging risks may go undetected or root 

causes for internal controls deficiencies are not addressed. Key points noted during the exam 

supporting this issue include: 

	 The board did not hold senior management accountable through appropriate 

performance management programs. Senior management performance objectives and 

incentive compensation practices do not clearly link to risk management objectives. 

	 The disaggregated risk committee reporting and decentralized committee oversight 

responsibilities impede the board’s ability to have a comprehensive view of the firm’s risk 

exposures and vulnerabilities. 

	 The current board composition lacks depth and experience. The board’s director 

recruiting process does not effectively address what would constitute an appropriate mix 

of skills, tenure, and risk experience in alignment with the changes in the Firm’s size and 

complexity 

	 With the limited and inconsistent reporting provided to the Risk Committee, the board did 

not adequately challenge management to provide substantive updates on the 

effectiveness of the Firm’s risk management program. 

Required Action: By August 31, 2022, the board is required to develop a plan for effective 

oversight of senior management. At a minimum, the board should address the following 

elements, along with the timeframe to implement the plan’s elements: 

a.	 Mechanisms to hold senior management accountable for meeting risk management 

expectations 

b.	 Protocols for board executive sessions with second line independent risk and third line IA 

leadership to promote candid assessments of firm’s governance and controls and more 

direct board oversight of the CRO and the CA 

c.	 Board committee structure, risk reporting, and escalation process to support holistic risk 

oversight 

d.	 Director recruiting criteria to support diversity of expertise within the context of board 

composition 

e.	 Training program to maintain alignment of directors’ skills with the Firm’s size and 

complexity 

Page 7 of 10 

       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

MRIA #2: RISK MANAGEMENT PROGRAM 

Issue: SVB’s existing risk management program is not effective. The existing risk management 

structure and framework does not provide the Firm with appropriate mechanisms to operate 

a fully integrated risk management program and impedes management's ability to identify 

emerging risks and address root causes of internal control deficiencies. Observations noted 

during the exam that contribute to this issue are: 

	 Risk monitoring and reporting are distributed across different management committees, 

without a central risk-focused committee and without the stature to oversee risks on an 

aggregated and holistic basis. 

	 The risk management program lacks effective risk monitoring, reporting and oversight. 

The existing program framework poorly defines standards for setting/approving risk limits 

and reporting/ escalating internal control exceptions. 

	 Risk reporting does not effectively present the information within the context of why the 

firm should/should not accept the risk associated with the informational topic being 

presented. 

Required Action: By August 31, 2022, management is required to complete a comprehensive 

gap assessment against regulatory and industry standards for a large financial institution risk 

management program. Management should develop a holistic remediation plan to address 

the identified gaps. The gap assessment and the remediation plan should be presented for 

the board risk committee’s review, effective challenge, and approval. At a minimum, the 

remediation plan should address the following elements and the timeframes to implement the 

plan’s elements: 

a.	 Enterprise-level risk programs, policies, and procedures with clear roles and 

responsibilities and the mechanisms to enforce accountability 

b.	 Processes for risk identification, assessment, mitigation, monitoring, and escalation 

c.	 Reporting to support effective risk-acceptance decision making 

Page 8 of 10
 
       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

MRIA #3: INTERNAL AUDIT EFFECTIVENESS 

Issue: The Internal Audit Department’s (IA) methodology and programs do not sufficiently 

challenge management, provide the Audit Committee with sufficient and timely reporting, or 

ensure the timely analysis of critical risk management functions and the overall risk 

management program. The deficiencies in IA’s processes and reporting negatively affected 

its ability to provide timely, independent assurance that the Firm's risk management, 

governance and internal controls were operating effectively. Key points noted during the 

exam that contribute to this issue are: 

	 Despite the weaknesses indicated in the second line independent risk function, IA’s 2020 

and 2021 risk assessment and audit plans did not result in appropriate or timely coverage 

of SVB’s second line enterprise risk management, financial risk management, or operations 

risk management. 

	 While the Firm launched a Large Financial Institution (LFI) transition program with specific 

workstreams centered on risk management, IA did not conduct comprehensive monitoring 

or project audits to challenge the Firm’s overall progress with respect to risk management 

and LFI readiness. 

	 While the Firm acquired Leerink Partners (now known as SVB Securities) in 2019, this entity 

was not fully integrated into the Firm’s risk management governance structure and IA 

provided minimal coverage of this key business line during the past two audit cycles. 

	 Internal Audit’s Audit Committee (AC) reporting lacks fundamental components. The 

current reporting does not provide the AC with sufficient and timely information to fulfill its 

oversight responsibilities. Also, the AC has not clarified what reporting they need to 

effectively execute their oversight role. Key elements lacking in AC reporting include: 

 Discussion of adverse audit results and high-risk issues along with associated
 

management action plans.
 

 Comprehensive analysis and stratification of outstanding issues including the 

identification of thematic macro control issues and trends and their impact on the risk 

assessment. 

 Remediation plans to address past due audit issues. 

 Risk management self-assessments for all significant risk categories and updates of 

the remediation of issues identified through these self-assessments 

Required Action: By August 31, 2022, IA is required to conduct a comprehensive gap 

assessment against regulatory and industry standards applicable for a large financial 

institution audit function. IA should also develop a remediation plan to address the identified 

gaps. The gap assessment and remediation plan should be presented for AC review, 

effective challenge, and approval. At a minimum, the remediation plan should address the 

following elements and the timeframes to implement the plan’s elements: 

Page 9 of 10
 
       

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

a.	 Risk assessment methodology and associated oversight processes to ensure the risk 

assessment drives accurate auditable entity risk results with appropriate coverage 

frequency. Risk assessment results should be subject to effective challenge by IA 

leadership including the AC 

b.	 Reporting that considers the applicable regulatory and industry guidance to support 

the AC fulfill their oversight responsibilities 

Page 10 of 10