© 2015 International Monetary Fund 

IMF Country Report No. 15/89 

UNITED STATES 

FINANCIAL SECTOR ASSESSMENT PROGRAM 

DETAILED ASSESSMENT OF OBSERVANCE ON THE BASEL 

CORE PRINCIPLES FOR EFFECTIVE BANKING SUPERVISION 

This Detailed Assessment of Observance on the Basel Core Principles For Effective Banking 

Supervision on the United States was prepared by a staff team of the International Monetary 

Fund. It is based on the information available at the time it was completed in March 2015. 

Copies of this report are available to the public from 

International Monetary Fund  Publication Services 

700 19th Street, N.W.  Washington, D.C. 20431 

Telephone: (202) 623-7430  Telefax: (202) 623-7201 

E-mail: publications@imf.org Internet: http://www.imf.org 

Price: $18.00 a copy 

International Monetary Fund 

Washington, D.C. 

April 2015 
UNITED STATES 

DETAILED ASSESSMENT OF OBSERVANCE 

BASEL CORE PRINCIPLES FOR EFFECTIVE BANKING 

SUPERVISION 

Prepared By 

Monetary and Capital 

Markets Department 

This Detailed Assessment Report was prepared in the 

context of an IMF Financial Sector Assessment 

Program (FSAP) mission in the United States during 

October-November 2014, led by Aditya Narain, IMF, 

and overseen by the Monetary and Capital Markets 

Department, IMF. Further information on the FSAP 

program can be found at 

http://www.imf.org/external/np/fsap/fssa.aspx 

March 2015 
UNITED STATES 

2 INTERNATIONAL MONETARY FUND

CONTENTS 

GLOSSARY _________________________________________________________________________________________ 3 

SUMMARY AND KEY FINDINGS _________________________________________________________________ 5

INTRODUCTION ________________________________________________________________________________ 12

A. Information and Methodology Used for Assessment _________________________________________ 12

B. Institutional and Market Structure—Overview ________________________________________________ 15

C. Preconditions for Effective Banking Supervision ______________________________________________ 22

DETAILED ASSESSMENT ________________________________________________________________________ 25

A. Supervisory Powers, Responsibilities and Functions ___________________________________________ 26

B. Prudential Regulations and Requirements ___________________________________________________ 106

SUMMARY COMPLIANCE WITH THE BCP ____________________________________________________ 240

RECOMMENDED ACTIONS AND AUTHORITIES COMMENTS _______________________________ 251

A. Summary of Recommended Actions _________________________________________________________ 251

B. Authorities’ Response to the Assessment ____________________________________________________ 254
UNITED STATES 

INTERNATIONAL MONETARY FUND 3

GLOSSARY

ABS Asset Backed Securities 

AC 

AICPA 

ALLL 

AMA 

Additional Criteria or Additional Criterion 

American Institute of Certified Public Accountants 

Allowance for Loan and Lease Losses 

Advanced Measurement Approach for Operational Risk 

AML/CFT 

ATRR 

Anti Money Laundering and Combating the Financing of Terrorism 

Allocated Transfer Risk Reserve 

BCP Basel Core Principles for Effective Banking Supervision 

BHC 

BSA 

CAMELS 

Bank Holding Company 

Bank Secrecy Act 

Capital adequacy, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk) 

CCAR 

CCR 

Comprehensive Capital Analysis and Review 

Counterparty Credit Risk 

CELM Current Expected Loss Model 

CFO Chief Financial Officer 

CFPB 

CFR 

Consumer Financial Protection Bureau 

Code of Federal Regulations 

CFTC Commodity Futures Trading Commission 

CIBC 

CLAR 

Change In Bank Control Act 

Comprehensive Liquidity Analysis and Review 

CLS 

CMG 

COAG 

Continuous Linked Settlement 

Crisis Management Group 

Complete Cooperation Agreement 

CP 

CPC 

Core Principle 

Central Point of Contact 

CRA 

CRE 

CRM 

CRO 

Community Reinvestment Act 

Commercial Real Estate 

Country Risk Management 

Chief Risk Officer 

C-SCAPE Consolidated Supervision, Comparative Analysis, Planning and Execution 

DAR Detailed Assessment Report 

DFA Dodd-Frank Wall Street Reform and Consumer Protection Act, or Dodd-Frank Act 

EC 

EDTF 

EIC 

FBAs 

Essential Criteria or Essential Criterion 

Enhanced Disclosure Task Force 

Examiner-in-Charge 

Federal Banking Agencies 

FBO 

FDIA 

Foreign Banking Organization 

Federal Deposit Insurance Act 

FDIC Federal Deposit Insurance Corporation 

FHFA Federal Housing Finance Agency 

FMU Financial Market Utility 

FRB Federal Reserve Board 

FSAP Financial Sector Assessment Program 

FSB Financial Stability Board 

FSOC Financial Stability Oversight Council 

FSSA 

GAO 

Financial System Stability Assessment 

Government Accounting Office 
UNITED STATES 

4 INTERNATIONAL MONETARY FUND

GDP Gross Domestic Product 

GSE Government-Sponsored Enterprises 

GSIB Global Systemically Important Banks 

HOLA Home Owner’s Loan Act 

IAP Institution-Affiliated Parties 

IASB International Accounting Standards Board 

ICE 

ICERC 

Intercontinental Exchange Clear Credit L.L.C 

Interagency Country Exposure Review Committee 

ILSA International Lending Supervision Act 

IOSCO 

LBOs 

International Organization of Securities Commissions 

Large Banking Organizations 

LC 

LCR 

LIDI 

Largely Compliant 

Liquidity Coverage Ratio 

Large Insured Depository Institution 

LISCC Large Institution Supervision Coordinating Committee 

MNC 

MoU 

MRA 

MRBA 

MRIA 

NRC 

Materially Non-Compliant 

Memorandum of Understanding 

Matters Requiring Attention 

Matters Requiring Board Attention 

Matters Requiring Immediate Attention 

National Risk Committee 

OCC Office of the Comptroller of the Currency 

OIG Office of the Inspector General 

OLA Orderly Liquidation Authority 

OTS Office of Thrift Supervision 

PCA 

PCAOB 

PEP 

PPM 

Prompt Corrective Action 

Public Company Accounting Oversight Board 

Politically Exposed Person 

Policies and Procedures Manual 

ROCA Risk Management, Operational Controls, Compliance, And Asset Quality 

ROE Report of Examination 

SCAP Supervisory Capital Assessment Program 

SEC Securities and Exchange Commission 

SLHC 

SR 

SSFA 

UBPR 

UFIRS 

Savings and Loans Holding Companies 

Supervision and Regulation Letters 

Simplified Supervisory Framework Approach 

Uniform Bank Performance Reports 

Uniform Financial Institution Rating System, known as CAMELS 

U.S. 

U.S.C. 

United States of America 

United States Code 

U.S. GAAP United Stated Generally Accepted Accounting Principles 

 
UNITED STATES 

INTERNATIONAL MONETARY FUND 5

SUMMARY AND KEY FINDINGS 

1. The U.S. federal banking agencies (FBAs1) have improved considerably in effectiveness 

since the previous FSAP. In response to global and domestic reforms, particularly the Dodd-Frank 

Act (DFA), the FBAs have stepped up their supervisory intensity, especially of large banking 

organizations, putting emphasis on banks’ capital planning, stress testing and corporate 

governance. To match, the FBAs have also enhanced their supervisory capacity, adding significantly 

to their staffing numbers and skills base. 

2. These improvements are reflected in the high degree of compliance with the Basel 

Core Principles for Effective Banking Supervision (BCP) in this current assessment. 

Shortcomings have been observed, particularly in the treatment of concentration risk and large 

exposures, but they do not raise concerns overall about the authorities’ ability to undertake effective 

supervision. These shortcomings should, however, be addressed if the United States is to achieve the 

standards of supervisory effectiveness expected of one of the most systemically important financial 

systems in the world. 

3. The Dodd-Frank reforms have resulted in some rationalization of supervisory 

responsibilities but they did not address, fundamentally, the fragmented nature of the U.S. 

financial regulatory structure. This was an opportunity lost. The problems inherent in multiple 

regulators with distinct but overlapping mandates remain, with the new challenge of delineating 

responsibilities with a stand-alone consumer protection agency. The FBAs are committed to making 

the revised arrangements work and cooperation has clearly improved. Nonetheless, there is 

substantial duplication of supervisory effort, particularly in respect of entities in major banking 

groups, and the ongoing risk of inconsistent messages from the agencies. Against this background, 

the assessors saw scope to sharpen supervisory mandates and opportunities for a more targeted 

allocation and commitment of resources to the supervision of smaller banking institutions. 

4. The U.S. prudential regulatory regime is a complex structure of federal statutes, 

regulations and reporting requirements, and policy statements and supervisory guidance. 

Since the crisis, the DFA and other initiatives have introduced various “tiers” of prudential 

requirements for banks and bank holding companies, which underpin the heightened supervisory 

focus on large banking organizations but have added to the complexity of the regime. Many 

requirements of the BCP are in practice, however, determined by the supervisor under a principlesbased approach. Such an approach provides flexibility for supervisors to tailor their actions to each 

individual situation and be more nuanced in their response. Under the Office of the Comptroller of 

the Currency (OCC)’s new “Heightened Standards”, for example, the supervisor has a range of 

informal and formal corrective responses that can be pursued before formal enforcement actions—

which, in the U.S., are published—are taken. Of course in benign circumstances, when the financial 

situation of a bank is still satisfactory, a principles-based approach may encourage a delayed 

 

1

 For the purposes of this assessment, the FBAs are the OCC, the Federal Reserve and the FDIC. 
UNITED STATES 

6 INTERNATIONAL MONETARY FUND

supervisory response. However, the assessors observed that banks were responsive to informal 

guidance and “best practice” recommendations from the FBAs and that supervisory oversight based 

on that guidance has stepped up in intensity. In the upturn of the cycle, it is important that good 

supervisory practice established under crisis conditions be maintained. 

5. In many cases, this principles-based approach is reflected in a lack of specificity in the 

regime, for example, the absence of guidelines or supervisory “triggers” for various risks. A 

greater degree of specificity would be consistent with the principles-based approach and would 

have three potential benefits: (i) the agencies would have an opportunity to make a preventative 

statement on risks that signals to banks where greater intensity of supervision can be expected; 

(ii) greater specificity would be a useful way to articulate the supervisors’ risk appetite and hence 

shorten the time gap between the build-up of risks and a supervisory response; and (iii) greater 

specificity would provide a useful (internal) reference point for offsite and continuous monitoring 

and an indicator of when a bank’s risk profile might need to be escalated up the supervisory 

management chain. There are a number of ways this greater level of specificity can be achieved 

within a principles-based approach, starting with agency statements to banks of areas that merit 

greater supervisory intensity and moving to more formal (internal) triggers for supervisory action. 

6. Since the crisis, there has also been a marked improvement in the risk management 

practices of banking organizations, an area identified to have material shortcomings in the 

previous FSAP. Consistent with global initiatives to “raise the bar” in risk management, the 

improvements are apparent in the greater engagement and skill levels of many boards, the 

strengthening of the risk management function itself, and in the aggregation of risk data. 

Nonetheless, these efforts are best described as “work-in-progress” from what was, in many cases, a 

lower starting point than in some major jurisdictions. The full implementation of the OCC’s 

“Heightened Standards” will add impetus to these efforts, as would a clearer delineation of the 

contribution of boards and senior management in supervisory assessments. 

Mandate, independence and cooperation (CP 1-3) 

7. The U.S. system of multiple FBAs with distinct but overlapping responsibilities 

continues to put an absolute premium on effective cooperation and collaboration. The FBAs 

will need to ensure that the significant improvements in collaboration in recent years become fully 

engrained in the modus operandi of each agency. Internationally, the establishment of supervisory 

colleges and crisis management groups (CMGs) has given greater urgency to information-sharing 

arrangements and there are no legal or other impediments to the ability and willingness of the FBAs 

to cooperate and collaborate with foreign supervisors. The dual banking structure does pose a 

challenge for international cooperation, and state banking agencies with Foreign Banking 

Organization (FBO) presence do not always inform or coordinate enforcement actions with home 

supervisors. 

8. The FBAs are operationally independent, and have clear mandates for safety and 

soundness of the banking system. However, the FBAs also have other objectives, and the primacy 

of the safety and soundness objective needs to be better enshrined in legislation or mission 
UNITED STATES 

INTERNATIONAL MONETARY FUND 7

statements to ensure a clear focus on this objective in different phases of the business cycle. In 

principle, the creation of a stand-alone Consumer Financial Protection Bureau (CFPB) should help 

establish a greater delineation between individual consumer issues and prudential issues and give 

the FBAs a clearer sense of purpose, but the delineation is not yet sharp. There is no evidence of 

direct interference by industry and government in supervisory priorities or decisions. The high level 

of public and congressional scrutiny and resulting sentiment may have an indirect effect in creating 

a perception of “cyclical” supervisory responses. 

Licensing, permissible activities, transfer ownership and major acquisitions (CP 3-6) 

9. The dual banking structure with charter choice adds to the challenge of cooperation 

and collaboration across multiple agencies. Banks may in principle choose to operate under a 

federal or state charter that best accommodates their business or strategic needs. Further, statechartered banks may choose between being supervised primarily by the FDIC or primarily by the 

Federal Reserve as a member bank, in addition to the supervision of their state supervisory 

authority. Concerns have been raised that this choice can give rise to “regime shopping” that can 

undermine the integrity of U.S. regulatory arrangements. The DFA has restricted the ability of weak 

and troubled banks to change charters, but charter conversions of (well-rated) banks and savings 

associations continue on a modest scale. The FBAs need to guard against perceptions of differences 

in supervisory style or treatment in their regional offices that could sway the choices made by banks 

in charter conversions. 

Supervisory approach, processes and reporting and sanctioning powers (CP 8-10) 

10. The FBAs have significantly increased their level of resources and intensity of 

supervision of the largest firms, and have articulated a tiered approach built on asset-based 

thresholds to achieve the desired proportionality. The traditional focus on on-site examinations 

has changed a little as there has been a shift towards more stress testing, analysis and horizontal 

reviews. Overall, the supervisory regime is effective and risk-based. There is an increasing focus on 

resolution (for the larger firms). There remains scope for better prioritization of matters requiring 

attention and their communication to banks and for aligning supervisory planning cycles across 

agencies. 

11. The FBAs have a long-established and effective regulatory reporting framework, with 

the flexibility to expand reporting requirements in response to pressing supervisory needs. 

There are safeguards built in to guard against redundant data items and information overreach. A 

lacuna is that supervisory data is not collected from banks at the solo level (i.e. at the level of the 

bank excluding its subsidiaries), which means supervisors and market participants may not have the 

information to test whether a bank is adequately capitalized on a stand-alone basis. In practice this 

omission has little prudential significance under current circumstances as bank subsidiaries tend to 

be small relative to the parent bank and can only undertake limited activities that the bank itself 

could undertake in its own name, but supervisors should closely monitor the development of 

banking groups and consider introducing solo level reporting if the number or size of bank 

subsidiaries were to expand or banking groups become less transparent. 
UNITED STATES 

8 INTERNATIONAL MONETARY FUND

12. The FBAs have a wide range of supervisory actions available to address safety and 

soundness concerns and do not hesitate to use them, although follow-up needs to be stricter.

The PCA framework is the main plank of the early intervention framework and has clear triggers. The 

authorities could consider implementing rules for promoting early action for other triggers than 

bank capital as well as introduce more explicit rules and processes to deal with ageing of 

MRAs/MRIAs. 

Consolidated and cross-border supervision (CP 12-13) 

13. Following up on the 2010 FSAP, there have been major improvements in the ability of 

the FBAs to implement a comprehensive framework for consolidated supervision. Work still 

remains outstanding, though, on developing regulatory and supervisory rules, guidance, and a 

formal rating system for SLHCs, as well as on developing a capital rule for corporate and insurance 

company SLHCs. 

14. Reflecting the large cross-border activities of U.S. banks and of foreign banking 

groups in the U.S., there is a comprehensive framework of policies and processes for cooperation and exchange of information between the FBAs and foreign supervisory authorities. 

As noted above, this is currently being strengthened by the work in supervisory colleges and in 

CMGs. The authorities should continue their efforts to establish agreements with their foreign 

counterparts on a framework of communication strategies, especially for crisis situations. While 

national treatment is the underlying principle, there remain some instances in which specific rules 

apply only to foreign institutions, such as the shorter run-off period for foreign branches in liquid 

asset requirements and requirements on FBOs to set up intermediate U.S. holding companies. 

Corporate governance (CP 14) 

15. Reflecting the global learnings from the crisis, major changes have taken place in 

supervisors ́ demands on banks’ corporate governance and in the banks’ own approaches. 

Laws and regulations have gradually raised the requirements and there is clearly heightened focus 

by boards and management on corporate governance issues. The demands on board involvement 

and skills have increased substantially and this has, in many instances, led to changes in board 

composition and calls for wider skill sets of directors. In general, supervisory expectations are 

tailored to be less strict for smaller, non-systemic banks. This means that there is a shortfall from the 

criteria, but the assessors judged that this was not sufficiently material to alter their overall 

conclusions. The assessors welcome that supervisors are encouraging medium and small banks with 

higher risk activities to adopt better practices in corporate governance and risk management that 

are appropriate for the risk profile of these firms, moving them closer to the criteria and some of the 

principles outlined in the requirements for the larger banks. 

Risk management, capital adequacy and prudential framework (CP 15-25) 

16. There have been substantial improvements in the risk management processes of 

banks, and risk aggregation has been greatly facilitated by the stress testing requirements. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 9

Given the enormity of the task of achieving and sustaining meaningful risk aggregation across the 

Global Systemically Important Banks (GSIBs), this remains very much work in progress and may take 

years to complete. Other areas in which progress needs to be made are a better delineation in 

supervisory guidance of the responsibilities of the board and management and more emphasis on 

contingency planning, particularly at the smaller end of the banking sector. The level of commitment 

to stress testing is substantial and there is considerable consensus that the outputs and outcomes of 

that process were significant in improving risk aggregation. Supervisors and firms were becoming 

more efficient with each iteration and standards required were also increasing, although there is 

some way to go before supervisory led stress tests achieve an optimum state of data granularity. 

There is still room for improvement in firm-led stress testing, where firms seem to be struggling to 

determine the appropriate severity, whilst maintaining a scenario that remains business relevant. 

17. There is a robust and comprehensive approach to setting prudent and adequate 

capital adequacy requirements, although the U.S. capital regime is in a state of transition. The 

FBAs have implemented major elements of the Basel II advanced approaches from I January, 2014 

and the U.S. standardized approach based on Basel II will begin to come into effect from 1 January, 

2015. The broad adoption of the Basel III definition of capital, when applicable to most banks from 

1 January 2015, will improve the quality of bank capital by limiting the extent to which certain 

intangibles, which had previously counted for a high proportion of bank capital, can be included in 

capital. Stress testing is entrenching a forward-looking approach to capital needs and engaging 

boards and senior management more fully in the capital planning process. The introduction of riskbased capital rules based on Basel standards for most savings and loan holding companies removes 

an anomaly created by the previous case-by-case determination of capital requirements for such 

companies, although a comprehensive capital framework for all savings and loan holding companies 

is not in place. There are a number of differences between the new U.S. capital regime and the 

relevant Basel framework, particularly the absence of a capital charge for operational risk and for 

Credit Value Adjustment (CVA) risk in the U.S. standardized approach, which provides the “floor” for 

the advanced approach banking organizations and applies to all other banking organizations. 

18. The long-established and rigorous process for evaluating banks’ approaches to 

problem assets and the maintenance of adequate provisions and reserves will be bolstered by 

accounting changes currently on the anvil. The FBAs have shown a consistent willingness to 

challenge unrealistic bank estimates of provisions and reserves and to secure increases they judge 

necessary. This steadfastness in approach will be tested as the U.S. economy continues to improve. 

Supervisory judgments in this area have been constrained by the “incurred loss” approach of U.S. 

GAAP, but the introduction of the FASB’s proposed Current Expected Loss Model (CELM) will permit 

more forward-looking provisioning. 

19. The supervisory framework to guard against concentration risk and large exposures 

needs to be strengthened. The FBAs have an effective supervisory framework for dealing with 

credit concentration risk. Guidance has been issued on specific areas of concentration of credit risk 

and this is followed up in supervisory reviews. Supervisors are also giving more attention to the 

treatment of concentration risk in counterparty credit risk management and stress testing 
UNITED STATES 

10 INTERNATIONAL MONETARY FUND

frameworks. However, the new BCP methodology has expanded this Core Principle to also include 

market and other risk concentrations “where a bank is overly exposed to particular asset classes, 

products, collateral, or currencies”. While there is some evidence of punctual supervisory action on 

this front (for instance, funding concentration), at this point a detailed supervisory framework and 

supervisory guidance for these other risk concentrations is not well developed. Although the 

widening of the definition of large exposures under the DFA has brought the large exposure 

thresholds more into line with the requirements of the BCP, some anomalies and omissions remain. 

The separate and additional limits available to banks for money market investments and security 

holdings continue to leave open the possibility of excessive risk concentrations. The 50 per cent limit 

on exposures to a corporate group is also problematic. The authorities are also encouraged to 

finalize the large exposures framework, with legal limits, for large bank holding companies and 

foreign banking organizations.

20. In addition, there remain gaps in the related party exposure framework that may 

heighten concentration risk in the system. There are no formal requirements for prior board 

approval of transactions with affiliated parties or the write-off of related party exposures exceeding 

specified amounts, or for board oversight of related party transactions and exceptions to policies, 

processes and limits on an ongoing basis. However, in practice the FBAs expect banks to apply a 

high degree of board oversight and monitoring of affiliate and insider transactions and review this 

as a matter of practice on offsite and onsite examinations. Statutes impose a set of limits on a bank’s 

exposures to affiliates and insiders that, with one exception, are at least as strict as those for single 

counterparties or groups of counterparties. The exception is the aggregate limit for lending to 

insiders of 100 per cent of a bank’s capital and surplus (and 200 per cent for smaller banks). As 

noted in the 2010 FSAP, this limit is higher than prudent practices and creates the risk that a small 

group of insiders could deplete the own funds of a bank. There is no formal limit framework for 

holding company transactions with their affiliates or insiders, which is needed for a comprehensive 

framework for transactions with related parties. Finally, the “related party” regime in the U.S. 

regulatory framework does not appear as broad as required by this CP. 

21. The approach to interest rate risk in the banking book (IRRBB) is in marked contrast to 

other key risks and could be usefully updated. The regimes for market and liquidity risks are 

tiered to support a risk-based approach and are comprehensive and robust, though the former 

would benefit from the introduction of a de-minimis regime for all banks and the latter from more 

granular and frequent reporting. The framework for IRRBB stands out with no tiering for example 

(although supervisory practice seems proportionate to the risk) and the philosophy is firmly 

principles-based. No specific capital is being set aside against a change in interest rates, nor are any 

supervisory limits set. Given the stage of the U.S. economic cycle, the inherent interest rate exposure 

is high and there are particular concentrations in the small bank sector. Updating the 1996 guidance 

to include more quantitative guidance is merited, as the risk of a principles-based approach is its 

inconsistency across a sector and across time; as such banks, or a group of banks may be overly 

exposed. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 11

22. Similarly, the overall regime for operational risk outside the AMA banks has not 

reached a sufficient level of maturity. There is no overall definition of operational risk, or 

structured guidance on identification, management and mitigation of operational risks. Guidance for 

banks under AMA (at the time of this assessment, only 8 banks) is well specified, however for all 

other bank operational risk management falls within the scope of “general” risk management. 

Guidance for other banks is disparate, and the weakness is compounded by the absence of a 

comprehensive reporting regime. There is not a standardized capital charge for operational risk. At 

the time of the assessment, several initiatives were underway. The FBAs are placing increasing 

emphasis on operational risk issues and are coordinating on the production of additional interagency guidance, as well as identifying and seeking mitigation of a number of issues in their vertical 

and horizontal reviews. They are also alert to the changing threat landscape, such as the escalation 

of fines and other penalties from litigation as well as cyber risks. Dealing with cyber risk is a top 

priority across all agencies and will pose coordination and operational challenges given the nature 

of the risk and the pressing need to collaborate with other arms of government. 

Controls, audit, accounting, disclosure and abuse of financial services (CP 26-29) 

23. The bar for audit and control functions has clearly been raised in the wake of the crisis, 

while further refinements are needed in the framework for abuse of financial services. The 

internal audit function is the subject of greater supervisory attention and expectations have been 

significantly raised though, in contrast, there is little mention of the compliance function except with 

reference to the regime of the Bank Secrecy Act and Anti-Money Laundering. Further, while 

significant resources are deployed by both the authorities and the firms to meet the BSA/AML 

standards, the attention to vulnerabilities to other forms of criminal abuse (e.g. theft, burglary) is 

more disparate. In addition, the regulatory framework at the time of the assessment did not include 

adequate identification of the ultimate beneficiary owner of legal entity clients, or processes for 

dealing with domestic Politically Exposed Persons (PEPs). On the external audit front, there is no 

requirement for an external auditor to report immediately directly to the supervisor, should they 

identify matters of significant importance, although this gap is mitigated by the frequent contact 

between supervisors and auditors in the course of planning and examinations. 

24. The disclosure regime represents best practice in some respects. The public disclosure of 

supervisory call reports promotes market discipline and is worthy of global emulation. There remain 

a few gaps though. Not all banks are required to issue full financial standards that are reviewed by 

an independent accountant in accordance with independent audit requirements and the U.S. 

definition of “reporting on a solo basis” differs in that it does not collect or disclose data on a “bank 

stand-alone basis.” 

 
UNITED STATES 

12 INTERNATIONAL MONETARY FUND

INTRODUCTION 

25. This assessment of the current state of the implementation of the Basel Core Principles 

for Effective Banking Supervision (BCP) in the United States has been completed as part of a 

FSAP update undertaken by the International Monetary Fund (IMF) from 21 October to 

10 November 2014. It reflects the regulatory and supervisory framework in place as of the date of 

the completion of the assessment. It is not intended to represent an analysis of the state of the 

banking sector or crisis management framework, which are addressed in the broader FSAP exercise. 

26. An assessment of the effectiveness of banking supervision requires a review of the 

legal framework, and detailed examination of the policies and practices of the institutions 

responsible for banking regulation and supervision. In line with the BCP methodology, the 

assessment focused on the three FBAs as the main supervisors of the banking system, and did not 

cover the specificities of regulation and supervision of other financial intermediaries, which are 

covered by other assessments conducted in this FSAP. The assessment did not cover supervision 

conducted by local State regulators,2

 the supervision of credit unions, or the activities of the CFPB. 

As the three federal agencies are the primary regulators of most depository institutions in the 

country, this assessment should provide a useful picture of current supervisory processes applicable 

to banks in the United States. 

A. Information and Methodology Used for Assessment 

27. The U.S. authorities agreed to be assessed according to the Revised BCP Methodology 

issued by the BCBS (Basel Committee of Banking Supervision) in September 2012. The current 

assessment was thus performed according to a revised content and methodological basis as 

compared with the previous BCP assessment carried out in 2009. It is important to note, for 

completeness’ sake, that the two assessments will not be directly comparable, as the revised BCP 

have a heightened focus on risk management and its practice by supervised institutions and its 

assessment by the supervisory authority, raising the bar to measure the effectiveness of a 

supervisory framework (see box for more information on the Revised BCP). 

28. The U.S. authorities also chose to be assessed and rated against not only the Essential 

Criteria, but also against Additional Criteria. To assess compliance, the BCP Methodology uses a 

set of essential and additional assessment criteria for each principle. The essential criteria (EC) were 

usually the only elements on which to gauge full compliance with a CP. The additional criteria (AC) 

are recommended best practices against which the U.S. authorities have agreed to be assessed and 

rated. This option was not available to assessed countries before the 2012 Revised BCP. The 

assessment of compliance with each CP is made on a qualitative basis to allow a judgment on 

whether the criteria are fulfilled in practice. Effective application of relevant laws and regulations is 

essential to provide indication that the criteria are met. A four-part grading system is used: 

 

2

 The assessment team did not assess State supervisors, but met with their representatives to hear their views on 

issues such as cooperation, regulatory framework, implementation of reforms, and mandates. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 13

compliant; largely compliant; materially noncompliant; and noncompliant. This is explained below in 

the detailed assessment section. 

29. The assessment team3

 reviewed the framework of laws, rules, and guidance and held 

extensive meetings with U.S. officials, and additional meetings with banking sector 

participants and other stakeholders (auditors, associations, etc). The authorities provided a selfassessment of the CPs rich in quality and comprehensiveness, as well as detailed responses to 

additional questionnaires, and facilitated access to supervisory documents and files, staff and 

systems. 

30. The team appreciated the very high quality of cooperation received from the 

authorities. The team extends its thanks to staff of the authorities who provided excellent 

cooperation, including extensive provision of documentation and access, at a time when staff was 

burdened by many initiatives related to the implementation of global regulatory changes under 

Basel III and further national regulatory changes under the Dodd-Frank Wall Street Reform and 

Consumer Protection Act (DFA). 

31. The standards were evaluated in the context of the U.S. financial system’s structure 

and complexity. The CPs must be capable of application to a wide range of jurisdictions whose 

banking sectors will inevitably include a broad spectrum of banks. To accommodate this breadth of 

application, a proportionate approach is adopted within the CP, both in terms of the expectations 

on supervisors for the discharge of their own functions and in terms of the standards that 

supervisors impose on banks. An assessment of a country against the CPs must, therefore, recognize 

that its supervisory practices should be commensurate with the complexity, interconnectedness, size, 

and risk profile and cross-border operation of the banks being supervised. In other words, the 

assessment must consider the context in which the supervisory practices are applied. The concept of 

proportionality underpins all assessment criteria. For these reasons, an assessment of one 

jurisdiction will not be directly comparable to that of another.

32. An assessment of compliance with the BCPs is not, and is not intended to be, an exact 

science. Reaching conclusions required judgments by the assessment team. Nevertheless, by 

adhering to a common, agreed methodology, the assessment should provide the U.S. authorities 

with an internationally consistent measure of the quality of its banking supervision in relation to the 

CPs, which are internationally acknowledged as minimum standards. 

 

3

 The assessment team comprised John Laker (former Australian Prudential Regulatory Authority), Göran Lind 

(Swedish Riksbank), and Lyndon Nelson (Bank of England). Fabiana Melo (IMF) helped coordinate the work of the 

assessors and the drafting of this report. 
UNITED STATES 

14 INTERNATIONAL MONETARY FUND

Box 1. The 2012 Revised BCP 

The revised BCPs reflect market and regulatory developments since the last revision, taking account of the 

lessons learnt from the financial crisis in 2008/2009. These have also been informed by the experiences 

gained from FSAP assessments as well as recommendations issued by the G-20 and FSB, and take into 

account the importance now attached to: (i) greater supervisory intensity and allocation of adequate 

resources to deal effectively with systemically important banks; (ii) application of a system-wide, macro 

perspective to the microprudential supervision of banks to assist in identifying, analyzing and taking preemptive action to address systemic risk; (iii) the increasing focus on effective crisis preparation and 

management, recovery and resolution measures for reducing both the probability and impact of a bank 

failure; and (iv) fostering robust market discipline through sound supervisory practices in the areas of 

corporate governance, disclosure and transparency. 

The revised BCPs strengthen the requirements for supervisors, the approaches to supervision and 

supervisors’ expectations of banks. The supervisors are now required to assess the risk profile of the banks 

not only in terms of the risks they run and the efficacy of their risk management, but also the risks they pose 

to the banking and the financial systems. In addition, supervisors need to consider how the macroeconomic 

environment, business trends, and the build-up and concentration of risk inside and outside the banking 

sector may affect the risk to which individual banks are exposed. While the BCP set out the powers that 

supervisors should have to address safety and soundness concerns, there is a heightened focus on the actual 

use of the powers, in a forward-looking approach through early intervention. 

The number of principles has increased from 25 to 29. The number of essential criteria has expanded from 

196 to 231. This includes the amalgamation of previous criteria (which means the contents are the same), 

and the introduction of 35 new essential criteria. In addition, for countries that may choose to be assessed 

against the additional criteria, there are 16 additional criteria. 

While raising the bar for banking supervision, the BCP must be capable of application to a wide range of 

jurisdictions. The new methodology reinforces the concept of proportionality, both in terms of the 

expectations on supervisors and in terms of the standards that supervisors impose on banks. The 

proportionate approach allows assessments of banking supervision that are commensurate with the risk 

profile and systemic importance of a wide range of banks and banking systems.

33. To determine the observation of each principle, the assessment has made use of five 

categories: compliant; largely compliant, materially noncompliant, noncompliant, and nonapplicable. An assessment of “compliant” is given when all EC and ACs are met without any 

significant deficiencies, including instances where the principle has been achieved by other means. 

A “largely compliant” assessment is given when there are only minor shortcomings, which do not 

raise serious concerns about the authority’s ability to achieve the objective of the principle and there 

is clear intent to achieve full compliance with the principle within a prescribed period of time (for 

instance, the regulatory framework is agreed but has not yet been fully implemented). A principle is 

considered to be “materially noncompliant” in case of severe shortcomings, despite the existence of 

formal rules and procedures and there is evidence that supervision has clearly not been effective, 

the practical implementation is weak or that the shortcomings are sufficient to raise doubts about 

the authority’s ability to achieve compliance. A principle is assessed “noncompliant” if it is not 

substantially implemented, several ECs are not complied with, or supervision is manifestly 

ineffective. Finally, a category of “non-applicable” is reserved for those cases that the criteria would 

not relate the country’s circumstances. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 15

B. Institutional and Market Structure—Overview4

34. The U.S. has a large, diverse financial sector, with assets stabilizing at about 

480 percent of GDP since the crisis. Depository institutions (mostly banks), pension funds, mutual 

funds and insurance companies account for around 70 percent of the financial sector assets. The 

structure of the financial system, by sectors, has been relatively stable since the last FSAP. Only 

mutual funds’ assets have increased whereas Asset Backed Securities (ABS) issuers have continued 

to reduce their balance sheets and the proportion of credit market debt owed by GovernmentSponsored Enterprises (GSEs) has increased. The structure of the financial system, by instruments, 

has also not changed drastically in the last four years. However, the corporate equities’ market has 

grown in size and the mortgage market has shrunk. Financial sector’s share of corporate profits has 

reached a record high in early 2000s, after dipping to a record low in 2008 and returning to its 

longer-term trend by 2013 while its contribution to gross value added has remained relatively 

stable. The U.S. financial system contributes about 20 percent to the U.S. GDP and around 

25 percent of U.S. corporate profits. 

35. Credit intermediation is decentralized. While depository institutions are present in almost 

every credit market, no single sector dominates the overall credit market. GSEs and banks are the 

main providers of mortgage credit (the largest credit market). Banks also play an important role in 

consumer credit market (together with finance companies) and in the market for agency and GSEbacked securities (together with Fed and mutual funds). Broker-dealers are the main players on 

securities repos market, whereas insurance sector and mutual funds are the main source of financing 

of corporate debt securities 

36. The pension funds sector is the largest financial sector accounting for about 

20 percent of total financial sector assets. Private pension funds account for one half of pension 

funds’ assets and the other half pertains to federal, state and local government retirement funds. 

The structure of the pension system has been stable since 2010, with defined benefit plans 

(45 percent of pension funds’ liabilities) representing the largest share of the system.5

 The sector’s 

assets are diversified across debt securities and shares and the remainder across investments in 

MMF and mutual funds shares and private equity. 

37. The banking sector holds 16 percent of all assets held by financial institutions. Banks 

are the second largest financial sector after pension funds. The overall number of banks has been on 

a downward trend since early 1990s and has fallen to an all time low level in 2014q1. The number of 

problem banks has decreased significantly, from around 500 at the peak in 2010 to around 200, but 

still above the number before the crisis. 

 

4

 This part of the document draws from the self assessment presented by the authorities, as well as from Article IV 

reports and other documents produced for the FSAP, some of which at the time of this assessment were not yet 

finalized. Unless otherwise stated, figures used in this section refer to December 2013. 

5

 Only 70 percent of defined benefit schemes are funded at the end of 2013. 
UNITED STATES 

16 INTERNATIONAL MONETARY FUND

38. Banks’ balance sheets and income statements have strengthened. Comparing to a 

period before the crisis, banks now hold more liquid assets, grant less loans and hold less trading 

account assets (both in absolute and relative terms). At the same time, banks have attracted more 

deposits, hold more capital, rely less on credit borrowing and are less leveraged. Profits have 

reached pre-crisis levels (in nominal terms) mainly due to lower provisions and lower interest 

expenses. The coverage ratio has stabilized since 2009, and the net charge off rate is slightly above 

the level before the crisis. However, the results from the CCAR stress tests show that, if hit by a 

severe global market shock, banks’ capital ratios would fall significantly and banks would face 

sizable losses from trading activities. For investment banks, a non-trivial dependence on wholesale 

funding continues to be a source of vulnerability in periods of severe financial market distress. 

39. The U.S. banking system is less concentrated than the banking systems of other 

industrialized countries. The five largest banks account for about 45 percent of the U.S. banking 

system’s total assets6

 (which is twice the share 10 years ago) and around 40 percent of GDP. 

Eight large banks are designated as G-SIBs. While the proportion of the largest five banks has 

stabilized over the last four year, the share of banks with asset size larger than $10 bn has continued 

to increase since 2009. 

40. The insurance sector assets correspond to a half of the banking sector assets. Life 

insurers account for largest part of insurance sector assets. Three U.S. insurers, AIG, Prudential and 

MetLife have been designated as G-SIIs. The first two have been designated by the Financial Stability 

Oversight Council (FSOC) as non-bank SIFIs and the latter is in the process of designation. The 

insurance sector in the U.S. is less concentrated than in other countries—top 10 insurers account for 

58 percent (life insurance), 71 percent (health insurance) and 46 percent (in P&C) of the market. 

41. Financial intermediation outside the traditional banking system is estimated at 

90 percent of GDP, and the debt securities market is dominated by corporate debt securities, 

treasury securities and GSE backed securities. While the banking sector has continued to grow 

after the crisis, the size of the shadow banking system7

 has contracted substantially since the peak in 

2007 mainly due to lower borrowing of ABS issuers. GSEs are the only segment of the shadow 

banking system that is now larger than before the crisis. The nominal value of outstanding debt 

securities at end-2013 amounted to about $39 trillion (230 percent of GDP). Corporate bonds, 

including ABS securities, accounted for a third of this, of which half were issued by non-financial 

corporations and 10 percent by ABS issuers (down from 30 percent before the crisis). The proportion 

of treasury securities has almost doubled since 2007 (from 17 percent to 32 percent). 

 

6

 Herfindahl–Hirschman index (HHI) is equal to 0.045. A HHI index below 0.15 indicates an unconcentrated system. 

7

 The definition of “shadow banking” is based on Pozsar and others (2010) and includes open market papers, 

overnight repos, net securities lending, liabilities of GSEs and ABS issuers and total shares outstanding of MMFs. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 17

42. The U.S. derivatives market represents 1/3 of the world market. The notional amount of 

outstanding contracts totaled $237.0 trillion8

 (1400 percent of GDP) and has been relatively stable 

since 2010. The market is dominated by a small group of large financial institutions—four large 

commercial banks (JPMorgan Chase, Citibank, Bank of America and Goldman Sachs) represent 

93 percent of the total banking industry notional amounts.9

 Derivative contracts are concentrated in 

interest rate products, which comprise 82 percent of total derivative notional amounts. Foreign 

exchange contracts represent 12 percent of the derivatives market and credit derivatives (mostly 

Credit Default Swaps) 5 percent of total derivatives notionals. Swap contracts represent the bulk of 

the derivatives market (64 percent of all notionals) followed by futures and forwards (18 percent) 

and options (14 percent). 

Structure for banking supervision 

43. The United States operates under a “dual banking system.” A bank charter may be 

issued by the federal government or by a state. Federal bank charters for “national banks” and 

“federal savings associations” are issued by the OCC. Each of the 50 states has a banking authority 

that charters banks under its own laws and regulations. These banks are generally referred to as 

“state banks” or “state savings associations.” Each U.S. bank, whether chartered under state or 

federal law, is subject to regulation, supervision, and examination by a primary federal banking 

supervisor, irrespective of whether the bank is part of a broader organization: 

 for national banks and federal savings associations, the OCC; 

 for state banks that choose to be members of the Federal Reserve System (state member 

banks), the Federal Reserve; 

 for state banks that choose not to become members of the Federal Reserve System 

(nonmember banks) and state savings associations, the FDIC. 

 

 

8

 Based on reports of derivatives activities of 1,383 insured U.S. commercial banks and savings associations at the end 

of the fourth quarter 2013. 

9

 Most of the contracts are held for trading purposes. 
UNITED STATES 

18 INTERNATIONAL MONETARY FUND

Table 1. Summary of Primary Federal Supervisory Responsibilities 

Component Supervisor and Regulator 

Holding companies (including 

financial holding companies 

Federal Reserve 

Nonbank subsidiaries of holding 

companies 

Federal Reserve/Functional Regulator 

National banks OCC 

State banks 

 Members 

 Nonmembers 

Federal Reserve 

FDIC 

 

Savings and loan associations (aka 

“savings associations”) 

OCC or FDIC based on federal or state charter, 

respectively 

U.S. offices of FBOs - subs, branches 

and agencies* 

 State-licensed 

 Federally licensed 

*There are some grandfathered, 

insured FBO branches. If these 

grandfathered branches are statechartered, the primary federal 

supervisor is the FDIC and if federally 

chartered, the primary federal 

supervisor is the OCC. 

Federal Reserve 

OCC 

Designated Nonbank Financial 

Company 

Federal Reserve 

44. The FDIC operates the federal deposit insurance program. In addition to its authority to 

examine state nonmember banks, the FDIC has the authority to examine for insurance purposes any 

bank, either directly or in cooperation with state or other federal supervisory authorities. The FDIC 

has backup enforcement authority over all banks. The FDIC can recommend that another federal 

banking agency take action against a bank in appropriate circumstances and may take such action 

directly if the other agency does not take action. 

45. The OCC is responsible for chartering, regulating, and supervising all national banks 

and federal savings associations and for supervising federal branches and agencies of foreign 

banks. 

46. Holding companies are supervised by the Federal Reserve. The Federal Reserve is 

responsible for regulating and supervising any company that owns or controls a national or state 

bank. BHCs and their subsidiaries may engage in activities that are closely related to banking. 

Certain BHCs that, along with their depository institution subsidiaries, meet enhanced capital and 

managerial standards, may elect to become financial holding companies (FHCs) and engage in a 

broader array of financial activities, including securities, insurance, and merchant banking. The 
UNITED STATES 

INTERNATIONAL MONETARY FUND 19

Federal Reserve is the consolidated supervisor of all BHCs and FHCs on a worldwide consolidated 

basis. The Federal Reserve also regulates and supervises SLHCs, which, like BHCs, may choose to be 

treated as FHCs if they and their depository institution subsidiaries meet enhanced capital and 

managerial standards and, thereby, engage in a broader array of financial activities. 

Table 2. Supervised Institutions 

(As of June 30, 2014) 

Agencies Supervised Institutions 

Number Total Assets ($ billions)

OCC 1,628 10,408

FDIC 4,131 2,536

Federal Reserve System 

 State Member Banks 860 2,188

 Bank Holding Companies 4,452 17,429

 Savings and Loan Holding Companies 314 2,230

 Foreign Banking Organizations (Program FBOs) 165 5,337

 Source: Federal Reserve Board

47. FBOs may do business in the United States under a policy of “national treatment” 

which gives FBOs the same powers and applies the same limitations as are given and applied 

to domestic banks. No FBO may establish a branch or an agency, or acquire ownership or control 

of a commercial lending company, without the prior approval of the Federal Reserve. All banks and 

branches or agencies of FBOs have a primary federal regulator. If the FBO chooses a federal license 

for a branch or agency, then it is supervised and examined solely by the OCC. If an FBO elects to 

open a branch or agency under a state license, then it is typically examined by the state banking 

authorities and also by the Federal Reserve on a joint or alternate (i.e., rotating) basis. The Federal 

Reserve relies on the OCC or state banking agencies to perform examinations and supervision 

depending on the form of organization and the charter the FBO receives to take in the country. 

48. Since the last FSAP, important changes have taken place in the legal and regulatory 

framework for banks. In response to the crisis, the U.S. Congress enacted the Dodd-Frank Wall 

Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act or DFA).10 The Act creates an 

interagency council to monitor and coordinate responses to emerging threats to the financial 

system (FSOC); requires that large bank holding companies and systemically designated nonbank 

financial firms be subject to enhanced prudential standards to reduce the risks they may present to 

the financial system; provides for the consolidated supervision of all systemically important financial 

institutions; gives the government an important additional tool to safely wind down financial firms 

whose failure could pose a threat to U.S. financial stability; and provides for the strengthened 

supervision of systemically important payment, settlement, and clearing utilities. 

 

10 For a comprehensive summary of the legislative changes introduced since the last FSAP, see authorities’ selfassessment (http://www.treasury.gov/resource-center/international/Pages/us-fsap.aspx.)
UNITED STATES 

20 INTERNATIONAL MONETARY FUND

49. The Dodd Frank Act has made important changes related to banking regulation and 

supervision. , The Act: (i) enhances the limitations on transactions among a BHC, a subsidiary bank, 

and its affiliates;11 (ii) incorporates a financial stability factor into the statutory analysis of 

transactions governed by the Bank Holding Company Act (BHC Act) and the Bank Merger Act;12

(iii) incorporates financial stability considerations into the supervision of holding companies; 

(iv) enhances the requirement for holding companies to be eligible to engage in expanded 

activities;13 (v) generally eliminates the limitations under the Gramm-Leach-Bliley Act that restricted 

the Federal Reserve's ability to examine, obtain reports from, or take enforcement action against a 

functionally regulated subsidiary of a BHC, such as a broker-dealer or insurance company;14

(vi) authorizes the Federal Reserve to examine the activities of nonbank subsidiaries of holding 

companies—other than functionally regulated subsidiaries—that are permissible for the 

organization's subsidiary banks in the same manner, subject to the same standards, and with the 

same frequency as if such activities were conducted in the organization's lead subsidiary depository 

institution; (vii) prohibits a depository institution that is subject to a formal enforcement order or 

memorandum of understanding with respect to a significant supervisory matter from converting its 

charter unless the current and proposed supervisors establish a plan that addresses the problems at 

the depository institution and that will be implemented and monitored by the new supervisor; and 

(viii) applies the national bank and savings association loans-to-one borrower limitation to credit 

exposures arising from derivative transactions and securities financing transactions.15

 

11 Specifically, the DFA clarifies that a "covered transaction" for the purposes of sections 23A and 23B of the Federal 

Reserve Act includes any credit exposure of a bank to an affiliate arising from derivative transactions or securities 

borrowing and lending transactions with such affiliate. In addition, the Act eliminates certain exemptions from 

sections 23A and 23B for subsidiaries of BHCs and requires that any purchase of assets by a bank from an insider 

must be on market terms.

12 Sections 163 and 604 of the DFA require the appropriate federal banking agency to take into account risks to the 

stability of the U.S. banking or financial system in approving the relevant applications under the BHC Act and the 

Bank Merger Act. Similarly, section 173 of the DFA adds financial stability to the list of factors that the Federal 

Reserve may consider when acting on an application by a foreign banking organization to open an office in the U.S. 

Specifically, the Federal Reserve may consider whether the foreign banking organization's home country has adopted 

or is making demonstrable progress toward adopting a financial regulatory system that mitigates risk to the stability 

of the U.S. financial system.

13 Section 606(a) of the DFA provides that a BHC must be well capitalized and well managed at the holding company 

and bank levels in order to become and remain a financial holding company (FHC) eligible to engage in expanded 

activities. The Federal Reserve has clarified that these requirements also apply to SLHCs. In addition, section 163(b) 

provides that in order to use authority under section 4(k) of the BHC Act to acquire a nonbank company with $10 

billion or more in assets, a designated nonbank financial company that is supervised by the Federal Reserve or a BHC 

with $50 billion or more in consolidated assets must obtain the Federal Reserve's prior approval. Further, section 164 

applies restrictions on management interlocks to designated nonbank financial companies supervised by the Federal 

Reserve.

14 See section 604 of the DFA (124. The Federal Reserve, however, must continue to rely on examinations conducted 

by the subsidiary's primary bank supervisors or functional regulators to the fullest extent possible and notify such 

supervisors before conducting an examination of the subsidiary.

15 “Securities financing transactions” mean repurchase agreements, reverse repurchase agreements, securities lending 

transactions, and securities borrowing transactions. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 21

50. The Dodd-Frank Act also established a new Financial Stability Oversight Council 

(FSOC) charged with important duties such as monitoring and identifying emerging risks to financial 

stability across the entire financial system, identifying potential regulatory gaps, and coordinating 

the agencies' responses to potential systemic risks. The voting membership of the FSOC is 

composed of the Treasury Secretary (who is also chairperson of the FSOC); the heads of the three 

FBAs (FBAs); the heads of the Consumer Financial Protection Bureau (CFPB), Securities and Exchange 

Commission (SEC), Commodities Futures Trading Commission (CFTC), Federal Housing Finance 

Agency (FHFA), and National Credit Union Administration (NCUA); and an independent member 

with insurance expertise appointed by the President and confirmed by the Senate. 

51. In addition, the FSOC has the task to designate as systemically important large, 

interconnected nonbank financial firms. Once designated, these nonbank financial companies 

are subject to consolidated supervision by the Federal Reserve and enhanced prudential standards. 

The FSOC has designated three nonbank financial companies: American International Group, Inc., 

General Electric Capital Corporation, Inc., and Prudential Financial, Inc. In addition, the Act 

authorizes the FSOC to designate financial market utilities (FMUs) as systemically important if the 

FSOC determines that that the failure of or a disruption to the functioning of the FMU could pose a 

threat to U.S. financial stability. Designated FMUs are also subject to heightened prudential and 

supervisory provisions. In 2012, the FSOC designated eight FMUs as systemically important: The 

Clearing House Payments Company L.L.C. (on the basis of its role as operator of the Clearing House 

Interbank Payments System); CLS Bank International; Chicago Mercantile Exchange, Inc.; The 

Depository Trust Company; Fixed Income Clearing Corporation; ICE Clear Credit LLC; National 

Securities Clearing Corporation (NSCC); and The Options Clearing Corporation. 

52. The DFA also requires the Federal Reserve to conduct and publish summary results of 

annual stress tests of systemic nonbank financial firms and BHCs with $50 billion or more in 

assets. Such firms also are required to conduct their own stress tests on a semiannual basis. The 

DFA requires financial firms with more than $10 billion in assets to conduct annual stress tests in 

accordance with regulations established by the respective primary federal financial regulatory 

agency. 

53. The new legislation requires that foreign banking organizations with U.S. non-branch 

assets of $50 billion or more be required to establish a U.S. intermediate holding company 

over their U.S. subsidiaries. The foreign-owned U.S. intermediate holding company generally will 

be subject to the same risk-based and leverage capital standards applicable to U.S. bank holding 

companies. The intermediate holding companies also will be subject to the Federal Reserve's rules 

requiring regular capital plans and stress tests. Like U.S. BHCs with assets of $50 billion or more, a 

foreign banking organization with combined U.S. assets of $50 billion or more will be required to 

establish a U.S. risk committee and employ a U.S. chief risk officer, and will be required to meet 

enhanced liquidity risk-management standards. FBOs with total consolidated assets of $50 billion or 

more, but combined U.S. assets of less than $50 billion, are subject to enhanced prudential 

standards. However, the capital, liquidity, risk-management, and stress testing requirements 
UNITED STATES 

22 INTERNATIONAL MONETARY FUND

applicable to these foreign banking organizations are substantially less than those applicable to 

foreign banking organizations with a larger U.S. presence. 

54. Finally, the DFA dissolved the Office of Thrift Supervision (OTS) and transferred its 

plenary regulatory and supervisory authority, including the authority to supervise, issue rules, and 

take enforcement actions, with respect to SLHCs and savings associations to the FBAs: the Federal 

Reserve regulates SLHCs, the OCC regulates federally chartered savings associations, and the FDIC 

regulates state-chartered savings associations. 

C. Preconditions for Effective Banking Supervision16

Macroprudential framework and cooperation17

55. In addition to the FSOC’s coordinating role, the FFIEC plays an important role in 

developing uniform approaches among the FBAs and acts as a forum for sharing of technical 

information. To promote consistency in the examination and supervision of banks and holding 

companies, in 1978 Congress created the Federal Financial Institutions Examination Council (FFIEC). 

The FFIEC is composed of the chairpersons of the FDIC and the National Credit Union 

Administration, the Comptroller of the Currency, the Director of the CFPB, and a governor of the 

Federal Reserve. As the result of legislation in 2006, the Chair of the FFIEC State Liaison Committee 

serves as a sixth member of the FFIEC. The State Liaison Committee is composed of five 

representatives of state agencies that supervise financial institutions. The FFIEC’s objectives are to 

prescribe uniform federal principles and standards for the examination of depository institutions, to 

promote coordination of bank supervision among the U.S. FBAs, and to encourage better 

coordination of federal and state regulatory activities. Through the FFIEC, state and U.S. FBAs may 

exchange views on important regulatory issues. Among other things, the FFIEC has developed 

uniform financial reports for federally supervised banks to file with their appropriate federal 

regulator. In addition to the FFIEC and longstanding information sharing practices, FSOC was 

created to provide a central body for coordinating the activities of the federal financial regulators, 

including the FBAs. Among other activities, FSOC has the ability to issue a nonbinding 

recommendation to any of its member agencies to take a particular action. 

Financial Safety Nets and Crisis Management18

56. Numerous liquidity back-stops were provided by the Fed during the crisis but 

subsequent legislative changes appear to limit its ability to similarly respond in the future. 

During the crisis additional backstops were provided to mitigate specific risks, for example: (i) run 

 

16 This section draws from other documents produced for the FSAP, some of which at the time of this assessment 

were not yet finalized. A complete analysis of the macroeconomic framework is contained in Article IV reports. 

17 See above, and separate Technical Note on Systemic Risk Oversight, Macroprudential framework, for a more 

complete description of FSOC’s attributions. 

18 See separate Technical Notes on Systemic Risk Oversight, and on Resolution Framework. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 23

risk in the money market funds sector; (ii) collateral fire sale risk faced by primary dealers in TPR, and 

(iii) funding risk faced by depository institutions. The DFA (section 214) and changes to the Federal 

Reserve Act (section 13.3) now seem to limit the provision of such assistance. The Fed’s standing 

credit facilities (“discount window”) may benefit from reform. The primary credit facility, for higher 

rated institutions, allows for borrowing on a ‘no questions asked’ basis while access to the secondary 

credit facility has conditions attached. But in both cases, activity must be disclosed under the 

Freedom of Information Act with a two year lag. Separating the two more clearly might help reduce 

stigma that is still associated with ‘normal’ use and with it, reluctance to access the facility (this 

would focus stigma on the ‘emergency’ use facility). 

57. The resolution regime for financial institutions has been enhanced. Title II (“Orderly 

Liquidation Authority”, OLA) of the DFA, enacted in July 2010, has extended the Federal Deposit 

Insurance Corporation’s (FDIC) resolution authority to “financial companies”. OLA mandates the 

appointment of the FDIC as receiver if the Secretary of the Treasury (in consultation with the 

President) determines that a financial company for which a systemic risk determination has been 

made is in default or in danger of default, would have a serious adverse effect on the financial 

stability and no viable private sector alternative is available to prevent the default. 

58. Detailed requirements for ’living wills’ seek to ensure the feasibility of a rapid and 

orderly resolution, but recent reviews of large banks suggest major shortcomings. The DFA 

requires covered financial companies to prepare plans for the orderly winding-up of such companies 

in the event of material financial distress or failure. While financial companies generally have made 

progress in the preparation of these plans, the Board of Governors of the Federal Reserve System 

and the FDIC concluded in August 2013 that the plans submitted by the eleven largest banking 

organizations (still) reflect important shortcomings, including failures to address structural and 

organizational impediments to orderly resolution. The affected organizations have been instructed 

to improve their resolvability and update their recovery plans accordingly by July 2015. 

Market discipline, business environment, accounting and auditing19

59. Business laws in the United States, including contract, bankruptcy, and property law, 

are well-developed and reliable. Contract law is established by the combination of common law 

and state statute. The enforceability of contracts is well-established and enforced by the courts. 

Laws establishing the enforceability of security interests (i.e., interests in property conveyed to 

collateralize loans) are governed, primarily, under Article 9 of the Uniform Commercial Code. The 

enforcement of mortgages of real property is upheld under (non-uniform) state laws. Federal 

bankruptcy laws incorporate protections for both creditors and debtors. Property rights are 

protected under the Bill of Rights of the U.S. Constitution and under state laws. 

 

19 This is a summary of existing FSAP documents. For detailed information on market discipline, accounting and 

auditing framework, see separate IOSCO assessment. 
UNITED STATES 

24 INTERNATIONAL MONETARY FUND

60. Business law disputes are typically resolved in state trial courts of general jurisdiction. 

Federal courts are available when the claim involves federal law or when a state law claim involves 

parties from different states. A right of appeal exists in both the federal and state systems. Contracts, 

both commercial and consumer, are sometimes permitted to also provide for mandatory arbitration 

rather than dispute resolution through the courts. 

61. The United States possesses an independent judiciary and well-regulated accounting, 

auditing, and legal professions. The judicial system is comprised of both federal and state systems. 

Judges in both federal and state courts must be members of the bar and generally have significant 

experience as practicing lawyers before becoming judges. Federal judges are appointed by the 

President with the advice and consent of the Senate and receive lifetime appointments. States vary 

in their methods of judicial appointment. Some follow a system similar to the federal system, i.e., the 

state governor appoints judges with some input from the legislature. Some states, however, appoint 

judges through a general election. 

62. Lawyers must receive a license to practice law from a state or states. All states but one 

(Wisconsin) require applicants who are not already members of another state’s bar to pass a bar 

examination prior to receiving a license. In addition to controlling admission into the profession, the 

states also regulate the profession. Regulation is often delegated to a self regulatory organization, 

i.e., a state bar association. Lawyers are also subject to ethical standards set by the states. 

63. U.S. accounting standards (U.S. GAAP) are established by the Financial Accounting 

Standards Board (FASB). Both the FASB and International Accounting Standards Board are 

currently working on a convergence program, designed to bring U.S. and international financial 

reporting standards (IFRS) into a single framework. 

64. Financial statement audit requirements are robust, having been considerably 

strengthened in 2002 with the passage of the Public Company Accounting Reform and 

Investor Protection Act (also known as the Sarbanes-Oxley Act). The Sarbanes-Oxley Act 

enhanced audit scrutiny, toughened auditor independence requirements, required various 

management attestations about the reliability of financial accounts, and expanded disclosure 

requirements with the objective of providing the users of financial statements with greater security 

as to their accuracy and reliability. 

 
UNITED STATES 

INTERNATIONAL MONETARY FUND 25

DETAILED ASSESSMENT 

65. The assessment of compliance of each principle is made based on the following four-grade 

scale: compliant, largely compliant, materially noncompliant, and noncompliant. A “not applicable” 

grading can be used under certain circumstances. 

 Compliant: a country will be considered compliant with a Principle when all essential criteria 

applicable for this country are met without any significant deficiencies. There may be 

instances, of course, where a country can demonstrate that the Principle has been achieved 

by other means. Conversely, due to the specific conditions in individual countries, the 

essential criteria may not always be sufficient to achieve the objective of the Principle, and 

therefore other measures may also be needed in order for the aspect of banking supervision 

addressed by the Principle to be considered effective. 

 Largely compliant: A country will be considered largely compliant with a Principle whenever 

only minor shortcomings are observed that do not raise any concerns about the authority’s 

ability and clear intent to achieve full compliance with the Principle within a prescribed 

period of time. The assessment “largely compliant” can be used when the system does not 

meet all essential criteria, but the overall effectiveness is sufficiently good, and no material 

risks are left unaddressed. 

 Materially non-compliant: A country will be considered materially non-compliant with a 

Principle whenever there are severe shortcomings, despite the existence of formal rules, 

regulations and procedures, and there is evidence that supervision has clearly not been 

effective, that practical implementation is weak, or that the shortcomings are sufficient to 

raise doubts about the authority’s ability to achieve compliance. It is acknowledged that the 

“gap” between “largely compliant” and “materially non-compliant” is wide, and that the 

choice may be difficult. On the other hand, the intention has been to force the assessors to 

make a clear statement. 

 Non-compliant: A country will be considered non-compliant with a Principle whenever there 

has been no substantive implementation of the Principle, several essential criteria are not 

complied with, or supervision is manifestly ineffective. 

 
UNITED STATES 

26 INTERNATIONAL MONETARY FUND

A. Supervisory Powers, Responsibilities and Functions

Principle 1 Responsibilities, objectives and powers. An effective system of banking supervision has 

clear responsibilities and objectives for each authority involved in the supervision of banks 

and banking groups.20 A suitable legal framework for banking supervision is in place to 

provide each responsible authority with the necessary legal powers to authorize banks, 

conduct ongoing supervision, address compliance with laws and undertake timely 

corrective actions to address safety and soundness concerns.21

Essential criteria

EC1 The responsibilities and objectives of each of the authorities involved in banking 

supervision22 are clearly defined in legislation and publicly disclosed. Where more than one 

authority is responsible for supervising the banking system, a credible and publicly available 

framework is in place to avoid regulatory and supervisory gaps. 

Description and 

findings re EC1 

As discussed more fully in CP 5, the United States operates under a “dual banking system” 

under which a bank may choose to be chartered by the federal government or by a state. 

Each U.S. bank, whether chartered under federal or state law, is subject to regulation, 

supervision and examination by a primary federal banking agency (FBA), irrespective of 

whether it is part of a broader organization. Following the DFA reforms, the division of 

responsibilities for the FBAs are: 

 the OCC has responsibility for national banks and federal savings and loan 

associations (“savings associations”), and for supervising federal branches and 

agencies of foreign banks; 

 the Federal Reserve has responsibility for state banks that choose to be members of 

the Federal Reserve System; and 

 the FDIC has responsibility for state banks and savings associations that choose not 

to be members of the Federal Reserve System. 

In addition, the FDIC has the authority to examine, for deposit insurance purposes, any bank, 

either directly or in cooperation with state banking agencies or other FBAs. 

The Federal Reserve has responsibility for supervision of bank holding companies and 

savings and loan holding companies, as well as for certain nonbank financial companies 

designated by the FSOC, which is discussed below. The Federal Reserve also has broad 

supervisory oversight over the U.S. banking operations of foreign banking organizations, but 

relies on the OCC or state banking agencies, as appropriate, to conduct examinations and 

supervision. 

In effect, then, each domestic bank has at least two regulators. For example, an insured 

national bank that is part of a Bank Holding Company (BHC) will be subject to supervision by 

 

20 In this document, “banking group” includes the holding company, the bank and its offices, subsidiaries, affiliates 

and joint ventures, both domestic and foreign. Risks from other entities in the wider group, for example non-bank 

(including non-financial) entities, may also be relevant. This group-wide approach to supervision goes beyond 

accounting consolidation. 

21 The activities of authorising banks, ongoing supervision and corrective actions are elaborated in the subsequent 

Principles. 

22 Such authority is called “the supervisor” throughout this paper, except where the longer form “the banking 

supervisor” has been necessary for clarification.
UNITED STATES 

INTERNATIONAL MONETARY FUND 27

the OCC, the Federal Reserve and the FDIC. If the bank has assets above $10 billion, it and its 

affiliates will also by overseen by the Consumer Financial Protection Bureau (CFPB) with 

respect to compliance with certain consumer financial protection statutes (see below). 

Each FBA operates pursuant to an express statutory grant of authority. In addition, agencies 

are mandated to administer various specific statutes that contain implicit or explicit goals 

(e.g., related to fair lending, community reinvestment, or bank secrecy and anti-money 

laundering/counter terrorist financing). FBAs also exercise competition authority powers with 

respect to bank mergers, using Department of Justice criteria. Legislation creating the 

agencies does not contain explicit and clear statements of mission or mandate. However, the 

substantive requirements imposed on agencies by statute provide the basis for the agencies’ 

publicly reported and longstanding objectives and responsibilities. 

State supervisory agencies also operate pursuant to an express statutory grant of authority. 

These agencies are outside the scope of this BCP assessment (as is the CFPB). However, the 

assessors did meet with state supervisory agencies and their representatives to understand 

the mechanisms in place to coordinate and collaborate with their federal counterparts. 

The DFA resulted in significant changes to the U.S. regulatory structure. The changes 

included dissolution of the Office of Thrift Supervision (OTS) and the creation of two new 

bodies—an independent Consumer Financial Protection Bureau (CFPB) within and funded by 

the Federal Reserve, and the FSOC. 

The CFPB has rulemaking authority for most federal consumer financial protection statutes, 

as defined in the DFA. It also has authority to conduct examinations, require reports and take 

enforcement actions with respect to these statutes in the case of banking organizations with 

assets of more than $10 billion and their affiliates. For smaller banking organizations, 

consumer compliance examination authority has remained with the applicable FBA. 

The FSOC is charged with: monitoring and identifying risks to financial stability across the 

entire U.S. financial system; identifying regulatory gaps; promoting market discipline; and 

coordinating agencies’ responses to potential systemic risks. However, the FSOC has no 

formal responsibility for overseeing financial crises or for guiding the development and 

implementation of consistent policy responses. The voting membership of the FSOC is 

composed of the Treasury Secretary (who is also chairperson of the FSOC); the heads of the 

three FBAs; the heads of the Consumer Financial Protection Bureau (CFPB), Securities and 

Exchange Commission (SEC), Commodities Futures Trading Commission (CFTC), Federal 

Housing Finance Agency (FHFA), and National Credit Union Administration (NCUA); and an 

independent member with insurance expertise appointed by the President and confirmed by 

the Senate. The FSOC is instructed by the DFA to designate as “systemically important” large, 

interconnected nonbank financial firms that are to be subject to consolidated supervision by 

the Federal Reserve and enhanced prudential standards. The FSOC has no direct supervisory 

powers but may make recommendations to its member agencies on the development of 

financial policies and rule making. The assessors met with staff from the FSOC. 

In addition to the operation of the FSOC, formal and informal mechanisms are in place to 

encourage cooperation and information sharing among the financial regulatory agencies. 

Foremost of the formal mechanisms is the FFIEC, with representatives from the FBAs and 

CFPB at head-of-agency level and from regulators of state-chartered banks and credit 

unions. The FFIEC’s objectives are to prescribe uniform federal principles and standards for 

the examination of depository institutions, to promote coordination of bank supervision 

among the FBAs and to encourage better coordination of federal and state regulatory 

agencies. The assessors met with the FFIEC. The range of informal mechanisms is discussed 
UNITED STATES 

28 INTERNATIONAL MONETARY FUND

in CP 3. 

EC 2 The primary objective of banking supervision is to promote the safety and soundness of 

banks and the banking system. If the banking supervisor is assigned broader responsibilities, 

these are subordinate to the primary objective and do not conflict with it. 

Description and 

findings re EC2 

Each FBA has the objective of promoting safe and sound banking practices in the U.S. and 

maintaining stability and public confidence in the banking system. The FBAs have authority 

to issue regulations or guidelines as deemed necessary to ensure the safety and soundness 

of the banks under their jurisdiction. See e.g., 12 U.S.C. § 93a (OCC); 12 U.S.C. § 1819 (FDIC); 

12 U.S.C. §§ 248, 1844 (Federal Reserve); 12 U.S.C. § 1831p-1 (all FBAs). In addition, under 

the DFA, the FBAs and other financial regulatory agencies are required to supplement their 

traditional supervision and regulation of individual firms or markets with consideration of 

threats to the stability of the financial system as a whole. 

At the same time, the FBAs each have other objectives that they see as complementary, 

rather than subordinate, to their safety and soundness objectives. The OCC has the added 

objectives of assuring fair access to financial services and fair treatment of customers. The 

Federal Reserve has the objectives of maintaining the stability of the financial system and 

containing systemic risk that may arise in financial markets and influencing money and credit 

conditions in the economy in pursuit of full employment and stable prices. The FDIC has an 

additional objective of minimizing the disruptive effects that can occur within the financial 

system when bank or nonbank financial firms fail. 

EC3 Laws and regulations provide a framework for the supervisor to set and enforce minimum 

prudential standards for banks and banking groups. The supervisor has the power to 

increase the prudential requirements for individual banks and banking groups based on their 

risk profile23 and systemic importance.24

Description and 

findings re EC3 

Under existing legislation, the FBAs have delegated authority for the imposition of prudential 

standards and they also issue guidance and manuals that describe supervisory expectations. 

The banking statutes, regulations and certain guidelines establish a framework of minimum 

prudential standards that banks and holding companies must meet, while policy statements, 

interpretations, and supervisory guidance and manuals (including the Federal Reserve’s 

Supervision and Regulation (SR) Letters) establish best practices that banks and holding 

companies are expected to meet. Taken together, the regulatory framework addresses such 

matters as capital adequacy, loan underwriting, single borrower and related party exposure 

limits, asset quality, loan losses and provisioning, risk management (including requirements 

for addressing specific types of risks), internal controls and audits, accounting standards, 

liquidity, Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) and 

anti-fraud measures, among others. 

In addition, certain large bank holding companies, including foreign banking organizations 

and systemically significant nonbank financial companies, are subject to enhanced prudential 

standards. The DFA requires the enhanced prudential standards established by the Federal 

Reserve under section 165 to be more stringent than those standards applicable to other 

bank holding companies and nonbank financial companies that do not present similar risks 

 

23 In this document, “risk profile” refers to the nature and scale of the risk exposures undertaken by a bank. 

24 In this document, “systemic importance” is determined by the size, interconnectedness, substitutability, global or 

cross-jurisdictional activity (if any), and complexity of the bank, as set out in the BCBS paper on Global systemically 

important banks: assessment methodology and the additional loss absorbency requirement, November 2011.
UNITED STATES 

INTERNATIONAL MONETARY FUND 29

to U.S. financial stability (12 U.S.C. § 5365(a)(1)(a)). The standards must also increase in 

stringency based on the systemic footprint and risk characteristics of companies subject to 

section 165 (12 U.S.C. 5365(a) (1) (B)). Generally, the Federal Reserve has authority under 

section 165 to tailor the application of the standards, including differentiating among 

companies subject to section 165 on an individual basis or by category. 

The FBAs generally have the authority to examine affiliates of banks under their supervision. 

In addition, the Federal Reserve generally has the authority to examine and obtain reports 

from a holding company and its affiliates so that it can be informed of, among other things, 

the companies’ conditions and stability of the U.S. financial system. The DFA eliminated 

previous restrictions on the Federal Reserve, imposed under the Gramm-Leach- Bliley Act, on 

the Federal Reserve’s ability to examine, obtain reports from, or take enforcement action 

against a functionally regulated subsidiary of a BHC, such as a broker-dealer or insurance 

company. 

EC4 Banking laws, regulations and prudential standards are updated as necessary to ensure that 

they remain effective and relevant to changing industry and regulatory practices. These are 

subject to public consultation, as appropriate. 

Description and 

findings re EC4 

Several factors ensure that banking laws and regulations are regularly reviewed and updated 

as necessary to remain effective and relevant to changing industry and regulatory practices. 

A number of statutes require the FBAs to review their regulations at regular intervals to 

ensure that they remain relevant and effective and to reduce the burden on regulated 

entities. These reviews are conducted through a process that allows for widespread public 

(including industry) participation in developing more efficient and relevant rules. 

In many instances, changes in statutory provisions are adopted by Congress in response to 

specific crises or market failures, industry concerns or recommendations, or to update 

banking laws to address changes in the marketplace. Changes also may be made in response 

to judicial decisions. 

In some cases, the FBAs have the discretion to determine the most effective form (e.g., 

regulations, guidelines, supervisory guidance, interpretations, etc.) in which to promulgate 

revised or new requirements. Depending on the urgency or nature of issues to be addressed, 

change may be made as part of the agencies’ regular, periodic review of regulations, or may 

occur more quickly through the development and issuance of policy statements or 

guidelines. 

EC5 The supervisor has the power to: 

(a) have full access to banks’ and banking groups’ Boards, management, staff and records 

in order to review compliance with internal rules and limits as well as external laws and 

regulations; 

(b) review the overall activities of a banking group, both domestic and cross-border; and 

(c) supervise the activities of foreign banks incorporated in its jurisdiction. 

Description and 

findings re EC5 

The FBAs have broad statutory authority to obtain a broad array of information from 

supervised entities and their affiliates, including financial data and information on their 

activities, operations, structure, corporate governance, risk management and any other 

details, in the form and with such frequency as the agencies deem necessary to determine 

and enforce compliance with applicable laws and ensure the safety and soundness of banks. 

Banks and their affiliates must provide the FBAs with full and complete access to their books, 

records and employees; failure to do so can result in the imposition of administrative 
UNITED STATES 

30 INTERNATIONAL MONETARY FUND

sanctions. These duties extend to the foreign operations of banks and their affiliates, 

although the laws of foreign host countries may restrict U.S. banks in such countries from 

sharing certain information with the FBAs. The FBAs must also have full and complete access 

to the work papers, reports and other relevant materials of external auditors responsible for 

conducting an external audit of the banks. Institutions are subject to potentially significant 

monetary penalties for failure to make available information or reports, to submit reports on 

a timely basis, or for submitting or publishing any false or misleading report or information. 

As an essential component of consolidated supervision, the Federal Reserve maintains an 

understanding of all material parts of banking groups and nonbank financial groups subject 

to its supervision, including their domestic and cross-border operations. The Federal Reserve 

generally relies to the fullest extent possible on relevant primary supervisors and functional 

regulators for information about financial institutions within holding companies (see CP12). 

The local operations of foreign banks are subject to prudential, inspection and regulatory 

reporting requirements similar to those applicable to domestic banks. In general, these 

requirements can be found in the statutes and regulations applicable to domestic banks and 

in the International Banking Act and its implementing regulations (see CP13). 

The assessors saw a range of supervisory material confirming the access of the FBAs to bank 

boards and staff, and relevant records, to conduct detailed examinations. 

EC6 When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or 

is likely to be engaging in unsafe or unsound practices or actions that have the potential to 

jeopardize the bank or the banking system, the supervisor has the power to: 

(a) take (and/or require a bank to take) timely corrective action; 

(b) impose a range of sanctions; 

(c) revoke the bank’s license; and 

(d) cooperate and collaborate with relevant authorities to achieve an orderly resolution of 

the bank, including triggering resolution where appropriate. 

Description and 

findings re EC6 

The FBAs have broad authority to take (or require a bank to take) remedial measures when, 

in their judgment, a bank or holding company is not complying with laws or regulations or 

is, or is likely to be, engaged in an unsafe or unsound practice. In general, these authorities 

provide supervisors with both a range of proactive and remedial measures to address 

matters of concern and the discretion to determine when to employ them. The measures 

include restricting the current activities and operations of the organization, requiring new 

remedial activities, withholding or conditioning approval of new activities or acquisitions, 

restricting or suspending payments to shareholders or share repurchases, restricting asset 

transfers, barring individuals from banking, replacing or restricting the powers of managers, 

board directors or controlling owners, facilitating a takeover by or merger with a healthier 

institution, providing for the interim management of the bank, closing an institution and 

revoking its banking license, and issuing monetary fines against institutions and individuals 

(The Federal Reserve’s ability to appoint a conservator or receiver to close a bank is more 

limited by statute than the OCC’s or FDIC’s). The FBAs have the authority to cooperate and 

collaborate to achieve an orderly resolution of a bank; by statute, the FDIC is always 

appointed the receiver for closed insured banks. In general, remedial measures are imposed 

according to the extent and severity of the problem being addressed (see CP11). The 

assessors reviewed a number of examples of the different types of remedial measures. 

EC7 The supervisor has the power to review the activities of parent companies and of companies 

affiliated with parent companies to determine their impact on the safety and soundness of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 31

the bank and the banking group. 

Description and 

findings re EC7 

As noted in EC5 above, as an essential component of consolidated supervision, the Federal 

Reserve maintains an understanding of all material parts of banking groups and nonbank 

financial groups subject to its supervision, including their domestic and cross-border 

operations. The Federal Reserve has the power to review the activities of parent holding 

companies and of companies affiliated with those and uses this power to determine and 

ensure the safety and soundness of bank subsidiaries. In addition, the OCC may examine 

affiliates of national banks. See 12 U.S.C. § 481. 

Assessment of 

Principle 1

Largely Compliant 

Comments The DFA reforms have resulted in some rationalization of responsibilities in the U.S. 

supervisory structure, with the dissolution of the OTS and the absorption of its 

responsibilities for federal savings associations by the OCC. Taken on its own, the assessors 

see this as a positive step forward. In principle, the establishment of a specialized, standalone consumer protection regulator should also help to provide greater clarity of purpose 

for the FBAs. Nonetheless, the problems associated with multiple regulators with distinct but 

overlapping mandates, highlighted in the 2010 Detailed Assessment Report (DAR), differ 

only in form but not substance. In particular, the supervisory structure involves substantial 

duplication of supervisory effort, carries a significant burden of ensuring cooperation and 

coordination, and runs the ongoing risk of inconsistent messages from the agencies. 

The assessors readily acknowledge the legislative constraints on the FBAs and welcomed the 

obvious determination of the FBA staff with whom they met to ensure that the revamped 

supervisory structure works effectively. The assessors also acknowledge the substantial 

commitment of the FBAs to safety and soundness. Within the legislative constraints, 

however, the assessors recommend further effort in two particular, and related, areas. 

The first is the mandate of the FBAs. Each of the mandates refers in different ways to the 

objective of safety and soundness. This objective has been underscored by the DFA and is 

manifest in the substantial commitment of additional resources in each of the agencies to 

safety and soundness. Nonetheless, the legislative mandates do not make explicit that the 

primary objective of each agency is to promote the safety and soundness of banks and the 

banking system, as this CP emphasizes. The FBAs have asserted that there is no confusion on 

the part of the agencies, the public or industry that the focus of bank supervision and 

regulation relates to safety and soundness. This may well be the case in the aftermath of the 

financial crisis, but the emphasis may shift over time if political or economic pressures were 

to bring other priorities, such as employment growth, to the fore. The assessors recommend 

that, in the absence of legislative change, each of the FBAs revisit their “mission and vision” 

statements to ensure they give primacy to safety and soundness and to clarify that the 

pursuit of other objectives must be consistent with, and if necessary subordinate to, that 

goal. The assessors note that an international peer review of the OCC’s supervision of large 

and mid-sized institutions made a similar recommendation in respect of the OCC. 

The second is the division of responsibilities between safety and soundness, and consumer 

protection. In other jurisdictions, the establishment of a specialized consumer regulator has 

freed the bank supervisor to focus on safety and soundness matters. In those jurisdictions, 

the supervisor needs to be able to respond to operational and reputational risks associated 

with a bank’s poor performance in dealing with customers, but it does not generally become 

involved in particular consumer matters. The U.S. arrangements as they stand may not, in the 

assessors’ view, achieve this greater clarity of purpose. The FBAs retain their responsibilities 

for consumer protection issues in banking institutions with assets of $10 billion or less and, 
UNITED STATES 

32 INTERNATIONAL MONETARY FUND

as the assessors understand it, for particular consumer issues in institutions above that 

threshold. Given the legislative framework and the current resourcing of the CFPB, these 

arrangements may be the only way forward at this point. Nonetheless the assessors 

recommend that the FBAs and the CFPB explore ways to reduce duplication of effort, in 

matters such as risk reviews, and over time look to pursue opportunities for a more coherent 

division of responsibilities between safety and soundness, and consumer protection. 

In the assessors’ view, there remains further work on making the new supervisory structure 

more focused and effective, and they judge that a “Largely Compliant” rating is warranted. 

Principle 2 Independence, accountability, resourcing and legal protection for supervisors. The 

supervisor possesses operational independence, transparent processes, sound governance, 

budgetary processes that do not undermine autonomy and adequate resources, and is 

accountable for the discharge of its duties and use of its resources. The legal framework for 

banking supervision includes legal protection for the supervisor. 

Essential criteria 

EC1 The operational independence, accountability and governance of the supervisor are 

prescribed in legislation and publicly disclosed. There is no government or industry 

interference that compromises the operational independence of the supervisor. The 

supervisor has full discretion to take any supervisory actions or decisions on banks and 

banking groups under its supervision. 

Description and 

findings re EC1 

As discussed under CP 1, each FBA operates pursuant to an express statutory grant of 

authority and has clearly defined objectives and responsibilities. Statutes and regulations 

provide supervisors clear and broad authority to address compliance with laws and the 

safety and soundness of institutions under their jurisdiction. In general, these authorities 

provide supervisors with both a range of proactive and remedial measures to address 

matters of concern and the discretion to determine when to employ them. Federal statutes 

also provide for the operational independence of each FBA. 

In addition to this statutory protection, other factors are intended to ensure the operational 

independence and accountability of each FBA, and these are discussed further below. They 

include the circumstances for appointment and removal of agency heads; the self-funding 

nature of the agencies and independence from the congressional budget process; 

accountability to, consultations with and testimony before and other submissions to 

Congress; multiple provisions for external review of, or public reporting on, agency 

operations; requirements to make records of the agency available to the public through 

various specified means, including upon request, under certain circumstances; adherence to 

requirements for establishing, meeting and reporting publicly on periodic operational 

performance targets; availability of judicial review for agency decisions; required annual 

reporting on regulatory and supervisory actions taken during the year; legal protection for 

supervisory staff acting within the scope of their employment; and conflicts of interest, 

financial disclosure and other similar restrictions applicable to agency personnel, including 

supervisory staff. 

The assessors saw no evidence of any constraints or intrusions on the operational 

independence of the FBAs by government or industry (see also EC 4 below). Clearly, 

however, the financial crisis has considerably increased political scrutiny of the agencies and 

raised expectations of stronger agency performance, which the assessors consider has been 

reflected in more intense and conservative supervisory approaches. 

For the FBAs, the organizing statutes, implementing regulations, guidelines and other 

resources are (and are required to be) made publicly available, including on the website of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 33

each agency. (See 5 U.S.C. § 552(a)). 

EC2 The process for the appointment and removal of the head(s) of the supervisory authority and 

members of its governing body is transparent. The head(s) of the supervisory authority is 

(are) appointed for a minimum term and is removed from office during his/her term only for 

reasons specified in law or if (s)he is not physically or mentally capable of carrying out the 

role or has been found guilty of misconduct. The reason(s) for removal is publicly disclosed. 

Description and 

findings re EC2 

Laws establishing the FBAs specify the appointment process for the heads of the agencies, 

which is for a fixed term, but there are no laws specifying the reasons for removal of agency 

heads. The U.S. President, with the advice and consent of the Senate, appoints the heads. 

The Comptroller of the Currency is appointed to a five-year term, but can be removed by the 

President for cause prior to the expiration of his/her term, with the reasons to be laid before 

the Senate. During the Comptroller’s tenure, he/she also serves as a director of the FDIC, as 

does the Director of the CFPB. The FDIC’s three remaining directors are appointed by the 

President to six-year terms, although one of the appointed members is designated as 

Chairman for a five-year term. Members of the Federal Reserve Board of Governors are 

appointed to a full or to an unexpired portion of a 14-year term. One of the members is 

designated to serve as Federal Reserve Chairman, and another of the members is designed 

to serve as Vice Chairman, for a four-year term. All of these FBA positions are non-partisan, 

and there is no expectation that agency heads will resign at the conclusion of the term of the 

President who appointed them. See 12 U.S.C. § 2 (OCC); 12 U.S.C. § 242 (Federal Reserve); 

and 12 U.S.C. § 1812 (FDIC). 

EC3 The supervisor publishes its objectives and is accountable through a transparent framework 

for the discharge of its duties in relation to those objectives.25

Description and 

findings re EC3 

Each of the FBAs complies with the Government Performance and Results Act of 1993, which 

requires federal agencies, in consultation with Congress and outside stakeholders, to prepare 

a strategic plan covering a multiyear period and submit an annual performance plan and 

performance report. See 5 U.S.C. § 306 and 31 U.S.C. § 1115. The performance plans and 

assessments are incorporated into the agencies’ annual reports, which are required to be 

made public. The agencies also are required, by separate statute, to report annually on 

regulatory and supervisory actions taken during the year. 

The FBAs’ strategic plans and performance reports related to regulation and supervision are 

high-level documents. They set out broad strategic objectives and, though the formats differ 

between the agencies, they provide discussion on roles and responsibilities, potential risks 

and challenges, and means and strategies. Few objective performance targets or measures 

are specified; those that are relate mainly to the completion of examination cycles or the 

initiation of enforcement actions within timeframes prescribed by statute or agency policy. In 

the assessors’ view, the strategic plans and performance reports are helpful in improving 

public understanding of the priorities and activities of the FBAs, and the assessors would 

encourage the agencies to develop performance metrics related to outcomes as well as 

activities. 

Oversight and accountability to Congress occur through various statutory reporting and 

frequent extensive hearings on various financial regulatory issues. This scrutiny has become 

more intense since the financial crisis began. The independence of agencies in expressing 

their views to Congress in testimony is specified by law. On behalf of Congress, the 

 

25 Please refer to Principle 1, Essential Criterion 1.
UNITED STATES 

34 INTERNATIONAL MONETARY FUND

Government Accounting Office (GAO) conducts and publishes audits of the agencies’ 

performance. In 2009, the GAO placed the U.S. financial regulatory structure on its “high risk” 

list of matters warranting attention by Congress and the Executive branch of government. 

This was because of the GAO’s view that significant market developments in recent decades 

have outpaced a fragmented and outdated regulatory structure and significant reforms to 

the U.S. regulatory system are critically and urgently needed. The GAO considers that the 

U.S. financial regulatory structure remains on its “high risk” list; issues of continuing concern 

are the large regulatory agenda still to be completed, the challenge for regulators in 

identifying and monitoring systemic risk, and whether current initiatives will be effective in 

addressing the “too-big-to-fail” problem. 

In addition to oversight by the GAO, each FBA has an independent Inspector General (IG) 

that performs audits and evaluations of its operations. The IGs are also required by 

legislation to perform material loss reviews (which are published) of any bank failure that 

cost the FDIC insurance fund more than a specified materiality threshold level (now set at 

$50 million). In September 2011, the IG of the Federal Reserve published its “lessons learned” 

from a series of community bank failures in the crisis; a common theme from the supervision 

perspective was that, even when key safety and soundness risks had been identified, 

supervisors did not take sufficient action in a timely manner. This IG advised the assessors 

that the “pipeline” of failed banks subject to material loss reviews has shrunk considerably, 

allowing the IG to reallocate resources to assess aspects of the supervision of systemically 

important financial institutions. 

EC4 The supervisor has effective internal governance and communication processes that enable 

supervisory decisions to be taken at a level appropriate to the significance of the issue and 

timely decisions to be taken in the case of an emergency. The governing body is structured 

to avoid any real or perceived conflicts of interest. 

Description and 

findings re EC4 

Each of the FBAs has a unique internal governance and accountability structure for 

supervision and regulation involving authority and review at various regional or central 

levels. Within each agency there are processes for delegation of various supervision and 

regulation functions. For example, within the Fed system, Reserve Bank Presidents have 

delegated authority for supervisory matters from the Board. In each agency, considerable 

day-to-day authority for supervision decisions (such as ratings of institutions) is vested in the 

examiner-in-charge (EIC) for each bank. Each agency has review processes that can result in 

changes in these assessments in exceptional cases. The structure of the various agencies 

leads to their own internal review and coordination processes, which differ somewhat from 

agency to agency. There are also processes to allow banks to appeal formal decisions of the 

FBAs including ratings and proposed enforcement actions. 

The agencies have sought to improve these internal governance and accountability 

arrangements in response to the crisis and to lessons learned. The assessors discussed the 

changes with each of the FBAs. Broadly, the changes have involved more centralized 

direction and oversight, improved reporting of risk issues to newly established high-level risk 

committees, and greater coordination between head office and regional and field offices to 

achieve a better blending of horizontal and vertical assessments of risk. 

The governance rules (legislation and/or by-laws) for the Federal Reserve district banks allow 

for two-thirds of the boards of these banks to be appointed by the regulated commercial 

banks. These boards, in turn, have the right to appoint the officers of the Reserve Banks 

(including those in charge of supervision) and to have a say in their compensation, and are 

involved in approving the budget. In principle, this may raise concerns—actual or 

perceived—about potential conflicts of interest in the governance structure of the Federal 
UNITED STATES 

INTERNATIONAL MONETARY FUND 35

Reserve in the handling of supervisory matters. Federal Reserve staff advised the assessors 

that, in practice, the boards are not involved in any way in operational supervisory matters 

and the assessors saw no indications to the contrary. Nonetheless, these longstanding 

governance rules for Federal Reserve district banks appear out of line with the importance 

now being attached globally to board independence and are worthy of review. At the least, 

board charters should make explicit that boards do not engage in supervisory matters and a 

robust conflict of interest framework is in place. 

EC5 The supervisor and its staff have credibility based on their professionalism and integrity. 

There are rules on how to avoid conflicts of interest and on the appropriate use of 

information obtained through work, with sanctions in place if these are not followed. 

Description and 

findings re EC5 

The FBAs require that agency heads and all staff maintain high professional standards and 

exhibit high integrity. Federal laws and regulations, as well as individual conflict-of-interest 

rules and codes of conduct of each of the FBAs, help to ensure that these standards are met. 

For some of the agencies, there are specific statutes governing ethical conduct. For example, 

the Comptroller of the Currency and Federal Reserve staff are subject to statutory 

restrictions on activities and affiliations that might raise conflicts of interests. See, e.g., 12 

U.S.C. §§ 11 (unlawful for the Comptroller to hold an interest in a national bank) and 241, 242 

(respectively prohibiting Federal Reserve members from holding office in or stock of a 

member bank). Similarly, FDIC employees are prohibited from owning stock in any FDICregulated entity. In addition, members of the FDIC Board of Directors are prohibited from 

holding any office, position or employment in any bank or holding company during their 

time in office and for two years after they leave office, subject to certain exceptions. See 12 

U.S.C. § 1812. 

Senior examination staff of the FBAs are generally subject to a one-year post-employment 

“cooling off” period with respect to entities they supervised. Violators are subject to civil 

monetary penalties, can be removed from office and can be prohibited from participating in 

the affairs of the bank, the holding company, or any other company for up to five years. 

Examiners also are prohibited from accepting loans or gratuities from banks that they 

examine. OCC employees are also barred from representing another party before the Federal 

Government in a matter in which they participated as an OCC employee; the restriction is 

either two years or permanent. These standards are reinforced by a number of criminal 

statutes, including those prohibiting corruption, bribery, theft and fraud by agency 

employees. These laws are actively enforced. The FBAs have administrative policies to ensure 

that appropriate codes of conduct are being followed. These policies outline the 

requirements for examiners and other supervisory staff concerning investment prohibitions, 

borrowing prohibitions and recusal requirements based on considerations such as family, 

debt, or prior employment relationships. 

The assessors were impressed by the caliber of the agency staff they met, and banks and 

banking associations also attested to the professionalism and integrity of FBA staff. 

EC6 The supervisor has adequate resources for the conduct of effective supervision and 

oversight. It is financed in a manner that does not undermine its autonomy or operational 

independence. This includes: 

(a) a budget that provides for staff in sufficient numbers and with skills commensurate 

with the risk profile and systemic importance of the banks and banking groups 

supervised; 

(b) salary scales that allow it to attract and retain qualified staff; 

(c) the ability to commission external experts with the necessary professional skills and 
UNITED STATES 

36 INTERNATIONAL MONETARY FUND

independence, and subject to necessary confidentiality restrictions to conduct 

supervisory tasks; 

(d) a budget and program for the regular training of staff; 

(e) a technology budget sufficient to equip its staff with the tools needed to supervise the 

banking industry and assess individual banks and banking groups; and 

(f) a travel budget that allows appropriate on-site work, effective cross-border 

cooperation and participation in domestic and international meetings of significant 

relevance (e.g. supervisory colleges). 

Description and 

findings re EC6 

Each of the FBAs is self-funding and, thus, is not subject to the congressional budget process 

or congressional appropriations. The assessors were advised by each agency that it has the 

budget needed to increase the intensity of its supervision and oversight, which has been a 

major priority in recent years. Indeed, since the crisis the FBAs have achieved a significant 

build-up of staffing resources, particularly in the supervision of large banking organizations, 

policy implementation and stress testing. The Federal Reserve, in particular, has significantly 

increased staffing in its supervision and regulatory policy areas. 

Each of the FBAs sets its own salary scales for its employees, having regard to salaries paid to 

other financial regulatory agencies, federal government and private sector salaries. Although 

the FBAs do not seek to match higher-end private sector salary scales, the subdued market 

conditions over recent years have enabled the FBAs to attract experienced hires from the 

financial and banking community to supplement their traditional preference for entry-level 

recruitment. 

The FBAs have intensified their staff training to match the influx of recruits. The FBAs also 

indicated to the assessors that they have the budget to meet travel needs associated with 

on-site work (including reviews of the offshore operations of U.S. banking institutions) and 

to participate in relevant policy fora and supervisory colleges. 

EC7 As part of their annual resource planning exercise, supervisors regularly take stock of existing 

skills and projected requirements over the short- and medium-term, taking into account 

relevant emerging supervisory practices. Supervisors review and implement measures to 

bridge any gaps in numbers and/or skill-sets identified. 

Description and 

findings re EC7 

Each of the FBAs undertakes an internal evaluation process to ensure that it has the staffing 

resources and skills to meet its supervisory needs. The assessors were advised that staffing 

requirements are generally determined from the “ground up” in the process of developing 

strategies and performance plans, and the assessors saw documents on this process. Active 

hiring and retention programs are used to attract and retain staff with the necessary critical 

skills. The FBAs offer comprehensive training for their staff, including a structured skills 

enhancement program to qualify as an examiner-in-chief. The FBAs also have the flexibility 

to bring in specialist staff on a fixed-term basis, as the FDIC has done to manage the 

significant increase in the number of bank workouts during the crisis. 

EC8 In determining supervisory programs and allocating resources, supervisors take into account 

the risk profile and systemic importance of individual banks and banking groups, and the 

different mitigation approaches available. 

Description and 

findings re EC8 

By statute, the FBAs are required to conduct a full-scope, onsite exam of each bank at least 

once during each twelve-month period. However, the agencies can lengthen this cycle to 18 

months for banks that meet certain asset size thresholds and supervisory rating criteria. See 

12 U.S.C. § 1820(d)(4). Figures provided to the assessors (see table in CP 9) show that 

institutions subject to the longer review cycle account for a majority of regulated institutions 
UNITED STATES 

INTERNATIONAL MONETARY FUND 37

but only a small percentage of total system assets. 

The FBAs utilize a risk-based supervisory approach. As part of this approach, supervisory 

programs are applied that are appropriate to the geographic scope and degree of 

specialization, sophistication, risk, size and complexity of the activities and organization of 

banks. In general, those entities presenting the greatest risk receive the most intense, 

frequent and comprehensive scrutiny. 

Supervisory programs allocate resources to each risk area, taking into account the intended 

frequency and intensity of risk assessments. As noted throughout this BCP assessment, each 

of the FBAs has increased the staffing resources allocated to the supervision of large banking 

organizations, reflecting the complexity and systemic importance of these organizations and 

the heightened supervisory focus on stress testing. 

EC9 Laws provide protection to the supervisor and its staff against lawsuits for actions taken 

and/or omissions made while discharging their duties in good faith. The supervisor and its 

staff are adequately protected against the costs of defending their actions and/or omissions 

made while discharging their duties in good faith. 

Description and 

findings re EC9 

The FBAs and their staffs are generally protected against lawsuits for actions and/or 

omissions made while discharging their duties in good faith. Sovereign immunity bars 

lawsuits without specific statutory authorization to pursue such litigation. Common law 

qualified immunity protects FBAs’ heads and staff from liability for the violation of an 

individual’s Constitutional rights in connection with the performance of discretionary 

functions, as long as the employee’s conduct does not clearly violate established statutory or 

Constitutional rights. Lawsuits are permitted against FBAs’ employees for acts and/or 

omissions that cause injuries while acting within the scope of their employment. In such a 

case, the U.S. would substitute itself as the defendant upon the Attorney General’s 

certification that an employee was acting within the scope of his office or employment. 

Moreover, an exception to the relevant act protects employees from lawsuits involving the 

execution of a statute or regulation or the exercise/ failure to exercise a discretionary 

function, whether or not the employee abused the discretion involved. 

Assessment of 

Principle 2

Compliant 

Comments Since the crisis, political and community expectations about the performance of the FBAs 

have heightened and the FBAs have responded by strengthening their accountability and 

transparency. This would be aided by further development of performance measures 

focused on supervisory outcomes. The FBAs have also improved their internal decisionmaking processes and have stepped up their supervisory intensity, particularly towards large 

banking organizations. Delivery on these various initiatives has required a substantial 

commitment of additional resources and specialized skills. The assessors welcome the 

success of the FBAs in strengthening their capacities. The challenge ahead will be to retain 

those capacities as U.S. economic conditions continue to improve and specialist skills in 

areas such as stress testing and risk modeling become even more attractive to industry. The 

assessors encourage the FBAs to keep their hiring programs flexible and responsive, and 

their training programs fully funded. 

As noted in the 2010 DAR, the independence of the Federal Reserve’s supervisory role would 

be further assured if the governance rules for the boards of Federal Reserve district banks 

were made consistent with emerging global good practice; at the least, greater clarity and 

transparency about the role of these boards in operational supervisory matters is needed. 
UNITED STATES 

38 INTERNATIONAL MONETARY FUND

Principle 3 Cooperation and collaboration. Laws, regulations or other arrangements provide a 

framework for cooperation and collaboration with relevant domestic authorities and foreign 

supervisors. These arrangements reflect the need to protect confidential information.26

Essential criteria 

EC1 Arrangements, formal or informal, are in place for cooperation, including analysis and 

sharing of information, and undertaking collaborative work, with all domestic authorities 

with responsibility for the safety and soundness of banks, other financial institutions and/or 

the stability of the financial system. There is evidence that these arrangements work in 

practice, where necessary. 

Description and 

findings re EC1 

The FBAs have broad statutory powers to share information with other domestic banking 

supervisors. See e.g., 12 U.S.C. §§ 1817 (a)(2)(A) and (C) on sharing with FDIC, a state or 

federal agency with supervisory or regulatory authority over the bank or other entity, or any 

appropriate person and 3412(e) on sharing of financial records, reports of examination or 

other information about a bank, holding company or bank or holding company subsidiary 

among and between the five FFIEC member supervisory agencies, as well as the SEC, CFTC, 

FTC and CFPB. 

The FBAs have a number of formal and informal mechanisms for information sharing, which 

forms an integral part of supervisory programs for the consolidated supervision of banks 

and holding companies. The FBAs routinely share information with each other. This typically 

occurs at the time of formation of a banking group, authorization of a new activity, changes 

in a banking group’s structure, as well as during supervisory activities, in crisis situations, and 

as part of periodic meetings among supervisors. Examination findings are also shared 

between the FBAs, as appropriate. 

Since the crisis, the FBAs have enhanced their collaboration in a number of ways, including: 

the sharing of supervisory plans for review and comment; quarterly meetings of examiners of 

large banks to discuss heightened risk areas and upcoming targeted reviews; increased joint 

supervisory presence at examinations of systemically important banks; joint participation in 

the Federal Reserve’s horizontal reviews: and a stronger commitment to issue joint 

supervisory guidance when possible. 

The FBAs routinely exchange information with state supervisory agencies. The assessors were 

advised, however, that these agencies do not necessarily consult with the FBAs (or with 

foreign supervisors) when the agencies take enforcement actions. The FBAs are also seeking 

to improve information with functional regulators, such as the SEC and the CFTC, related to 

securities companies in a banking group or a financial conglomerate that includes a bank. A 

MoU between the OCC and the SEC was finalized in September 2014. The FBAs also have 

formal arrangements with state insurance supervisors to coordinate and plan supervisory 

activities, both on a routine and an emergency basis, with respect to particular banking 

groups that have significant insurance operations. The Federal Reserve makes available 

relevant information to other banking agencies and functional regulators regarding the 

financial condition, risk-management policies and operations of a holding company that 

may have a material impact on an individual regulated subsidiary. The other FBAs make 

information about bank subsidiaries of holding companies available to the Federal Reserve 

and to each other. Other functional regulators also provide information to the FBAs 

 

26 Principle 3 is developed further in the Principles dealing with “Consolidated supervision” (12), “Home-host 

relationships” (13) and “Abuse of financial services” (29).
UNITED STATES 

INTERNATIONAL MONETARY FUND 39

concerning regulated entities within U.S. banking groups that may have an adverse effect on 

the banks within the group. 

As noted in CP1, the FSOC facilitates regulatory coordination and information sharing 

among the member agencies, among other responsibilities. The Federal Reserve, OCC, CFPB 

and FDIC are members. 

EC2 Arrangements, formal or informal, are in place for cooperation, including analysis and 

sharing of information, and undertaking collaborative work, with relevant foreign supervisors 

of banks and banking groups. There is evidence that these arrangements work in practice, 

where necessary. 

Description and 

findings re EC2 

The FBAs have broad statutory authority to share relevant supervisory information with 

foreign financial sector (banking and functional) supervisors of banks and banking groups of 

interest to the home or host supervisor (see, e.g., 12 U.S.C. § 3109). The FBAs may disclose 

information obtained in the course of exercising their supervisory or examination authority; 

they may also assist foreign banking supervisors by investigating and collecting information 

and evidence where the foreign supervisor is conducting an investigation to determine 

whether a person has violated, is violating or is about to violate any law or regulation 

enforced by that supervisor. 

The FBAs have entered into bilateral formal information-sharing and cooperation 

arrangements (e.g., memoranda of understanding and statements of cooperation) with a 

number of foreign supervisors, and additional arrangements are in process. These 

arrangements cover the sharing of confidential supervisory information, with an emphasis on 

host-to-home sharing to support home supervisors’ consolidated supervision of the financial 

groups for which they have responsibility. The arrangements contain a number of requisite 

provisions to govern the confidentiality of information. The arrangements also provide for 

on-site examinations by home authorities of cross-border operations in the host jurisdiction. 

The FBAs are authorized to share relevant supervisory information even in the absence of a 

formal arrangement, and in practice they share significant information whether acting in a 

home or host capacity. 

The assessors saw evidence that these arrangements are working in practice. 

EC3 The supervisor may provide confidential information to another domestic authority or 

foreign supervisor but must take reasonable steps to determine that any confidential 

information so released will be used only for bank-specific or system-wide supervisory 

purposes and will be treated as confidential by the receiving party. 

Description and 

findings re EC3 

The FBAs are subject to a general statutory prohibition on disclosing certain types of 

confidential financial information unless the law specifically authorizes such sharing. In 

addition, each FBA’s regulations, which have the force of law, require confidential treatment 

of a broad range of non-public supervisory information. In general, prior to engaging in 

information sharing, the FBAs require assurances that the information will be used only for 

lawful supervisory purposes and will be kept confidential. Under the International Banking 

Act, the FBAs must determine that disclosure to a foreign bank supervisor is appropriate and 

would not prejudice the interest of the U.S. (see 12 U.S.C. § 3109(a)). In addition, the FBAs 

must obtain, to the extent necessary, the recipient’s agreement to keep the information 

confidential to the “extent possible under applicable law” (see 12 U.S.C. § 3109(b)). 

EC4 The supervisor receiving confidential information from other supervisors uses the 

confidential information for bank-specific or system-wide supervisory purposes only. The 

supervisor does not disclose confidential information received to third parties without the 

permission of the supervisor providing the information and is able to deny any demand 
UNITED STATES 

40 INTERNATIONAL MONETARY FUND

(other than a court order or mandate from a legislative body) for confidential information in 

its possession. In the event that the supervisor is legally compelled to disclose confidential 

information it has received from another supervisor, the supervisor promptly notifies the 

originating supervisor, indicating what information it is compelled to release and the 

circumstances surrounding the release. Where consent to passing on confidential 

information is not given, the supervisor uses all reasonable means to resist such a demand 

or protect the confidentiality of the information. 

Description and 

findings re EC4 

The FBAs are able to deny demands for confidential information in their possession except in 

limited situations. Such information may be subpoenaed by a court, a grand jury or a 

committee of the U.S. Congress. When feasible, an agency that is being compelled to 

provide confidential information received from another supervisor (domestic or foreign) will 

notify such supervisor and make reasonable efforts to resist disclosure. The FBAs also must 

notify and provide information to U.S. law enforcement authorities if they receive indications 

of a possible violation of criminal law. 

Under the International Banking Act, confidential material provided by a foreign supervisor 

will have broad protection from compelled onward disclosure if certain conditions are met. If 

these conditions are met, the FBAs could not be compelled to disclose such information 

except to a committee of the U.S. Congress or to comply with an order of a U.S. court. 

 EC5 Processes are in place for the supervisor to support resolution authorities (e.g. central banks 

and finance ministries as appropriate) to undertake recovery and resolution planning and 

actions. 

Description and 

findings re EC5 

The broad statutory authority of the FBAs to share information with other domestic and 

foreign financial authorities would include sharing relevant recovery- and resolution-related 

information with foreign resolution authorities, central banks and finance ministries with 

responsibility for resolution. See, e.g., 12 U.S.C §§ 1817(a)(2)(A) and (C); 12 U.S.C. § 3109. Such 

information may be provided on a bilateral basis under existing memoranda of 

understanding (or similar arrangements) or in response to specific requests. In the U.S., the 

FDIC is both the resolution authority and a direct supervisor. Therefore, coordination is an 

integral part of the FDIC’s activities as the resolution authority, and ongoing relationships 

with the other FBAs and state supervisory agencies provide the basis for effecting resolutions 

in an orderly and timely manner. Recovery and resolution planning also takes place in the 

CMGs established for large U.S. banking groups. The U.S. regulatory authorities have been 

working with their foreign counterparts to complete cooperation agreements (COAGs) that 

will facilitate work in the CMGs by establishing a framework for cooperation and the 

protection of sensitive supervisory information. 

The FBAs participate as home and host authorities of firms designated as global systemically 

important financial institutions by the Financial Stability Board in numerous firm-specific 

CMGs for the purposes of developing crisis management strategies and resolution plans for 

such firms. The FBAs also participate as home and host authorities in supervisory colleges 

established for a number of banking institutions at which recovery plans created by those 

institutions are reviewed. 

Assessment of 

Principle 3

Compliant 

Comments The U.S. system of multiple FBAs with distinct but overlapping responsibilities puts an 

absolute premium on effective domestic cooperation and collaboration if consolidated 

supervision is to be targeted, comprehensive and timely. The assessors are satisfied that the 

FBAs have made a substantial effort since the crisis to improve their performance in this 
UNITED STATES 

INTERNATIONAL MONETARY FUND 41

area, and this was also acknowledged in meetings with staff from all three agencies. The 

improvements are evident in the sharing of strategic planning and institution-specific 

supervisory plans, the greater frequency of interagency meetings, the increased number of 

examinations and other visits conducted jointly, the sharing of information, and efforts to 

ensure consistent messaging to banking organizations. However, consistency may not 

always be achieved when the FBAs bring different perspectives to a current issue, a concern 

raised by banks with which the assessors met in the context of recent guidance on leveraged 

lending. 

It is important that the effort be maintained and that collaboration becomes fully engrained 

in the modus operandi of each agency, so as to avoid any temptation to “go it alone” when 

crisis pressures next emerge. To this end, the assessors recommend that the FBAs ensure 

that the preparation of supervisory plans is on the same cycle or, when that is not 

practicable, that supervisory strategies for individual institutions are carefully coordinated 

and that necessary specialized resources are available. 

Internationally, the establishment of supervisory colleges and CMGs has given greater 

urgency to information-sharing arrangements, which have moved or are moving to more 

formal footings. The assessors have accepted the views put by each of the FBAs that there 

are no legal or other impediments to their ability and willingness to cooperate and 

collaborate with foreign supervisors. The actual performance of supervisory colleges was 

beyond the scope of this assessment and the assessors did not review papers from 

supervisory colleges. International cooperation would be further strengthened if state 

supervisory agencies consulted fully, in all cases, with the FBAs and foreign supervisors on 

impending enforcement actions. The assessors were made aware of circumstances where 

this was not the case. Although this is a clear deficiency in cooperation arrangements, the 

assessors did not judge it as sufficient to lower the “Compliant” rating for CP 3, but 

improvements in such consultations should be a high priority. 

Principle 4 Permissible activities. The permissible activities of institutions that are licensed and subject 

to supervision as banks are clearly defined and the use of the word “bank” in names is 

controlled.

Essential criteria 

EC1 The term “bank” is clearly defined in laws or regulations. 

Description and 

findings re EC1 

Federal and state laws expressly provide for the establishment, operation, permissible 

activities and transactions, and supervision of entities referred to as “banks.” In general, a 

“bank” is an institution (a) incorporated or chartered either under federal or state law; (b) 

authorized to engage in activities as specified under applicable law, typically including 

accepting demand deposits and engaging in the business of making loans; and (c) subject to 

supervision by state or federal authorities. Hence, the term “bank” is defined in terms of its 

range of permitted activities. 

Laws also provide for the establishment of specialized institutions that engage in some 

activities also permitted banks, but that generally are not called “banks.” These include 

“savings associations.” They provide many of the same services as banks and are supervised 

similarly. There is a small number of other more specialized institutions supervised by the 

FDIC that are not subject to the full gamut of banking regulations (e.g., industrial loan 

companies, trust companies, credit card banks and single purpose banks). These latter 

institutions, through “grandfathering clauses,” provide typical banking services and may 

remain in the deposit insurance scheme. Collectively, however, they have only a small share 

of the U.S. banking market. 
UNITED STATES 

42 INTERNATIONAL MONETARY FUND

EC2 The permissible activities of institutions that are licensed and subject to supervision as banks 

are clearly defined either by supervisors, or in laws or regulations. 

Description and 

findings re EC2 

Federal and state banking laws and regulations provide clear parameters on permissible 

activities and transactions for banks. The National Bank Act, the Home Owners’ Loan Act and 

implementing regulations specify the permissible activities of national banks and federal 

savings associations, respectively. In general, banks are limited to a set of activities 

considered to be “banking” or related and necessary to banking activities. Under certain 

circumstances, banks can be permitted to engage in a broader range of “financial” activities 

through particular subsidiaries or by parent companies; in general, however, banks cannot 

engage in additional activities through a subsidiary that they would not be able to engage in 

directly. Bank holding companies and savings and loan holding companies are permitted to 

engage in a variety of activities that are closely related to banking. 

The state laws under which state banks and state savings associations are chartered specify 

the permissible activities of such institutions. Federal law provides an “overlay” to the states’ 

authority to determine the permissible activities and transactions of such institutions. In 

general, insured state chartered banks and savings associations may only engage in activities 

permissible for national banks and federal savings associations, respectively, unless the FDIC 

determines that an activity poses no significant risk to the deposit insurance fund, is related 

to the business of banking and engaged in directly, and the banks or savings associations 

continue to meet applicable capital requirements. 

EC3 The use of the word “bank” and any derivations such as “banking” in a name, including 

domain names, is limited to licensed and supervised institutions in all circumstances where 

the general public might otherwise be misled. 

Description and 

findings re EC3 

No entity may operate as a “bank” and engage in banking operations in the U.S. without a 

charter from a federal or state banking agency. 12 U.S.C. § 378 makes it a crime for any 

person or entity to purport to be a bank that accepts deposits if the entity is not licensed as 

such by an appropriate banking agency. In addition, states generally prohibit a corporation 

from using the word “bank” in its name unless it has a bank charter. Federal law also makes 

it a crime to make unauthorized use of terms, such as “national,” “Federal,” “United States,” 

“reserve” or “Deposit Insurance”, that indicate a federal banking charter, membership in the 

Federal Reserve or federal deposit insurance. The FBAs issue public alerts about known 

unauthorized use of these terms but do not have the power to take enforcement actions 

themselves against such usage. 

EC4 The taking of deposits from the public is reserved for institutions that are licensed and 

subject to supervision as banks.27

Description and 

findings re EC4

12 U.S.C. § 378 stipulates that all persons or entities engaged in demand deposit-taking are 

required to be subject to some degree of regulation, supervision or oversight by federal or 

state authorities. Persons violating this requirement are subject to criminal penalties, 

including fines and imprisonment. In practice, entities engaged in retail deposit-taking 

(except credit unions) are generally licensed and subject to supervision as banks or savings 

 

27 The Committee recognizes the presence in some countries of non-banking financial institutions that take deposits 

but may be regulated differently from banks. These institutions should be subject to a form of regulation 

commensurate to the type and size of their business and, collectively, should not hold a significant proportion of 

deposits in the financial system. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 43

associations. 

EC5 The supervisor or licensing authority publishes or otherwise makes available a current list of 

licensed banks, including branches of foreign banks, operating within its jurisdiction in a way 

that is easily accessible to the public. 

Description and 

findings re EC5

Collectively through the FFIEC, and separately, the FBAs publish and regularly update 

information on banks and holding companies (domestic and foreign, and including U.S. 

branches and subsidiaries of foreign banks) subject to their jurisdiction. Information 

accessible through the FFIEC’s National Information Center includes detailed financial 

information and organizational charts. 

Assessment of 

Principle 4

Compliant 

Comments There is a well-established framework for defining the permissible activities of banks and 

protecting the integrity of the term “bank”. Though not a specific responsibility of the FBAs, 

it is important that the U.S. authorities closely monitor the disclosure practices of “bank-like” 

institutions, such as mutual funds offering deposit-like products, to ensure the community is 

well informed about the security of their savings. 

Principle 5 Licensing criteria. The licensing authority has the power to set criteria and reject 

applications for establishments that do not meet the criteria. At a minimum, the licensing 

process consists of an assessment of the ownership structure and governance (including the 

fitness and propriety of Board members and senior management)28 of the bank and its wider 

group, and its strategic and operating plan, internal controls, risk management and 

projected financial condition (including capital base). Where the proposed owner or parent 

organization is a foreign bank, the prior consent of its home supervisor is obtained. 

Essential criteria 

EC1 The law identifies the authority responsible for granting and withdrawing a banking license. 

The licensing authority could be the banking supervisor or another competent authority. If 

the licensing authority and the supervisor are not the same, the supervisor has the right to 

have its views on each application considered, and its concerns addressed. In addition, the 

licensing authority provides the supervisor with any information that may be material to the 

supervision of the licensed bank. The supervisor imposes prudential conditions or limitations 

on the newly licensed bank, where appropriate.

Description and 

findings re EC1 

Banks, whether organized under federal or state law, are regulated and supervised by their 

licensing authority, as discussed in EC 2 below. They are typically also subject to concurrent 

regulation and supervision by one or more additional banking agencies. Establishing a de 

novo bank often involves obtaining related authorizations (i.e. federal deposit insurance, 

membership in the Federal Reserve System) from more than one agency. In particular, 

 

28 This document refers to a governance structure composed of a board and senior management. The Committee 

recognizes that there are significant differences in the legislative and regulatory frameworks across countries 

regarding these functions. Some countries use a two-tier board structure, where the supervisory function of the 

board is performed by a separate entity known as a supervisory board, which has no executive functions. Other 

countries, in contrast, use a one-tier board structure in which the board has a broader role. Owing to these 

differences, this document does not advocate a specific board structure. Consequently, in this document, the terms 

“board” and “senior management” are only used as a way to refer to the oversight function and the management 

function in general and should be interpreted throughout the document in accordance with the applicable law within 

each jurisdiction.
UNITED STATES 

44 INTERNATIONAL MONETARY FUND

foreign banks establishing a branch, agency or a subsidiary bank in the U.S. must obtain 

approval from the Federal Reserve as well as from the relevant licensing authority (see EC 

10). The relevant agencies have well-established practices and procedures to communicate 

and coordinate investigations on related licensing and deposit insurance applications, and 

often conduct joint investigations on such applications. The assessors saw examples of 

interagency communications and information sharing on license applications. 

The licensing authorities/supervisors generally have the authority to impose prudential 

conditions or limitations on newly licensed banks, as appropriate. 

EC2 Laws or regulations give the licensing authority the power to set criteria for licensing banks. 

If the criteria are not fulfilled or if the information provided is inadequate, the licensing 

authority has the power to reject an application. If the licensing authority or supervisor 

determines that the license was based on false information, the license can be revoked. 

Description and 

findings re EC2 

The authority to license banks and the criteria to be considered are set out in statutes and 

regulations. The OCC is the licensing authority for national banks (see 12 U.S.C. §21 et seq) 

and federal savings associations (see 12 U.S.C. § 1464(a)), while each of the states has the 

authority to license (“charter”) banks headquartered and operating within its jurisdiction. 

Typically, the OCC and the states make licensing approvals for de novo banks conditional on 

the receipt of deposit insurance coverage. The FDIC alone is authorized to make 

determinations regarding deposit insurance under the Federal Deposit Insurance (FDI) Act. 

The OCC may deny an application if it determines that the applicants have not met the 

established criteria or if the information provided is inadequate. The FDIC and the Federal 

Reserve may also deny authorizations within their respective competences The agencies 

must evaluate the evidence and, in this respect, may conduct investigations and exercise 

independent judgment based on all the information collected. Providing false or misleading 

information can be a basis for civil, administrative and criminal liability, and the penalties can 

include license revocation. See 12 U.S.C. §93 (a). The primary supervisor must consult with 

other relevant agencies on action to revoke a license. The FDIC is the resolution authority for 

banks. 

EC3 The criteria for issuing licenses are consistent with those applied in ongoing supervision. 

Description and 

findings re EC3 

Although not expressly required by statute, the criteria for issuing licenses are generally 

consistent with those applied in ongoing supervision. For example, the OCC considers 

whether an applicant bank: (a) has organizers who are familiar with national banking laws 

and regulations; (b) has competent management that has ability and experience relevant to 

the type of products and services to be provided, and the scope and size of the projected 

risks; (c) has capitalization, access to liquidity, and risk-management systems that are 

sufficient to support the projected volume and type of business; (d) can reasonably be 

expected to achieve and maintain profitability; and (e) will operate in a safe and sound 

manner. See 12 CFR 5.20(f)(2). The OCC evaluates these same factors and others in the 

course of ongoing supervision. Supervisory material provided to the assessors confirmed a 

thorough license evaluation process. 

When evaluating applications for deposit insurance, the FDIC considers seven statutory 

factors enumerated in Section 6 of the FDI Act. These factors assess: the financial history and 

condition of the proposed depository institution and its parent organization; capital 

structure; proposed ownership and management; earnings prospects; activities to be 

conducted; convenience and needs of the community to be served; and potential risks to the 

Deposit Insurance Fund. The FDIC also considers the complexity and unique nature of the 

underlying proposal and business plan, including the conditions under which the proposed 
UNITED STATES 

INTERNATIONAL MONETARY FUND 45

institution will operate. Supervisory material provided to the assessors confirmed a thorough 

process for evaluating applications for deposit insurance. 

EC4 The licensing authority determines that the proposed legal, managerial, operational and 

ownership structures of the bank and its wider group will not hinder effective supervision on 

both a solo and a consolidated basis.29 The licensing authority also determines, where 

appropriate, that these structures will not hinder effective implementation of corrective 

measures in the future. 

Description and 

findings re EC4 

The FBAs acknowledge that developing a complete understanding of the proposed legal, 

managerial, operational and ownership structures of a bank, on both a stand-alone and 

consolidated basis, is an essential component of the licensing process. In order to fulfill its 

responsibility for protecting the safety and soundness of banks, each banking agency must 

have a clear understanding of proposed internal operating and external ownership 

(including group) structures and be able to assess (at authorization and during ongoing 

supervision) the impact that those structures may have on the integrity of a bank. The 

importance of structural assessments to safety-and-soundness evaluations is emphasized in 

the “Joint Agency Statement on Parallel-Owned Banking Organizations” (April 23, 2002). If 

impediments exist or arise, the agencies may take appropriate remedial measures, including 

denying or terminating a bank’s license, deposit insurance coverage or Federal Reserve 

membership. The assessors understand that, in the light of crisis experience, the FBAs have a 

strong preference for business models that are transparent and are viable without an overreliance on affiliates. 

EC5 The licensing authority identifies and determines the suitability of the bank’s major 

shareholders, including the ultimate beneficial owners, and others that may exert significant 

influence. It also assesses the transparency of the ownership structure, the sources of initial 

capital and the ability of shareholders to provide additional financial support, where needed.

Description and 

findings re EC5 

As part of the licensing process, applicants are required to identify prospective shareholders 

and key decision-makers, including ultimate beneficial owners. The OCC may require each 

prospective principal shareholder (generally, those owning or controlling 10 per cent or 

more of a class of a bank’s shares) and key decision-makers of an applicant to provide 

detailed information on their current and past work experiences and financial holdings. The 

OCC conducts a background check and/or field investigation for information on criminal 

convictions, financial capacity and expertise in the financial industry. The FDIC also conducts 

background investigations of prospective principal shareholders, directors and executive 

officers during its review of deposit insurance applications. The assessors saw ample 

evidence of these evaluation processes. 

Assessments regarding principal shareholders primarily consider whether they have the 

ability to provide financial support to the proposed bank. A necessary part of this 

assessment is identifying the sources of initial capital from and the liquidity position of 

principal shareholders, and ensuring transparency of ownership structures. 

The FDIC’s “Final Statement of Policy on Qualifications for Failed Bank Acquisitions” 

(September 2, 2009) confirms that complex and functionally opaque ownership structures in 

which the beneficial ownership is difficult to ascertain with certainty, the responsible 

decision-makers are not clearly identified, and ownership and control are separated, would 

 

29 Therefore, shell banks shall not be licensed. (Reference document: BCBS paper on shell banks, January 2003.)
UNITED STATES 

46 INTERNATIONAL MONETARY FUND

not be granted approval to own an insured depository institution. 

EC6 A minimum initial capital amount is stipulated for all banks. 

Description and 

findings re EC6 

In general, a de novo depository institution must have a minimum amount of initial capital, 

which is available and ready to be deployed. For de novo banks, the OCC does not stipulate 

a minimum dollar amount of capital but it requires the bank to have sufficient initial capital 

(net of pre-opening expenses) to support the projected volume and type of business to be 

conducted. However, a de facto minimum of $2 million applies since that is the FDIC’s 

minimum capital requirement for inclusion in the deposit insurance scheme. Generally, the 

OCC expects a de novo bank to remain above the “well-capitalized” level for purposes of 

Prompt Corrective Action throughout the first three years of its operation, and requires it to 

meet a minimum leverage ratio, measured in terms of tier 1 capital to on-balance sheet 

assets, of 8 per cent throughout that period, based on a realistic business plan. In most 

cases, a newly insured bank requires initial capital of significantly more than $2 million to 

reach a size and scale that enables it to operate and compete in its identified geographic 

market(s). For de novo federal savings associations, there is a statutory minimum initial 

required capital of $2 million (see 12 CFR 1431.3(b)). 

In addition to its minimum capital requirement for all depository institutions, the FDIC 

requires institutions to maintain an adequate Allowance for Loan and Lease Losses (ALLL) 

(see CP 18). For state nonmember institutions, the FDIC requires that the minimum leverage 

ratio of 8 per cent be met throughout the first seven years of operation. Furthermore, 

depending on a de novo institution’s anticipated risk profile, and regardless of charter type, 

the FDIC and/or other appropriate agency may impose a minimum leverage ratio 

requirement in excess of 8 per cent. 

The assessors questioned the FBAs about the de facto $2 million minimum capital 

requirement for de novo banks and savings associations, which is much lower than the 

corresponding requirement for small banks in many other jurisdictions. The assessors were 

advised that the limit has become largely irrelevant and is in need of review; the OCC 

provided information that initial capital in a range of $10-20 million is more typical for 

smaller de novo banks. 

EC7 The licensing authority, at authorization, evaluates the bank’s proposed Board members and 

senior management as to expertise and integrity (fit and proper test), and any potential for 

conflicts of interest. The fit and proper criteria include: (i) skills and experience in relevant 

financial operations commensurate with the intended activities of the bank; and (ii) no 

record of criminal activities or adverse regulatory judgments that make a person unfit to 

uphold important positions in a bank.30 The licensing authority determines whether the 

bank’s Board has collective sound knowledge of the material activities the bank intends to 

pursue, and the associated risks. 

Description and 

findings re EC7 

The FBAs, as applicable, evaluate proposed directors and senior management with respect 

to expertise, integrity and any potential for conflicts of interest. The OCC, for example, 

generally considers each individual’s: (a) financial institution and other business experience; 

(b) duties and responsibilities with respect to the proposed bank and, if applicable, holding 

companies and affiliates; (c) personal and professional financial responsibility, e.g., indicated 

by earlier professional experiences; (d) reputation for honesty and integrity, e.g., verified by 

(lack of) criminal convictions; and (e) familiarity with the economy, financial needs and 

 

30 Please refer to Principle 14, Essential Criterion 8.
UNITED STATES 

INTERNATIONAL MONETARY FUND 47

general character of the community in which the bank will operate. Applicants must 

demonstrate that each prospective director has sufficient competence, experience and ability 

to direct the policies of the bank in a safe and sound manner, taking into account the 

circumstances and plans of the organization. Officers must show their ability to perform their 

proposed duties successfully, e.g., in interviews with licensing staff. The assessors saw ample 

evidence of this evaluation process. 

EC8 The licensing authority reviews the proposed strategic and operating plans of the bank. This 

includes determining that an appropriate system of corporate governance, risk management 

and internal controls, including those related to the detection and prevention of criminal 

activities, as well as the oversight of proposed outsourced functions, will be in place. The 

operational structure is required to reflect the scope and degree of sophistication of the 

proposed activities of the bank.31

Description and 

findings re EC8 

Applicants must show that the proposed business plan is viable and that the proposed 

management team has the ability to implement the plan successfully. The plan generally 

must: (a) establish the bank’s ability to achieve a reasonable market share; (b) show that the 

bank has reasonable earnings prospects and the ability to attract and maintain adequate 

capital; (c) demonstrate that management is knowledgeable of and has plans for serving the 

community’s needs; and (d) be supported by adequate policies, procedures and 

management expertise so that the bank can be operated in a safe and sound manner. 

Typically, applicants must provide a documented analysis of the market environment and 

realistic financial projections based on reasonable assumptions related to interest rates, 

growth, expenses and potential losses. 

To evaluate corporate governance structures, the licensing authorities seek to understand 

the board’s involvement in setting and enforcing clear lines of responsibility and 

accountability by reviewing organizational charts, business plans and proposed policies and 

procedures. The agencies specifically determine how a bank’s board will approve, oversee 

and communicate the bank’s strategic objectives and otherwise exercise its fiduciary 

responsibilities. Board members are expected to exercise the duties of loyalty and care, 

which require them to act as prudent and diligent business persons in conducting the affairs 

of the bank. 

The agencies also consider the relationship between the proposed bank (its affiliates and 

holding company, if applicable) and any related parties. This includes evaluating potential 

conflicts of interest, terms and conditions of any transactions, contracts or business 

relationships, and the terms of compensation plans. 

With respect to risk-management systems and policies, applicants must develop appropriate 

written investment, loan, funds management and liquidity policies. They must also establish 

an acceptable internal control structure and audit program, including policies and 

procedures necessary to prevent the bank from being used for criminal purposes (including 

money laundering and terrorist financing) and for exercising appropriate oversight over 

outsourced functions. The operational structure and risk-management framework are 

expected to be consistent with the complexity, risk and scope of proposed operations. Plans 

that involve high-risk lending, a special purpose market or significant funding from sources 

other than core deposits, or that otherwise diverge from conventional bank-related financial 

services, require specific documentation as to the suitability of the proposed activities for a 

 

31 Please refer to Principle 29. 
UNITED STATES 

48 INTERNATIONAL MONETARY FUND

bank. Similarly, additional documentation is required where markets to be entered are 

intensely competitive or economic conditions are marginal. 

As noted above, supervisory material provided to the assessors confirmed that the 

evaluation processes of the agencies were detailed, probing and comprehensive, and 

incorporated a range of financial information as well as thoughtful supervisory judgment. 

EC9 The licensing authority reviews pro forma financial statements and projections of the 

proposed bank. This includes an assessment of the adequacy of the financial strength to 

support the proposed strategic plan as well as financial information on the principal 

shareholders of the bank. 

Description and 

findings re EC9 

The OCC evaluates the inherent risks of the applicant’s business model and reasonableness 

of the financial projections as a critical element of the licensing process. Also critical is an 

assessment of the adequacy of financial strength, including capital levels, to support the 

proposed strategic plan. Estimates must be fully documented, supported and based on 

established growth patterns in the applicant’s specific market area. The OCC also evaluates 

concentrations of funding sources for safety and soundness concerns and determine 

whether contingency funding plans are adequate for the bank’s complexity and risk profile. 

With respect to asset growth projections, the OCC generally reviews the nature and risk 

profile of the asset mix, identify high-risk asset concentrations and consider whether riskmanagement systems and policies sufficiently measure, identify, and control risks. 

Depending on the risk profile of the assets contemplated, the OCC may require stress tests 

to show that the bank can maintain required minimum capital ratios and adequate 

profitability under adverse market conditions. Applicants must demonstrate that the 

proposed bank can achieve stabilized operations and generate an adequate profit within a 

reasonable period of time (typically, three years). 

EC10 In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the 

host supervisor establishes that no objection (or a statement of no objection) from the home 

supervisor has been received. For cross-border banking operations in its country, the host 

supervisor determines whether the home supervisor practices global consolidated 

supervision. 

Description and 

findings re EC10 

Foreign banks establishing a branch, agency or a subsidiary bank in the U.S. must obtain 

approval both from the licensing authority (the OCC or a state licensing authority) and from 

the Federal Reserve. The licensing authority may, and the Federal Reserve generally must, 

determine that the foreign bank, and any parent foreign bank, is subject to comprehensive 

and consolidated supervision by its home country supervisor. The licensing authority and the 

Federal Reserve also assess the extent, if at all, to which home country supervisors oversee or 

monitor any operations between a foreign bank and any foreign nonbank parent. The 

adequacy of home country supervision is evaluated at authorization and as part of ongoing 

supervision. The licensing authority and the Federal Reserve routinely contact the home 

country supervisor during the application process and, in making a decision on an 

application, take into account whether the home country supervisor has approved (or 

expressed no objection) to the proposal. See 12 CFR 28.12(b)(6) (OCC). The assessors saw 

evidence of this process. A foreign entity that is not a BHC must obtain Federal Reserve 

approval before establishing or acquiring a subsidiary savings association in the U.S. If the 

foreign entity is a foreign bank, the Federal Reserve must determine that the foreign bank 

and any foreign bank parent are subject to comprehensive and consolidated supervision by 

the home country supervisor. 

EC11 The licensing authority or supervisor has policies and processes to monitor the progress of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 49

new entrants in meeting their business and strategic goals, and to determine that 

supervisory requirements outlined in the license approval are being met. 

Description and 

findings re EC11 

The FBAs monitor the progress of de novo institutions in meeting their business plans and 

underlying strategic objectives. These reviews also include consideration of whether the 

banks have complied with any other conditions imposed as part of licensing. After the de 

novo period, changes in a bank’s activities, if permissible under state and federal law, are 

subject to review during periodic safety-and-soundness examinations. In addition, de novo 

banks are required to give the FDIC prior notice of any change to the bank’s business plan 

during the first three years of operation. As a condition of deposit insurance, the FDIC 

requires de novo state nonmember banks to submit pro forma financial statements and a 

business plan for operating years four through seven or longer, if deemed appropriate, 

before the end of the bank’s third year of operation. The FDIC monitors compliance with 

such plans during the annual examination process and requires prior non-objection for any 

material deviations from or material changes to the plan. 

Based on experience in the financial crisis, when a number of de novo banks failed in their 

fourth to eighth years, the FDIC has stepped up the intensity of its supervision of de novo 

banks and, as noted in EC 6, has extended the period of application of the minimum 

leverage ratio of 8 percent. 

Assessment of 

Principle 5

Compliant 

Comments Under the U.S. dual banking structure, banks may in principle choose to operate under a 

federal or state charter that best accommodates their business or strategic needs, although 

all banks will have a primary Federal supervisor. State-chartered banks may choose between 

supervision by the FDIC or by the Federal Reserve as a member bank, in addition to the 

supervision of their state supervisory authority. The evaluation processes for banks seeking a 

national charter and access to the deposit insurance fund appear thorough and testing. The 

assessors did not review the parallel evaluation processes of state supervisory authorities, 

which were out of scope for this assessment. 

Concerns have been raised, including in the U.S. Treasury White Paper on Financial 

Regulatory Reform (2009), that the choice of supervisor available to banks can give rise to 

“regime shopping” that can undermine the integrity of U.S. regulatory arrangements. The 

financial crisis highlighted egregious examples. Since the crisis, the authorities have taken 

steps to reduce banks’ incentives for inappropriate charter conversions. In 2009, the FFIEC 

“Statement on Regulatory Conversions” addressed proposed conversions by institutions with 

less than satisfactory ratings (a CAMELS rating of 3, 4 or 5) or that have a material corrective 

action program in place or being contemplated, as well as those subject to serious or 

material enforcement actions. Such conversion applications require consultation with the 

FDIC and Federal Reserve (in the event of a holding company); in practice, the FBAs will not 

accept conversions involving a 4 or 5 rated institution. Key aspects of the FFIEC Statement 

were given statutory force by the DFA, which also resulted in the dissolution of the OTS. 

Section 612 of that Act generally prohibits charter conversions, in either direction, while the 

institution concerned is subject to any formal enforcement actions that involve a significant 

supervisory matter. Exceptions to this conversion prohibition are possible in certain defined 

circumstances, which are expected to be rare. The FFIEC Statement remains in place, since it 

covers a broader range of circumstances than section 612. 

A large number of (well-rated) banks and savings associations currently fall outside the 

scope of these conversion restrictions and there has been a steady stream of charter 

conversions in both directions, although the numbers are not large in absolute terms. The 
UNITED STATES 

50 INTERNATIONAL MONETARY FUND

FBAs have explained to the assessors that state banks generally convert to federal charters if 

they have national ambitions, while national banks and savings associations converting to 

state charters generally claim that state supervisory authorities are more attuned to local 

economic conditions and the needs of smaller community banking organizations. The FBAs 

explained to the assessors that charter conversions that fall outside the scope of the FFIEC 

Statement are generally subject to handover “protocols” that would discourage 

inappropriate regime shopping. The assessors see merit in incorporating these protocols in 

the FFIEC Statement. 

The choices made by banking organizations between the three FBAs can, over time, have 

important implications for the staffing and sustainability of regional offices. The FBAs need 

to guard against creating perceptions of differences in supervisory style or intensity in these 

offices that could sway the choices made by banks on charter conversions. 

Principle 6 Transfer of significant ownership. The supervisor32 has the power to review, reject and 

impose prudential conditions on any proposals to transfer significant ownership or 

controlling interests held directly or indirectly in existing banks to other parties. 

Essential criteria 

EC1 Laws or regulations contain clear definitions of “significant ownership” and “controlling 

interest”. 

Description and 

findings re EC1 

Federal statutes and their implementing regulations define controlling interest but not 

significant ownership. They address proposed changes in ownership, control, or structure of 

banks. In general, prior authorization by the appropriate FBA is required for any person to 

acquire “control” of a bank. “Control” for this purpose is defined as “the power, directly or 

indirectly, to direct the management or policies of an insured depository institution or to 

vote 25 per cent or more of any class of voting securities of an insured depository 

institution.” See The Change in Bank Control Act (CIBC Act) 12 U.S.C. §1817(j)(8)(B). Under 

limited circumstances a presumption of control arises when a person would own, control, or 

hold the power to vote 10 percent or more of any class of voting securities. In certain cases, 

a five percent voting share may be assessed as “a rebuttable threshold” for deeming a 

person to having control. A “person” for purposes of the CIBC Act includes an individual, a 

group of individuals acting in concert, or certain entities (e.g. corporations, partnerships, and 

trusts) that own shares of banks but that do not qualify as bank holding companies. 

Further, prior authorization of the Federal Reserve is generally required under the Bank 

Holding Company Act (BHC Act), 12 U.S.C. § 1842(a), for a company that is subject to the 

BHC Act to directly or indirectly acquire control of a bank or BHC. “Control” for this purpose 

generally includes direct or indirect ownership, control, or the power to vote 25 percent or 

more of any class of voting securities of a bank or BHC. “Control” is further defined to 

include (a) control over the election of a majority of directors or persons exercising similar 

functions; or (b) the power to exercise directly or indirectly a controlling influence over the 

management or policies of the bank or BHC (see 12 CFR 225.2(e)(1)). For existing BHCs, 

Federal Reserve authorization is required before the BHC can acquire, directly or indirectly, 5 

percent or more of any class of voting shares of another bank (see 12 U.S.C. § 1842(a)(3)). 

The Federal Reserve generally is required to consult with the state banking agency and/or 

the OCC (as appropriate) in processing the request for authorization (see 12 U.S.C. § 

 

32 While the term “supervisor” is used throughout Principle 6, the Committee recognizes that in a few countries these 

issues might be addressed by a separate licensing authority.
UNITED STATES 

INTERNATIONAL MONETARY FUND 51

1842(b)(1)). By statute, the Federal Reserve cannot approve a BHC application under certain 

enumerated circumstances (see 12 U.S.C. § 1842(c) and 12 CFR 225.13). 

Prior authorization of the Federal Reserve is required under the Home Owners’ Loan Act 

(HOLA), 12 U.S.C. § 1467a (e), for a company directly or indirectly to acquire control of a 

savings association or savings and loan holding company (SLHC). The definition of “control” 

under the HOLA is similar to the BHC Act definition of control. Approval criteria for SLHC 

applications are similar to the approval criteria for BHC Act applications, and by statute the 

Federal Reserve cannot approve a SLHC application under certain circumstances (see 12 

U.S.C. § 1467a (e) (2)). See EC3 for a more detailed account of the conditions for 

approval/denial. In addition, subject to statutorily enumerated exceptions, Federal Reserve 

approval is required before an SLHC can acquire, directly or indirectly, more than 5 percent 

of a class of voting securities of another savings association or SLHC (see 12 U.S.C. § 1467a 

(e) (1) (A) (iii)). 

As noted above, there is a clear definition of the concept of “control”. However, there is no 

definition or use of the concept “significant ownership”. That said, there is a threshold for the 

bank to annually report to the supervisors all shareholders having five percent or more of 

the total votes. Additionally, Federal Reserve approval is required for SHLC acquisitions 

exceeding five percent of a class of voting securities of another savings association of SHLC. 

This may be interpreted as a measure of “significant ownership”. 

EC2 There are requirements to obtain supervisory approval or provide immediate notification of 

proposed changes that would result in a change in ownership, including beneficial 

ownership, or the exercise of voting rights over a particular threshold or change in 

controlling interest. 

Description and 

findings re EC2 

The U.S. FBAs have statutory authority under the CIBC Act, 12 U.S.C. § 1817(j), to review, 

reject, and impose conditions on proposals involving significant changes in ownership or 

control of banks. As noted above, prior authorization by the appropriate federal banking 

agency is generally required for any person to acquire “control” of a bank or BHC. 

The implementing regulations for the CIBC Act, the BHC Act, and the HOLA set forth 

procedures that must be followed to effect a change in ownership (including beneficial 

ownership), the exercise of voting rights over a particular threshold, or control of a bank or 

holding company. Submission of a prior notice under the CIBC Act is normally required, but 

the CIBC Act exempts various categories of transactions from this requirement (including 

some grandfathering of control existing before 1979) or requires a 90-days after-the-fact 

notice for other categories of transactions (this applies for instance to “unexpected 

transactions” such as gifts, changes in other persons’ shareholdings etcetera) . 

Similarly, the Federal Reserve’s regulations provide for the filing of either an application or 

prior notice with respect to a company’s acquisition of a bank, identify a limited set of 

transactions not requiring agency approval, and allow for a waiver of filing requirements 

under certain circumstances (see 12 CFR part 225.12). OCC regulations pertaining to 

application requirements and procedures are found at 12 CFR 5.33 (national banks) and 12 

CFR 163.22 (federal savings associations). 

EC3 The supervisor has the power to reject any proposal for a change in significant ownership, 

including beneficial ownership, or controlling interest, or prevent the exercise of voting 

rights in respect of such investments to ensure that any change in significant ownership 

meets criteria comparable to those used for licensing banks. If the supervisor determines 

that the change in significant ownership was based on false information, the supervisor has 

the power to reject, modify or reverse the change in significant ownership. 
UNITED STATES 

52 INTERNATIONAL MONETARY FUND

Description and 

findings re EC3 

The FBAs have the power to reject a proposal for a change in ownership. In general, the 

factors considered with respect to proposed changes in significant ownership, including 

beneficial ownership, or control of banks are comparable to those used in approving new 

banks. For example, the agencies evaluate change in control notices based on the statutory 

factors enumerated in section 7(j) of the Federal Deposit Insurance Act (FDIA). These factors 

include whether the proposal would result in a monopoly; whether the effect of the proposal 

in any section of the country may be to substantially lessen competition, or in any other 

manner be in restraint of trade; the financial condition of the acquiring party and its 

potential impact on the bank or depositors; the competence, experience or integrity of any 

acquiring person or proposed management; whether any acquiring party neglects, fails, or 

refuses to furnish information required by the appropriate federal banking agency; and the 

effect on the Deposit Insurance Fund. 

Criteria vary under the other applicable statutes, such as the Bank Merger Act, CIBC, BHC Act, 

and Home Owners’ Loan Act, but the relevant federal bank agency generally considers (a) 

the financial condition and integrity of the ownership group; (b) the competence, experience, 

and integrity of management; (c) the future prospects of the resulting entity; (d) business 

plans of the resulting entity; (e) the impact of the proposal on the safety and soundness of 

the resulting entity; (f) the convenience and needs of the community(ies) to be served; and 

(g) the impact of the proposal on financial stability In addition, the FBAs generally also 

consider the competitive effects of the proposal, along with compliance with applicable 

consumer protection and anti-money laundering statutes, and activities covered by the CRA. 

A request for authorization under any of these applicable statutes may be denied on any of 

the grounds considered, or an agency may impose conditions on authorization limiting an 

acquirer’s exercise of voting rights. 

If a change in significant ownership was based on false information, the FBAs have various 

powers to impose penalties and affirmative requirements, potentially including divestiture of 

ownership. See e.g., 12 U.S.C. § 1818(b)(6) (authority to require appropriate affirmative action 

due to a violation of law or regulation); see also 12 U.S.C. § 1817(j)(15)(B)(ii) (authority to 

seek relief necessary to prevent violation of the CIBC Act, including divestiture). 

EC4 The supervisor obtains from banks, through periodic reporting or on-site examinations, the 

names and holdings of all significant shareholders or those that exert controlling influence, 

including the identities of beneficial owners of shares being held by nominees, custodians 

and through vehicles that might be used to disguise ownership. 

Description and 

findings re EC4 

The agencies obtain from banks and holding companies through annual reporting and/or 

on-site examinations, the names of all significant shareholders, including those that may 

exert a controlling influence, and the identities of beneficial owners. The Federal Reserve, for 

example, requires the annual submission of the identities of those shareholders who own or 

control 5 percent or more of a class of voting shares of a bank or BHC. (The other FBAs apply 

corresponding rules to savings banks and SHLCs). On-site or off-site examinations will 

periodically include review of the ownership of significant shareholders. 

EC5 The supervisor has the power to take appropriate action to modify, reverse or otherwise 

address a change of control that has taken place without the necessary notification to or 

approval from the supervisor. 

Description and 

findings re EC5 

The agencies require after-the-fact requests for authorization for changes in control made 

without necessary notice to, or approval of, the agencies. In evaluating such requests, the 

agencies consider whether the failure to request authorization in the first instance was a 

knowing violation of the law. (Such a violation could result in the imposition of civil 

monetary penalties against participants and sanctions against any “institution-affiliated 
UNITED STATES 

INTERNATIONAL MONETARY FUND 53

party” up to, and including, debarment.) The agencies also consider whether appropriate 

policies and procedures have been put in place to ensure that further violations do not 

occur. The agencies have the authority to deny or condition an after-the-fact request for 

authorization. For instance, they may bar the shareholder from voting or from appointing 

directors in the bank. Ultimately, they may require that the stockholding be divested. 

EC6 Laws or regulations or the supervisor require banks to notify the supervisor as soon as 

they become aware of any material information which may negatively affect the 

suitability of a major shareholder or a party that has a controlling interest. 

Description and 

findings re EC6 

Although there is no explicit regulatory requirement, the agencies expect (on general 

grounds such as the safety and soundness prerequisites) controlling shareholders, or the 

bank with which they are affiliated, to provide the agencies with timely notice of any material 

information that would impact the shareholders’ continued suitability. 

Assessment of 

principle 6 

Compliant 

Comments The FBAs have comprehensive definitions for “controlling interest”, taking into account both 

quantitative and qualitative factors of control. There are clear rules for prior approval or 

notifications of changes in ownership. Supervisors may deny improper changes in ownership 

and may in certain circumstances require the reversal of completed transactions or require 

other remedial actions. The assessors saw evidence of supervisors taking such actions. 

The concept of “significant ownership” is not defined per se. However, in practice the 

international practice of a five percent threshold for the reporting of significant shareholders 

is applied. The assessors saw evidence, including supervisors’ responses to applications for 

ownership changes, that the above rules and policies are applied in practice. 

There is no explicit regulatory requirement for a bank to immediately report if they find that 

a major shareholder is no longer suitable. Nor did the assessors see any evidence of such 

reporting in the written documentation. The assessors recommend that such a supervisory 

requirement is introduced, with the aim to ensure that supervisors are promptly informed if 

a major shareholder is no longer suitable, since this might have a negative impact on the 

safety and soundness of the bank. Assessors chose to address this shortcoming under CP 9. 

Principle 7 Major acquisitions. The supervisor has the power to approve or reject (or recommend to 

the responsible authority the approval or rejection of), and impose prudential conditions on,

major acquisitions or investments by a bank, against prescribed criteria, including the 

establishment of cross-border operations, and to determine that corporate affiliations or 

structures do not expose the bank to undue risks or hinder effective supervision. 

Essential criteria 

EC1 Laws or regulations clearly define: 

(a) what types and amounts (absolute and/or in relation to a bank’s capital) of 

acquisitions and investments need prior supervisory approval; and 

(b) cases for which notification after the acquisition or investment is sufficient. Such 

cases are primarily activities closely related to banking and where the investment 

is small relative to the bank’s capital. 

Description and 

findings re EC1 

Federal and state laws limit and define the types of acquisitions or investments banks may 

make. For banks, the permissible activities and investments are set forth in the statutes 

discussed under Principle 4 and the agencies’ implementing regulations. The agencies have 
UNITED STATES 

54 INTERNATIONAL MONETARY FUND

established regulatory criteria for prior approval of major acquisitions or investments of 

banks. Although not every investment or acquisition must be approved in advance by the 

regulatory authorities, procedural criteria have been designed to allow the banking 

supervisors to review acquisitions or investments that could have a significant effect on a 

bank’s condition (e.g., mergers and acquisitions of subsidiaries). See summary table33 below.

Under the Federal Reserve’s Regulation K (12 CFR part 211), foreign investments by member 

banks may be made under general consent, prior notice, or application procedures. In 

general, prior approval is necessary for new or large investments, while post-notice is 

sufficient for smaller investments. However, “well capitalized and well managed” FHCs are 

allowed to execute a wider range of acquisitions and investments on a general consent basis. 

(12 CFR 211.9) Similarly, the FDIC’s International Banking regulations (12 CFR part 347) 

authorize state nonmember banks to make foreign investments under general consent or 

with prior approval after the filing of an application. The regulations set forth criteria for 

determining the appropriate procedure in 12 CFR 347.117, 347.118, and 347.119. Under 12 

CFR 28.3, national banks acquiring an interest in an Edge or agreement corporation, foreign 

bank, or other foreign organization must provide notice to the OCC. 

 The OCC’s regulations for federal savings associations on Lending and Investment, 12 CFR 

part 160 (in particular 160.36), and Subordinate Organizations, 12 CFR part 159 apply to both 

domestic and foreign activities and investments. CFR 12 CFR 24.4 and 24.5 requires that 

OCC approves a written request for investments exceeding in aggregate 5 percent of the 

acquiring institution’s capital and surplus. The BHC Act and section 10 of the HOL Act set 

forth the permissible activities of BHCs and SLHCs, respectively (see 12 U.S.C. §§ 1843(c) and 

1843(k) and 12 U.S.C. § 1467a(c)). The Federal Reserve’s SLHC regulation applies to both 

domestic and foreign activities and investments. For both BHCs and SLHCs, there are clear 

regulatory directions as to when an application for prior supervisory approval is necessary or 

when post-notice is sufficient for an acquisition. 

Nationally chartered banks may only acquire minority stakes (i.e. a minority in the 

investment target) in non-bank activities. Furthermore, these must be related to banking, 

such as investments in service corporations. 

Prior Notice Prior 

Approval

General 

Consent

Post Notice FDIC 

Statutory 

Approval

All Bank Holding

Companies

Investments 

abroad above 

a specific

dollar amount 

or amount of 

capital 

Acquisition 

of a bank or 

thrift

Purchase of 

more than 

5% of a bank

New nonbanking 

activities.

Purchase of 

more than 

5% of a 

non-bank

company

Investments 

abroad below

a specific

dollar amount

or amount of 

capital 

Acquisition 

of an 

uninsured 

entity that

takes 

deposits by 

an insured 

depository

institution

 

33 The FBAs noted the major acquisitions framework is too complex to be adequately reflected in a table. This 

summary table is therefore not exhaustive and only highlights main points required by this EC. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 55

Well Capitalized and 

Well managed BHC 

and FHC

Investments 

abroad above 

a specific

dollar amount 

of capital

Acquisition 

of a bank or 

thrift 

Investments 

abroad below 

a specific

amount of 

capital

Reporting of 

acquisitions 

of nonbank

companies 

BHC and FHC above 

$50bn of assets

As above As above

Plus 

acquisition if 

any shares in

a financial 

company 

greater than 

$10bn

Acquisitions 

that do not 

give rise to

financial 

stability 

concerns

All National Banks New activities 

that are 

permissible

banking 

activities

Minority 

interests 

where there 

is an exit

strategy

Mergers with

other banks

New 

Branches

 

EC2 Laws or regulations provide criteria by which to judge individual proposals 

Description and 

findings re EC2 

Implementing regulations specify the criteria by which individual proposals are to be 

evaluated. In some instances, these criteria also are specified by statute, which may include 

the Bank Merger Act, CIBC Act, BHC Act, and HOL Act. Factors considered in reviewing such 

proposals generally include competitive concerns, financial and managerial resources, future 

prospects of the resultant bank, the convenience and needs of the community to be served, 

CRA compliance, anti-money laundering compliance, the impact of the proposal on the risk 

to the stability of the U.S. banking or financial system, and compliance with consumer 

protection statutes (see e.g., 12 U.S.C. 1828(c)(5); 12 CFR 5.33(e)). 

Where acquisitions by a holding company of a bank require agency approval, applicable 

statutes and regulations provide review criteria. The FBAs expect that investments and 

foreign activities, whether conducted directly or indirectly, will be confined to activities of a 

banking or financial nature and those necessary to carry on such activities. At all times, 

investors must act in accordance with high standards of banking or financial prudence, with 

due regard for diversification of risks, suitable liquidity, and adequacy of capital. To be 

eligible to make foreign investments, the investor and its parent(s) must be in compliance 

with applicable minimum capital adequacy standards. In order to make investments under 

general consent authority, the investor and any insured parent bank must have received at 

least a composite rating of “satisfactory” at the most recent examination. 

EC3 Consistent with the licensing requirements, among the objective criteria that the 

supervisor uses is that any new acquisitions and investments do not expose the bank to 

undue risks or hinder effective supervision. The supervisor also determines, where 
UNITED STATES 

56 INTERNATIONAL MONETARY FUND

appropriate, that these new acquisitions and investments will not hinder effective 

implementation of corrective measures in the future.34 The supervisor can prohibit 

banks from making major acquisitions/investments (including the establishment of 

cross-border banking operations) in countries with laws or regulations prohibiting 

information flows deemed necessary for adequate consolidated supervision. The 

supervisor takes into consideration the effectiveness of supervision in the host country 

and its own ability to exercise supervision on a consolidated basis. 

Description and 

findings re EC3 

In all instances in which a notice or application is required for a proposed acquisition or 

investment, the agencies assess whether the acquisition or investment would expose a bank 

to undue risk or would hinder effective supervision. Such assessment would include analysis 

of the host country supervision. When evaluating proposals by organizations to establish 

foreign operations (including an office or subsidiary), the FBAs require the applicants to 

show, and the FBAs must determine, that the laws or regulations of the foreign jurisdiction 

would not prohibit the FBAs from obtaining information needed to determine and enforce 

compliance with U.S. banking regulations. 

The FBAs have the authority to deny a request for authorization if they determine that they 

would not be able to obtain adequate information for the exercise of consolidated 

supervision. See Principles 12 and 13 for further information and 12 CFR part 28, subpart A 

and 12 CFR 211.13(a)(3). 

EC4 The supervisor determines that the bank has, from the outset, adequate financial, 

managerial and organizational resources to handle the acquisition/investment. 

Description and 

findings re EC4 

For those proposals requiring authorization, the FBAs consider whether the bank or holding 

company has the financial, managerial and organizational resources to support the 

acquisition or investment. See, e.g., 12 U.S.C. 1828(c)(5) and 1842(c); 12 CFR 5.33(e); 12 CFR 

225.13. This evaluation includes, but is not limited to, an assessment of the amount and 

source of initial funding, the resulting capital condition of the acquirer, the impact of the 

acquisition on the examination ratings of the acquirer, and the policies and procedures to be 

implemented at the target (including compliance with BSA/AML requirements). A three-year 

projection of the financial impact of the acquisition on the acquiring institution is required. 

For examples, see OCC’s Licensing Manual: Business Combinations; Investment in 

Subsidiaries and Equities, Subordinate Organizations, and Combination with a National or 

State Bank booklets. 

For those proposals not requiring authorization, the supervisors will typically be informed of 

investments/acquisitions through its off-site monitoring and on-site examinations. 

Supervisors will then, as warranted, assess the impact of the investments/acquisitions on the 

bank and holding company. 

EC5 The supervisor is aware of the risks that non-banking activities can pose to a banking 

group and has the means to take action to mitigate those risks. The supervisor 

considers the ability of the bank to manage these risks prior to permitting investment in 

non-banking activities. 

Description and Significant nonbanking activities must be approved in advance by the applicable FBAs. See, 

e.g., OCC’s Licensing Manual: Investment in Subsidiaries and Equities and Subordinate 

 

34 In the case of major acquisitions, this determination may take into account whether the acquisition or investment 

creates obstacles to the orderly resolution of the bank.
UNITED STATES 

INTERNATIONAL MONETARY FUND 57

findings re EC5 Organizations booklets. The Federal Reserve is responsible for approving the establishment 

of BHCs, SLHCs, and their nonbank subsidiaries, and examines the activities of BHCs and 

SLHCs on a consolidated basis. Any investment in nonbanking activities by a BHC or SHLC 

requires prior approval by the Federal Reserve. Well capitalized and well managed FHCs may, 

however, make such investments and notify after-the-fact. There are statutory provisions 

designed to protect a bank from suffering losses in transactions with affiliates. For instance, 

lending from the bank to another affiliate of the group may not exceed 10 percent of the 

bank’s capital and the aggregate lending to all other affiliates may not exceed 20 percent. 

During examinations, supervisors regularly review transactions between the bank and its 

affiliates to determine compliance with such provisions. If there are transactions that pose 

safety and soundness concerns for the bank, federal supervisors can take actions to ensure 

that corrective action is taken and that the bank is protected. The FBAs consider the ability of 

the organization to manage the risks associated with the activities as part of the approval 

process. See, e.g., 12 U.S.C. § 1843; 12 CFR 225.26. 

Additional 

criteria 

AC1 The supervisor reviews major acquisitions or investments by other entities in the 

banking group to determine that these do not expose the bank to any undue risks or 

hinder effective supervision. The supervisor also determines, where appropriate, that 

these new acquisitions and investments will not hinder effective implementation of 

corrective measures in the future.35 Where necessary, the supervisor is able to effectively 

address the risks to the bank arising from such acquisitions or investments.

Description and 

findings re AC1 

The FBAs review acquisitions within the banking group, as described above. See Principle 7, 

EC 1. Direct or indirect investments by banks in entities engaged in nonbanking activities 

would be subject to approval by the appropriate federal supervisor. See 12 CFR 5.39 

(financial subsidiaries of national banks), 12 CFR part 208 subpart G (financial subsidiaries of 

state member banks), and 12 CFR part 362 (financial subsidiaries of state nonmember 

banks). Other direct or indirect investments by a BHC or SLHC would be subject to review by 

the Federal Reserve. See 12 CFR part 211 subpart A; 12 CFR part 225 subparts C and I 

(nonbank investments by BHCs); 12 CFR part 238 subparts F and G (nonbank investments by 

SLHCs). Major acquisitions would be subject to prior approval requirements, while other 

investments may qualify for limited or post-notice. To the extent that an acquisition was 

approved, but raised significant potential issues, the approving agency could impose 

conditions on its approval to mitigate any concerns. Assessors have reviewed files that 

included acquisitions by the broader group. 

Assessment of 

Principle 7 

Compliant 

Comments Laws and regulations exist to define which acquisitions and investments that require prior 

approval by the authorities, a notification after-the-fact or may be made under general 

consent. There are also clear criteria by which the authorities assess the applications. 

Legislation and regulations also put clear restrictions on the scope of permissible 

investments and acquisitions, such as in non-bank related activities. 

Assessors saw evidence, including supervisors’ reports on banks’ applications for 

 

35 Please refer to Footnote 33 under Principle 7, Essential Criterion 3 
UNITED STATES 

58 INTERNATIONAL MONETARY FUND

investments/acquisitions, that the above rules and policies are applied in practice. 

Principle 8 Supervisory approach. An effective system of banking supervision requires the supervisor 

to develop and maintain a forward-looking assessment of the risk profile of individual banks 

and banking groups, proportionate to their systemic importance; identify, assess and 

address risks emanating from banks and the banking system as a whole; have a framework 

in place for early intervention; and have plans in place, in partnership with other relevant 

authorities, to take action to resolve banks in an orderly manner if they become non-viable. 

Essential criteria 

EC1 The supervisor uses a methodology for determining and assessing on an on-going basis the 

nature, impact and scope of the risks: 

(a) which banks or banking groups are exposed to, including risks posed by entities in the 

wider group; and 

(b) which banks or banking groups present to the safety and soundness of the banking 

system 

The methodology addresses, among other things, the business focus, group structure, risk 

profile, internal control environment and the resolvability of banks, and permits relevant 

comparisons between banks. The frequency and intensity of supervision of banks and 

banking groups reflect the outcome of this analysis. 

Description and 

findings re EC1 

All Banks 

The U.S. firmly adopts a risk-based approach to supervision. This is both in terms of its focus 

on risk within banks, but also adjusting that approach in proportion to the risk banks pose to 

the system. The supervisory process is highly structured with a high proportion of mandated 

reviews, a uniform rating process and an extensive planning process that agrees the 

supervisory strategy going forward. U.S. regulators have a statutory responsibility to ensure 

and evaluate safety and soundness. The multiple regulators also look at different aspects of 

banking groups and their structure – for example Federal Reserve looking at Bank Holding 

Companies and OCC looking at banks. 

During each supervisory cycle, the supervisors formally assess the risk profile of each bank 

and holding company in order to determine the supervisory strategy to be followed by 

examination staff and prioritization of agency resources. Risk assessments are updated on a 

regular basis through off-site monitoring programs and on-site examinations. These risk 

assessments use a common framework that promote and facilitate comparisons across 

banking organizations. Supervisors maintain continuous off-site monitoring programs to 

determine and assess on an on-going basis the nature, importance, and scope of risks to 

which banks and holding companies are exposed. These programs draw on financial data, 

prior supervisory assessments, regulatory reports specifying changes in activities, and other 

internal and publicly available sources of information to identify banks and holding 

companies requiring a heightened supervisory focus. Banks and holding companies showing 

signs of significant deterioration or making significant changes in their business focus may 

be subject to immediate on-site or targeted examination under policies and procedures 

maintained by the banking agencies. The adequacy of internal controls is evaluated during 

on-site or targeted examinations and is also taken into consideration when determining the 

need for additional supervisory work. In addition, the banking agencies collect information 

on the scope of each bank’s and holding company’s external audit to help to gauge the 

quality of internal controls, and require audited financial statements and additional reporting 

on the quality of internal controls for banks and holding companies of significant size (banks 
UNITED STATES 

INTERNATIONAL MONETARY FUND 59

exceeding a minimum asset threshold of $500 million). 

The Federal Reserve uses a ratings system known as RFI to assign supervisory ratings for 

Bank Holding Companies on a consolidated basis. The R rating component provides a 

framework for assessing and assigning risk ratings across Bank Holding Companies. In 

addition, all the agencies’ Uniform Bank Performance Report allows supervisors and 

supervisory staff to compare financial trends across groups of peer banks to identify outlier 

or high-risk banks. The agencies also use a common Uniform Financial Institution Rating 

System (UFIRS), known as CAMELS, that provides a consistent methodology and terminology 

for assessing and assigning risk ratings across banks. Similar uniform rating systems are used 

to assess holding companies, information technology, trust, and consumer compliance 

systems. The ROCA rating system is used for FBOs. Each agency has additional tools and 

systems, such as horizontal examinations of a group of banks that it uses to supplement 

these interagency tools. 

The Prompt Corrective Action (PCA) statute provides the agencies with authority to promptly 

resolve capital deficiencies at insured depository institutions, and thereby reduce bank 

failures. The PCA imposes mandatory and discretionary restrictions on an insured depository 

institution’s capital position to ensure a minimum level of capital is maintained or, in the 

absence of maintaining the minimum level of capital, requires the chartering government 

agency to close or seize the insured depository. 

 Generally the supervisors use a $10bn threshold as a key dividing point in the intensity of 

supervision—typically it is the point where supervisors carry out continuous assessment of 

firms usually supported by resident examination teams, rather than a periodic examination, 

which is based on a twelve-month cycle (or eighteen months in certain circumstances). 

Banking Institutions with at least $10bn of Assets 

Above the $10bn threshold, the supervisors typically adopt a process of continuous 

assessment. This will normally involve resident examination teams. 

Banking Institutions with at least $50bn of Assets 

The most intensive form of supervision is reserved for those institutions above $50bn. These 

firms will typically have the greatest level of resources devoted to their supervision. 

The U.S. supervisory approach was further broadened with a new supervisory program 

aimed at large, complex financial institutions. The Federal Reserve issued supervisory 

guidance in 2012 that builds upon the lessons learned from the financial crisis by 

strengthening both micro prudential supervision and regulation and macro prudential 

supervisory considerations to reduce potential threats to the financial system. This guidance 

supports a tailored approach that accounts for the unique risk characteristics of each firm. 

The guidance embodied in SR 12-17 covers core areas of supervisory focus. The guidance 

specifies the Federal Reserve’s expectations around two main areas: 1) enhancing the 

resiliency of a firm that includes guidance on capital and liquidity planning and positions; 

corporate governance; recovery planning; and management of core business lines, and 2) 

reducing the impact of a firm’s failure that includes guidance on management of critical 

operations; support for banking offices; resolution planning; and additional macro prudential 

supervisory approaches to address risk to financial stability. The guidance covers firms 

supervised by the Federal Reserve with consolidated assets of $50 billion or more (for Large 

FBOs with combined assets of U.S. operations of $50 billion or more). The supervisory 

guidance embodied in SR 12-17 does not apply to regional or community banking 

organizations—regional organizations with total consolidated assets less than $50 billion. 
UNITED STATES 

60 INTERNATIONAL MONETARY FUND

Additionally, under the DFA, systemically-significant bank holding companies or nonbank 

financial firms are required to submit periodic reports to the agencies providing the plan of 

the company for rapid and orderly resolution in the event of material financial distress or 

failure. The DFA also provides for the orderly liquidation of covered financial companies. 

Thus, the U.S. supervisory approach also includes a framework for early intervention and 

resolution of banking organizations if they become non-viable. 

Supervisors develop and maintain an understanding of the operations of individual banks 

and holding companies, to evaluate and ensure their safety and soundness and compliance 

with applicable laws and regulations, and to monitor the stability of the banking and 

financial system. Under the DFA, the agencies, in their capacity as FSOC members, are 

required to report annually and testify before the U.S. Congress on significant financial 

market and regulatory developments, potential emerging threats to financial stability, 

determinations of companies that pose a threat to financial stability in the U.S., and 

recommendations that the primary financial regulatory agencies apply new or heightened 

standards and safeguards for a financial activity. 

EC2 The supervisor has processes to understand the risk profile of banks and banking groups 

and employs a well defined methodology to establish a forward-looking view of the profile. 

The nature of the supervisory work on each bank is based on the results of this analysis. 

Description and 

findings re EC2 

All Banks 

U.S. FBAs carry out on-site reviews and off-site analyses to develop a thorough 

understanding of the risk profile of banks and holding companies. Under U.S. law, the 

agencies conduct full-scope on-site examinations of banks at least once every year (for 

banks that have assets of at least $500 million or that are not considered well-managed or 

well-capitalized) or 18 months (for banks that have assets of less than $500 million and that 

are considered well-managed and well-capitalized—CAMELS ratings of 1 or 2). BHC 

inspections are mandated on an annual or two year basis depending upon size, complexity, 

and rating, with smaller (less than $1 billion in assets) banks subject to off-site reviews. See 

CP9 for more on this. 

A full-scope examination addresses all key areas of a bank’s operations, including capital 

adequacy, asset quality, management strength and quality of oversight from the bank’s 

board of directors, compliance with laws and regulations, quality and sustainability of 

earnings, adequacy of liquidity sources to support on-going cash needs, and sensitivity of a 

banking organization’s earnings and capital position to market risk. 

The assessors did see evidence of supervisors employing a forward-looking perspective on 

their assessments—for example making assessments of the way credit risk and margins will 

migrate. 

Banking Institutions with at least $10bn of Assets 

For many larger banks and holding companies (typically those over $10bn of assets), full 

scope examinations/inspections consist of a series of targeted reviews during the 

examination cycle which culminate in a roll-up process where ratings are assigned based 

upon the results of these targets and the continuous monitoring activities. The requirements 

and mandates for these on-site activities can be found in the individual agencies’ 

examination manuals. Additionally, for many of the largest banks and holding companies, 

one or more of the banking agencies maintains a full-time, on-site examination staff to 

monitor the banking organizations’ condition and activities. 

During the period of time in between full-scope, on-site examinations, the agencies maintain 
UNITED STATES 

INTERNATIONAL MONETARY FUND 61

a thorough understanding of the bank’s and holding company’s risk profile. This is 

accomplished through the analysis of quarterly financial statements filed with their relevant 

agency and the review of regulatory reports that banks and holding companies must file to 

notify the agencies of changes in their activities and structure. Further, supervisors may 

request and review key management information reports including, but not limited to, 

internal audit information, and, in the case of publicly traded banks and holding companies, 

the consideration of market indices that may provide insight into the market’s assessment of 

the risk profile. These sources are supplemented by discussions with the banking 

organization’s management, meetings with its internal and external auditors, and, where no 

full-time on-site examination staff is maintained, on-site visits to maintain an up-to-date 

understanding of the financial condition. In addition, the agencies maintain various analytical 

tools that can help identify emerging risks or changes in the risk profile that may require 

specified follow-up steps. 

The CFPB has primary supervisory and enforcement authority with respect to certain federal 

consumer financial protection laws as applied to banking organizations with assets greater 

than $10 billion (and their affiliates), and it is responsible for confirming that these 

organizations appropriately manage their consumer compliance programs for these laws. 

The Federal Reserve, FDIC, and OCC have primary supervisory and enforcement authority 

with respect to (i) these same federal consumer financial protection laws as applied to 

banking organizations with assets of $10 billion or less and (ii) all other federal consumer 

financial protection laws. The agencies conduct regular Consumer Compliance examinations 

to confirm that the organization is appropriately managing its compliance risk and 

complying with U.S. consumer protection laws and regulations. 

The DFA also requires all financial institutions supervised by the Federal Reserve, FDIC, and 

OCC with total consolidated assets greater than $10 billion to conduct and submit results 

from regular company-run stress tests using supervisory-provided financial scenarios 

designed to help these institutions identify vulnerabilities. The FBAs issued the annual 

company-run stress testing rules for banks and savings associations in October of 2012. 

Interagency guidance on DFA stress testing for firms with total assets greater than $10 

billion but less than $50 billion was issued on March 13, 2014. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve issued a Capital Plan Rule in November 2011 that requires all U.S.-

domiciled, top-tier Bank Holding Companies with total consolidated assets of $50 billion or 

more to develop and maintain a capital plan supported by a robust process to assess capital 

adequacy. A guidance note explaining supervisory expectations and range of current 

practice was issued in August 2013 to support the rule. The preamble to the Capital Plan 

Rule outlines the elements on which the Federal Reserve evaluates the robustness of a BHC’s 

internal capital planning process, known as “CAP.” 

Stress testing is now an integral part of the U.S. supervisory approach. The Federal Reserve, 

OCC and FDIC, with respect to banks and savings associations under their supervision, have 

tailored expectations for institutions of different sizes, scope of operations, activities, and 

systemic importance. The FBAs have conducted stress-testing programs on the largest 

banking organizations, which have evolved since 2009 when the Supervisory Capital 

Assessment Program (SCAP) initiated the forward-looking assessment of risk for individual 

institutions. SCAP, which was applied to 19 institutions, which was followed by the annual 

Comprehensive Capital Assessment Review (CCAR), applicable to holding companies with 

total assets greater than $50 billion. The DFA also requires supervisory stress tests, 

conducted by the Federal Reserve, which are designed to assess the resiliency of banking 
UNITED STATES 

62 INTERNATIONAL MONETARY FUND

organizations’ capital positions under various baseline, adverse, and severely adverse 

supervisory-provided economic conditions. This program provides for the collection and 

analysis of a significant amount of granular institution-specific asset and liability data to 

better assess idiosyncratic and systemic risks to these firm’s capital positions. 

EC3 The supervisor assesses banks’ and banking groups’ compliance with prudential 

regulations and other legal requirements. 

Description and 

findings re EC3 

All Banks

Examinations address all key areas of a bank’s operations, including capital adequacy, asset 

quality, management strength and quality of oversight from the bank’s board of directors, 

compliance with laws and regulations, quality and sustainability of earnings, adequacy of 

liquidity sources to support on-going cash needs, and sensitivity of a banking organization’s 

earnings and capital position to market risk. 

During regular on-site examinations, the U.S. FBAs complete a series of testing procedures, 

contained in the agencies’ examination and inspection manuals, to confirm banks’ and 

holding companies’ compliance with prudential regulations and other legal requirements. In 

addition, compliance with some rules is monitored on an on-going basis through the 

collection and analysis of financial and structure reports that are required to be filed by 

banking organizations. U.S. federal banking supervisors confirm that banks and holding 

companies also maintain policies and procedures designed to ensure their compliance with 

applicable laws and regulations. These internal compliance programs are evaluated by the 

banking agencies during on-site examinations. U.S. FBAs have developed and maintained 

extensive supervisory guidance to evaluate compliance programs and specific areas 

including internal controls, audit, consumer protection, fair credit reporting, home mortgage 

disclosure, real estate settlement procedures, and anti-money-laundering, among others. A 

complete listing of the guidance is available through each agency. 

EC4 The supervisor takes the macroeconomic environment into account in its risk assessment of 

banks and banking groups. The supervisor also takes into account cross-sectoral 

developments, for example in non-bank financial institutions, through frequent contact with 

their regulators. 

Description and 

findings re EC4 

All Banks 

On an on-going basis, supervisors monitor and assess banks and holding companies 

through financial statements that each are required to file. These financial statements consist 

of a balance sheet, income statement, and supporting financial schedules. Using 

aggregations of these data, the banking agencies complete analyses addressing overall 

conditions within the banking industry. These analyses highlight earnings performance, 

industry capitalization levels, lending concentrations, and many other fundamental and 

specialized areas of the bank’s or holding company’s operations, and are used to assess 

trends, developments, and risks for the banking system as a whole. The agencies also make 

use of higher-level risk committees, made up of senior agency officials, to evaluate and 

assess the macroeconomic risks facing the financial system. In addition, the results of formal 

off-site monitoring programs, which use the submitted financial data to identify emerging 

problems in supervised banks and holding companies, are also used to monitor banking 

industry trends. 

The agencies also maintain contacts with a variety of market and industry analysts to obtain 

insights on emerging risks that may affect the banking system and financial markets as a 

whole. For example, the OCC has a Financial Markets Group specifically dedicated to 

monitoring and analyzing market developments and trends, and maintaining contact with 
UNITED STATES 

INTERNATIONAL MONETARY FUND 63

market participants. This group conducts periodic meetings with various market analysts, 

hedge fund managers, and other key players to get their insights on emerging risks. The U.S. 

President’s Working Group on Financial Markets facilitates coordination among the agencies 

and other market regulators on issues and risks that cut across the financial sector. The 

FSOC, created under DFA, is another important organization that monitors cross-sectoral 

financial developments, including developments in non-banking sectors. The heads of the 

Federal Reserve, OCC, CFPB, and FDIC are all members of the FSOC and these agencies also 

participate at the staff level. The agencies also periodically consult with the supervisors of 

major non-bank organizations in the U.S., including the SEC in the case of broker-dealers 

and the state insurance authorities in the case of insurance companies, to help to evaluate 

the impact of these institutions’ activities on the condition of holding companies. 

OCC also has a structure of risk committees that feed into the National Risk Committee. The 

Federal Reserve has also recently created a Risk Council. Both of the groups serve as a 

conduit for risks coming up from the vertical firm-facing supervisors and also the macroeconomic view coming down. 

Banking Institutions with at least $10bn of Assets 

The DFA requires an annual company-run stress test to be conducted at the bank and 

holding company level for certain large financial institutions 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve is required to conduct an annual supervisory stress test on all large Bank 

Holding Companies and nonbank financial companies designated by the FSOC to evaluate 

whether they have sufficient capital to absorb losses resulting from adverse economic 

conditions. The annual supervisory stress test, conducted as part of the annual CCAR 

exercise, includes economic scenarios (baseline, adverse, and severely adverse) provided by 

the Federal Reserve that define the annual supervisory assessment. Each firm subject to 

CCAR is required to maintain sufficient capital to withstand nine quarters of a severely 

adverse macroeconomic environment. In addition, the aggregate assessment for the most 

recent CCAR exercise indicated a significantly higher level of aggregate capital since the 

initial SCAP review was conducted during the crisis for the largest BHCs. 

In addition to the annual supervisory-run stress tests conducted by the Federal Reserve at 

Bank Holding Companies with total consolidated assets of more than $50 billion, the Federal 

Reserve requires that these institutions conduct a second company-run stress test each year. 

These company-run stress tests are designed to assess the potential impact of stressed 

economic conditions on the institutions consolidated earnings, losses and capital over a nine 

quarters planning horizon, taking into account the institution’s current condition, risk, 

exposures, strategies and activities. The stress test scenarios (baseline, adverse, and severely 

adverse) required to be used for the company run stress test are developed in coordination 

by the agencies but generally the agencies expect that these scenarios will typically mirror 

the scenarios applied by the Federal Reserve under the supervisory-run stress tests. 

EC5 The supervisor, in conjunction with other relevant authorities, identifies, monitors and 

assesses the build-up of risks, trends and concentrations within and across the banking 

system as a whole. This includes, among other things, banks’ problem assets and sources of 

liquidity (such as domestic and foreign currency funding conditions, and costs). The 

supervisor incorporates this analysis into its assessment of banks and banking groups and 

addresses proactively any serious threat to the stability of the banking system. The 

supervisor communicates any significant trends or emerging risks identified to banks and to 

other relevant authorities with responsibilities for financial system stability. 
UNITED STATES 

64 INTERNATIONAL MONETARY FUND

Description and 

findings re EC5 

All Banks 

Each of the U.S. FBAs employs off-site surveillance procedures for measuring and monitoring 

the risk profiles of individual banks and holding companies and the banking environment as 

a whole for possible systemic risks. These surveillance systems focus heavily on identifying 

banks and holding companies that are exhibiting problems or deteriorating so that 

examination resources can be directed to troubled organizations. They also flag banks and 

holding companies engaging in new or complex activities. These programs use a mix of 

predictive econometric models, expert systems based on judgmentally determined screens, 

and market-based financial measures to identify banks and holding companies warranting a 

heightened supervisory focus. For example, the agencies have adopted a standardized 

request for electronic loan files that supervisors can use to analyze, sample, and report on 

the contents of a loan trial balance. Other examples include the Federal Reserve’s SR-SABR 

model, the OCC’s Canary System, and the FDIC’s Large Insured Depository Institution (LIDI) 

program. Through their on-going risk assessment processes, the agencies also look for risks 

that may be increasing or risk-management systems that may need improvements. For 

example, the OCC, FDIC, and Federal Reserve have risk assessment systems that evaluate 

whether the direction of a bank’s risk profile is increasing, decreasing, or stable. 

The agencies use a variety of means to convey actions to bank boards and senior 

management. The assessors found that regulators can make recommendations, criticisms, 

matters requiring attention (MRA), matters requiring board attention (MRBA) and matters 

requiring immediate attention (MRIA). The range of these approaches and for some firms 

(the sheer volume of them) makes prioritization difficult. The assessors also noted that some 

of the matters requiring attention could be outstanding for a considerable amount of time. 

The agencies also conduct annually a joint review of the largest, complex credits that are 

shared by three or more banks. This annual review provides an opportunity for the agencies 

to identify trends in underwriting and credit classification practices, as well as overall 

commercial credit conditions, across the banking system. The 2013 review included over 

9,300 credit facilities totaling $3.0 trillion extended to approximately 5,800 borrowers. 

The FSOC is charged with identifying risks to the financial stability of the U.S.; promoting 

market discipline; and responding to emerging risks to the stability of the U.S. financial 

system. 

The assessors saw some very good management reports one example from the OCC 

showing trends in credit (e.g. concentrations by industry, geography and type of institution, 

and trend in probability of defaults) and counterparty credit was very useful. 

EC6 Drawing on information provided by the bank and other national supervisors, the supervisor, 

in conjunction with the resolution authority, assesses the bank’s resolvability where 

appropriate, having regard to the bank’s risk profile and systemic importance. When bankspecific barriers to orderly resolution are identified, the supervisor requires, where necessary, 

banks to adopt appropriate measures, such as changes to business strategies, managerial, 

operational and ownership structures, and internal procedures. Any such measures take into 

account their effect on the soundness and stability of on-going business. 

Description and 

findings re EC6 

All Banks 

The Prompt Corrective Action statute and implementing regulations by the Federal Reserve, 

the FDIC and OCC provide the agencies with authority to promptly resolve capital 

deficiencies at insured depository institutions and thereby reduce bank failures. In addition 

the assessors found that additional FDIC resolution scrutiny was triggered either because of 

an alert (such as high growth) from their remote monitoring system or because the CAMELS 
UNITED STATES 

INTERNATIONAL MONETARY FUND 65

rating is a 3, 4 or 5. Resolution work for most banks is therefore on a risk basis. 

Banking Institutions with at least $50bn of Assets 

Additionally, under the DFA, systemically-significant bank holding companies or nonbank 

financial firms are required to submit periodic reports to the agencies providing the plan of 

the company for rapid and orderly resolution in the event of material financial distress or 

failure. 

To implement the DFA’s requirement for resolution plans for certain banking organizations, 

the Federal Reserve and FDIC issued regulations in November 2011. The regulations require 

all domestic bank holding companies and FBOs with total consolidated assets of $50 billion 

or more and non-bank financial companies designated by FSOC (covered companies) to 

submit annually their plans (resolution plan or living will) for rapid and orderly resolution 

under the U.S. Bankruptcy Code in the event of material financial distress or failure. The 

Federal Reserve and FDIC do not approve resolution plans, but they may jointly find a plan is 

not credible or would not facilitate an orderly resolution in bankruptcy. If a resolution plan is 

found to have deficiencies, a covered company will have 90 days to resubmit a plan; if 

deficiencies are not corrected, the firm may become subject to more stringent capital, 

leverage, or liquidity requirements, or restrictions on growth, activities, or operations. A 

covered company’s resolution plan may not rely on extraordinary government support. 

These company prepared plans are used to support the FDIC’s planning for the exercise of 

its resolution authority under the DFA and FDI Act by providing the FDIC with an 

understanding of the company’s structure, complexity, strategies and processes. 

These resolution plans promote financial system stability by minimizing the potential impact 

of a resolution of a covered company. The resolution plans consider the direct and indirect 

effects of a resolution of a covered company on market and public confidence while 

ensuring accountability by having the failed company’s investors bear the losses arising from 

a failure. Resolution plans ensure that no taxpayer credit supports a failing covered company 

and implements a process for assessing the industry to cover payments associated with the 

resolution of a covered company. Resolution plans preserve day-to-day operations in order 

to promote market confidence and implement an expedient process for resolution. 

EC7 The supervisor has a clear framework or process for handling banks in times of stress, such 

that any decisions to require or undertake recovery or resolution actions are made in a 

timely manner. 

Description and 

findings re EC7 

All Banks 

The Prompt Corrective Action statute and implementing regulations by the Federal Reserve, 

the FDIC and OCC provide the agencies with authority to promptly resolve capital 

deficiencies at insured depository institutions and thereby reduce bank failures. 

In addition regulators carried out additional intensive supervision for banks with CAMELS 

ratings of 3, 4 or 5. For example, the OCC has roughly 70 banks (and thrifts) in their Special 

Supervision function. 

Banking Institutions with at least $50bn of Assets 

Additionally, under the Dodd Frank Act, systemically-significant bank holding companies or 

nonbank financial firms are required to submit periodic reports to the agencies providing the 

plan of the company for rapid and orderly resolution in the event of material financial 

distress or failure. See EC6 
UNITED STATES 

66 INTERNATIONAL MONETARY FUND

EC8 Where the supervisor becomes aware of bank-like activities being performed fully or 

partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the 

matter to the attention of the responsible authority. Where the supervisor becomes aware of 

banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes 

appropriate steps to address this. 

Description and 

findings re EC8 

When bank-like activities are performed outside the regulatory perimeter, the FBAs are able 

to raise the issue with Congress, which would be responsible for addressing the issue 

through legislation. Supervisors have the authority to prevent or preclude restructuring for 

purposes of evading the regulatory perimeter. 

The FSOC is charged with identifying risks to the financial stability of the U.S.; promoting 

market discipline; and responding to emerging risks to the stability of the U.S. financial 

system. This would include identifying risks from financial activities that reside or have been 

pushed out of the existing regulatory perimeter. 

Supervisors generally expect banks and holding companies to notify them of any substantive 

changes in their activities, structure and overall condition, or as soon as they become aware 

of any material adverse developments, including breach of legal or prudential requirements. 

Supervisors identify deviating or new bank-like activities primarily through onsite 

examination work. Other means that alert supervisors to new activities include formal off-site 

monitoring programs and required regulatory reports on structure to identify banks and 

holding companies substantively changing their activities. Regardless of the structure of the 

entity, if impermissible activities are detected there are a number of actions and strategies 

the agencies may employ in order to curtail or eliminate these activities. Supervisors can 

require impermissible or unsafe and unsound activities be eliminated through informal 

corrective actions and formal corrective actions. Informal corrective action programs include 

bilateral agreements that provide direction and instruction to the supervised institution. 

Formal corrective action programs, which are enforceable through court action, provide 

instruction to institutions to take specific corrective action to resolve the outstanding 

issue(s). 

In approving applications, generally, the U.S. banking agencies may impose conditions that 

require banks or bank holding companies to provide prior notice of any changes to the 

business plans or related documents submitted in conjunction with the underlying 

application or filing. For example, in the case of new banks and holding companies, U.S. 

banking agencies routinely include a condition in their approval orders that requires prior 

notice of any change to the new organization’s business plan during the first three years of 

operation. After this period, changes in the activities, if permissible under state and federal 

law, would be subject to review during periodic safety and soundness examinations. For 

state non-member banks, the FDIC also includes a condition in the approval order that 

requires the bank to submit pro forma financial statements and a business plan for 

operating years four through seven to the appropriate FDIC office within 60 day before the 

end of the bank’s third year of operation. The FDIC monitors compliance with such plans 

during the annual examination process and requires prior non-objection for any material 

deviations or material changes from the plan. Further, U.S. FBAs may impose notification 

requirements formally or informally as determined by supervisors. 

Assessment of 

Principle 8 

Compliant 

Comments The U.S. system of regulation is changing rapidly. Some of that change is internally driven, 

but some is external – either from legislative change (such as the DFA) or from international 

policy agreements. The combination of these changes has broadened the role of supervision 
UNITED STATES 

INTERNATIONAL MONETARY FUND 67

and has introduced a greater level of tiering into the regime (e.g. Banking Institutions with at 

least $50bn of Assets). 

The assessors find that the net effect of these changes has been positive. The supervisory 

regime is effective and risk-based. There is an increasing focus on resolution (for the larger 

firms). 

The range of approaches the regulators use to communicate issues (EC 5) that are important 

to them and on which they seek action does run the risk of confusing messages. The 

supervisors should consider some simplification of this system and ideally it might be 

something that the supervisors could agree an interagency approach—at the moment all 

make use of Matters Requiring Attention, with the Federal Reserve using Matters Requiring 

Immediate Attention and also Matters Requiring Board Attention which is used by Federal 

Reserve and the OCC. Furthermore where supervisors have a substantial agenda of issues to 

be resolved—the assessors saw some firms with over 100 matters requiring attention, the 

supervisors should consider clearer methods of prioritization and communication. This 

should not be to devalue the individual items themselves, but should instead be thought of 

as a better way to convey supervisory issues and themes to the Boards of Banks. 

The assessors were also concerned to see that some matters requiring attention had been 

outstanding for a long time—three years for example. Supervisory management was aware 

of these cases and indeed had good management information to track ageing of matters 

requiring attention. The assessors agreed with Supervisor Senior Management that the cause 

of the aging was not just the target banks being behind in delivery, but also that the matters 

requiring attention were not well drafted or had not taken adequate consideration of 

feasible delivery times. (See CP 11 – authorities have started addressing the issue). 

Principle 9 Supervisory techniques and tools. The supervisor uses an appropriate range of techniques 

and tools to implement the supervisory approach and deploys supervisory resources on a 

proportionate basis, taking into account the risk profile and systemic importance of banks. 

Essential criteria 

EC1 The supervisor employs an appropriate mix of on-site36 and off-site37 supervision to evaluate 

the condition of banks and banking groups, their risk profile, internal control environment 

and the corrective measures necessary to address supervisory concerns. The specific mix 

between on-site and off-site supervision may be determined by the particular conditions and 

circumstances of the country and the bank. The supervisor regularly assesses the quality, 

effectiveness and integration of its on-site and off-site functions, and amends its approach, 

as needed. 

Description and 

findings re EC1 

All Banks 

The U.S. firmly adopts a risk-based approach to supervision. This is both in terms of its focus 

on risk within banks, but also adjusting that approach in proportion to the risk banks pose to 

 

36 On-site work is used as a tool to provide independent verification that adequate policies, procedures and controls 

exist at banks, determine that information reported by banks is reliable, obtain additional information on the bank 

and its related companies needed for the assessment of the condition of the bank, monitor the bank’s follow-up on 

supervisory concerns, etc. 

37 Off-site work is used as a tool to regularly review and analyze the financial condition of banks, follow up on 

matters requiring further attention, identify and evaluate developing risks and help identify the priorities, scope of 

further off-site and on-site work, etc. 
UNITED STATES 

68 INTERNATIONAL MONETARY FUND

the system. The supervisory process is highly structured with a high proportion of mandated 

reviews (both offsite and onsite), a uniform rating process and an extensive planning process 

that agrees the supervisory strategy going forward. U.S. regulators have a statutory 

responsibility to ensure and evaluate safety and soundness. 

The agencies have segmented the banking organizations under their respective jurisdictions, 

taking into account legislative thresholds (such as those in the DFA) and adjusting, where 

possible, for different risk profiles and business models. Each agency has dedicated 

resources proportionately to the size and complexity of the supervised organization. 

Supervision is accomplished through a combination of on-site examinations, off-site reviews 

and surveillance monitoring programs. In general, the primary federal banking supervisor 

conducts annual, on-site examinations of the banks within its jurisdiction. 

Examination areas for all banks and holding companies include any cross-border operations. 

In its role as a holding company supervisor, the Federal Reserve also conducts inspections 

and makes risk assessments of a holding company’s operations. In addition to examining 

national banks and their affiliates, the OCC examines federal branches and federal agencies 

of foreign banks. The Federal Reserve alternates with state regulators in examining state 

licensed branches and agencies of foreign banks. All of the U.S. FBAs examine bank service 

companies. 

Off-site supervision involves periodic surveillance and assessment of information from a 

variety of sources, including standard regulatory reports and internal information received 

from the supervised bank and holding company. The standard regulatory reports capture a 

host of commercial and financial information on supervised entities. The number and the 

type of standard regulatory report forms that must be filed depend on the size of a bank or 

holding company and the scope of its operations. Off-site surveillance also includes a review 

of reports of recent examinations and inspections, internal management and internal and 

external auditor reports (when requested by supervisors), reports filed by public companies 

(e.g., 10-Qs and 10-Ks), application materials, and publicly available material (e.g., 

information published in the financial press and elsewhere). In addition, it includes 

information obtained from regular discussions with management, internal and external 

auditors, and other supervisors, both foreign and domestic. 

Through on-site examinations and continuous supervision, supervisory staff generally: (1) 

evaluate the soundness of the bank’s or holding company’s assets and the effectiveness of 

its internal controls, policies, and management; (2) analyze key financial factors such as the 

bank’s and holding company’s capital, earnings, liquidity, and sensitivity to interest rate risk; 

(3) assess the bank’s or holding company’s exposure to off-balance-sheet risks; (4) check for 

compliance with banking laws and regulations; and (5) determine the bank’s or holding 

company’s overall soundness and solvency. In addition to these specific areas, supervisors 

also evaluate transactions between a bank or holding company and its affiliates to determine 

the effect of the transactions on the bank’s or holding company’s condition and to ascertain 

whether the transactions are consistent with the limitations set out in sections 23A and 23B 

of the Federal Reserve Act. 

Each agency has the authority to take an enforcement action if, in the agency’s opinion, the 

bank, holding company or any institution-affiliated party (IAP) is engaging or has engaged, 

or the agency has reasonable cause to believe that the bank, holding company or any IAP is 

about to engage in an unsafe or unsound practice, or is violating or has violated, or the 

agency has reasonable cause to believe that the bank, holding company or any IAP is about 

to violate a law, rule, or regulation, or any condition imposed in writing by the agency in 

connection with the granting of any application or other request by the bank or holding 
UNITED STATES 

INTERNATIONAL MONETARY FUND 69

company or any written agreement entered into with the agency. The primary FBAs generally 

have the authority to examine affiliates of the bank under their supervision. The OCC’s 

process regarding a functionally regulated affiliate of a national bank are described in the 

Comptroller’s Handbook, Bank Supervision Process (Sept. 2007), pages 16-18. The Federal 

Reserve has the authority to examine bank subsidiaries of Bank Holding Companies; 

however, the Federal Reserve must rely to the fullest extent possible on the bank 

examinations conducted by the primary federal banking or functional supervisor. The Federal 

Reserve is the primary federal supervisor of Savings and Loan Holding Companies and must 

rely to the fullest extent possible on the examinations conducted by the primary supervisor 

of savings banks (e.g., state savings banks regulated by the FDIC). In addition, all of the FBAs 

rely to the fullest extent possible on the functional supervisors of the securities and 

insurance subsidiaries and any other subsidiary that is subject to comprehensive supervision 

by a federal or state authority for supervisory information to minimize duplication and 

unnecessary regulatory burden on regulated entities. 

The U.S. FBAs routinely share supervisory information with each other and with the 

functional supervisors, as needed. In addition, the U.S. Attorney General, Secretary of the 

Treasury, and the head of other federal agencies are required, unless prohibited by law, to 

disclose to the appropriate federal banking agency any information they believe raises 

significant concerns regarding the safety or soundness of any bank or holding company. 

While each holding company and bank has a primary federal regulator, there are certain 

cases where there is overlapping examination authority among the federal supervisors. For 

example, the FDIC has the authority to conduct a special examination of any insured 

depository institution to independently determine the condition of that bank for purposes of 

the FDIC’s deposit insurance. 

Banking Institutions with less than $500mn of Assets 

Generally smaller banks are subject to an annual examination. However, smaller banks that 

satisfy certain qualifying criteria (typically CAMELS ratings of 1 or 2 for management and 

overall) may be examined on an 18-month cycle [see Table 9.1 for more detail broken down 

by, State Member Banks (SMB), FDIC and OCC]. The OCC maintains a supervision strategy for 

each of its nationally chartered banks and federal savings associations, and each of the U.S. 

FBAs retains authority to examine a bank as frequently as it deems necessary. For example, 

the FDIC would conduct annual examination of problem institutions (typically CAMELS 

ratings of 3, 4 or 5) less than $500 million, and depending on the nature of the problems, 

conduct more frequent visits. Small bank holding company (less than $10bn in assets) 

inspections are conducted by the Federal Reserve and the majority follow the lead bank’s 

supervisory cycle. 

Table 9.1 Total of 

small

firms

Care not 

adjusted for 

double 

18 month 

cycle

Percentage 

subject to 

18- month 

cycle

Total 

Assets 

$bn

Percentage 

of Total 

Assets

SMB 860 425 49% 81 no 

data

FDIC 4180 2787 67% 450 no 

data

OCC 1794 951 53% 188 1.75%
UNITED STATES 

70 INTERNATIONAL MONETARY FUND

Banking Institutions with at least $10bn of Assets 

For larger banks and holding companies (typically those above $10bn in Assets), the federal 

banking agency maintains resident on-site supervisors who provide continuous supervision 

of the banking organization and at least quarterly updates on the bank’s and holding 

company’s condition and risk. In each of its designated large banks, the OCC maintains an 

onsite resident team that follows a specific detailed supervision strategy tailored for each 

national bank or Federal savings association. This includes targeted examinations that may 

include Federal Reserve, FDIC, and CFPB participation or collaboration. 

With respect to insured depository institutions with total assets greater than $10 billion and 

any affiliates, and insured credit unions with total assets of more than $10 billion and any 

affiliates, the CFPB has exclusive authority to require reports and conduct examinations for 

the purposes of assessing compliance with the requirements of Federal consumer financial 

laws; obtaining information about the activities subject to such laws and the associated 

compliance systems or procedures of such persons; and detecting and assessing associated 

risks to consumers and to markets for consumer financial products and services. As 

applicable, the U.S. FBAs and the CFPB are required to coordinate the scheduling of 

examinations of insured depository institutions, insured credit unions, or other covered 

persons; conduct simultaneous examinations of such institutions unless the institution 

requests examinations to be conducted separately; share each draft report of examination 

with the other agency and permit the receiving agency a reasonable opportunity (which shall 

not be less than a period of 30 days after the date of receipt) to comment on the draft 

report before such report is made final; and prior to issuing a final report of examination or 

taking supervisory action, take into consideration concerns, if any, raised by the other agency 

in its comments. The CFPB, OCC, Federal Reserve, and FDIC entered into a Memorandum of 

Understanding, dated May 16, 2012, to facilitate the implementation of these statutory 

provisions. 

In addition, under Section 165(i)(2) the FDIC, the OCC and the Federal Reserve require banks 

and savings associations with more than $10 billion in assets to conduct annual companyrun stress tests themselves. These company-run stress tests are required to be conducted 

annually and are designed to assess the potential impact of adverse economic conditions on 

the consolidated earnings, and capital over a nine quarters planning horizon, taking into 

account the institution’s current condition, risk, exposures, strategies and activities. The 

stress test scenarios (baseline, adverse, and severely adverse) required to be used for the 

company run stress test are developed in coordination by the agencies but generally the 

agencies expect that these scenarios will typically mirror the scenarios applied by the Federal 

Reserve under the supervisory-run stress tests. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve has divided its largest banks into two groups – largest, most 

systemically important financial institutions in the U.S. are overseen by the LISCC. The LISCC 

is a multi-disciplinary committee composed of senior officers representing various functions 

at the Federal Reserve and the 12 Federal Reserve Banks, including supervisors, economists, 

and market specialists. Firms supervised in the LISCC portfolio are financial institutions that 

may pose elevated risks to U.S. financial stability. Financial institutions included in the LISCC 

portfolio are referred to as “LISCC firms.” Members of the LISCC Operating Committee 

provide the macro-prudential perspective to supervision of the LISCC firms. LISCC provides 

strategic and policy direction for supervisory activities across the Federal Reserve system in 

order to improve the consistency and quality of supervision of LISCC firms. Similarly, LISCC 
UNITED STATES 

INTERNATIONAL MONETARY FUND 71

supervision is supported by the Quantitative Surveillance (QS) group that identifies systemic 

and firm-specific risk identification through aggregate loss forecasts, stressed capital 

adequacy analysis and measures of interconnectedness. The QS includes staff members from 

the Board’s Divisions of Research and Statistics, Monetary Affairs, International Finance, and 

Banking Supervision and Regulation, and from the Reserve Banks. LISCC supervision also 

uses horizontal examinations among LISCC firms and a high degree of consultation and 

coordination among supervisors from the Federal Reserve System of LISCC firms. 

Generally for banks above $50bn of assets, there is a greater level of resource allocated to 

supervision. The assessors also noted that there has been an increase in horizontal resources 

and supervision. For example the Federal Reserve’s QS group and the OCC’s Lead Expert 

Group. There has also been an increase in the number of horizontal examinations. 

As required by Section 165(i) of the DFA, the agencies have adopted rules requiring various 

BHC and bank level stress tests. Specifically, under Section 165(i)(1) the Federal Reserve 

requires bank holding companies with $50 billion or more in assets to conduct annual 

supervisory-run stress tests, using the exposure data submitted by the institutions. These 

supervisory run stress tests are conducted by the Federal Reserve on the largest institutions 

with participation of staff from the OCC and the FDIC, on both domestic and foreign-owned 

institutions. The covered institutions file quarterly data submissions to support on-going 

analysis of their risks. The institutions are expected to maintain a well-documented risk and 

capital modeling process that covers all major risk areas of the institution. The results of 

these tests, along with both qualitative and quantitative feedback, are provided in writing to 

the institutions at the conclusion of the tests. 

EC2 The supervisor has a coherent process for planning and executing on-site and off-site 

activities. There are policies and processes to ensure that such activities are conducted on a 

thorough and consistent basis with clear responsibilities, objectives and outputs, and that 

there is effective coordination and information sharing between the on-site and off-site 

functions. 

Description and 

findings re EC2 

Each of the U.S. FBAs and the CFPB maintains written guidance for planning and executing 

on-site and off-site activities. Generally, agencies annually develop on- and off-site 

examination strategies and goals based on the risk profile of the bank or holding company. 

Guidance can be found in each of the agencies’ examination manuals, which are updated 

periodically. The guidance specifies the objectives and expected actions and outputs for 

these activities, and also details basic procedures for completing on-site reviews and 

implementing off-site surveillance programs. Coordination and information sharing between 

on- and off-site supervision functions is facilitated by formal off-site monitoring programs 

that trigger follow-up by the on-site function when banks and holding companies meet 

various screening thresholds. In addition, supervisory policies require the consideration of 

off-site monitoring results when supervisors are determining the scope and procedures for 

on-site reviews. 

There has been an increase in the coordination of plans between the supervisors – the 

assessors saw evidence of consultation on plans and also joint participation in the planning 

process. Jointly resourced examinations are also commonplace. However the assessors 

noted that planning cycles differ materially between organizations and as such this can and 

does limit the extent to which coordination can exist—for example a request for resource to 

join in on an examination may be thwarted because resources have been committed by a 

planning process that had begun and been completed earlier. 

EC3 The supervisor uses a variety of information to regularly review and assess the safety and 

soundness of banks, the evaluation of material risks, and the identification of necessary 
UNITED STATES 

72 INTERNATIONAL MONETARY FUND

corrective actions and supervisory actions. This includes information, such as prudential 

reports, statistical returns, information on a bank’s related entities, and publicly available 

information. The supervisor determines that information provided by banks is reliable38 and 

obtains, as necessary, additional information on the banks and their related entities. 

Description and 

findings re EC3 

The supervisors receive a significant of information in the form of regulatory returns and also 

from ad hoc data requests. 

On-site examinations address all key areas of a bank’s and holding company’s operations, 

including capital adequacy, asset quality, management strength and quality of oversight 

from the board of directors, compliance with laws and regulations, quality and sustainability 

of earnings, the adequacy of liquidity sources to support on-going cash needs, and 

sensitivity of earnings and capital position to market risk. These reviews incorporate 

independent assessments of the effectiveness of risk management, internal controls, 

management reporting, and overall corporate governance. In addition, examination 

procedures may be directed to validating the reliability and accuracy of financial data 

reported to the agencies. Also, at each examination, supervisors evaluate any follow-up to 

supervisory concerns raised at prior examinations or as a result of off-site monitoring. 

During on-site examinations, U.S. federal banking supervisors review the most recent 

external auditor’s assessment of the bank’s or holding company’s financials and the work of 

the loan review function and internal audit. Typically, supervisors review audit testing of 

financial and Call Report reconcilements and accuracy. 

Section 404 of the Sarbanes-Oxley Act, requires an external auditor of a bank or holding 

company that is a public company annually to render an opinion on the effectiveness of the 

company’s internal controls over financial reporting and make a management assessment. 

Banking Institutions with at least $1bn of Assets 

For banks over $1 billion, section 112 of the Federal Deposit Insurance Corporation 

Improvement Act (FDICIA) requires a formal attestation from company management on the 

quality of the internal control structure. External auditors are required to attest to, and report 

separately on, the assertions of the bank’s management regarding internal controls. 

Banking Institutions with at least $10bn of Assets 

 As part of their Report of Examination, supervisors will specify matters requiring attention 

from the board. These are practices that deviate from sound governance, internal control, 

and risk management principles, which may adversely impact earnings or the capital, risk 

profile, or reputation if not addressed, or that result in substantial noncompliance with laws 

and regulations, internal processes, or supervisory guidelines. Supervisors evaluate 

management plans for corrective action and consider whether they are likely to be effective. 

In cases of severe problems or where management has been unable or unwilling to correct 

deficiencies, either formal or informal actions are typically issued against the bank and 

holding company. These actions often require the bank or holding company to correct the 

most serious of examination findings and communicate progress of those corrections to the 

responsible agency, commonly on a quarterly basis. The U.S. federal banking agency then 

has the ability to render judgment on management’s progress and can in turn structure the 

ongoing supervisory plans accordingly. 

Continuous monitoring is also an important supervisory tool at the largest U.S. banking 

 

38 Please refer to Principle 10. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 73

organizations. Continuous monitoring activities include meetings with a banking 

organization’s management and directors; review of governance committee meeting notes 

and information packages, analysis of internal MIS reports, market indicators, and other 

internal and external information; review of internal and external audit and compliance 

findings; analysis of internal and external financial reporting including regulatory and 

business line reporting, cross-firm analysis, identification of emerging issues and 

coordination with other relevant supervisors and functional regulators and utilization of their 

work as appropriate. 

EC4 The supervisor uses a variety of tools to regularly review and assess the safety and 

soundness of banks and the banking system, such as: 

(a) analysis of financial statements and accounts; 

(b) business model analysis; 

(c) horizontal peer reviews; 

(d) review of the outcome of stress tests undertaken by the bank; and 

(e) analysis of corporate governance, including risk management and internal control 

systems. 

The supervisor communicates its findings to the bank as appropriate and requires the bank 

to take action to mitigate any particular vulnerability that have the potential to affect its 

safety and soundness. The supervisor uses its analysis to determine follow-up work required, 

if any. 

Description and 

findings re EC4 

As part of formal, off-site monitoring programs, the U.S. FBAs use automated screening 

systems, regulatory reports, standardized financial reports detailing key financial ratios and 

measures, and public sources of financial information to monitor the performance and 

condition of supervised banks and holding companies and promptly identify those requiring 

heightened supervisory attention. Supervisors periodically (e.g., quarterly) communicate with 

the bank’s or holding company’s management to discuss emerging issues or concerns. 

Supervisors also provide written reports following targeted or limited-scope examinations, 

horizontal / comparative examinations, and annual summary reports that provide the 

supervised institution with a consolidated overview of supervisors’ view of the institution as a 

whole, including assessments of significant subsidiary operations. 

Examination staff also uses off-site surveillance tools and reports to plan the scope of, and 

determine priorities for, on-site examination work, as well as to monitor the progress in 

responding to matters requiring further attention. Included in this analysis is monitoring of 

standardized financial data from financial reports such as the FFEIC 031 or 041 Consolidated 

Reports of Condition and Income (Call Report), FR-Y9 Consolidated Financial Statements for 

Holding Companies. Supervisors carry out comparative peer analyses of the standardized 

reports for all organizations. Further, supervisors require banks to submit financial reports 

and management analyses of the overall organization, subsidiaries, and business activities 

including financial, market risk, and operational risk management analyses that reflect each 

organization’s unique mix of activities. Supervisors also receive copies of board of directors’ 

minutes and exhibits, minutes and exhibits for their various committees, as well as minutes 

and materials for significant management committees throughout the supervised 

organization. 

The supervisors use a range of supervisory activities to maintain a comprehensive 

understanding and assessment of each firm, including: 
UNITED STATES 

74 INTERNATIONAL MONETARY FUND

a) In developing and executing a detailed supervisory plan for each firm, supervisors 

generally rely to the fullest extent possible on the information and assessments 

provided by other relevant supervisors and functional regulators. The supervisors 

actively participate in interagency information sharing and coordination, consistent 

with applicable laws, to promote comprehensive and effective supervision and limit 

unnecessary duplication of information requests. Supervisory agencies continue to 

enhance formal and informal discussions to jointly identify and address key 

vulnerabilities, and to coordinate supervisory strategies for large financial 

institutions. 

b) Supervisors use firm-specific examination and continuous monitoring activities 

(“continuous monitoring activities” include meetings with a banking organization’s 

management; analysis of internal MIS reports, market indicators, and other internal 

and external information; review of internal and external audit findings; and 

coordination with other relevant supervisors and functional regulators and 

utilization of their work as appropriate) undertaken to maintain an understanding 

and assessment across the core areas of supervisory focus for each firm. These 

activities include review and assessment of changes in strategy, inherent risks, 

control processes, and key personnel, and follow-up on previously identified 

concerns (for example, areas subject to enforcement actions or other supervisory 

issues), or emerging vulnerabilities. 

c) Coordinated horizontal reviews involve examination of several institutions 

simultaneously, encompassing firm-specific supervision and the development of 

cross-firm perspectives. The supervisors recognize the priority of these reviews 

through the dedication of multidisciplinary skills and experienced staff. Examples 

include analysis of capital adequacy and planning via the Comprehensive Capital 

Analysis and Review (CCAR) and the required annual company-run stress tests, as 

well as horizontal evaluations of resolution plans and incentive compensation 

practices. For a more detailed description of stress tests. The assessors noted the 

greater use of horizontal reviews, particularly for the larger banks. However the 

assessors noted that there were occasions where supervisory expectations of the 

peer-group were not clearly established and many of the contacts the assessors 

spoke to, suggested that supervisory expectations drifted and became relative to 

the peer-group, rather than absolute in terms of rules or guidance. 

d) In certain instances, supervisors may be able to rely on a firm’s internal audit or 

internal control functions in developing a comprehensive understanding and 

assessment if deemed effective. 

Supervisors also review corporate governance, risk management systems and practices, as 

well as the internal control systems, including operations, management information systems 

and audit effectiveness, in assessing an institution’s overall condition. These reviews seek 

two primary objectives: 

1. Enhancing resiliency of a firm to lower the probability of its failure or inability to 

serve as a financial intermediary. Each firm is expected to ensure that the 

consolidated organization (or the combined U.S. operations in the case of FBOs) 

and its core business lines can survive under a broad range of internal or external 

stresses. This requires financial resilience by maintaining sufficient capital and 

liquidity, and operational resilience by maintaining effective corporate governance, 

risk management, and recovery planning; and 

2. Reducing the impact on the financial system and the broader economy in the event 
UNITED STATES 

INTERNATIONAL MONETARY FUND 75

of a firm’s failure or material weakness. 

Each firm is expected to ensure the sustainability of its critical operations and banking offices 

under a broad range of internal or external stresses. This requires, among other things, 

effective resolution planning that addresses the complexity and the interconnectivity of the 

firm’s operations. 

The assessors found business model analysis much improved since the last BCP assessment, 

but still evolving. At the moment the assessors judged that it was adequately serving the 

prudential agenda but there was scope for further improvement to support more strategic 

assessments. 

In terms of communication, the assessors found that the size of some letters and reports 

were extensive and could often lose key messages - particularly when addressed to Board of 

Directors. This is particularly the case where there are extensive MRAs or observations in 

terms of particular credit loans or transactions. In some examples the assessors found 

supervisors had used what the assessors considered to be excessive praise in their 

communication to banks. The assessors regard this as different from supervisors making 

sound judgments and producing a balanced piece of feedback to the banks. Also the 

assessors noted some examples of communication that seemed to spend a large amount of 

time recounting the recent events in the bank to the bank themselves. This is not to say that 

supervisors should not put their own judgments into context, but the assessors felt that the 

histories could be reduced a little with no loss of context. 

EC5 The supervisor, in conjunction with other relevant authorities, seeks to identify, assess and 

mitigate any emerging risks across banks and to the banking system as a whole, potentially 

including conducting supervisory stress tests (on individual banks or system-wide). The 

supervisor communicates its findings as appropriate to either banks or the industry and 

requires banks to take action to mitigate any particular vulnerability that have the potential 

to affect the stability of the banking system, where appropriate. The supervisor uses its 

analysis to determine follow-up work required, if any. 

Description and 

findings re EC5 

All Banks 

Supervisory agencies use analysis from their own staff economists and financial analysts, 

who monitor trends in domestic U.S. financial markets and global markets, for emerging 

risks or concentrations of risk in supervised institutions. The OCC has a formal risk 

monitoring process known as the National Risk Committee (NRC). The objectives of the NRC 

are to identify primary and emerging risks to the national banking system; stay abreast of 

evolving business practices and financial market issues; inform the OCC’s Executive 

Committee of material risks facing the national banking system; and facilitate 

communication of risk issues and OCC supervisory efforts to address those issues. The NRC 

issues a semi-annual report, in the Spring and Autumn. The supervisors internally use 

horizontal examinations or comparative analysis to detect institutions with concentrations of 

risk, or where trends in risks taken appear to constitute a threat to safety and soundness of 

the institutions. Similarly, the supervisors also look at trends in the functioning of bank 

operations, including studies or horizontal examination work aimed at the operations of 

supervised institutions, to identify emerging risks as well as best practices. Findings of these 

are communicated to institutions through a number of means. Where the findings affect a 

single institution or a small group of institutions, a direct supervisory letter might be the 

means of communication. Where the risk is emerging but not a threat, discussion with 

management, public comment by supervisory leaders, informal written guidance from 

supervisors such as Bulletins, Financial Institution Letters, Supervision & Regulation or 
UNITED STATES 

76 INTERNATIONAL MONETARY FUND

Community Affairs Letters, Handbooks and Examination Manual updates are all used. 

The Federal Reserve has also just created a Risk Council to bring together their view of risks 

within regulated firms. 

Banking Institutions with at least $10bn of Assets 

Supervisors require an annual company-run stress test to be conducted at the bank level. 

These company-run stress tests are designed to assess the potential impact of stress under 

various economic conditions on the institution’s consolidated earnings, losses and capital 

over a nine quarters planning horizon, taking into account the institution’s current condition, 

risk, exposures, strategies and activities. The stress test scenarios (baseline, adverse, and 

severely adverse) required to be used for the company run stress test are developed in 

coordination by the agencies but generally the agencies expect that these scenarios will 

typically mirror the scenarios applied by the Federal Reserve under the supervisory-run 

stress tests. 

Banking Institutions with at least $50bn of Assets 

Supervisory-run stress tests are conducted on the largest institutions by the Federal Reserve 

along with participation of staff from the OCC and the FDIC, on both domestic and foreignowned institutions on an annual basis. The covered institutions file quarterly data 

submissions to support on-going analysis of their risks. On an annual basis, the institutions 

are expected to maintain a well-documented risk and capital modeling process that covers 

all major risk areas of the institution. The Federal Reserve instructs financial and bank 

holding companies to submit the results of their own financial stress tests each year, using 

financial scenarios developed by the institutions, along with stress tests for a scenario 

provided by the Federal Reserve. In addition, the Federal Reserve conducts its own 

supervisory stress tests, using the exposure data submitted by the institutions that they used 

for their own internal tests, to assess the impact of identical stresses on each institution’s 

unique business portfolios. The results of these tests, along with both qualitative and 

quantitative feedback, are provided in writing to the institutions at the conclusion of the 

tests. The results, along with any supervisory findings from the tests, then become a 

component of the Federal Reserve’s annual assessment of the institution. Recently the 

Federal Reserve has also begun conducting stress tests solely focused upon liquidity of its 

institutions in the LISCC portfolio. The supervisory teams that monitor each institution yearround are part of the team that conducts the tests and assesses results, in order to clearly 

transition findings of the tests into any necessary supervisory actions over the following year.

EC6 The supervisor evaluates the work of the bank’s internal audit function, and determines 

whether, and to what extent, it may rely on the internal auditors’ work to identify areas of 

potential risk. 

Description and 

findings re EC6 

All Banks 

The U.S. FBAs assess the quality and scope of every bank’s and holding company’s internal 

audit function, whether or not audits are performed by the bank’s or holding company’s own 

staff or an outside vendor. These assessments include consideration of the independence of 

the function, the appropriateness of the risk assessment program for addressing the 

activities and risks of the bank or holding company, the size and quality of staffing, and the 

effectiveness and completeness of audits performed. The results of this assessment are used 

in determining how reliable the resulting internal audit work product is and whether it may 

be relied upon in developing a supervisory assessment of a bank’s or holding company’s 

soundness, risk profile, and internal controls. Examination manuals maintained by the various 

agencies provide details of procedures used to evaluate a bank’s and holding company’s 
UNITED STATES 

INTERNATIONAL MONETARY FUND 77

audit function. 

EC7 The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, 

non-executive Board members and senior and middle management (including heads of 

individual business units and control functions) to develop an understanding of and assess 

matters such as strategy, group structure, corporate governance, performance, capital 

adequacy, liquidity, asset quality, risk management systems and internal controls. Where 

necessary, the supervisor challenges the bank’s Board and senior management on the 

assumptions made in setting strategies and business models. 

Description and 

findings re EC7 

All Banks 

Throughout the supervisory process, the U.S. FBAs communicate extensively with the bank’s 

and holding company’s board, non-executive directors, audit committee, and senior and 

middle management (including heads of individual business units and control functions). 

This communication facilitates the development of an understanding and assessment of 

such matters as strategy, group structure, corporate governance, performance, capital 

adequacy, liquidity, asset quality, and risk-management systems. It also provides an 

opportunity for the banking agencies to deliver recommendations for corrective actions as 

needed and follow a bank’s and holding company’s progress in addressing earlier 

recommendations. At the conclusion of each exam, the supervisor will meet with the bank’s 

or holding company’s senior management and board of directors to discuss findings 

including any significant issues and to obtain management’s commitment to correct any 

weaknesses noted during the exam. The banking agencies also provide the bank’s or holding 

company’s board of directors a written report of examination for review by all directors and 

senior officers. The report of examination conveys the overall condition and risk profile of 

the bank and provides conclusions on the assigned supervisory CAMELS ratings (those 

ratings assess the bank’s Capital adequacy, Asset quality, Management, Earnings, Liquidity, 

and Sensitivity to market risk); identifies any violations of law; assesses compliance with the 

Bank Secrecy Act (BSA); and addresses compliance with consumer financial protection laws 

and regulations and the CRA. The report of examination also discusses significant 

deficiencies, violations, and excessive risks, and details corrective action to which the board 

or management has committed. 

Banking Institutions with at least $10bn of Assets 

For large banks and holding companies and those exhibiting a higher degree of risk, the 

amount of communication by the agencies with all levels of a bank’s and holding company’s 

corporate governance structure is expanded, with the frequency and scope of this contact 

determined based on the size or risk profile of the bank or holding company. This contact 

may include an on-going, on-site presence to enable monitoring by CPC and EIC teams. The 

assessors saw substantial evidence that regular contact between supervisor and senior 

management and the Board has increased significantly over the last few years. 

EC8 The supervisor communicates to the bank the findings of its on- and off-site supervisory 

analyses in a timely manner by means of written reports or through discussions or meetings 

with the bank’s management. The supervisor meets with the bank’s senior management and 

the Board to discuss the results of supervisory examinations and the external audits, as 

appropriate. The supervisor also meets separately with the bank’s independent Board 

members, as necessary. 

Description and 

findings re EC8 

All Banks 

Findings of supervisory activities are written in report format and delivered to and discussed 

with the bank’s and holding company’s management and the board of directors each 
UNITED STATES 

78 INTERNATIONAL MONETARY FUND

examination cycle. The CFPB (for Banking Institutions with more than $10bn of assets and 

their affiliates) also issues supervisory letters for target reviews. The supervisory ratings 

assigned to the bank and holding company, as a result of supervisory activities, are also 

provided to the subject’s board of directors and senior management within the written 

examination reports. In cases where supervisory activity results in an assessment of the bank 

or holding company that is less than satisfactory, the bank’s or holding company’s board of 

directors and senior management are made aware of resulting regulatory restrictions where 

appropriate. Examples of these restrictions are constraints on severance payments made to 

IAPs, requirements regarding the appointment of new directors or senior executive officers, 

restrictions on dividend payments while the bank or holding company is in a problem 

condition, and prohibition of new branches. The manner by which agencies coordinate 

communication of examination activities and findings varies depending on the specific 

condition of the bank or holding company, structure, and in the case of state counterparts, 

geographic location. The assessors found evidence of joint letters being issued after 

examinations as well as separate letters from each agency involved in the examination. 

Occasionally this would also involve regulators arriving at different ratings for the same 

institution although these are rare. 

In terms of communication, the assessors noted that supervisors often conflated the board 

and senior management (a tendency the assessors also found in guidance) when in many 

cases the role of the two are different. 

EC9 The supervisor undertakes appropriate and timely follow-up to check that banks have 

addressed supervisory concerns or implemented requirements communicated to them. This 

includes early escalation to the appropriate level of the supervisory authority and to the 

bank’s Board if action points are not addressed in an adequate or timely manner. 

Description and 

findings re EC9 

All Banks 

U.S. supervisory authorities undertake follow-up to verify that banks and holding companies 

have addressed supervisory concerns and/or implemented requirements communicated to 

them, including early escalation to the appropriate level of the supervisory authority and to 

the bank’s board of directors if action points are not addressed in an adequate or timely 

manner. 

For instance, through the supervision process, including onsite and off-site examination 

activities, staff may identify Matters Requiring Attention (MRAs), Matters Requiring Board 

Attentions (MRBAs) and Matters Requiring Immediate Attention (MRIAs) for institutions 

supervised by the Federal Reserve by banks and holding companies. MRAs/MRBAs/MRIAs 

are detailed in reports on examination and/or other communications to management and as 

warranted, boards of directors. Depending on the significance of the MRAs/MRBAs/MRIAs 

identified, an informal or formal enforcement action may be issued. MRAs/MRBAs/MRIAs 

and enforcement actions detail the weaknesses identified by the supervisors, the corrective 

actions that are expected to be taken by the company to address the concerns, and specific 

dates for completing the work [see also CP 8]. 

The assessors did see evidence of MRAs being outstanding for some time beyond the 

original date. Supervisory management was aware of a wider issue of aging of MRAs and 

had management information to monitor them. Management was also considering issuing 

further guidance to examination staff to reduce the number of out aged MRAs. 

The assessors also noted that where banks had a large number of MRAs, both the relative 

prioritization and any broader themes could be lost. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 79

EC10 The supervisor requires banks to notify it in advance of any substantive changes in their 

activities, structure and overall condition, or as soon as they become aware of any material 

adverse developments, including breach of legal or prudential requirements. 

Description and 

findings re EC10 

All Banks 

U.S. FBAs have an expectation, but not a requirement, that banks notify them in advance of 

any substantive changes in their activities, structure and overall condition. 

In addition supervisory staff members discuss with bank management during periodic onsite 

and offsite monitoring financial trends and changes in bank operations, controls, and 

management, and monitor the approvals of banks’ boards of directors, investment 

committees, and business plans overall. They receive frequent, quarterly if not monthly, 

reports on business areas, new products. They also discuss with the internal audit 

departments changes in businesses. 

Some aspects are subject to statutory notification such as breaches of the BSA. In addition 

permitted bank and non-bank activities, as well as changes in ownership and/or control, are 

addressed by regulations published by a number of agencies, each focused on activities of 

banking institutions within each agency’s jurisdiction. In addition to the on-going 

communication, institutions are expected to notify supervisors promptly of material adverse 

developments. Periodic review of management reports by supervisors helps to ensure that 

communications of these events occurs on a timely basis. 

The Federal Reserve is the primary regulator of financial and bank holding companies, as 

well as state-chartered banks that are members of the Federal Reserve System. State 

member banks’ permissible activities may be enacted by the state laws of the states where 

the banks are incorporated and the states where they do business. Federal-level regulation 

for holding companies are documented in the FRB’s Regulation Y, which addresses changes 

in ownership and control of financial and bank holding companies as well as banks 

supervised by the Federal Reserve. 

Regulation H contains the requirements for state member banks, activities they may engage 

in, prompt corrective action for institutions where capital is inadequate, and financial record 

keeping and reporting requirements. 

National Bank permissible activities are discussed in “Activities Permissible for a National 

Bank, Cumulative,” an OCC publication. National banks must apply to the OCC for approval 

for certain activities, as well as for permission for activities not specifically approved by 

statute or OCC regulation. 

The FDIC publishes similar regulations for state-chartered banks that are not members of the 

Federal Reserve System. 

Banking Institutions with at least $50bn of Assets 

Regulation Y also contains restrictions on, and reporting requirements for, non-bank 

activities of a BHC and/or its subsidiaries as well as non-bank activities of foreign banks 

doing business in the U.S. 

Regulation Y also contains the requirements for large bank holding companies to submit 

annual capital plans for review. 

EC11 The supervisor may make use of independent third parties, such as auditors, provided there 

is a clear and detailed mandate for the work. However, the supervisor cannot outsource its 

prudential responsibilities to third parties. When using third parties, the supervisor assesses 

whether the output can be relied upon to the degree intended and takes into consideration 
UNITED STATES 

80 INTERNATIONAL MONETARY FUND

the biases that may influence third parties. 

Description and 

findings re EC11 

U.S. FBAs do not use independent third parties, such as auditors, to conduct their prudential 

supervisory activities of banks and holding companies. However, on an as needed basis or 

during periods where staffing needs to be augmented, the agencies may use external 

experts to perform specific tasks such as commercial credit reviews. Tasks and deliverables 

are outlined in a formal contract with a defined timeline. Further, these roles are typically 

filled with former supervisors or subject matter experts who are supervised by agency 

personnel. 

EC12 The supervisor has an adequate information system that facilitates the processing, 

monitoring and analysis of prudential information. The system aids the identification of areas 

requiring follow-up action. 

Description and 

findings re EC12 

U.S. FBAs use a variety of information systems to facilitate the processing, monitoring, and 

analysis of prudential information. For example, the Federal Reserve System maintains a 

National Information Centre (NIC) database that contains financial, regulatory, and structure 

report data for supervised domestic financial companies and foreign financial institutions 

with a presence in the U.S., as well as their subsidiaries and branches around the world. 

In addition, the Federal Reserve uses C-SCAPE (Consolidated Supervision, Comparative 

Analysis, Planning and Execution) that is an application used to enhance the planning and 

execution of supervisory activities in the LISCC, LBOs, large FBOs, and financial market utility 

portfolios. C-SCAPE has facilitated the migration from point-in-time document-centric 

supervision to an integrated consolidated supervision workflow process. These new 

processes, with linked workflows across supervisory analysis, planning and execution, enable 

continuous updates of information provided via exams and continuous monitoring that, in 

turn, are reflected in the Risk Assessment and analyses of capital, asset quality, earnings, and 

liquidity (CAEL) financial factors. The updated information directly assists planning and 

prioritization of supervisory activities reflecting both "bottom-up" firm-specific assessments 

and follow-up activities, as well as "top-down" planning for macro-prudential and horizontal 

matters. Robust reporting and decision support tools enable real-time horizontal views of 

supervisory priorities, resource needs and risk assessments 

The OCC uses several tools to support on-going supervision and analytics of institutions 

regulated under its purview. Planning and prioritization of supervisory strategies and 

activities for large and/or complex institutions are developed, reviewed and approved via the 

Strategy Automation Tool (SAT), with the strategy artifact automatically stored in Examiner 

View (EV) or eDocs. Strategies for smaller institutions are entered directly into EV. When 

resources external to the business unit are needed to execute the strategy, those resources, 

including subject matter experts, are requested and filled through the National Resource 

Planning Tool (NRPT). Local and national resources are scheduled via the National 

Scheduling Application (NSA). Conducting and documenting the results of supervisory 

activities uses a combination of applications, including the Large Bank Institutional Database 

(LBID), eDocs and EV. These applications enable continuous updating and monitoring of an 

institution’s structure, risk profile, and supervisory ratings and issues. Specific exam areas are 

supported with specific tools to improve efficiency and promote consistent analysis and 

documentation, such as National Credit Tool, which is used in credit examinations. 

Additionally, on-going portfolio analysis is undertaken with the use of several analytical tools 

such as Financial Institution Data Retrieval System (FINDRS), Microsoft Reporting Services 

(SIS Reports), Data Analytics Reporting Tools (DART), Canary benchmark ratios and custom 

Tableau data visualizations. These tools, as well as a portfolio of standard analytic reports, 

facilitate supervisory risk assessments from a macro view of the institutions at several levels. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 81

Additional 

criteria 

AC1 The supervisor has a framework for periodic independent review, for example by an internal 

audit function or third party assessor, of the adequacy and effectiveness of the range of its 

available supervisory tools and their use, and makes changes as appropriate.

Description and 

findings re AC1 

The Government Accountability Office is authorized to conduct periodic audits of the U.S. 

Federal banking agencies. Such audits may include a review or evaluation of the 

international regulation, supervision, and examination activities of the appropriate Federal 

banking agency, including the coordination of such activities with similar activities of 

regulatory authorities of a foreign government or international organization. Additionally, 

the Office of Inspector General (OIG) for each of the U.S. FBAs conducts internal audits of the 

agency. The OIG of the Department of the Treasury has audit authority with respect to the 

OCC. The purpose of the OIG is: to conduct and supervise audits and investigations relating 

to the programs and operations of the agencies; to provide leadership and coordination and 

recommend policies intended to promote economy, efficiency, and effectiveness in the 

administration of, and to prevent and detect fraud and abuse in, such programs and 

operations; and to provide a means to keep the head of the agency and the Congress fully 

informed and up-to-date about problems and deficiencies relating to the administration of 

such programs and operations and the necessity for and progress of corrective action. 

Assessment of 

Principle 9

Largely Compliant 

Comments The assessors found that the U.S. agencies have an array of tools and techniques to carry out 

their supervisory responsibilities and furthermore that they are also developing new 

techniques, such as stress testing and horizontal reviews. 

As noted in CP6, there is no explicit regulatory requirement for a bank to immediately report 

if they find that a major shareholder is no longer suitable. Nor did the assessors see any 

evidence of such reporting in the written documentation. The assessors recommend that 

such a supervisory requirement is introduced, with the aim to ensure that supervisors are 

promptly informed if a major shareholder is no longer suitable, since this might have a 

negative impact on the safety and soundness of the bank. 

Traditionally the U.S. approach has been dominated by on-site examinations and 

consequently (as noted in EC 10) there are few requirements for banks to report to the 

regulator. Although the assessors accepted that the extent of examination was a mitigant to 

an extent, the assessors viewed this omission as a cause for increasing concern. Not least 

because the assessors detected a noticeable shift towards more analysis (and, of course, 

stress testing takes up a significant level of resource). The assessors believe the absence of 

reporting poses three main risks: 

 It creates a potential single source of failure should the examination process not 

discover the change in activity; 

 It removes the onus on banks to consider what they should be telling their regulator 

in order to be in compliance; and 

 it potentially leads to a delay in the ability of the supervisor’s to respond until the 

next examination or next contact. 

The assessors also noted that there was room for improvement in the ways the regulators 

communicated with banks. The assessors would make four observations: 
UNITED STATES 

82 INTERNATIONAL MONETARY FUND

 the size of some letters and reports are extensive and can often lose key messages - 

particularly when addressed to Board of Directors. This is particularly the case where 

there are extensive MRAs or observations in terms particular credit loans or 

transactions (EC4); 

 supervisors often conflated the board and senior management (a tendency the 

assessors also tend to find in guidance) when in many cases the role of the two are 

different (EC8); 

 in some examples the assessors found supervisors had used what the assessors 

considered to be excessive praise in their communication to banks. The assessors 

regard this as different from supervisors making sound judgments and producing a 

balanced piece of feedback to the banks. The assessors would recommend that 

supervisors should consider their communication strategy in this respect (EC4); and 

 The assessors also noted that supervisors seemed to spend a large amount of time 

recounting the recent events in the bank to the bank themselves. This is not to say 

that supervisors should not put their own judgments into context, but the assessors 

felt that the histories could be reduced a little with no loss of context (EC4). 

The assessors were pleased to see that management were trying to tackle several issues with 

MRAs (the assessors were shown some draft guidance to examiners drawn up by the OCC)—

such as those which had been outstanding for some time and also where they had not been 

drafted clearly enough to begin with. The assessors would support further clarity in this area.

The assessors noted that the supervisors were making greater efforts to collaborate, but the 

assessors did note that this could go further if planning cycles were aligned. At the moment 

with one regulator beginning their planning much earlier, it runs the risk that resources are 

committed before another regulator has completed their plan and made a bid for assistance.

As noted in EC4, there is a greater emphasis on horizontal reviews and the assessors 

welcomed this development. However the assessors urged that supervisory expectations 

should be clearly established at the outset of such reviews. The absence of such clarity, runs 

the risk of regulatory creep as supervision is increasingly set against the best practice within 

a peer-group, which may mean an inadequate standard because the peer-group as a whole 

does not include a good exemplar. 

Principle 10 Supervisory reporting. The supervisor collects, reviews and analyses prudential reports and 

statistical returns39 from banks on both a solo and a consolidated basis, and independently 

verifies these reports through either on-site examinations or use of external experts. 

Essential criteria 

EC1 The supervisor has the power40 to require banks to submit information, on both a solo and a 

consolidated basis, on their financial condition, performance, and risks, on demand and at 

regular intervals. These reports provide information such as on- and off-balance sheet assets 

and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations 

(including by economic sector, geography and currency), asset quality, loan loss 

provisioning, related party transactions, interest rate risk, and market risk. 

 

39 In the context of this Principle, “prudential reports and statistical returns” are distinct from and in addition to 

required accounting reports. The former are addressed by this Principle, and the latter are addressed in Principle 27. 

40 Please refer to Principle 2.
UNITED STATES 

INTERNATIONAL MONETARY FUND 83

Description and 

findings re EC1 

The FBAs have an extensive reporting framework and have the authority to require 

information needed for supervisory purposes at regular intervals and upon demand. The 

authority is broad, extending to affiliates of a bank or holding company and including 

information on a bank’s or holding company’s domestic and foreign operations. The FBAs 

collaborate on an interagency basis to maintain regulatory reports under the FFIEC. 

Banks and holding companies are required to submit information on their financial 

condition, performance and risks. Required reports provide information on balance sheet 

assets and liabilities, off-balance-sheet exposures, profit and loss, capital adequacy, asset 

quality, loan loss provisioning, affiliate and insider transactions. They also provide 

information allowing for an assessment of liquidity, large exposures, asset concentrations 

(including by economic sector, geography and currency), foreign exposures, interest rate risk 

and market risk. The volume of information reported has increased substantially since the 

crisis in the context of regulatory changes, enhanced supervisory oversight of capital and 

liquidity management, and supervisory stress testing. 

The framework for standard reporting is that individual banks must submit reports to the 

appropriate FBA on a consolidated basis (i.e. capturing the bank and its subsidiaries). There 

is no bank reporting on a solo (banking entity only) basis. Bank holding companies with 

consolidated assets of $500 million or more and savings and loan holding companies of all 

sizes must also submit financial and supervisory information on a consolidated basis. A 

parent holding company must submit reports that include financial statements on a “standalone” basis and also include information on related party transactions. Moreover, a report 

must be submitted regarding certain related party transactions between the holding 

company and affiliates. In addition, all other U.S. nonbank subsidiaries and foreign 

subsidiaries of holding companies are subject to reporting requirements that include 

financial and supervisory information if these entities exceed certain size thresholds. 

Under the final rules giving effect to the Volcker Rule, banking entities with significant 

trading operations are required to calculate and report metrics of their trading activity, by 

trading desk, to allow the FBAs to assess whether such trading activity is consistent with 

permitted trading activities in scope, type, and profile. The reporting requirements are being 

phased in based on the type and size of the entity’s trading activities. 

EC2 The supervisor provides reporting instructions that clearly describe the accounting standards 

to be used in preparing supervisory reports. Such standards are based on accounting 

principles and rules that are widely accepted internationally. 

Description and 

findings re EC2 

By statute, banks and holding companies are required to apply accounting principles that 

are uniform and consistent with U.S. GAAP in preparing and submitting financial reports to 

FBAs (see 12 U.S.C. § 1831n(a)(2)). Although they have the power to adopt more stringent 

requirements, the FBAs have generally chosen to adopt U.S. GAAP for regulatory reporting. 

In certain instances, however, reports allow the alternative of International Financial 

Reporting Standards (IFRS) or national accounting standards, provided the alternative is no 

less stringent than U.S. GAAP. 

EC3 The supervisor requires banks to have sound governance structures and control processes 

for methodologies that produce valuations. The measurement of fair values maximizes the 

use of relevant and reliable inputs and is consistently applied for risk management and 

reporting purposes. The valuation framework and control procedures are subject to 

adequate independent validation and verification, either internally or by an external expert. 

The supervisor assesses whether the valuation used for regulatory purposes is reliable and 

prudent. Where the supervisor determines that valuations are not sufficiently prudent, the 

supervisor requires the bank to make adjustments to its reporting for capital adequacy or 
UNITED STATES 

84 INTERNATIONAL MONETARY FUND

regulatory reporting purposes. 

Description and 

findings re EC3 

The FBAs ensure that banks develop and maintain a strong governance framework, policies 

and controls that ensure the effectiveness of methodologies that produce valuations. The 

FBAs ensure reliability of the data by verifying that banks maintain a robust validation 

process commensurate with the risk in valuation methodologies and models and that the 

validation process is comprehensive, rigorous and effective. The assessors reviewed 

examples of supervisory reviews of valuation processes. In situations where the validation 

process is deemed unacceptable, the supervisor will require adjustments to the reported 

amounts. The FBAs review the effectiveness of the internal audit function and verify that the 

bank board annually reviews and approves model risk management policies. 

U.S. GAAP applies various measurement models to different categories of assets and 

liabilities. Certain assets and liabilities are reported on a historical cost or amortized cost 

basis, while the application of lower of cost or fair value and fair value accounting (with 

changes in fair value reported in earnings or other comprehensive income as appropriate) is 

required under other circumstances. For example, loans held for investment are accounted 

for at historical cost and loans held for sale are measured at the lower of cost or fair value 

(unless the fair value option is elected), whereas trading assets and liabilities are measured at 

fair value with changes in fair value included in earnings. A bank or holding company that 

elects the fair value option is expected to apply sound risk management and control 

practices to the assets and liabilities accounted for at fair value. The current use of the fair 

value option under U.S. GAAP is generally limited to larger, more complex banks and 

holding companies. 

EC4 The supervisor collects and analyses information from banks at a frequency commensurate 

with the nature of the information requested, and the risk profile and systemic importance of 

the bank. 

Description and 

findings re EC4 

The FBAs collect and analyse information quarterly from all banks, bank holding companies 

with consolidated assets of $500 million or more,, and savings and loan holding companies 

of all sizes. All federal banks and savings and loan associations, regardless of size, need to 

file quarterly Call Reports. If the BHC is below the $500 million threshold, it submits a 

parent-only report on a semi-annual basis. In addition, reports from other subsidiaries, such 

as non-bank subsidiaries, in the BHC are required to be submitted either quarterly or 

annually, depending of the size and nature of the subsidiary. 

At large banks or holding companies where the FBAs have on-site examination teams, 

supervisors receive frequent risk management reports that allow them to monitor the 

entity’s condition and trends in key portfolios and risk segments. The FBAs may direct 

individual banks and holding companies to provide information on a more frequent basis, 

depending on their risk profile. For example, monthly reports on key risk areas may be 

required from banks and holding companies that are identified as posing special supervisory 

concerns or that are subject to certain enforcement actions. In some situations, daily reports 

may be received on key funding or liquidity issues; key institutions provided daily liquidity 

reports during the crisis and continue to do so. 

EC5 In order to make meaningful comparisons between banks and banking groups, the 

supervisor collects data from all banks and all relevant entities covered by consolidated 

supervision on a comparable basis and related to the same dates (stock data) and periods 

(flow data). 

Description and 

findings re EC5 

The FBAs collect reports on the same dates for all banks on a quarterly basis and for all 

entities in the consolidated holding company. While the frequency may differ given the size 
UNITED STATES 

INTERNATIONAL MONETARY FUND 85

and nature of the entity, the reporting dates are as of the calendar quarter end. Banks and 

holding companies are required to complete reports using a standard set of reporting 

instructions, thereby ensuring comparability of reported items between banks and holding 

companies. 

The FBAs work together to ensure, to the extent possible, that the information reported at 

the subsidiary level is comparable to information that is collected at the consolidated 

holding company level. In addition, any revisions to supplemental reports for other entities 

(e.g. a nonbank subsidiary report) are driven by changes made to the bank report and the 

holding company report, which helps ensure that comparable information is reported across 

the holding company. 

EC6 The supervisor has the power to request and receive any relevant information from banks, as 

well as any entities in the wider group, irrespective of their activities, where the supervisor 

believes that it is material to the condition of the bank or banking group, or to the 

assessment of the risks of the bank or banking group or is needed to support resolution 

planning. This includes internal management information. 

Description and 

findings re EC6 

Collectively, the FBAs have broad statutory authority to obtain a wide array of information 

from supervised banks and holding companies, including financial data and information on 

their activities, operations, structure, corporate governance, risk management and other 

information needed by supervisors (see CP 1, EC 5). Banks and holding companies must 

provide supervisors with full and complete access to their books, records and employees 

(including directors); failure to do so can result in the imposition of administrative sanctions. 

These requirements extend to the foreign operations of U.S. banks and holding companies; 

however, the laws of foreign host countries may restrict the sharing of information with the 

FBAs. 

Under their statutory authorities, the FBAs have the power to request and receive any 

relevant information from banks and holding companies, irrespective of their activities, 

where the supervisor believes that it is material to their financial situation, or to the 

assessment of the risks of the bank or holding company. This includes internal management 

information (see e.g. 12 U.S.C. § 161(a) and (c)). Affiliates of banks and holding companies 

that may generally be exempt from reporting certain information can also be required to do 

so by their FBA. In addition, an agency may request information from the functional 

supervisor for entities it does not supervise, although this authority is limited by the 

requirement that the FBAs must rely to the fullest extent possible on the relevant functional 

supervisor (see e.g. 12 U.S.C. §§ 1831v and 1844(c)(2)(E)). 

EC7 The supervisor has the power to access41 all bank records for the furtherance of supervisory 

work. The supervisor also has similar access to the bank’s Board, management and staff, 

when required. 

Description and 

findings re EC7 

The FBAs have the authority to review all books and records of a bank or holding company 

that are deemed necessary for supervisory purposes. The agencies have access to the bank’s 

or holding company’s board, management and staff when required to discuss supervisory 

matters. Furthermore, the agencies have the authority to require a bank or holding company 

to submit any information if there is a supervisory need, even when it would not be 

otherwise required to submit such information. 

 

41 Please refer to Principle 1, Essential Criterion 5. 
UNITED STATES 

86 INTERNATIONAL MONETARY FUND

EC8 The supervisor has a means of enforcing compliance with the requirement that the 

information be submitted on a timely and accurate basis. The supervisor determines the 

appropriate level of the bank’s senior management is responsible for the accuracy of 

supervisory returns, imposes sanctions for misreporting and persistent errors, and requires 

that inaccurate information be amended. 

Description and 

findings re EC8 

Banks and holding companies are required by statute to comply with reporting requirements 

and information disclosure requests of FBAs. A failure to comply (including by submitting an 

untimely report or through misreporting or persistent errors) can provide the basis for 

informal or formal enforcement measures, including cease-and-desist proceedings and the 

imposition of a civil monetary penalty, against a bank or holding company and/or its 

institution-affiliated parties (IAPs). Under certain circumstances, a culpable IAP also may be 

subject to suspension and debarment. See 12 U.S.C. §§ 1817(a) and 1818(b) and (i). The 

agencies can require banks and holding companies to amend previously filed reports when 

material errors have occurred. The consolidated regulatory reports for banks and holding 

companies require attestation by the Chief Financial Officer (CFO) and bank-level regulatory 

reports also require attestation by three members of the board. 

Banks and holding companies that are also public companies are required to file reports with 

the SEC and banks that are required to file reports with their primary FBA, are required by 

the Sarbanes-Oxley Act of 2002 to obtain an annual audit of their financial statements and 

their internal controls over financial reporting. Public company officers must acknowledge in 

writing that they have evaluated the company’s internal financial controls and the Chief 

Executive Officer (CEO) and Chief Financial Officer (CFO) are required to sign and certify that 

they have reported to the independent auditors and to the audit committee all information 

regarding material weakness and significant deficiencies in internal controls that could 

adversely affect the company's ability to provide accurate financial reports. See 15 U.S.C. § 

7241. 

For banks with assets of $1 billion or more, the FDIC requires that the bank’s management 

annually prepare and submit to the appropriate FBA, and any appropriate state bank 

supervisor, a management report that includes (1) a statement of management’s 

responsibilities for preparing the bank’s annual financial statements, for establishing and 

maintaining an adequate internal control structure and procedures for financial reporting, 

and for complying with certain designated laws and regulations relating to safety and 

soundness; (2) an assessment by management of the bank’s compliance with such laws and 

regulations during the fiscal year; and (3) an assessment by management of the effectiveness 

of such internal control structure and procedures as of the end of the fiscal year. Banks with 

assets of $500 million or more, but less than $1 billion, must prepare and submit annually a 

management report that includes items (1) and (2). See 12 CFR 363.2. These particular 

requirements do not apply to holding companies, although statutes and regulations provide 

that, in certain instances, the audit requirements may be satisfied at the holding company 

level. 

EC9 The supervisor utilizes policies and procedures to determine the validity and integrity of 

supervisory information. This includes a program for the periodic verification of supervisory 

returns by means either of the supervisor’s own staff or of external experts.42

Description and The FBAs review and verify regulatory reports during the course of on-site examinations of 

 

42 Maybe external auditors or other qualified external parties, commissioned with an appropriate mandate, and 

subject to appropriate confidentiality restrictions. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 87

findings re EC9 banks and holding companies. In addition, the FBAs utilize extensive off-site automated 

programs that provide validity and quality checks (“edits”) against the regulatory reports 

submitted. Some edits check the mathematical accuracy of certain areas of the regulatory 

reports (“validity edits”) while other edits review relationships between various aspects of the 

reports and certain qualitative measures (“quality edits”). The assessors saw examples of 

quality edits. All edit exceptions must either be corrected or explained. If an edit explanation 

provided by a bank or holding company is found to be unacceptable by the relevant FBA, 

additional investigative work is performed with that bank or holding company until the edit 

exception is resolved (sometimes resulting in amended reports). There cannot be any validity 

edit exceptions on the regulatory reports and all quality edit exceptions must be considered 

reasonable by the FBA before the report is accepted. The FBAs do not use external experts to 

verify supervisory returns. 

EC10 The supervisor clearly defines and documents the roles and responsibilities of external 

experts,43 including the scope of the work, when they are appointed to conduct supervisory 

tasks. The supervisor assesses the suitability of experts for the designated task(s) and the 

quality of the work and takes into consideration conflicts of interest that could influence the 

output/recommendations by external experts. External experts may be utilized for routine 

validation or to examine specific aspects of banks’ operations. 

Description and 

findings re EC10 

The FBAs generally do not utilize external experts to perform supervisory tasks. However, on 

an as-needed basis or during periods where staffing needs to be augmented, the FBAs may 

use external experts to perform specific tasks such as commercial credit reviews. Tasks and 

deliverables are outlined in a formal contract with a defined timeline. Further, these roles are 

typically filled with former supervisors or subject matter experts who are supervised by 

agency personnel. 

EC11 See EC 10 above and CP 9 EC 11. The supervisor requires that external experts bring to its 

attention promptly any material shortcomings identified during the course of any work 

undertaken by them for supervisory purposes. 

Description and 

findings re EC11 

When the FBAs engage consultants or external experts, such experts and consultants are 

under the direct supervision of on-site agency personnel and, as a result, their findings are 

promptly reported to the agencies. 

EC12 The supervisor has a process in place to periodically review the information collected to 

determine that it satisfies a supervisory need. 

Description and 

findings re EC12 

The FBAs review all FFIEC reports for relevance on a periodic basis under the direction of the 

FFIEC’s Task Force of Reports. In addition, the Paperwork Reduction Act (PRA) requires 

periodic review of all regulatory reports and the Office of Management and Budget (OMB) 

must approve all reports for extensions of existing collections, as well as new and revised 

collections. See 44 U.S.C. §§ 3501-3521. The OMB is responsible for ensuring that regulations 

are based on sound analysis and that the information collected satisfies a supervisory need. 

This statutory review process predates the financial crisis. 

The FBAs conducted their most recent five-yearly review of data collected in the Call Report 

in November 2012. Information determined to be no longer necessary or appropriate as a 

result of this review will be eliminated after appropriate notice and comment pursuant to the 

 

43 Maybe external auditors or other qualified external parties, commissioned with an appropriate mandate, and 

subject to appropriate confidentiality restrictions. External experts may conduct reviews used by the supervisor, yet it 

is ultimately the supervisor that must be satisfied with the results of the reviews conducted by such external experts. 
UNITED STATES 

88 INTERNATIONAL MONETARY FUND

PRA. 

In addition, the FFIEC and the FBAs are required to conduct a review of all their regulations 

to identify outdated, unnecessary or unduly burdensome regulations applicable to insured 

depository institutions. The FFIEC and the FBAs must conduct this review at least once every 

10 years; the next review must be completed by December 31, 2016. 

Assessment of 

Principle 10

Compliant 

Comments The FBAs have a long-established and effective regulatory reporting framework, with the 

flexibility, demonstrated through the crisis, to expand reporting requirements in response to 

pressing supervisory needs. At the same time, reporting demands are subject to periodic 

public reviews of reporting burden and to information collection budgets in each agency. 

These are important disciplines to guard against redundant data items and information 

overreach; banks to which the assessors spoke expressed concern that some reporting 

requirements generate data of little use to the banks themselves or are not aligned with 

their way of conducting activities, requiring them to generate reports simply to satisfy 

supervisory needs. At the same time, cost-benefit analysis in this area can easily understate 

the safety-and-soundness benefits of supervisory access to timely and relevant data, which 

are extremely difficult to quantify. With the crisis passed, the FBAs are encouraged to review 

the level of granularity of data collected, particularly for stress testing and liquidity analysis 

purposes, to ensure that data continues to be needed at that level. 

The FBAs do not collect data from banks at the solo level (i.e. at the level of the bank 

excluding its subsidiaries). In principle, this would appear a significant deviation from CP 10; 

it means that supervisors and market participants may not have the information to test 

whether a bank is adequately capitalized on a stand-alone basis. However, the assessors 

understand that, in practice, this omission is not sufficiently material in its impact to warrant 

a lower rating for CP 10 under current circumstances. U.S. bank subsidiaries tend to be small 

relative to the parent bank and can only undertake limited activities that the bank itself 

could undertake in its own name. Nonetheless, the assessors recommend that future Core 

Principles assessments verify that these circumstances have continued to apply. Supervisors 

should closely monitor the development of banking groups and consider introducing solo 

level reporting if the number or size of bank subsidiaries were to expand or banking groups 

become less transparent. The assessors also note that the Basel capital framework applies at 

every tier within a banking group on a fully consolidated basis. 

Principle 11 Corrective and sanctioning powers of supervisors. The supervisor acts at an early stage to 

address unsafe and unsound practices or activities that could pose risks to banks or to the 

banking system. The supervisor has at its disposal an adequate range of supervisory tools to 

bring about timely corrective actions. This includes the ability to revoke the banking license 

or to recommend its revocation. 

Essential criteria 

EC1 The supervisor raises supervisory concerns with the bank’s management or, where 

appropriate, the bank’s Board, at an early stage, and requires that these concerns be 

addressed in a timely manner. Where the supervisor requires the bank to take significant 

corrective actions, these are addressed in a written document to the bank’s Board. The 

supervisor requires the bank to submit regular written progress reports and checks that 

corrective actions are completed satisfactorily. The supervisor follows through conclusively 

and in a timely manner on matters that are identified.

Description and Generally, the FBAs identify problems or deficiencies at a bank or holding company during 
UNITED STATES 

INTERNATIONAL MONETARY FUND 89

findings re EC1 on-site examinations. Most problems or deficiencies are resolved informally during the 

course of the examination, when the bank or holding company immediately takes steps to 

correct or commits to promptly correct the problems or deficiencies and address the 

regulatory concerns. At the conclusion of the examination of a bank, supervisors send a 

written “Report of Examination” (ROE) to the bank for review by all directors and senior 

officers. The ROE assesses the condition of the bank’s capital, asset quality, management, 

earnings, liquidity and sensitivity to market risk (CAMELS); identifies violations of law; 

assesses compliance with the BSA; and addresses compliance with consumer laws and 

regulations, information technology, and the CRA. The narrative of the ROE also calls 

attention to “concerns” or matters that need attention (MRAs and MRIAs/MRBAs). For 

further discussion on MRAs, see CPs 8 and 9. (Example of an agency’s policy of 

communicating examination findings: The Federal Reserve’s 2013 supervisory letter 

“Supervisory Considerations for the Communication of Supervisory Findings”). Similar 

reports are issued after the inspection of holding companies. 

Some problems or deficiencies may not be satisfactorily addressed through the informal 

means mentioned above, especially if problems or deficiencies are serious, pervasive, or 

repeated. In such cases the supervisors may take supervisory actions (further described in 

ECs 2, 3 and 4 below). Generally, supervisory actions require a bank or holding company to 

take certain affirmative actions and make periodic (monthly or quarterly) written reports to 

the relevant agency (-ies) on the progress that the bank or holding company has made to 

address the deficiencies identified. Detailed policies and action plans with target dates may 

be requested from a bank or holding company, and supervisors will review the plan for 

sufficiency and examine progress against key milestone dates. 

EC2 The supervisor has available44 an appropriate range of supervisory tools for use when, in the 

supervisor’s judgment, a bank is not complying with laws, regulations or supervisory actions, 

is engaged in unsafe or unsound practices or in activities that could pose risks to the bank or 

the banking system, or when the interests of depositors are otherwise threatened.

Description and 

findings re EC2 

The FBAs have a wide range of supervisory options when a bank or holding company is not 

complying with the laws, regulations or supervisory orders, or is engaged in an unsafe or 

unsound practice. The agencies may take prompt remedial action and impose penalties, 

including a divestiture of activities or control of an entity. The range of tools is applied in 

accordance with the gravity of a situation. 

Such action may include requiring the bank’s or holding company’s board of directors to 

adopt a resolution to cure the deficiencies, sign a commitment letter, develop and 

implement a safety and soundness plan, conform to institution-specific minimum capital 

ratios established by the agencies (applicable only to banks), or execute a memorandum of 

understanding with the supervisor. 

In the event that the problems are pervasive, repeated, unresolved by management, or 

otherwise of serious concern, the agencies may exercise their statutory enforcement 

authority by taking formal enforcement action. Such actions include (i) Formal or Written 

Agreements; (ii) Cease and Desist Orders; (iii) Safety and Soundness Orders; (iv) Capital 

Directives; (v) PCA Directives; (vi) Civil Money Penalty Assessments. FBAs may also take 

temporary injunctive action using a temporary C&D order under certain conditions. The 

federal enforcement statutes associated with such actions are the same for all of the 

 

44 Please refer to Principle 1.
UNITED STATES 

90 INTERNATIONAL MONETARY FUND

agencies. 

In determining whether a formal enforcement action, as mandated by 12 U.S.C. 1818, is 

appropriate, the agency staffs consider all relevant factors, including the nature, severity and 

duration of the problem, the risks presented at the bank or holding company, the 

anticipated resources and actions necessary to resolve the problem, and the responsiveness 

of the directors and management, Under certain circumstance, the federal enforcement 

statutes require formal enforcement action, rather than giving the agency discretion to 

pursue a formal action. Formal enforcement actions are legally enforceable, remain in effect 

until modified or terminated, and must be publicly disclosed by the appropriate agency. 

All informal supervisory actions are entered into with the consent of the bank or holding 

company. Formal enforcement actions are generally issued with the consent of the bank or 

holding company. Should the bank or holding company decline to consent to a formal 

enforcement action, the agency may initiate a contested judicial proceeding to impose the 

formal action upon the institution. In cases where there is (i) an immediate threat to the 

viability of the bank or holding company or ongoing unsafe and unsound practices or (ii) the 

institution ́s books and records are so incomplete or inaccurate that the agency is unable to 

determine the financial conditions of the institution, an agency may immediately issue a 

temporary order to cease and desist (notwithstanding the ongoing contested proceeding). 

EC3 The supervisor has the power to act where a bank falls below established regulatory 

threshold requirements, including prescribed regulatory ratios or measurements. The 

supervisor also has the power to intervene at an early stage to require a bank to take action 

to prevent it from reaching its regulatory threshold requirements. The supervisor has a range 

of options to address such scenarios. 

Description and 

findings re EC3 

A PCA regime (the PCA statute at 12 U.S.C. § 1831 o.) applies to those instances in which a 

bank’s capital ratios fall below the stipulated minima. The regime encourages intervention at 

an early stage, also before the thresholds have been violated, to resolve issues and prevent 

further deterioration. For instance, any bank which is less than adequately capitalized cannot 

pay dividends and must submit a capital restoration plan that is acceptable to the supervisor. 

(See the description of the PCA in CP 16, EC1) 

The supervisor also have powers to act if a bank or holding company violates other 

regulatory threshold requirements, for instance on large exposures. 

Supervisors may also act if banks fall below the regulatory minima for liquidity. See CP 24. 

EC4 The supervisor has available a broad range of possible measures to address, at an early 

stage, such scenarios as described in essential criterion 2 above. These measures include the 

ability to require a bank to take timely corrective action or to impose sanctions 

expeditiously. In practice, the range of measures is applied in accordance with the gravity of 

a situation. The supervisor provides clear prudential objectives or sets out the actions to be 

taken, which may include restricting the current activities of the bank, imposing more 

stringent prudential limits and requirements, withholding approval of new activities or 

acquisitions, restricting or suspending payments to shareholders or share repurchases, 

restricting asset transfers, barring individuals from the banking sector, replacing or 

restricting the powers of managers, Board members or controlling owners, facilitating a 

takeover by or merger with a healthier institution, providing for the interim management of 

the bank, and revoking or recommending the revocation of the banking license. 

Description and 

findings re EC4 

Possible remedial measures include restricting the current activities and operations of the 

bank or holding company; withholding or conditioning approval of new activities or 

acquisitions; restricting or suspending payments to shareholders or share repurchases; 
UNITED STATES 

INTERNATIONAL MONETARY FUND 91

restricting asset transfers; barring individuals from banking; replacing or restricting the 

powers of managers, directors, or controlling owners; facilitating a takeover or merger; 

providing for the interim management of the bank or holding company ; revoking or 

recommending the revocation of the banking license; revoking membership in the Federal 

Reserve; and terminating deposit insurance. 

The FBAs may also restrict a bank or holding company’s growth; or require it to dispose of 

any loan or asset involved in the violation or unsafe or unsound practice; require it to 

employ qualified officers and employees; and take any other action that the agency deems 

appropriate. The provisions of formal enforcement actions may require the bank or holding 

company to stop certain action or to take affirmative action. It may be required to submit 

specific plans, policies or procedures. Common provisions require it to cure specified 

violations, correct risk management or board of directors ́ oversight weaknesses, submit a 

plan to increase or maintain sufficient capital, provide for an adequate allowance for loan 

and lease losses, and restrict the payment of dividends. 

EC5 The supervisor applies sanctions not only to the bank but, when and if necessary, also to 

management and/or the Board, or individuals therein. 

Description and 

findings re EC5 

Remedial penalties and sanctions may be applied to the institution and, when appropriate to 

management, board members, employees, and other individuals who participate in the 

institution’s affairs (Institution-Affiliated Parties or IAPs). 

The supervisors may set provisions to limit the individual’s activities at the institution, or to 

take affirmative actions, or to make restitution or reimbursement to the institution. An 

agency may suspend or remove an IAP from the institution for violations of law or other 

misconduct and prohibit an IAP from further participation in the banking industry. An 

agency may assess civil monetary penalties against an IAP under the same circumstances as 

a civil monetary penalty against a bank. 

EC6 The supervisor has the power to take corrective actions, including ring-fencing of the bank 

from the actions of parent companies, subsidiaries, parallel-owned banking structures and 

other related entities in matters that could impair the safety and soundness of the bank or 

the banking system. 

Description and 

findings re EC6 

The FBAs have the authority to impose conditions on the relationships between banks and 

any other entity, including a holding company, subsidiary, parallel owned banking 

organization, or other related company in order to prevent or address a threat to the safety 

and soundness of the bank. The agencies have broad powers to order remedial actions that 

can protect a bank from adverse actions by its holding company or affiliates. For example, 

remedial actions may limit or prohibit payments from the bank to its holding company or 

affiliates. Provisions of such enforcement actions may include restrictions on inter-corporate 

transactions, prohibitions on the holding company accepting payments from the bank, and 

requirements for the holding company to provide management and financial support to the 

bank (known as the Source of Strength doctrine as codified at 12 U.S.C. §1831o-1. 

EC7 The supervisor cooperates and collaborates with relevant authorities in deciding when and 

how to effect the orderly resolution of a problem bank situation (which could include 

closure, or assisting in restructuring, or merger with a stronger institution). 

Description and 

findings re EC7 

When a problem bank does not have the ability or resources to solve its deficiencies, the 

FBAs have authority to appoint a conservator or a receiver. The conservator takes full control 

of the bank and assumes the powers of shareholders and board of directors. The conservator 

may repudiate contracts and temporarily limit customer withdrawals and payments to 
UNITED STATES 

92 INTERNATIONAL MONETARY FUND

creditors. If the bank returns to a safe and sound condition, the conservator may return 

control to the shareholders or prepare for a sale of the bank. 

In the case of a resolution the relevant supervisory agency (ies) of a bank would cooperate 

with the resolution agency, the FDIC, to ensure a smooth process. For instance, it would 

inform the FDIC at an early stage about impending problems that might lead to a bank’s 

failure. It would also provide the FDIC with supervisory information needed for the 

resolution. It could also, on behalf of the FDIC, conduct investigations on the bank postresolution. 

Additional 

criteria 

AC1 Laws or regulations guard against the supervisor unduly delaying appropriate corrective 

actions. 

Description and 

findings re AC1 

The PCA statute and regulations require early intervention by supervisors to address capital 

shortfalls of banks. The capital levels triggering supervisory action are clear and objective, 

and many of the associated remedial measures are mandatory. 

Aside from the PCA, there are generally no specific statutory requirements that establish 

timetable for taking supervisory action. However, formal enforcement actions generally are 

implemented within a reasonable time frame. Moreover, formal enforcement actions and 

most other supervisory measures, such as MRAs and MRIAs, establish timeframes for each of 

the actionable articles in the enforcement action. Each FBA has instituted tracking of matters 

that a bank needs to address, whether as a result of MRAs, etc., set forth in exam reports or 

deadlines set in enforcement actions. For instance, the Federal Reserve has established a 

Performance Measurement Program that tracks the type of MRA/MRIA found in 

examinations on a quarterly basis and measures the response time for correction of such 

deficiencies. 

The agencies maintain a time limit of 45 days between the end of a supervisory full-scope 

examination and the sending of the Supervisory Letter to the bank, but this limit may be 

prolonged for various reasons in individual cases. 

AC2 When taking formal corrective action in relation to a bank, the supervisor informs the 

supervisor of non-bank related financial entities of its actions and, where appropriate, 

coordinates its actions with them. 

Description and 

findings re AC2 

The “Policy Statement on Interagency Notification and Coordination of Enforcement Actions” 

discusses federal banking agency coordination. The U.S. FBAs work together to address 

supervisory concerns of common interest. Coordination with non-banking regulators on 

enforcement action s coordinated on a case-by- case basis, in particular when the 

enforcement action is to be published. The Federal Reserve, as the “umbrella supervisor” of 

holding companies of holding companies and their subsidiaries, relies on the federal and 

state supervisors of “functionally regulated” subsidiaries, such as broker dealers and 

insurance companies, to examine these companies and to take supervisory actions when 

appropriate. The Federal Reserve coordinates its actions and share information where 

appropriate with the FBAs and other agencies, foreign supervisors and sectoral regulators. 

Also, the FSOC could in certain circumstances be a forum for coordination and informationsharing when formal corrective action is being taken against a systemically important 

institution. 

Assessment of Compliant 
UNITED STATES 

INTERNATIONAL MONETARY FUND 93

principle 11

Comments The authorities are recommended to consider implementing rules for promoting early action 

also for other issues than bank capital and liquidity. The advantages of a prompt correction 

regime are that it provides transparency to the supervisory process and to the expectations 

on the supervised institutions, while mitigating against forbearance. However, it is important 

that there is adequate flexibility in the regime since a too-rigid framework would not be able 

to deal with different situations. 

The assessors acknowledge that the U.S. legislation, regulations, and processes for taking 

supervisory action (informal or formal) are robust and have been further strengthened in 

recent years. For instance, the assessors noted earlier cases in which the escalation of 

supervisory measures, when warranted, took longer than appropriate given the severity of 

the deficiency at hand. However, in recent years there has been a clear reduction in such 

cases, reflecting the authorities’ new and more explicit rules and stricter implementation. The 

assessors recommend the authorities to continue on this path, for instance by setting even 

more explicit rules for the ageing of MRAs and MRIAs. The evolving practice of setting 

timelines for the completion of remedial actions, and requiring regular reporting of progress, 

is encouraged by the assessors. The assessors also encourage the implementation of 

planned OCC guidance on supervisory practices relating to MRAs 

The assessors saw ample evidence of both informal and formal enforcement actions 

undertaken by the FBAs. Subject to the comments above, the assessors found that the 

authorities do use the options available to make banks take remedial action and that the 

follow-up process is adequate. 

Principle 12 Consolidated supervision. An essential element of banking supervision is that the 

supervisor supervises the banking group on a consolidated basis, adequately monitoring 

and, as appropriate, applying prudential standards to all aspects of the business conducted 

by the banking group worldwide.45

Essential criteria 

EC1 The supervisor understands the overall structure of the banking group and is familiar with all 

the material activities (including non-banking activities) conducted by entities in the wider 

group, both domestic and cross-border. The supervisor understands and assesses how 

group-wide risks are managed and takes action when risks arising from the banking group 

and other entities in the wider group, in particular contagion and reputation risks, may 

jeopardize the safety and soundness of the bank and the banking system. 

Description and 

findings re EC1 

The Federal Reserve is the consolidated supervisor for U.S. banking holding companies 

(BHCs)—including financial holding companies (FHCs)—and for savings and loans holding 

companies (SLHCs). 

The Federal Reserve achieves a comprehensive understanding of the overall structure of 

banking groups through the ongoing supervision process. The statutes require specific prior 

approval for holding company formation, acquisitions, and commencement of new activities. 

As a part of the approval process for these transactions, the Federal Reserve evaluates a 

banking group’s structure, material activities, and risk management programs. The Federal 

Reserve also relies on the relevant primary supervisors, functional regulators, and foreign 

supervisors for information and analysis about other entities within a holding company 

 

45 Please refer to footnote 19 under Principle 1. 
UNITED STATES 

94 INTERNATIONAL MONETARY FUND

structure. 

Section 604 of the DFA makes it easier for the Federal Reserve to obtain information directly 

from BHC subsidiaries, including functionally regulated subsidiaries. The provision also 

grants the Federal Reserve examination authority over BHC subsidiaries, including 

functionally regulated subsidiaries, to inform itself of (1) the nature of the operations and 

financial condition of the BHC and the subsidiaries; (2) the financial, operational and other 

risks within the BHC system that may pose a threat to the safety and soundness of the BHC 

or any of its depository subsidiaries or the stability of the financial system of the U.S., and 

(3) the systems of the BHC for monitoring and controlling the foregoing risks. In exercising 

this authority, the Federal Reserve must rely to the fullest extent possible on examination 

reports prepared by a functional regulator and notify the functional regulator before 

conducting an examination of the functionally regulated subsidiary. Section 604 of the DFA 

repealed a provision of the GLB Act that barred the Federal Reserve from exercising 

enforcement or rulemaking authority over functionally regulated subsidiaries except in 

extraordinary circumstances. 

In conjunction with state bank supervisors, the U.S. FBAs have a number of formal and 

informal mechanisms to facilitate consolidated supervision. These mechanisms cover, among 

other things, the coordination of examinations, communication protocols for emergency 

situations, and information sharing related to electronic databases containing examination 

reports, financial records, and other supervisory information. In addition, functional 

regulators, such as the SEC, the CFTC, and state insurance supervisors exchange information 

with the FBAs related to securities and insurance companies in a holding company or a 

financial conglomerate that includes a bank. Normally, the FBAs would rely on information 

provided by the functional regulators before making their own requests. U.S. law authorizes 

the U.S. FBAs to exchange financial records, examination reports, and other information 

regarding banks and holding companies. 

In addition, structural changes have by themselves implied improved consolidated 

supervision. An increasing number of insurance companies have acquired thrifts, which 

means that the holding companies will be supervised by the Federal Reserve on a 

consolidated basis. 

Also, the scope of supervision of the largest groups has been broadened and examination 

teams now include, for instance, macroeconomic experts, IT experts and legal experts in 

addition to prudential supervisors. 

The stress-testing requirements for all holding companies having assets in excess of $50 bn, 

laid down in the DFA, apply on a consolidated basis and will increase supervisors’ 

understanding of the group’s risk profile. The Capital Plan requirements (2011) require large 

banks to submit for supervisors’ review a yearly capital plan on a consolidated basis, taking 

all material risks into account, 

The requirement in the Section 165 DFA that FBOs generally, with some exceptions, must 

form a holding company for their U.S. affiliates, has also strengthened consolidated 

supervision. 

EC2 The supervisor imposes prudential standards and collects and analyses financial and other 

information on a consolidated basis for the banking group, covering areas such as capital 

adequacy, liquidity, large exposures, and exposures to related parties, lending limits and 

group structure. 

Description and The Federal Reserve has established prudential standards to address a broad range of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 95

findings re EC2 supervisory issues and concerns. These include, but are not limited to, standards to address:

1) Resolution and recovery plans for large holding companies 

2) Capital adequacy—See responses for Principle 16 for detail. 

3) Liquidity—See responses for Principle 24 for detail. 

4) Large exposures and lending limits—See responses for Principle 19 for detail. 

5) Exposures to related parties—See responses for Principle 20 for detail. 

6) Group structure—See responses for Principle 4, Principle 6, and Principle 7 for detail. 

The Federal Reserve imposes the prudential standards on capital adequacy, risk 

management, and risk-specific measures, the internal audit and controls measures, and the 

accounting and disclosures standards on a consolidated, group-wide basis. The Federal 

Reserve requires regular financial and organizational structure reporting by all holding 

companies. Holding companies having over $500 million in assets report financial data on a 

consolidated basis, while smaller holding companies provide parent-only financial 

statements which, when combined with bank financial reports, provide an approximate 

consolidated view. Organizational structure information is updated on an ongoing basis. 

Reported information is analyzed by the Federal Reserve in conjunction with regular 

supervisory activities and as part of formal off-site monitoring programs. 

EC3 The supervisor reviews whether the oversight of a bank’s foreign operations by management 

(of the parent bank or head office and, where relevant, the holding company) is adequate 

having regard to their risk profile and systemic importance and there is no hindrance in host 

countries for the parent bank to have access to all the material information from their 

foreign branches and subsidiaries. The supervisor also determines that banks’ policies and 

processes require the local management of any cross-border operations to have the 

necessary expertise to manage those operations in a safe and sound manner, and in 

compliance with supervisory and regulatory requirements. The home supervisor takes into 

account the effectiveness of supervision conducted in the host countries in which its banks 

have material operations. 

Description and 

findings re EC3 

The Federal Reserve’s processes for understanding and assessing firm-wide legal and 

compliance risk management encompass both domestic and international operations. Under 

the Federal Reserve’s Regulation K (12 CFR part 211) (See also CP 15, EC 1), foreign branches 

and subsidiaries of U.S. banking groups must be managed to ensure their operations 

conform to high standards of banking and financial prudence and must make available to 

Federal Reserve examiners all information deemed necessary to determine compliance with 

U.S. banking laws. 

As part of the authorization process for foreign operations of U.S. banking groups, the 

applicant must describe any potential obstacles to providing necessary information to 

regulators and its parent and discuss how it will mitigate any such impediments. The U.S. 

FBAs assess the quality of supervision conducted in the countries in which its banks and 

holding companies seek to establish material operations. Once material operations are 

established, the FBAs informally evaluate host country supervisors through ongoing 

communication with host supervisors and evaluation and inspection of the cross-border 

establishments. 

The FBAs have implemented an enterprise-wide supervisory approach that cuts across legal 

entities. In carrying out this approach, the agencies evaluate the effectiveness of the bank’s 

and holding company’s policies, procedures, controls, management information systems 
UNITED STATES 

96 INTERNATIONAL MONETARY FUND

(MIS) and risk management processes across the organization. This includes audit programs, 

internal monitoring reports, and review processes that provide the organization with input 

on the performance of local managers. An assessment of cross-border operations is 

incorporated into the evaluation of key corporate governance functions and primary firmwide risk management and internal control functions, including legal and regulatory risk 

management. 

There are often issues unique to a bank’s or holding company’s international operations. For 

example, some host country legal and regulatory structures and supervisory approaches are 

fundamentally different from those in the U.S., which often requires the organization to 

devote additional resources to maintain expertise in local legal and regulatory requirements. 

In some instances, privacy concerns have led to limits on information that can be shared by a 

foreign office with its parent holding company. This can limit the parent holding company’s 

ability to exercise consolidated risk management on a global basis. In these cases, strong 

internal controls and audit processes are particularly important and hence enforced by the 

supervisors. 

For a holding company with international operations or risks, an assessment of cross- border 

operations is incorporated into the processes for developing an understanding and 

assessment of key corporate governance functions and primary firm-wide risk management 

and internal control functions. Any limits to the Federal Reserve’s ability to access 

information on host country operations or to engage in on-site activities is considered when 

assessing the appropriate extent of the organization’s activities in that jurisdiction. 

The U.S. FBAs review materials prepared by host country supervisors, including examination 

reports and assessments, and conduct ongoing communications with involved foreign and 

domestic supervisors regarding trends and assessment of cross-border operations. These 

continuous monitoring activities are supplemented, as appropriate, by examination activities 

to understand and assess the bank’s or holding company’s cross border strategy, activities, 

risks, trends, and legal entity structure and related governance, risk management, and 

internal controls. For example, in the case of large, complex banking organizations with 

foreign operations, OCC supervisors perform on-site inspections of high-risk foreign 

operations and analyze the macroeconomic and market risks in countries in which U.S. banks 

operate. 

EC4 The home supervisor visits the foreign offices periodically, the location and frequency being 

determined by the risk profile and systemic importance of the foreign operation. The 

supervisor meets the host supervisors during these visits. The supervisor has a policy for 

assessing whether it needs to conduct on-site examinations of a bank’s foreign operations, 

or require additional reporting, and has the power and resources to take those steps as and 

when appropriate. 

Description and 

findings re EC4 

Statutory provisions expressly authorize examinations of and the submission of reports by 

regulated banks and their affiliates, including foreign offices and subsidiaries. A provision of 

the International Banking Act provides for communication and cooperation with foreign 

bank supervisors (see 12 U.S.C. §3109). 

As noted in EC 3, for holding companies with international operations or risks, the FBAs 

assess cross-border operations as part of their evaluation of key corporate governance 

functions and primary firm-wide risk management and internal control functions. Also, the 

U.S. FBAs’ formal strategies for the supervision of individual banks and holding companies 

revolve around assessments of risk, and control processes, including those of foreign 

operations. On-site work is performed where risks are greatest. When foreign offices are 

inspected, supervisors meet with host supervisors. Agencies have the ability to use a wide 
UNITED STATES 

INTERNATIONAL MONETARY FUND 97

variety of approaches to supervise and have, for example, required special reports and audits 

of foreign offices. Additionally, the U.S. FBAs have worked for many years with counterparts 

from various countries to strengthen communication and cooperation as it relates to the 

supervision of banks and holding companies that operate across borders. These efforts have 

intensified in recent years and now take place in a variety of settings. 

In accordance with principles promulgated by the Financial Stability Board, the Federal 

Reserve participates with other U.S. and international supervisors in CMG meetings to 

enhance preparedness for the cross-border management and resolution of a failed global 

systemically important financial institution. The U.S. FBAs also participate in supervisory 

colleges with international supervisors. 

As discussed in Principle 13, the U.S. FBAs have formal information sharing arrangements 

with many supervisors. These arrangements set out essential elements in the areas of on-site 

inspections, ongoing coordination, and protection of information, and facilitate timely 

information sharing. Periodic visits are used to develop working relationships with many 

foreign supervisors. During these visits there are banking industry discussions and strategy 

sessions focusing on specific supervisory issues and initiatives. 

EC5 The supervisor reviews the main activities of parent companies, and of companies affiliated 

with the parent companies, that have a material impact on the safety and soundness of the 

bank and the banking group, and takes appropriate supervisory action. 

Description and 

findings re EC5 

The U.S. FBAs have implemented a comprehensive supervisory framework that evaluates the 

risks that non-banking activities conducted by banks and holding companies may pose to 

the consolidated organization. The authority for this derives from the overarching duty of 

the agencies to protect the safety and soundness of banks (12 U.S.C. § 1831p-1), including 

through the imposition of prudential safeguards. Under the FDI Act, the FDIC is also 

responsible for developing an independent risk assessment of affiliates of the insured 

depository institution and to ensure that appropriate correct actions are taken to reduce 

unreasonable risk. 

The Federal Reserve has the authority and responsibility to understand and assess the risks 

that the parent holding company and its nonbank subsidiaries may pose to the whole 

organization, its depository institution subsidiaries, and to the U.S. financial system. 

However, there is no regulated framework on capital rules for corporate and insurance 

company SLHCs. Further, no regulatory and supervisory rules, guidance, and a formal rating 

system for SLHCs have been adopted, which hinders assessment of impact of the broader 

group on safety and soundness. 

Supervisory activities: For all significant nonbanking subsidiaries and nonbanking activities of 

the parent holding company, the Federal Reserve uses two mechanisms: continuous 

monitoring and periodic examination activities. These mechanisms are utilized to: (i) 

maintain an understanding of the unit’s operations, financial condition, inherent risks, and 

risk management practices, and (ii) assess the adequacy of risk management and internal 

controls, including those relating to compliance risk. 

Periodic testing examination activities may also be used to ensure that key risk management 

and internal control practices conform to legal requirements and internal policies. The 

examination activities are also used to understand and assess operations presenting a 

moderate or greater likelihood of significant negative impact to a subsidiary bank or the 

consolidated organization. Periodic examination testing will focus on controls for identifying, 

monitoring, and controlling these risks. 
UNITED STATES 

98 INTERNATIONAL MONETARY FUND

EC6 The supervisor limits the range of activities the consolidated group may conduct and the 

locations in which activities can be conducted (including the closing of foreign offices) if it 

determines that: 

(a) the safety and soundness of the bank and banking group is compromised because 

the activities expose the bank or banking group to excessive risk and/or are not 

properly managed; 

(b) the supervision by other supervisors is not adequate relative to the risks the activities 

present; and/or; 

(c) the exercise of effective supervision on a consolidated basis is hindered. 

Description and 

findings re EC6 

The U.S. FBAs have the power, at authorization or as a remedial measure, to limit the range 

of activities a bank or holding company may conduct and the locations in which activities 

may be conducted. In practice, the FBAs use this power to ensure that the consolidated 

organization’s activities are properly supervised and that the safety and soundness of the 

bank and holding company are not compromised. The assessors saw evidence on actions 

relating to item (a) but not to (b) or (c). According to the authorities there had been no need 

for such formal actions (in specific cases, informal measures were used to achieve adequate 

consolidated supervision. For example, supervisory information on the overseas entity was 

gathered through the parent company itself rather than from the foreign supervisor and the 

internal audit function of the banking group was given broader responsibilities vis-á-vis the 

affiliates by the supervisor). 

EC7 In addition to supervising on a consolidated basis, the responsible supervisor supervises 

individual banks in the group. The responsible supervisor supervises each bank on a standalone basis and understands its relationship with other members of the group.46

Description and 

findings re EC7 

Statutes authorize the relevant FBAs to examine and require reports from individual banks in 

the group. The U.S. FBAs have strong cooperative relationships with each other and with 

functional and foreign regulators. These relationships respect the statutory authorities and 

responsibilities of the respective supervisors and provide for appropriate information flows 

and coordination to enable each responsible bank supervisor to understand the bank’s 

relationship to the banking group. 

An important element of effective consolidated supervision is the supervision of individual 

banks within a banking organization. The FBAs each have specific bank supervision 

responsibilities that are carried out to ensure the safety and soundness of individual 

institutions and contribute to the understanding of a banking organization’s condition on a 

consolidated basis. 

Information sharing among domestic and international supervisors, consistent with 

applicable law and the jurisdiction of each supervisor, is essential to ensure that a bank’s and 

holding company’s global activities are well understood. These concepts underlie the 

provisions of the DFA and the GLB Act that govern the interaction between the Federal 

Reserve as consolidated supervisor, and the other primary federal banking supervisors. 

The U.S. FBAs assist each other by sharing pertinent information to the extent permissible. 

This includes information regarding the financial condition, risk management policies, and 

operations of a bank and holding company that may have a material impact on the bank 

subsidiaries. The U.S. FBAs also consider transactions or relationships between the bank and 

 

46 Please refer to Principle 16, Additional Criterion 2.
UNITED STATES 

INTERNATIONAL MONETARY FUND 99

its affiliates. 

Additional 

criteria 

AC1 For countries which allow corporate ownership of banks, the supervisor has the power to 

establish and enforce fit and proper standards for owners and senior management of parent 

companies. 

Description and 

findings re AC1 

Only companies that are regulated BHCs may hold controlling interests in banks, and their 

managerial resources and integrity must be taken into account in the authorization and 

approval process (12 U.S.C. § 1842(c)(5)). Management also is evaluated in ongoing 

supervision. Companies that are not BHCs may hold non-controlling interests in banks. For 

this ownership structure, the approval process includes an investigation of the competence, 

experience, integrity, and financial ability of each person or entity who will have an 

ownership stake (12 U.S.C. § 1817(j); 12 CFR 225.43(f) and (g)). The U.S. FBAs have authority 

to remove or prohibit participation in the affairs of a bank if the statutory requirements in 

the Federal Deposit Insurance Act are met (see 12 U.S.C. §§1813(u) and 1818(e)). 

Rulemaking and supervisory guidance/procedures are under development to provide 

additional detail around the supervision of commercial SLHCs. These organizations are 

principally engaged in either commercial activities (such as manufacturing or merchandising) 

or activities not specifically permissible for FHCs (such as real estate development). See SR 

letter 11-11. 

Refer also to the lack of regulations and supervisory powers on SHLCs mentioned in EC 5 

above. 

Assessment of 

Principle 12

Largely compliant 

Comments A lack of full compliance with this principle is based on the absence of a capital rule for 

corporate and insurance company SLHCs, and on the fact that regulatory and supervisory 

rules, guidance, and a formal rating system for SLHCs have not been adopted. Capital 

standards are not required at the diversified financial group level under the Basel capital 

framework ( which are to be calculated at the banking holding group level and banking 

group level), however the lack of an established supervisory assessment framework will 

likely hamper the supervisors in reviewing and taking action at the holding company (SHLC) 

level. 

As noted in CP 10, the FBAs do not collect data from banks at the solo level (i.e. at the level 

of the bank excluding its subsidiaries). The assessors are satisfied; however, that in practice 

this omission has no prudential significance under the current circumstances as U.S. bank 

subsidiaries tend to be small relative to the parent bank and can only undertake activities 

that the bank itself could undertake in its own name. 

Principle 13 Home-host relationships. Home and host supervisors of cross-border banking groups 

share information and cooperate for effective supervision of the group and group entities, 

and effective handling of crisis situations. Supervisors require the local operations of foreign 

banks to be conducted to the same standards as those required of domestic banks. 

Essential criteria 

EC1 The home supervisor establishes bank-specific supervisory colleges for banking groups with 

material cross-border operations to enhance its effective oversight, taking into account the 

risk profile and systemic importance of the banking group and the corresponding needs of 
UNITED STATES 

100 INTERNATIONAL MONETARY FUND

its supervisors. In its broadest sense, the host supervisor who has a relevant subsidiary or a 

significant branch in its jurisdiction and who, therefore, has a shared interest in the effective 

supervisory oversight of the banking group, is included in the college. The structure of the 

college reflects the nature of the banking group and the needs of its supervisors. 

Description and 

findings re EC1 

The U.S. FBAs have established supervisory colleges for U.S. banking groups that have 

material cross-border operations. The U.S. FBAs have policies and guidelines in place for 

determining the appropriate members of supervisory colleges, and those policies and 

guidelines take into account the size of the operations in the foreign jurisdiction, their 

significance to the group as a whole and to the host market, and the needs of the 

supervisors. 

The Federal Reserve and OCC co-chair supervisory colleges for several U.S. banking groups 

with significant foreign operations. The colleges hold meetings at least annually, with 

conference calls between meetings to supplement communications. Where the size and 

scope of the bank’s operations warrant it, the U.S. convenes both core and general college 

meetings. Those participants with whom the Federal Reserve and OCC do not have standing 

information-sharing arrangements participate on the basis of ad hoc confidentiality 

undertakings. 

A college meeting will generally include the following elements: meetings with the bank 

officials in which host supervisors can raise questions and concerns, sessions in which 

Federal Reserve/OCC present to host supervisors a high-level supervisory assessment of the 

bank’s risk profile and its risk management and internal audit functions, and sessions in 

which host supervisors present information about developments in their jurisdictions. 

The assessors saw evidence of general documentation about FBAs participation in 

supervisory colleges. 

EC2 Home and host supervisors share appropriate information on a timely basis in line with their 

respective roles and responsibilities, both bilaterally and through colleges. This includes 

information both on the material risks and risk management practices of the banking 

group47 and on the supervisors’ assessments of the safety and soundness of the relevant 

entity under their jurisdiction. Informal or formal arrangements (such as memoranda of 

understanding) are in place to enable the exchange of confidential information. 

Description and 

findings re EC2 

The U.S. FBAs share information bilaterally with home and host supervisors, understanding 

arrangements, such as memoranda of understanding (MoUs) and statements of cooperation 

(SOCs) (There are no legal differences between MOUs and SOCs), and in response to 

requests on a case-by-case basis. As noted in EC 1, the U.S. FBAs also share information in 

supervisory colleges. On a case-by-case basis, the U.S. FBAs share information with foreign 

supervisors that have a legitimate supervisory need for the information and agree to keep it 

confidential. 

U.S. FBAs provide adequate and timely data and information relevant to host country 

supervisors about U.S. banks and holding companies, including any significant issues of a 

supervisory nature, to enable the host authority to supervise the overseas operations of the 

U.S. banks effectively and appropriately. The U.S. FBAs have ongoing contact with 

supervisors in other countries in which U.S. banks have material operations. 

 

47 See Illustrative example of information exchange in colleges of the October 2010 BCBS Good practice principles on 

supervisory colleges for further information on the extent of information sharing expected.
UNITED STATES 

INTERNATIONAL MONETARY FUND 101

Information sharing by the U.S. FBAs as both home and host supervisors involves sharing 

significant supervisory concerns and supervisory documents; providing information to assist 

with the authorization process and with investigations; discussing and coordinating 

supervisory plans and strategies; managing and participating in bilateral and multilateral 

meetings in the U.S. and overseas; developing joint enforcement actions when warranted; 

and participating in supervisory colleges to focus on a specific bank, holding company or 

supervisory issue. Additionally, U.S. FBAs periodically visit foreign supervisory authorities to 

discuss supervisory issues. 

The U.S. FBAs provide relevant information on U.S. banks and holding companies to host 

supervisors in response to specific requests regarding their supervision and provide 

information on significant problems that might have a material effect on the subsidiaries or 

branches in the host country. Information sharing on a home to host basis is also provided 

for in MoUs and similar arrangements. These arrangements provide for cooperation during 

the licensing process, in the supervision of ongoing activities, and in the handling of 

problem banks. U.S. FBAs endeavor to inform host country supervisors in a timely manner 

about events that could endanger the stability of cross-border establishments in the host 

country. The U.S. FBAs also inform host country supervisors when administrative penalties 

have been imposed or any other formal enforcement action has been taken against a U.S. 

bank or holding company if the agencies believe such information will be important to the 

host country supervisor as it may relate to the cross-border operations in that country. 

As host country supervisors, the U.S. FBAs cooperate with the home country supervisors of 

foreign banking organizations (FBOs) with U.S. banking operations in order to facilitate the 

consolidated supervision activities of those supervisors. 

Under the FBO Supervision Program, the Federal Reserve and the OCC routinely provide 

copies of essential supervisory products to home country supervisors. This includes an 

annual assessment of the combined U.S. operations of the FBO, which contains a supervisory 

rating, summary examination and supervisory findings along with details of areas requiring 

management attention, and notice of any proposed or pending formal or informal 

supervisory action as well as a copy of the notification to the head office of the FBO’s 

Strength-of-Support Assessment (SOSA) ranking). The SOSA is an assessment by the U.S. 

supervisor of the foreign parent/head office’s ability to support its U.S. operations. Where 

specifically requested by the home country supervisor, copies of examination reports of the 

U.S. operations of the FBOs may be provided to the home country supervisor. 

Similarly, the U.S. FBAs communicate with home country supervisors on subsidiaries of 

foreign banks and banking organizations. The U.S. FBAs will apprise home supervisors of 

significant concerns and impending supervisory actions. 

International cooperation would be further strengthened if state supervisory agencies 

consulted fully, in all cases, with the FBAs and foreign supervisors on impending 

enforcement actions. The assessors were made aware of circumstances where this was not 

the case. 

Information sharing through MoUs, SOCs or similar arrangements has become increasingly 

common. Today, U.S. FBAs have joint (and, in certain cases, individual) information sharing 

arrangements in place with banking supervisors in many foreign jurisdictions. These 

arrangements, while not legally binding, broadly govern information access and information 

sharing between supervisors acting in a home and host capacity. These arrangements 

generally cover those elements set forth in the Basel Committee’s paper “Essential elements 

of a statement of cooperation between banking supervisors” (May, 2001). 
UNITED STATES 

102 INTERNATIONAL MONETARY FUND

U.S. FBAs are authorized to share relevant supervisory information with foreign banking 

supervisors even in the absence of a formal arrangement such as a MoU. In practice the U.S. 

FBAs share significant information with foreign supervisors whether the U.S. FBAs act in a 

home or host capacity. All sharing is subject to certain statutory requirements including 

those relating to the ability of the foreign bank supervisor to maintain the confidentiality of 

information provided to it. In appropriate cases the U.S. FBAs also have the authority to 

share information with financial supervisors other than bank supervisors (see 12 U.S.C. 

1817(a)(2)(C)(iii)). Information sharing on risk management practices and supervisory 

concerns varies across different home regulators. This can result in incomplete cooperation 

or release of key regulatory documents such as annual assessment letters of foreign banking 

organizations conducted by home country regulators. In such cases, the supervisors may 

require the banks to restrict their activities in the concerned country. 

EC3 Home and host supervisors coordinate and plan supervisory activities or undertake 

collaborative work if common areas of interest are identified in order to improve the 

effectiveness and efficiency of supervision of cross-border banking groups. 

Description and 

findings re EC3 

Under the statutory authority that allows sharing confidential supervisory information with 

foreign bank regulators (see EC 1), the U.S. FBAs coordinate supervisory activities with host 

and home supervisors to improve the effectiveness and efficiency of supervision. 

As noted in the response to EC 2, the U.S. FBAs regularly share significant supervisory 

concerns and related supervisory documents; discuss and coordinate supervisory plans and 

strategies with foreign supervisors; and manage and participate in bilateral and multilateral 

meetings in the U.S. and overseas, such as supervisory colleges and CMGs. Additionally, U.S. 

FBAs periodically visit foreign supervisory authorities to discuss supervisory issues. 

As host country supervisors, the U.S. FBAs cooperate with the home country supervisors of 

FBOs with U.S. banking operations in order to facilitate the consolidated supervision 

activities of those supervisors. This might include a home country supervisor conducting a 

review at the U.S. operations of an FBO or the participation of a home country supervisor in 

examination activities conducted by the U.S. supervisors at an FBO’s U.S. operations. 

Similarly, as home country supervisors, the U.S. FBAs regularly conduct examinations of the 

foreign operations of banks and BHCs in coordination with host country supervisors. 

 The U.S. FBAs communicate with home country supervisors on subsidiaries of foreign banks 

and banking organizations. The U.S. FBAs will apprise home supervisors of significant 

concerns and impending supervisory actions, and will provide reports of examination upon 

request. 

EC4 The home supervisor develops an agreed communication strategy with the relevant host 

supervisors. The scope and nature of the strategy reflects the risk profile and systemic 

importance of the cross-border operations of the bank or banking group. Home and host 

supervisors also agree on the communication of views and outcomes of joint activities and 

college meetings to banks, where appropriate, to ensure consistency of messages on groupwide issues. 

Description and 

findings re EC4 

In addition to the MoUs and SOCs described above, the U.S. FBAs have established ongoing 

information sharing mechanisms and regularly scheduled meetings and conference calls as 

part of their communication strategies for banking groups for which such enhanced 

cooperation is appropriate. 

The U.S. FBAs communicate with foreign supervisors through formal processes (i.e., MOUs, 

SOCs, supervisory colleges) and informal processes (e.g., ad hoc conference calls, email). 

Ongoing communication between home and host supervisors and with supervised banking 
UNITED STATES 

INTERNATIONAL MONETARY FUND 103

organizations is a fundamental aspect of the supervisory process. For example, the U.S. 

supervisors hold periodic meetings with host supervisors to share information as applicable 

on home country risk management practices and models that may be employed in host 

country entities of the globally supervised banks and holding companies. 

EC5 Where appropriate, due to the bank’s risk profile and systemic importance, the home 

supervisor, working with its national resolution authorities, develops a framework for crossborder crisis cooperation and coordination among the relevant home and host authorities. 

The relevant authorities share information on crisis preparations from an early stage in a way 

that does not materially compromise the prospect of a successful resolution and subject to 

the application of rules on confidentiality. 

Description and 

findings re EC5 

With reference to cross-border cooperation for crisis preparation, CMGs have been 

established for the largest, most systemic U.S. banking groups and the U.S. FBAs are in the 

process of completing cooperation agreements (COAGs) that will govern the activities and 

information sharing in each CMG. 

The U.S. FBAs participate as home and host authorities of firms designated as global 

systemically important financial institutions by the Financial Stability Board in numerous 

firm-specific CMGs for the purposes of developing crisis management strategies and 

resolution plans for such firms. 

EC6 Where appropriate, due to the bank’s risk profile and systemic importance, the home 

supervisor, working with its national resolution authorities and relevant host authorities, 

develops a group resolution plan. The relevant authorities share any information necessary 

for the development and maintenance of a credible resolution plan. Supervisors also alert 

and consult relevant authorities and supervisors (both home and host) promptly when taking 

any recovery and resolution measures. 

Description and 

findings re EC6 

The U.S. FBAs participate as home and host authorities of firms designated as global 

systemically important financial institutions by the Financial Stability Board in numerous 

firm-specific CMGs for the purposes of developing crisis management strategies and 

resolution plans for such firms. The U.S. FBAs also participate as home and host authorities in 

supervisory colleges established for numerous banking institutions at which recovery and 

resolution plans created by those institutions are reviewed. 

EC7 The host supervisor’s national laws or regulations require that the cross-border operations of 

foreign banks are subject to prudential, inspection and regulatory reporting requirements 

similar to those for domestic banks. 

Description and 

findings re EC7 

The U.S. operations of foreign banks are subject to prudential, inspection, and regulatory 

reporting requirements similar to those applicable to domestic banks. In general, these 

requirements can be found in the statutes and regulations applicable to domestic banks and 

in the International Banking Act (IBA), 12 U.S.C. § 3101 et seq, and its implementing 

regulations, see 12 CFR part 211, subpart B and 12 CFR part 28, subpart B. The IBA 

establishes a framework under which “national treatment” is afforded to foreign banks doing 

a banking business in the U.S., which means that foreign banks are generally accorded parity 

of treatment with U.S. banking organizations. Apart from branches and agencies, foreign 

banks may choose to establish banking subsidiaries under either a federal or state license. In 

addition, foreign banks are subject to the BHC Act, in the same way as a U.S. banking 

organization. U.S. savings associations owned or controlled by foreign banks are subject to 

the same requirements and treatment as U.S. savings associations owned by U.S. SLHCs. 

In February 2014 the Federal Reserve introduced enhanced prudential standards for FBOs 

(see 12 CFR part 252) as required in Section 165 of DFA. For a foreign banking organization 
UNITED STATES 

104 INTERNATIONAL MONETARY FUND

with total consolidated assets of $50 billion or more, the final rule implements enhanced 

risk-based and leverage capital requirements, liquidity requirements, risk-management 

requirements, stress testing requirements, and the debt-to-equity limit for those companies 

that the FSOC has determined pose a potentially grave threat to the financial stability of the 

U.S.. In addition, it requires foreign banking organizations with U.S. non-branch assets of 

$50 billion or more to form a U.S. intermediate holding company and imposes enhanced 

risk-based and leverage capital requirements, liquidity requirements, risk-management 

requirements, and stress-testing requirements on the U.S. intermediate holding company. 

The final rule also establishes a risk-committee requirement for publicly traded foreign 

banking organizations with total consolidated assets of $10 billion or more and implements 

stress-testing requirements for foreign banking organizations and foreign savings and loan 

holding companies with total consolidated assets of more than $10 billion. Foreign banking 

organizations with U.S. non-branch assets of $50 billion or more are large, complex, and 

interconnected institutions, and generally have a U.S. risk profile similar to U.S. bank holding 

companies of total consolidated assets of $50 billion or more. The U.S. intermediate holding 

company requirement provides for consistent application of capital, liquidity, and other 

prudential requirements across the U.S. non-branch operations of the foreign banking 

organization and a single nexus for risk management of those U.S. non-branch operations, 

facilitating application of the mandatory enhanced prudential standards, increasing the 

safety and soundness of and providing for consolidated supervision of these operations. 

As noted, the IBA establishes a framework under which “national treatment” is afforded to 

foreign banks doing business in the U.S. However, a number of regulations do not apply to 

foreign banking organizations that do not have retail banking operations. The Federal 

Reserve’s CA letter 04-3 and the OCC’s Federal Branches and Agencies Supervision 

Handbook provide guidance for assessing whether a consumer compliance or CRA 

examination of an FBO is necessary (see 12 CFR 228.11(c)(3)). These assessments are 

conducted according to the frequencies mandated in the OCC’s Bank Supervision Process 

Handbook and the Federal Reserve’s CA letter 03-12. 

Where foreign banking organizations own and/or control subsidiary U.S. savings 

associations, those savings associations are subject to the same requirements and treatment 

as domestically held savings associations. 

Liquidity rules for branches to foreign banks apply a 15-day run-off criterion, versus the 30-

day period for U.S. banks. Also, some States apply an asset maintenance rule for foreign 

branches, i.e. the branch must hold a certain portion of its assets in qualified U.S. assets. 

EC8 The home supervisor is given on-site access to local offices and subsidiaries of a banking 

group in order to facilitate their assessment of the group’s safety and soundness and 

compliance with customer due diligence requirements. The home supervisor informs host 

supervisors of intended visits to local offices and subsidiaries of banking groups. 

Description and 

findings re EC8 

Foreign home supervisors may conduct examinations of U.S. operations of their banks and 

will generally have access to all relevant information, including information necessary to 

assess safety and soundness and compliance with customer due diligence requirements. 

Before conducting on-site examinations in the U.S., foreign supervisors should contact the 

relevant U.S. FBAs and the state banking authority if the operations to be examined are 

state-chartered or state-licensed. With prior arrangement, foreign supervisors typically may 

conduct their on-site examinations without being accompanied by representatives of the 

U.S. FBAs. Note, however, there may be state laws (e.g. FLA.STAT. 655.059 (2007)) that limit 

access to certain types of information at state-licensed entities. 

In general, the U.S. FBAs expect to be permitted on-site access to foreign offices and 
UNITED STATES 

INTERNATIONAL MONETARY FUND 105

subsidiaries of a U.S. bank and holding company’s foreign operations in order to facilitate 

their assessment of the bank and holding company’s safety and soundness and compliance 

with KYC requirements. The U.S. FBAs inform host supervisors in advance of intended visits 

to foreign offices and subsidiaries. MOUs and SOCs generally contain provisions regarding 

on-site examinations. 

EC9 The host supervisor supervises booking offices in a manner consistent with internationally 

agreed standards. The supervisor does not permit shell banks or the continued operation of 

shell banks. 

Description and 

findings re EC9 

Shell banks are not permitted under U.S. law, nor may U.S. banks establish correspondent 

accounts for foreign shell banks. In addition, foreign banks may not use their U.S. branches 

or agencies to manage types of activities through offshore offices that could not be 

managed by a U.S. bank at its foreign branches or subsidiaries. 

Banks also must take reasonable steps to ensure that any correspondent account 

established, maintained, administered, or managed in the U.S. for a foreign bank is not being 

used by that foreign bank to provide banking services indirectly to foreign shell banks, i.e., 

that the U.S. correspondent bank of the foreign bank does not in turn give a foreign shell 

bank the ability to access the U.S. correspondent account through its account. A bank is 

required to terminate immediately any account that it knows to be the account of a foreign 

shell bank or that it knows is being used indirectly by a foreign shell bank. Recent 

amendments to the Bank Secrecy Act (BSA) prohibit U.S. banks from establishing, 

maintaining, administering or managing a correspondent account in the U.S. for any foreign 

shell bank other than a regulated affiliate of a U.S. or foreign bank. See 31 CFR 103.177 

As host supervisors the FBAs supervise booking offices in a manner consistent with 

internationally agreed standards. 

EC10 A supervisor that takes consequential action on the basis of information received from 

another supervisor consults with that supervisor, to the extent possible, before taking such 

action. 

Description and 

findings re EC10 

As a general matter, the U.S. FBAs do not take action on the basis of information received 

from another supervisor without independently confirming the information and consulting 

with the providing supervisor, to the extent possible, before taking action. 

Effective cross-border supervision relies on clear, open communication between home and 

host supervisors. This is particularly the case where a banking supervisor contacts a 

supervisor in another country about significant or serious (including criminal) supervisory 

issues requiring attention. By the very nature of U.S. federal (and state) banking supervision, 

the relevant agencies work within a communication web that demands continuous 

coordination and consideration. The same methodology applies with cross-border 

information exchanges and requests for action or opinions. In such cases, the U.S. FBAs 

confer at the appropriate level and to the appropriate extent with the foreign supervisor 

before taking any action. See Federal Reserve AD letter 03-27/SR letter 01-21/AD letter 01-3; 

and OCC’s PPM 5500-1 (Rev). 

Notwithstanding the above, the FBAs will, and have the powers to, take action without prior 

consultation if the situation is deemed urgent. 

Assessment of 

Principle 13

Compliant 

Comments Reflecting the large cross-border activities of U.S. banks abroad, and of foreign banking 

groups in the U.S., there exist a comprehensive framework of policies and processes for co-
UNITED STATES 

106 INTERNATIONAL MONETARY FUND

operation and exchange of information between the FBAs and foreign supervisory 

authorities. This is currently being strengthened by the work in supervisory colleges and in 

CMGs. 

The assessors encourage the authorities to establish agreements with their foreign 

counterparts on a framework of communication strategies, especially for crisis situations 

International cooperation would be further strengthened if state supervisory agencies 

consulted fully, in all cases, with the FBAs and foreign supervisors on impending 

enforcement actions. The assessors were made aware of circumstances where this was not 

the case. Although this is a clear deficiency in cooperation arrangements, the assessors did 

not judge it as sufficient to lower the “Compliant” rating for CP 13, but improvements in 

such consultations should be a high priority. 

There remain some instances in which specific rules apply to foreign institutions, such as the 

shorter run-off period for foreign branches in the liquidity, asset maintenance requirements 

for branches and requirements on large FBOs to set up intermediate U.S. holding companies. 

The mandate of the BCP assessment is limited to ensure that prudential rules and 

supervision are applied to ensure a minimum level of safety and soundness of banks. The 

assessors find that these rules are aimed to obtain such effect. The BCP mandate and 

assessment and do not include a judgment of level playing field issues. 

B. Prudential Regulations and Requirements

Principle 14 Corporate governance. The supervisor determines that banks and banking groups have 

robust corporate governance policies and processes covering, for example, strategic direction, 

group and organizational structure, control environment, responsibilities of the banks’ Boards 

and senior management,48 and compensation. These policies and processes are 

commensurate with the risk profile and systemic importance of the bank. 

Essential criteria 

EC1 Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior 

management with respect to corporate governance to ensure there is effective control over 

the bank’s entire business. The supervisor provides guidance to banks and banking groups on 

expectations for sound corporate governance. 

Description and 

findings re EC1 

Comprehensive corporate governance rules that establish the responsibility of the bank’s 

board of directors and senior management primarily arise from state corporate law as well as 

federal regulations for publicly held companies, relating to financial disclosure, the auditing 

process, incentive compensation, ethical conduct, conflict of interest standards, internal 

controls over financial reporting, board composition, and board committees. (NYSE listing 

requirements, NASDAQ listing requirements (including Sections 303A.00, 303A.02, 303A.05, 

and 303A.07 of the NASDAQ Listing Rules), the Sarbanes-Oxley Act of 2002 (SOX), 12 U.S.C. § 

1831i, 12 U.S.C. § 1831m, 15 U.S.C. § 78j-1, 15 U.S.C. § 7262(b), 15 U.S.C. § 7265, and 12 CFR 

208 Appendix D-1. 

The Federal Reserve, the OCC, and the FDIC also have various regulations governing the 

composition and activities of the boards of directors and senior management, such as 

requirements related to audit functions, capital, resolution planning, financial disclosure, 

conflicts of interest, and insider activities. These regulations require specific actions or 

 

48 Please refer to footnote 27 under Principle 5. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 107

avoidance of certain activities by the firm and require the board of directors and/or senior 

management to manage, approve, and provide oversight. Also, these regulations may 

prohibit or require certain actions by the board of directors or senior management. 

Guidance established by the Federal Reserve regarding the responsibilities of the board of 

directors and senior management of bank holding companies (BHCs) and state member banks 

is discussed in the BHC Supervision Manual, Commercial Bank Examination Manual, and 

specific supervisory letters, among them SR 12-17. 

Guidance established by the OCC regarding the responsibilities of the board of directors and 

senior management of national banks, savings associations, and insured federal branches, as 

well as corporate governance generally, is discussed in the Comptroller’s Handbook, including 

booklets on Duties and Responsibilities of Directors, Management and Board Processes, 

Insider Activities, and Management Information Systems. 

SR Letter 12-17, referenced above, states that in order for a firm to be sustainable under a 

broad range of economic, operational, legal or other stresses, its board of directors (or 

equivalent for the U.S. operations of FBOs) should provide effective corporate governance 

with the support of senior management. The board is expected to establish and maintain the 

firm’s culture, incentives, structure, and processes that promote its compliance with laws, 

regulations, and supervisory guidance. Each firm’s board of directors and committees, with 

support from senior management, should: 

 Maintain a clearly articulated corporate strategy and institutional risk appetite. The 

board should set direction and oversight for revenue and profit generation, risk 

management and control functions, and other areas essential to sustaining the 

consolidated organization; 

 Ensure that the firm’s senior management has the expertise and level of involvement 

required to manage the firm’s core business lines, critical operations, banking offices, 

and other material entities. These areas should receive sufficient operational support to 

remain in a safe and sound condition under a broad range of stressed conditions; 

 Maintain a corporate culture that emphasizes the importance of compliance with laws 

and regulations and consumer protection, as well as the avoidance of conflicts of 

interest and the management of reputational and legal risks; 

 Ensure the organization’s internal audit, corporate compliance, and risk management 

and internal control functions are effective and independent, with demonstrated 

influence over business-line decision making that is not marginalized by a focus on 

short-term revenue generation over longer-term sustainability; 

 Assign senior managers with the responsibility for ensuring that investments across 

business lines and operations align with corporate strategies, and that compensation 

arrangements and other incentives are consistent with the corporate culture and 

institutional risk appetite; and 

 Ensure that management information systems (MIS) support the responsibilities of the 

board of directors to oversee the firm’s core business lines, critical operations, and 

other core areas of supervisory focus. 

Federal Reserve and OCC guidance specifically references the board of directors and their 

responsibility to establish a comprehensive and effective compliance function. The board of 

directors is expected to establish clear policies regarding the management of key risks and 

ensure that the institution adheres to those policies. Additionally, regulatory guidance requires 

the board of directors to have general oversight of the corporate governance structure, as well 
UNITED STATES 

108 INTERNATIONAL MONETARY FUND

as specific requirements in the areas of risk management, capital, liquidity, funding, credit, 

model risk management, and fiduciary activities, to name a few. 

Following the recent financial crisis, the OCC developed a set of “Heightened Expectations” to 

enhance the supervision and strengthen the corporate governance and risk management 

practices of large national banks. The OCC has also applied aspects of the heightened 

expectations to midsize banks. In January 2014, the OCC proposed guidelines to formalize 

these Heightened Expectations by setting forth the minimum standards for the design and 

implementation of a bank’s risk governance framework and for the board of directors’ 

oversight of the risk governance framework. The public comment period on the proposed 

guidelines closed on March 28, 2014, and the adoption of final guidelines took place in 

September 2014 and will be gradually implemented during a transitional period beginning on 

November 10, 2014. However, the OCC has for some time applied the prior heightened 

expectations backed by its powers for ensuring banks’ safety and soundness. The “Heightened 

Standards” apply to banks supervised by the OCC with average total assets of $50 billion or 

greater. The guidelines provide that each member of the board should oversee a bank’s 

compliance with safe and sound banking practices. Consistent with this, the board should 

also require management to establish and implement an effective risk governance framework 

that complies with the guidelines. The board or its risk committee should also approve any 

significant changes to the framework. The guidelines also provide that the board should 

actively oversee a bank’s risk-taking activities and hold management accountable for adhering 

to the framework. The board should also evaluate management’s recommendations and 

decisions by questioning, challenging, and when necessary, opposing management’s 

proposed actions that could cause the covered bank’s risk profile to exceed its risk appetite or 

threaten the institution’s safety and soundness. Additionally, a bank’s board of directors 

should review and approve a talent management program covering the talent development, 

recruitment, and succession planning. Further at least two members of a covered bank’s board 

would need to be independent, i.e., they should not be members of the bank’s or parent 

company’s management. 

The U.S. FBAs guidance discuss that one of the primary areas of focus for consolidated 

supervision of large complex BHCs and banks are evaluating the adequacy of governance 

provided by the board and senior management. The culture, expectations, and incentives 

established by the highest levels of corporate leadership set the tone for the entire 

organization and are essential determinants of whether a banking organization is capable of 

maintaining fully effective risk management and internal control processes. The board and its 

committees should have an ongoing understanding of key inherent risks, associated trends, 

primary control functions, and senior management capabilities. Primary expectations for the 

board and its committees include: 1) selecting competent senior managers, ensuring that 

they have the proper incentives to operate the organization in a safe and sound manner, and 

regularly evaluating senior managers’ performance; 2) establishing, communicating, and 

monitoring (for example, by reviewing comprehensive MIS reports produced by senior 

management) institutional risk tolerances and a corporate culture that emphasizes the 

importance of compliance with the law and ethical business practices; 3) approving significant 

strategies and policies; 4) demonstrating leadership, expertise, and effectiveness; 5) ensuring 

the organization has an effective and independent internal audit function; 6) ensuring the 

organization has appropriate policies governing the segregation of duties and avoiding 

conflicts of interest; and 7) ensuring that public disclosures are consistent with how the board 

and senior management assess and manage the risks of the organization, balance quantitative 

and qualitative information with clear discussions about risk management processes, and 

reflect evolving disclosure practices for peer organizations. See Federal Reserve BHC 

Supervision Manual, Section 1050.3.1, and OCC Comptroller’s Handbook, Safety and 
UNITED STATES 

INTERNATIONAL MONETARY FUND 109

Soundness booklets. 

EC2 The supervisor regularly assesses a bank’s corporate governance policies and practices, and 

their implementation, and determines that the bank has robust corporate governance policies 

and processes commensurate with its risk profile and systemic importance. The supervisor 

requires banks and banking groups to correct deficiencies in a timely manner. 

Description and 

findings re EC2 

As part of the examination process, examiners review and assess whether the institution’s 

board of directors is providing a clear framework of objectives and policies within which senior 

management can operate and administer the bank’s affairs. Examiners evaluate the adequacy 

and effectiveness of the board of directors by assessing the frequency and effectiveness of 

board meetings; the effectiveness of board committees; the directors’ role in establishing 

policy; the adequacy of the policies and major inconsistencies therein; the quality of reports 

for directors; violations of laws and regulations; the composition of the board; and the board’s 

responsiveness to recommendations from auditors and supervisory authorities. See 

Commercial Bank Examination Manual, Section 5000.3, and Comptroller’s Handbook. 

The FBAs have developed ratings systems in which a bank or BHC is rated, in part, based upon 

board and senior management oversight of the organization’s entire business including the 

areas cited above for which directors are held responsible. The ratings system that applies to a 

bank or BHC is dependent on the bank’s charter. 

With regards to rating BHCs, all of which are supervised by the Federal Reserve, examiners 

assign ratings for board and senior management oversight which feed into the board and 

senior management subcomponent of a BHC’s Risk Management (R) rating under the RFI/C 

(D) rating system. See SR Letter 04-18, BHC Rating System. 

With regards to rating domestically chartered banks (nationally-chartered banks, statechartered member banks, state-chartered nonmember banks, and savings associations), the 

FBAs have adopted, and adhere to, uniform guidance for rating board and senior 

management oversight of the bank through the FFIEC’s Uniform Financial Institutions Rating 

System (UFIRS). This rating system also known as CAMELS explicitly references the level and 

quality of oversight and support of all institution activities by the board of directors and 

management within the Management (M) component rating description of the CAMELS. 

Examiners evaluate the board of directors and management in light of all of the factors 

necessary to operate the institution in a safe and sound manner and their ability to identify, 

measure, monitor, and control the risks of the institution’s activities. In assigning a (M) rating 

under CAMELS, examiners consider a variety of factors, including but not limited to the level 

and quality of oversight and support provided by management and the board; compliance 

with regulations and statutes; ability to plan for and respond to risks that may arise from 

changing business conditions or initiation of new products or services, accuracy, timeliness, 

and effectiveness of management information and risk monitoring systems; adequacy of and 

compliance with internal policies and controls; adequacy of audit and internal control systems; 

responsiveness to recommendations from auditors and supervisory authorities; 

reasonableness of compensation policies and avoidance of self-dealing; demonstrated 

understanding and willingness to serve the legitimate banking needs of the community; 

management depth and succession; the extent that management is affected by or susceptible 

to dominant influence or concentration of authority; and the overall performance of the 

institution and its risk profile. 

The U.S. FBAs also complete a series of testing procedures, contained in the agencies’ 

examination manuals, to confirm banks’ and holding companies’ compliance with prudential 

regulations and other legal requirements. The agencies assign a numeric rating (on a scale of 
UNITED STATES 

110 INTERNATIONAL MONETARY FUND

1 to 5, with ‘1’ being the best and ‘5’ being the worst) to financial institutions to indicate how 

well the board of directors and management identify, measure, monitor and control the risks 

of the organization’s activities and ensure the organization is managed in a safe and sound 

manner with efficient operations in compliance with applicable laws and regulations (under 

the Management component rating in the CAMELS rating system). Among the criteria 

considered are: (1) the level and quality of oversight and support of all institution activities by 

the board of directors and management; (2) the ability of the board of directors and 

management, in their respective roles, to plan for and respond to risks that may arise from 

changing business conditions; (3) the accuracy, timeliness, and effectiveness of management 

information and risk monitoring systems; and (4) the adequacy of internal controls to promote 

effective operations and reliable financial and regulatory reporting. In addition to the rating 

system for banks, the Federal Reserve also assigns numeric ratings (using a “1” to “5” scale 

comparable to the scale for banks) for Risk Management in the RFI/C (D) rating system for 

BHCs. This risk management component rating includes, among other things, a Board and 

Senior Management Oversight subcomponent. See discussion of the CAMELS and RFI/D (C) 

rating systems in Legal Framework for EC 2 above. 

EC3 The supervisor determines that governance structures and processes for nominating and 

appointing Board members are appropriate for the bank and across the banking group. Board 

membership includes experienced non-executive members, where appropriate. 

Commensurate with the risk profile and systemic importance, Board structures include audit, 

risk oversight and remuneration committees with experienced non-executive members 

Description and 

findings re EC3 

Comprehensive corporate governance rules that establish the responsibility of the bank’s 

board and senior management primarily arise from state corporate laws, banking regulations 

as well as federal regulations for publicly held companies. This includes the organization’s 

activities related to nominating and appointing board members, establishing board 

committees such as audit, risk oversight, and remuneration committees, and requiring specific 

director independence requirements. 

Publicly traded bank holding companies with total consolidated assets between $10 and $50 

billion, and bank holding companies with total consolidated assets of $50 billion or more, are 

required to maintain a risk committee that periodically approves the risk-management policies 

and global operations and global risk-management framework. See 12 U.S.C. § 5365; and 12 

CFR 252.22 and 225.33. Refer also to CP 15. The BHC’s global risk-management framework is 

required to be commensurate with its structure, risk profile, complexity, activities, and size. The 

applicable regulations also impose specific corporate governance requirements on the charter, 

composition, and activities of the risk committee, including requiring having at least one 

member with experience in identifying, assessing, and managing risk exposures of large, 

complex firms, being chaired by an independent director pursuant to the listing standards of a 

national securities exchange, receiving regular reports from the company’s chief risk officer, 

and conducting regular, fully documented meetings. In addition, federal regulations require 

FBOs with total consolidated assets over $10 billion to maintain a committee on its global 

board of directors that is responsible in whole or in part for overseeing the risk management 

policies of the combined U.S. operations of the organization, with at least one committee 

member having experience in identifying, assessing, and managing risk exposures of large, 

complex firms. 

In addition, in the proposed Appendix D to 12 CFR part 30, the OCC proposes to require at 

least two directors of each bank supervised by the OCC to be independent (not members of 

the bank’s or the parent company’s management). A bank’s board of directors would also be 
UNITED STATES 

INTERNATIONAL MONETARY FUND 111

required to establish and adhere to a formal, ongoing training program for independent 

directors. OCC examiners would evaluate each director’s knowledge and experience. 

An audit committee’s duties include reviewing with management and the independent public 

accountant the basis for all financial reports issued. For banks and holding companies with 

total assets between $500 million and $1 billion, the majority of audit committee members 

must be outside, non-executive directors, subject to case-by-case exceptions granted by 

supervisors. For banks and holding companies with total assets of $1 billion or more, the audit 

committee must be comprised entirely of outside, non-executive directors. For banks and 

holding companies with total assets of more than $3 billion, the audit committee members 

must (a) have banking or related financial management expertise; (b) have access to the 

committee’s own outside counsel; and (c) not be a large customer of the bank or holding 

company. For public companies, SOX requires each member of the audit committee to be 

independent of the issuer. SOX also requires public companies to disclose in their periodic 

reports whether there is at least one financial expert on the audit committee and, if not, why 

not. 

There is also a 30-day prior-notice requirement for appointing any new directors or senior 

executive officers of banks and bank holding companies. This notice requirement also applies 

to any change in the responsibilities of any current senior executive officer that proposes to 

assume a different position. Section 32 of the FDI Act requires federal banking agency 

approval for additions to the board of directors or executive management of a troubled 

Insured Depository Institutions (IDI) or troubled holding company of an IDI within 90 days of 

the required notice. 

One of the primary areas of focus for consolidated supervision of large financial institutions is 

the adequacy of governance provided by the board and senior management. This would 

include an evaluation of the governance processes for nominating and appointing board 

members. Supervisors will evaluate the culture, expectations, and incentives established by the 

highest levels of corporate leadership to ensure they set an appropriate tone for the entire 

organization and are essential determinants of whether a banking organization is capable of 

maintaining fully effective risk management and internal control processes. The board and its 

committees should have an ongoing understanding of key inherent risks, associated trends, 

primary control functions, and senior management capabilities. 

EC4 Board members are suitably qualified, effective and exercise their “duty of care” and “duty of 

loyalty”.49

Description and 

findings re EC 4 

As reflected in law and practice, the primary basis for ensuring board members are suitably 

qualified, effective, and exercise their “duty of care” and “duty of loyalty” arises from the 

business judgment rule in the U.S.. For a plaintiff to place an action against the corporation’s 

board of directors in the court of law, the plaintiff would need to prove that one of the 

directors breached their fiduciary duty and breached their duty of care or duty of loyalty. 

 

49 The OECD (OECD glossary of corporate governance-related terms in “Experiences from the Regional Corporate 

Governance Roundtables”, 2003, www.oecd.org/dataoecd/19/26/23742340.pdf.) defines “duty of care” as “The duty 

of a board member to act on an informed and prudent basis in decisions with respect to the company. Often 

interpreted as requiring the board member to approach the affairs of the company in the same way that a ’prudent 

man’ would approach their own affairs. Liability under the duty of care is frequently mitigated by the business 

judgment rule.” The OECD defines “duty of loyalty” as “The duty of the board member to act in the interest of the 

company and shareholders. The duty of loyalty should prevent individual board members from acting in their own 

interest, or the interest of another individual or group, at the expense of the company and all shareholders.” 
UNITED STATES 

112 INTERNATIONAL MONETARY FUND

Banks in the U.S. are also subject to these requirements. In addition, banking-specific 

provisions address the duties of bank boards of directors and the directors. See, for example, 

12 U.S.C. 73; 12 CFR part 215 (Reg. O); 12 CFR 163.201; and OCC Comptroller’s Handbooks 

“Insider Activities”, “Duties and Responsibilities of Directors”. 

The FBAs establish expectations of boards of directors and senior management. The level of 

technical knowledge required of directors varies depending on the size, complexity, and 

business practices of the bank and holding company. Specifically, boards of directors and 

officers of banks and holding companies are obligated to discharge the duties owed to their 

bank and holding company and to the shareholders and creditors of their organizations, and 

to comply with federal and state statutes, rules and regulations. These duties include the 

duties of loyalty and care. Directors have ultimate responsibility for the level of risk taken by 

their bank or holding company. This means that directors are responsible for selecting, 

monitoring, and evaluating competent management; establishing business strategies and 

policies; monitoring and assessing the progress of business operations; establishing and 

monitoring adherence to policies; and for making business decisions on the basis of fully 

informed and meaningful deliberation credibly challenging management as appropriate to 

ensure risks are identified, managed, and controlled consistent with risk appetite and 

governing policies. 

Written and oral evidence from the supervisors as well as from the interviewed bank 

management provided assessors with the clear impression that the requirements on board 

members’ qualifications and duties were considerably increased during the last few years. This 

improvement seems to stem both from new legislation/regulation and from within the 

banking sector itself. The actual competence of bank boards has risen substantially, although 

to different degrees in different banks. That said, changing boards is a gradual process and 

there is still a way to go in the advanced banks, and even more in the laggards. 

EC5 The supervisor determines that the bank’s Board approves and oversees implementation of 

the bank’s strategic direction, risk appetite50 and strategy, and related policies, establishes and 

communicates corporate culture and values (e.g. through a code of conduct), and establishes 

conflicts of interest policies and a strong control environment. 

Description and 

findings re EC5 

Regarding ECs 5 to and including EC 8, the supervisors’ determination of the quality of the 

work of the bank board and of the senior management will be reflected in the component “M” 

(for Management) in the CAMELS grading system. Hence, there is a comprehensive and clear 

process for such determination, which is based on onsite visits to the bank as well as banks’ 

periodic reporting to supervisors and other offsite information-gathering including contacts 

between supervisors and representatives of the banks. Non-compliance with rules for 

corporate governance may therefore lead not only to enforcement actions but also to a 

downgrade. 

The FBAs establish expectations for, and examine, review and monitor, the role of a bank’s 

board of directors in setting the bank’s strategic direction, risk appetite, related policies, 

corporate culture, and establishing appropriate conflicts of interest policies and a strong 

control environment. 

 

50 “Risk appetite” reflects the level of aggregate risk that the bank’s Board is willing to assume and manage in the 

pursuit of the bank’s business objectives. Risk appetite may include both quantitative and qualitative elements, as 

appropriate, and encompass a range of measures. For the purposes of this document, the terms “risk appetite” and 

“risk tolerance” are treated synonymously. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 113

Because banking is essentially a business of assuming and managing risk, the OCC has 

adopted a supervisory philosophy that is centered on evaluating risks and risk management 

systems. The OCC applies this philosophy to all supervisory activities it conducts, including 

safety and soundness, information technology, compliance, and fiduciary activities. 

Supervision by risk consists of determining the quantity of risk exposure in a bank and 

evaluating the quality of risk management systems in place to control risk. Supervision by risk 

provides consistent definitions of risk, a structure for assessing these risks, and integration of 

risk assessment in the supervisory processes. Supervision by risk places the responsibility for 

controlling risks with the board of directors and management. 

Federal banking agencies review whether the board oversees the banking organization’s 

strategic direction through the approval of significant strategies and policies. Additionally, the 

board, with the support of senior management, is expected to maintain a clearly articulated 

corporate strategy and institutional risk appetite. The board is expected to establish control 

activities encompassing policy and implement procedures that ensure management’s 

directives are achieved. Furthermore, the board and senior management are expected to 

establish and implement an effective risk management framework capable of identifying and 

controlling both current and emerging risks as well as effective independent control functions 

that ensure risk-taking is consistent with the organization’s risk tolerance and policies. The 

board and senior management are expected to promote a continuous dialogue between and 

across business areas and risk management functions to help align the organization's 

established risk appetite and risk controls. The board is also expected to ensure that 

organization’s internal audit, corporate compliance, risk management, and internal control 

functions are effective and independent, with demonstrated influence over business-line 

decision making that is not marginalized by a focus on short-term revenue generation over 

longer-term sustainability. 

The board and senior management are expected to establish a “tone from the top” by 

establishing, communicating, and monitoring institutional risk tolerances and a corporate 

culture that emphasizes the importance of compliance with laws and regulations and 

consumer protection. The board and senior management are expected to further demonstrate 

their development of a strong control environment by establishing and implementing a code 

of conduct addressing integrity and ensuring the organization has appropriate policies 

governing the segregation of duties and the avoidance of conflicts of interest. 

In the event that audit, compliance, or regulatory issues arise, the board and senior 

management are expected to take corrective actions to ensure timely resolution of these 

issues. 

EC6 The supervisor determines that the bank’s Board, except where required otherwise by laws or 

regulations, has established fit and proper standards in selecting senior management, 

maintains plans for succession, and actively and critically oversees senior management’s 

execution of Board strategies, including monitoring senior management’s performance 

against standards established for them. 

Description and 

findings re EC6 

The FBAs have identified the expectations against which examiners should assess a banking 

organization’s board with respect to selecting senior management, maintaining plans for 

succession, and actively and critically overseeing senior management’s execution of board 

strategies, including monitoring senior management’s performance against standards 

established for them. Examiners are expected to assess whether boards of banks and BHCs 

are selecting competent senior managers, ensuring that they have the proper incentives to 

operate the organization in a safe and sound manner, and regularly evaluating senior 

managers’ performance. The board is expected to ensure that the firm’s senior management 
UNITED STATES 

114 INTERNATIONAL MONETARY FUND

has the expertise, training, and level of involvement required to manage the firm’s core 

business lines, critical operations, banking offices, and other material entities. To ensure that 

senior management can continue to perform its duties in the event that there is turnover 

amongst its ranks, the board is expected to have a management succession plan in place. 

The board is expected to actively and critically oversee management’s execution of board 

strategies, including monitoring senior management’s performance against standards 

established for them. The board is expected to monitor and enforce established guidelines to 

minimize management’s ability to override policies and procedures. 

The FBAs require institutions that are in less-than-satisfactory condition (also including de 

novo institutions) to provide prior notice before appointing any new directors or senior 

executive officers. The notice must contain the identity, personal history, business background, 

and experience of each proposed individual. The agency may disapprove of an individual on 

the basis of the individual’s competence, experience, character, or integrity that it would not 

be in the best interests of the depositors or the public to permit the individual to be employed 

by, or associated with, the bank. See 12 U.S.C. § 1831i, 12 CFR 5.51, Comptroller’s Licensing 

Manual, Changes in Directors and Senior Executive Officers, 12 CFR 225.71-.72; SR Letter 03-6, 

Guidance Regarding Restrictions on Institutions in Troubled Condition. 

In the proposed Appendix D to 12 CFR part 30, the OCC states that the bank’s board of 

directors has a duty to oversee the bank’s risk-taking activities and hold management 

accountable for adhering to the risk governance framework. In providing active oversight, the 

board of directors should question, challenge, and when necessary, oppose recommended 

decisions made by management that could cause the bank’s risk profile to exceed its risk 

appetite or jeopardize the safety and soundness of the bank. The board of directors or a 

board committee should provide oversight over processes for talent development, 

recruitment, and succession planning to ensure management and employees who are 

responsible for or influence material risk decisions have the knowledge, skills and abilities to 

effectively identify, measure, monitor and control relevant risks. When the proposed Appendix 

D is finalized, it is expected that OCC examiners will formally review (this has so far been 

conducted on an informal “expectations” basis) and assess whether the bank’s board of 

directors is meeting the expectations described above. 

EC7 The supervisor determines that the bank’s Board actively oversees the design and operation of 

the bank’s and banking group’s compensation system, and that it has appropriate incentives, 

which are aligned with prudent risk taking. The compensation system, and related 

performance standards, are consistent with long-term objectives and financial soundness of 

the bank and is rectified if there are deficiencies. 

Description and 

findings re EC7 

The FBAs jointly issued “Guidance on Sound Incentive Compensation Policies” (the Guidance) 

in June 2010. The Guidance is intended to ensure that a banking organization’s compensation 

system and related performance standards are designed and implemented in a way that is 

consistent with the long-term objectives and financial soundness of the banking organization. 

Incentive compensation arrangements at a banking organization should: provide employees 

incentives that appropriately balance risk and reward; be compatible with effective controls 

and risk-management; and be supported by strong corporate governance, including active 

and effective oversight by the organization’s board of directors. Banking organizations are 

expected to regularly review their incentive compensation arrangements for all executive and 

non-executive employees who, either individually or as part of a group, have the ability to 

expose the organization to material amounts of risk, as well as to regularly review the riskmanagement, control, and corporate governance processes related to these arrangements. 

Boards of directors at banking organizations are responsible for ensuring that their 
UNITED STATES 

INTERNATIONAL MONETARY FUND 115

organizations’ incentive compensation arrangements are consistent with the principles 

described in the Guidance and that the arrangements do not encourage employees to expose 

the organization to imprudent risks. Section 39(c) of the FDI Act (Compensation Standards) 

requires the FBAs to prohibit excessive compensation to executive officers, employees, 

directors, and principal shareholders as an unsafe and unsound practice. The definition of 

excessive compensation, as well as the specific prohibition required by section 39(c), is found 

in Section III of Appendix A to Part 364, Standards for Safety and Soundness. 

The FBAs communicate supervisory findings related to incentive compensation through 

relevant reports of bank examination or inspection as well as continuous monitoring activities. 

Per the Guidance, a banking organization’s appropriate federal supervisor may take an 

enforcement action against the organization if its incentive compensation arrangements or 

related risk-management, control, or governance processes pose a risk to the safety and 

soundness of the organization. 

Moreover, examiners routinely review the reasonableness of an institution’s compensation 

policies as part of their review of the “Management” component of the CAMELS rating in the 

examination process. 

With certain limited exceptions, banks and bank holding companies that are in less-thansatisfactory supervisory condition are also subject to restrictions on making “golden 

parachute” and indemnification payments to any current or former institution-affiliated party. 

In those cases, the FDIC, and the OCC or the Federal Reserve, as applicable, is required to 

review and approve any such payments in advance of such payments being made to an IAP. 

EC8 The supervisor determines that the bank’s Board and senior management know and 

understand the bank’s and banking group’s and its risks, including those arising from the use 

of structures that impede transparency (e.g. special-purpose or related structures). The 

supervisor determines that risks are effectively managed and mitigated, where appropriate. 

Description and 

findings re EC8 

As part of onsite examinations, i.e. by perusing reports from external and internal auditors of 

banks, or from Board discussions, supervisors determine that board of directors and senior 

management understanding of the bank’s and banking group’s operational structure and its 

risks. Directors and senior management oversight of the enterprise-wide compliance program, 

including approval of risk-management policies and monitoring of internal processes, is 

essential to get an understanding of the risks to the bank and the banking group, including 

those emanating from specific structures. The supervisor will determine that risks are 

effectively managed, and may order the bank, if warranted, to take steps to mitigate risks, 

such as through limiting its exposures to other group entities. 

Refer also to the answer provided to EC 1, CP 12. 

EC9 The supervisor has the power to require changes in the composition of the bank’s Board if it 

believes that any individuals are not fulfilling their duties related to the satisfaction of these 

criteria. 

Description and 

findings re EC9 

As part of their remedial powers, the FBAs may limit the powers of institution-affiliated parties 

(IAPs) (including directors and management) when an unsafe or unsound practice or violation 

exists. See 12 U.S.C. § 1818(b). The agencies also have the power, under certain well-defined 

circumstances, to prohibit an IAP from participating in the affairs of a bank or holding 

company. See 12 U.S.C. § 1818(e). In some instances, this prohibition may extend industrywide. See 12 U.S.C. § 1818(e)(7). In general, supervisors try to address deficiencies in the 

composition of the board or management by less formal means, including moral suasion, and 

as part of a broader effort to resolve prudential concerns. Federal law also prohibits 

individuals convicted of any criminal offense involving dishonesty or a breach of trust or 
UNITED STATES 

116 INTERNATIONAL MONETARY FUND

money laundering (or who have agreed to enter into a pretrial diversion or similar program in 

connection with a prosecution of such offense) from: (a) becoming or continuing as an IAP of 

any insured depository institution; (b) owning or controlling, directly or indirectly, any insured 

depository institution; or (c) otherwise participating, directly or indirectly, in the conduct of the 

affairs of any insured depository institution. This includes removal of the IAPs from their 

position if they are convicted of such crimes. See 12 U.S.C. § 1829. 

Additional 

criteria 

AC1 Laws, regulations or the supervisor require banks to notify the supervisor as soon as they 

become aware of any material and bona fide information that may negatively affect the 

fitness and propriety of a bank’s Board member or a member of the senior management. 

Description and 

findings re AC1 

Certain laws and regulations require the bank and holding company to notify the supervisor 

when they become aware of material information that may indicate that a board member or 

member of senior management is unfit for service. For example, suspicious activity reports are 

required to be filed for any instances of known or suspected illegal or suspicious activity 

including the actions of board members and senior management. See 31 U.S.C. § 5318(g); 12 

CFR 208.62, 12 CFR 211.24(f), and 12 CFR 225.4(f); 12 CFR 353; and 12 CFR 21.11 and 163.180. 

The FBAs expect that notification would be given of any circumstance involving a board or 

management member that has the potential to impact the safety or soundness of the bank or 

holding company. 

Assessment of 

Principle 14

Largely Compliant 

Comments Since the financial crisis of 2008-09 major changes have taken place in supervisors ́ demands 

on banks’ corporate governance and in the bank’s own approaches to these issues. Laws and 

regulations have gradually raised the requirements, although from a low level In particular, the 

expectations have been strengthened in those areas: (i) Board involvement in setting the 

bank’s risk appetite; (ii) the establishment of Risk Management Committees and; (iii) the 

increased frequency of Board meetings. The BCP assessors saw evidence of this, for instance in 

the reports from supervisory examinations, including when taking informal supervisory actions 

or formal enforcement actions for non-compliance. Assessors’ discussions with banks also 

indicate a clearly heightened focus by boards and management on corporate governance 

issues. One prominent area concerns the role and mandates of banks ́ boards relative to that 

of the senior management. Until very recently in the U.S., there was not a clear distinction 

between the two; for example the assessors saw numerous examples both in regulation and in 

actual supervision where the standard term “board and senior management” was used in 

situations where good current international practices would dictate that only one of the two 

should have the specific role and responsibility. The demands on board involvement and skills 

have increased substantially and this has also in many instances led to consequential changes 

in board compositions and calls for wider skill sets of directors. That said, both supervisors and 

banks agree that further steps need to be taken and implemented in the field of corporate 

governance. For instance, the stricter requirements and expectations by the supervisors seem 

to apply primarily to large banks. There seems to be a process of “trickling down”, i.e., that 

strengthened corporate governance practices also reach midsize and smaller banks, but this 

will probably take some more time before reaching desired levels. 

The LC rating is based on the fact that some key regulations, such as the SR 12-17 by the FRB 

and Heightened Standards by the OCC, have only recently come into force and have therefore 

not yet been fully implemented (and, as mentioned above, they primarily refer to large banks.) 
UNITED STATES 

INTERNATIONAL MONETARY FUND 117

The new requirements will imply a substantial improvement but, in fact, the new, higher level 

is no more than standard practice in some other jurisdictions. In addition, there continue to 

exist areas where the requirements on the roles and responsibilities of bank boards fall short 

of international standards (See for instance the comments on CP 20 on Lending to related 

parties). 

In addition, on AC1, the requirements that bank informs the supervisors promptly about 

material developments that affect the fitness and propriety of Board directors or senior 

management are defined only for a narrow scope of events and should be broadened. 

Principle 15 Risk management process. The supervisor determines that banks51 have a comprehensive 

risk management process (including effective Board and senior management oversight) to 

identify, measure, evaluate, monitor, report and control or mitigate52 all material risks on a 

timely basis and to assess the adequacy of their capital and liquidity in relation to their risk 

profile and market and macroeconomic conditions. This extends to development and review 

of contingency arrangements (including robust and credible recovery plans where warranted) 

that take into account the specific circumstances of the bank. The risk management process is 

commensurate with the risk profile and systemic importance of the bank.53

Essential criteria 

EC1 The supervisor determines that banks have appropriate risk management strategies that have 

been approved by the banks’ Boards and that the Boards set a suitable risk appetite to define 

the level of risk the banks are willing to assume or tolerate. The supervisor also determines 

that the Board ensures that: 

(a) a sound risk management culture is established throughout the bank; 

(b) policies and processes are developed for risk-taking, that are consistent with the risk 

management strategy and the established risk appetite; 

(c) uncertainties attached to risk measurement are recognized; 

(d) appropriate limits are established that are consistent with the bank’s risk appetite, risk 

profile and capital strength, and that are understood by, and regularly communicated 

to, relevant staff; and 

(e) senior management takes the steps necessary to monitor and control all material risks 

consistent with the approved strategies and risk appetite. 

Description and 

findings re EC1 

As with many aspects of the regime, the approach to risk management is tiered. In the case of 

risk management this is largely achieved by reference to asset size. See Table 15.1. 

 

51 For the purposes of assessing risk management by banks in the context of Principles 15 to 25, a bank’s risk 

management framework should take an integrated “bank-wide” perspective of the bank’s risk exposure, 

encompassing the bank’s individual business lines and business units. Where a bank is a member of a group of 

companies, the risk management framework should in addition cover the risk exposure across and within the 

“banking group” (see footnote 19 under Principle 1) and should also take account of risks posed to the bank or 

members of the banking group through other entities in the wider group. 

52 To some extent the precise requirements may vary from risk type to risk type (Principles 15 to 25) as reflected by 

the underlying reference documents. 

53 It should be noted that while, in this and other Principles, the supervisor is required to determine that banks’ risk 

management policies and processes are being adhered to, the responsibility for ensuring adherence remains with a 

bank’s Board and senior management.
UNITED STATES 

118 INTERNATIONAL MONETARY FUND
UNITED STATES 

INTERNATIONAL MONETARY FUND 119

All Banks 

The general supervisory regime that applies to all banks for risk management is derived from 

guidance against the safety and soundness statutes. 

As part of the examination process, supervisors review and rate risk management (strategy 

and culture) to determine the adequacy of bank processes relative to the size and nature of 

the bank, and identify weaknesses requiring attention from management. If Supervisors 

determine that risk management processes (including risk appetite and consideration of 

uncertainties) are inadequate, they have the power through various means to require a 

banking group to strengthen them. Supervisors assess risk management as part of the formal 

rating systems and various other ratings and assessment processes they use (risk management 

is a part of Management assessment in the CAMELS rating for banks or part of "R" (risk and 

risk management) in the RFI/C rating system for Bank Holding Companies, Savings and Loan 

Holding Companies. There are continuous supervision activities, specific on-site reviews, and 

horizontal supervision reviews. Off-site monitoring looks for indications of metrics that may 

indicate risk management issues. Risk-focused supervision places specific emphasis on the 

quality of risk management. Examiners consider findings relating to the following elements of 

a sound risk management system: active board and senior management collective oversight; 

adequate policies, procedures, and limits; adequate risk measurement, monitoring, and 

management information systems; and comprehensive internal controls. Examiners use a riskfocused approach to supervision, and apply flexibility when assessing the appropriateness of a 

banking organization’s risk management processes to address the organization’s 

circumstances and the nature, scope, and complexity of its operations. 

For smaller banks engaged predominantly in traditional banking activities and whose senior 

managers and directors are actively involved in the details of day-to-day operations, risk 

management systems may be less sophisticated. Even smaller and mid-size banks can have 

complex parts of their operation needing sophisticated risk monitoring and risk management 

capabilities. Risk specialists can join supervisory activities for these banks. 

Banks and holding companies are required to have in place comprehensive risk management 

policies and processes to identify, evaluate, monitor and control or mitigate material risks. 

Interagency safety and soundness guidelines require institutions to establish internal controls 

and information systems that are appropriate to the size of the institution and the nature, 

scope and risk of its activities. High-level requirements are specified in those portions of the 

interagency safety and soundness guidelines addressing operational and managerial 

standards. There is detailed guidance and supervisory manuals on various specific risk areas 

and on consolidated approaches to risk management. 

Banking Institutions with at least $10bn of Assets 

Large complex banks and holding companies are expected to have far more sophisticated and 

formal risk management systems in order to address their broader and typically more complex 

range of financial activities and to provide the board and senior management with the 

information needed to monitor and direct day-to-day activities. These risk management 

systems require frequent monitoring and testing by independent control areas and internal, as 

well as external, auditors to ensure the integrity of the information used in overseeing 

compliance with policies and limits. Supervisors will review the adequacy of internal audit 

work and their capacity to rely on it. Large complex banks and holding companies should have 

risk management systems or units that are credible, authoritative, and sufficiently independent 

of the business lines in order to ensure an adequate separation of duties and the avoidance of 

conflicts of interest. Supervisors review the work of these units, and Basel II supervisory work 
UNITED STATES 

120 INTERNATIONAL MONETARY FUND

has also been used in this regard. 

The DFA introduced some risk management and stress testing standards for institutions 

between $10bn and $50bn (such as annual company-run stress tests and the formation of a 

risk committee). 

Banking Institutions with at least $50bn of Assets 

The DFA contained a number of additional requirements relating to risk management 

primarily targeted at Banking Institutions with at least $50bn of Assets. The requirements 

cover establishing a risk-management framework that is commensurate with an institution’s 

structure, risk profile, complexity, activities, and size. That framework should include policies 

and procedures establishing risk-management governance, risk-management procedures, and 

risk-control infrastructure for its global operations, as well as processes and systems for 

implementing and monitoring compliance with such policies and procedures. These processes 

and systems would cover identifying and reporting risks and risk-management deficiencies, 

including regarding emerging risks; ensuring effective and timely implementation of actions to 

address emerging risks and risk-management deficiencies for its global operations; 

establishing managerial and employee responsibility for risk management; ensuring the 

independence of the risk-management function; and integrating risk management and 

associated controls with management goals and its compensation structure for its global 

operations. Assessments of the quality of risk management at large institutions subject to 

higher risk management requirements are included as part of the evaluation of the overall 

organization. The Federal Reserve has established, through its Capital Plan Rule and its annual 

CCAR, additional requirements for Bank Holding Companies with at least $50bn in assets to 

ensure they properly assess their risks (including those arising during adverse conditions) and 

maintain sufficient capital to support those risks. The Federal Reserve’s Capital Plan Rule, 

along with subsequent capital planning guidance, establishes requirements for firms to have 

effective processes for ensuring they have sufficient levels of capital in both normal and 

stressed conditions. The firms are required to have internal processes for assessing their 

capital adequacy that reflect a full understanding of their risks and ensure that they hold 

capital corresponding to those risks to maintain overall capital adequacy. 

Banking Institutions with at least $250 billion in total consolidated assets or at least $10 

billion in total on-balance sheet foreign exposure 

The agencies’ Supervisory Guidance on the Supervisory Review Process of Capital Adequacy 

(Pillar 2) lays out further requirements related to risk management for core banks mandated 

to use the advanced capital approaches under Basel II, which they have been putting in place 

for some time. During the implementation process Supervisors having been using Basel II 

implementation (and supervisors have been assessing implementation), among other 

measures to promote enhanced risk management practices. There are also supervisory letters, 

which lay out additional risk management guidance. Taken together, the amount of guidance 

on risk management is extensive. 

Note 

Banking Institutions with at least $50bn of Assets 

The OCC formalized its "heightened expectations" for risk management and governance in its 

Heightened Standards Guidelines. The guidelines contain minimum standards for the design and 

implementation of a Risk Governance Framework and for the role of the board of directors in 

overseeing the framework. These standards apply to large national banks and federal savings 

associations and are consistent with the principles embedded in the Federal Reserve's 

expectations for large bank holding companies. The Guidelines will be phased in according to 
UNITED STATES 

INTERNATIONAL MONETARY FUND 121

the bank's size: (i) banks with average total consolidated assets of $750 billion or more should 

comply with the Guidelines on 10 November 2014; (ii) banks with average total consolidated 

assets of $100 billion or more but less than $750 billion should comply by 10 May 2015; (iii) 

banks with average total consolidated assets of $50 billion or more but less than $100 billion 

should comply by 10 May 2016; (iv) banks with average total consolidated assets of less than 

$50 billion that are subject to the Guidelines by virtue of being a subsidiary of a parent company 

that controls another bank subject to the guidelines should comply with the Guidelines on the 

same date that the affiliated bank should comply; and (v) banks with average total consolidated 

assets of less than $50 billion on the effective date (November 10, 2014) that subsequently 

become subject to the Guidelines should comply within 18 months as of date of the most recent 

Call Report used to calculate the average.

EC2 The supervisor requires banks to have comprehensive risk management policies and processes 

to identify, measure, evaluate, monitor, report and control or mitigate all material risks. The 

supervisor determines that these processes are adequate: 

(a) to provide a comprehensive “bank-wide” view of risk across all material risk types; 

(b) for the risk profile and systemic importance of the bank; and 

(c) to assess risks arising from the macroeconomic environment affecting the markets in 

which the bank operates and to incorporate such assessments into the bank’s risk 

management process. 

Description and 

findings re EC2 

All Banks 

In assessing the adequacy of risk management processes, agencies' processes are designed to 

ensure that banks and holding companies have effective risk management and internal 

controls systems with a documented understanding of both. The agencies assess, and ratings 

reflect, the board's fulfillment of its responsibilities primarily in accordance with the guidance 

outlined in EC 1 above. On balance the assessors felt that the guidance did not constitute 

requirements, but the assessors did see considerable evidence of supervisory action in 

supporting improved levels of risk aggregation. The Firms the assessors interviewed also 

acknowledged the push from the regulator and that some of the improvements they had 

made had been down to that pressure. 

U.S. FBAs are required to assess the management of all institutions under their jurisdiction, 

regardless of their size, and to assign a rating reflecting the assessment. In assessing 

management, risk-focused supervision places specific emphasis on the quality of risk 

management. Examiners consider findings relating to the following elements of a sound risk 

management system: active board and senior management oversight; adequate policies, 

procedures, and limits; adequate risk measurement, monitoring, mitigation, and management 

information systems; and comprehensive internal controls. An institution's policies, 

procedures, and limits are expected to provide for the adequate identification, measurement, 

monitoring, and control of the risks posed by its activities. Policies and procedures are also 

expected to reflect the changing risk profile of the institution by providing for the review of 

activities new to the institution to ensure that the infrastructures necessary to identify, 

monitor, and control risks associated with an activity are in place before the activity is initiated. 

Principles of sound risk management are expected to apply to the entire spectrum of risks 

facing a consolidated organization as well as individual institutions. U.S. federal banking 

examiners use a risk-focused approach to supervision, and apply flexibility when assessing the 

appropriateness of a banking organization’s risk management processes to address the 

organization's circumstances and the nature, scope, and complexity of its operations. Large 

complex banks and holding companies are expected to have more sophisticated and formal 
UNITED STATES 

122 INTERNATIONAL MONETARY FUND

risk management systems in order to address their broader and typically more complex range 

of financial activities and to provide the board and senior management with the information 

needed to monitor and direct day-to-day activities. 

The agencies use a risk-based process for smaller (community) banks. Assessments of these 

firms are generally made through both periodic on-site examinations that are supplemented 

with off-site monitoring (see, for example, SR Letter 97-25, Risk Focused Framework for the 

Supervision of Community Banks and the OCC's Community Bank Supervision Booklet). As 

with their supervisory programs for large institutions, the agencies' supervisory programs for 

smaller organizations assess management's ability to identify, measure, monitor and control 

risks. The risk management processes of BHCs are assessed in accordance with the guidance 

set out in SR Letter 95-51, Rating the Adequacy of Risk Management Processes and Internal 

Controls at State Member Banks and Bank Holding Companies, the BHC Supervision Manual 

(BHCSM), the Commercial Bank Examination Manual (CBEM), the Trading and Capital-Markets 

Activities Manual (Trading Manual), and various other guidance documents. Similar to the 

Federal Reserve, the OCC uses a risk assessment system to evaluate the risk profiles of 

nationally chartered banks across eight categories of risks. These assessments consider the 

bank's quantity of risk, quality of risk management and direction of the bank's risk exposures. 

The OCC expects that regardless of a bank's size and complexity, sound risk management 

systems should (i) Identify risk —To properly identify risks, a bank must recognize and 

understand existing risks and risks that may arise from new business initiatives, including risks 

that originate in nonbank subsidiaries and affiliates, and those that arise from external market 

forces, or regulatory or statutory changes. Risk identification should be a continuing process 

and should occur at both the transaction and portfolio levels; (ii) Measure risk—Accurate and 

timely measurement of risks is essential to effective risk management systems. A bank that 

does not have a risk measurement system has limited ability to control or monitor risk levels. 

Further, more sophisticated measurement tools are needed as the complexity of the risk 

increases. A bank should periodically test to make sure that the measurement tools it uses are 

accurate. Sound risk measurement systems assess the risks of both individual transactions and 

portfolios; (iii) Monitor risk—Banks should monitor risk levels to ensure timely review of risk 

positions and exceptions. Monitoring reports should be timely, accurate, and informative and 

should be distributed to appropriate individuals to ensure action, when needed. For a large, 

complex company, monitoring is essential to ensure that management's decisions are 

implemented for all geographies, products, and related entities; and (iv) Control (mitigate) 

risk—Banks should establish and communicate risk limits through policies, standards, and 

procedures that define responsibility and authority. These limits should serve as a means to 

control exposures to the various risks associated with the bank's activities. The limits should be 

tools that management can adjust when conditions or risk tolerances change. Banks should 

also have a process to authorize and document exceptions or changes to risk limits when 

warranted. The board must establish the bank's strategic direction and risk tolerances. In 

carrying out these responsibilities, the board should approve policies that set operational 

standards and risk limits. Well-designed monitoring systems will allow the board to hold 

management accountable for operating within established tolerances. (See OCC's Bank 

Supervision Process Handbook). A bank's or holding company's failure to establish a 

management structure that adequately identifies, measures, monitors, and controls the risks 

involved in its various products and lines of business is considered unsafe and unsound 

conduct, for which the U.S. FBAs may initiate formal or informal supervisory action requiring 

the immediate implementation of necessary corrective measures, as explained in the 

enforcement actions section of the banking agencies' web sites and in BCP 11. 

Publically Traded Banking Institutions with at least $10bn of Assets 
UNITED STATES 

INTERNATIONAL MONETARY FUND 123

Banks are required to maintain a risk committee that approves and periodically approves the 

risk-management policies and global operations and global risk-management framework (see 

12 U.S.C. § 5365; and 12 CFR 252.22 and 252.33). The Bank Holding Companies global riskmanagement framework is required to be commensurate with its structure, risk profile, 

complexity, activities, and size. The applicable regulations also impose specific corporate 

governance requirements on the charter, composition, and activities of the risk committee, 

including requiring having at least one member with experience in identifying, assessing, and 

managing risk exposures of large, complex firms, being chaired by an independent director 

pursuant to the listing standards of a national securities exchange, receiving regular reports 

from the company's chief risk officer, and conducting regular, fully documented meetings. The 

Federal Reserve, OCC, and FDIC also require annual company-run stress tests, under which 

firms must estimate the impact of a range of economic and financial scenarios on their capital 

levels. The agencies maintain teams of examiners dedicated to each of the large complex 

banks, and these banks are subject to a continuous risk-focused supervision program. These 

teams include examiners with specialized expertise in areas such as capital markets, retail and 

commercial lending, operations, and information technology, and they conduct on-going, 

risk-focused supervision based upon agency guidance. 

Banking Institutions with at least $50bn of Assets 

Firm-wide views of all material risks and risk profile (and controls) are critical elements to the 

CCAR process and the overall supervisory evaluation of the firm, built through examinations 

and on-going supervision throughout the year. The supervisory evaluations are built on 

regulation and guidance, along with a broader view of safety and soundness. The risks from 

the macroeconomic environment are assessed in CCAR-related stress testing along with 

broader stress testing regimes that may occur across the organization or within individual 

businesses or portfolios. In CCAR, the Federal Reserve utilizes their teams dedicated to 

individual large banks, horizontal teams for specialty areas, and independent stress testing to 

determine the adequacy of capital levels and the management of capital at the firms and 

across the portfolio. Each firm's capital adequacy process is assessed in relation to seven key 

principles: (1) Sound foundational risk management—identification, measurement, 

assessment, and control (2) Effective loss estimation methodologies (3) Solid resource 

estimation methodologies (estimating capital resources) (4) Sufficient capital adequacy impact 

assessment (5) Comprehensive capital policy and capital planning (6) Robust internal controls 

and (7) Effective governance. Within this framework, risk identification, measurement, 

assessment, and control are examined, along with governance over those risks. The process 

includes the assessment during the CCAR examination and assessments developed through 

other supervisory processes. 

The OCC applies a similar set of practices for large national banks and as a management 

initiative they have launched the “Strive for Strong” approach whereby supervisors judge the 

gap from the current risk management standard of the bank and a strong rating. They then 

devise a supervisory strategy to bridge that gap. The assessors were shown data that 

suggested that this strategy was yielding further improvements. The Federal Reserve issued 

supervisory guidance in 2012 (see SR 12-17, Consolidated Supervision Framework for Large 

Financial Institutions) to describe the enhanced supervisory approach for institutions with at 

least $50 billion in assets, given their systemic importance. 

Note 

Banking Institutions with at least $50bn of Assets 

The OCC formalized its "heightened expectations" for risk management and governance in its 

Heightened Standards Guidelines. The guidelines provide that the bank should have a 
UNITED STATES 

124 INTERNATIONAL MONETARY FUND

comprehensive written statement that articulates the bank’s risk appetite and serves as a basis 

for the risk governance framework (i.e., risk appetite statement). The term risk appetite refers to 

the aggregate level and types of risk that the board and management are willing to assume to 

achieve a covered bank's strategic objectives and business plan, consistent with applicable 

capital, liquidity, and other regulatory requirements. The risk appetite statement should include 

both qualitative components and quantitative limits. The qualitative components of the risk 

appetite statement should describe a safe and sound risk culture and how a covered bank will 

assess and accept risks, including those that are difficult to quantify, on a consistent basis 

throughout the institution. Quantitative limits should incorporate sound stress testing processes, 

as appropriate, and should address a covered bank's earnings, capital, and liquidity positions. 

Additionally, the guidelines provide that each member of the board should oversee a covered 

bank's compliance with safe and sound banking practices. Consistent with this, the board should 

also require management to establish and implement an effective risk governance framework 

that complies with the guidelines. The board or its risk committee should approve any significant 

changes to the framework.

EC3 The supervisor determines that risk management strategies, policies, processes and limits are: 

(a) properly documented; 

(b) regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk 

profiles and market and macroeconomic conditions; and 

(c) communicated within the bank 

The supervisor determines that exceptions to established policies, processes and limits receive 

the prompt attention of, and authorization by, the appropriate level of management and the 

bank’s Board where necessary. 

Description and 

findings re EC3 

All Banks 

In assessing the adequacy of risk management processes, agencies ensure that risk 

management strategies, policies, processes, and limits are properly documented, reviewed 

and updated, and communicated within the bank and banking group. In addition, examiners 

determine that exceptions to established policies, processes and limits receive the prompt 

attention of and authorization by the appropriate level of management and the board where 

necessary. The agencies generally conduct examinations of the documentation supporting the 

risk management process and adherence to internal policies, processes, and limits in 

conjunction with targeted examinations of specific business activities. 

Banking Institutions with at least $50bn of Assets 

These institutions are subject to enhanced standards of risk management. Bank Holding 

Companies are expected to have effective risk identification,-measurement, -management, 

and -control processes in place to support their internal capital planning. 

Note 

Banking Institutions with at least $50bn of Assets 

The OCC formalized its "heightened expectations" for risk management and governance in its 

Heightened Standards Guidelines. The guidelines provide that a bank should establish and 

adhere to a formal, written risk governance framework that is designed by independent risk 

management and approved by the board of directors or the board’s risk committee. The 

framework should be reviewed and updated at least annually, and as often as needed to address 

improvements in industry risk management practices and changes in the bank’s risk profile 

caused by emerging risks, its strategic plans, or other internal or external factors. Also, the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 125

guidelines provide that the framework should include processes whereby initial communication 

and on-going reinforcement of the bank’s risk appetite statement occurs throughout the bank in 

a manner that causes all employees to align their risk-taking decisions with applicable aspects of 

the risk appetite statement.

EC4 The supervisor determines that the bank’s Board and senior management obtain sufficient 

information on, and understand the nature and level of risk being taken by the bank and how 

this risk relates to adequate levels of capital and liquidity. The supervisor also determines that 

the Board and senior management regularly review and understand the implications and 

limitations (including the risk measurement uncertainties) of the risk management information 

that they receive. 

Description and 

findings re EC4 

All Banks 

Supervisors review whether senior management and the board understand the nature and 

level of risk being taken by the institution and how this risk relates to adequate capital levels. 

Examiners also determine that senior management ensures that the risk management policies 

and processes are appropriate in the light of the institution's risk profile and business plan and 

that they are implemented effectively. Senior management is expected to review regularly and 

understand the implications (and limitations) of the risk management information that it 

receives. The same requirement applies to the board in relation to risk management 

information presented to it in a format suitable for board oversight. The agencies assess, and 

ratings reflect, whether senior management and the board of directors understand the nature 

and level of risk being taken by the organization primarily in accordance with guidance 

outlined in EC 1. 

EC5 The supervisor determines that banks have an appropriate internal process for assessing their 

overall capital and liquidity adequacy in relation to their risk appetite and risk profile. The 

supervisor reviews and evaluates banks’ internal capital and liquidity adequacy assessments 

and strategies. 

Description and 

findings re EC5 

Capital 

All Banks 

Supervisors expect banks and bank holding companies to develop internal capital and 

strategic plans that exceed minimum regulatory capital requirements to ensure that the 

capital they are holding and forecast to need is adequate given their risk profile and appetite 

including as they are manifested through various stress scenarios. All organizations are 

expected to understand their underlying risks and hold capital commensurate with those risks 

“at levels above regulatory minimum” to ensure capital adequacy. 

Banking Institutions with at least $50bn of Assets 

DFA capital stress tests and the Federal Reserve’s annual CCAR exercise also enhance the 

supervisory approach to ensuring that the largest firms have sufficient capital to support their 

risks. Federal Reserve published Capital Planning at Large Bank Holding Companies: 

Supervisory Expectations and Range of Current Practice in August 2013, which set out that Bank 

Holding Companies are expected to have effective risk identification, —measurement,—

management, and-control processes in place to support their internal capital planning. 

Liquidity 

All Banks 

Similarly, various rules and interagency guidelines require banking organizations to establish 

and maintain robust liquidity risk management practices and process for determining the 
UNITED STATES 

126 INTERNATIONAL MONETARY FUND

adequacy of their liquidity resources, including through various stress scenarios. This involves 

requiring a company’s board of directors to approve the company’s liquidity risk tolerance at 

least annually, receive and review information from senior management at least semi-annually 

to determine whether the organization is operating in accordance with its established liquidity 

risk tolerance, and to approve and periodically review the liquidity risk management 

strategies, policies, and procedures established by senior management. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve undertakes a Comprehensive Liquidity Analysis and Review (CLAR) 

program to assess liquidity in normal and stressed scenarios and aspects of liquidity risk 

management for individual firms. 

EC6 Where banks use models to measure components of risk, the supervisor determines that: 

(a) banks comply with supervisory standards on their use; 

(b) the banks’ Boards and senior management understand the limitations and 

uncertainties relating to the output of the models and the risk inherent in their use; 

and 

(c) banks perform regular and independent validation and testing of the models 

The supervisor assesses whether the model outputs appear reasonable as a reflection of the 

risks assumed. 

Description and 

findings re EC6 

All Banks 

Banks and holding companies generally are expected to ensure that risk management models 

and systems are independently validated and tested with an appropriate frequency. 

Supervisory guidance directs that key assumptions, data sources, and procedures used in 

measuring (including any model output uncertainties) and monitoring risk be appropriate and 

adequately documented and tested for reliability on an on-going basis. Models should be 

independently validated and tested by risk management staff or by internal or outside 

auditors. Guidance that more specifically addresses model requirements for various types of 

models is found in the related sections of the agencies' manuals. Although the 

comprehensiveness and specificity of supervisory guidance relating to the role of the Board 

varied, the assessors found evidence that supervisors did pursue issues in relation the role of 

the Board. 

Banking Institutions with at least $10bn of Assets 

Rules on DFA stress tests also include requirements for institutions to validate their stress 

testing models. 

The assessors saw examples of supervisors raising limitations on models. 

Banking Institutions with at least $50bn of Assets 

Federal Reserve published Capital Planning at Large Bank Holding Companies: Supervisory 

Expectations and Range of Current Practice in August 2013, which set out that Bank Holding 

Companies are expected to have an effective independent review and validation of all models 

used in internal capital planning. 

EC7 The supervisor determines that banks have information systems that are adequate (both 

under normal circumstances and in periods of stress) for measuring, assessing and reporting 

on the size, composition and quality of exposures on a bank-wide basis across all risk types, 

products and counterparties. The supervisor also determines that these reports reflect the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 127

bank’s risk profile and capital and liquidity needs, and are provided on a timely basis to the 

bank’s Board and senior management in a form suitable for their use. 

Description and 

findings re EC7 

Supervisory safety and soundness guidelines require banks and holding companies to have 

information systems that are appropriate to the size of the institutions and the nature, scope 

and risks of their activities and that provide access to timely and accurate financial, 

operational, and regulatory reports. Supervisors assess, and their supervisory ratings reflect, 

the adequacy of firm-wide risk management information at both the holding company and 

institution level. Risk monitoring activities must be supported by information systems that 

provide senior managers and directors with timely reports clearly indicating positions and risk 

exposures, as well as with regular and sufficiently detailed reports for line managers engaged 

in the day-to-day management of the organization’s activities. Examiners analyze reports 

flowing to executive management, board committees, and the board of directors for clarity, 

consistency, timeliness, quality, and coverage of crucial areas of the organization. Examiners 

ascertain that reporting is sufficiently comprehensive for sound decision-making, and that 

reports relate risks relative to the bank's earnings and capital. 

EC8 The supervisor determines that banks have adequate policies and processes to ensure that the 

banks’ Boards and senior management understand the risks inherent in new products,54

material modifications to existing products, and major management initiatives (such as 

changes in systems, processes, business model and major acquisitions). The supervisor 

determines that the Boards and senior management are able to monitor and manage these 

risks on an on-going basis. The supervisor also determines that the bank’s policies and 

processes require the undertaking of any major activities of this nature to be approved by 

their Board or a specific committee of the Board. 

Description and 

findings re EC8 

Supervisors verify that banks and Bank Holding Companies have policies and processes in 

place to ensure that management identifies and reviews all risks associated with new activities 

or products, and that the infrastructure and internal controls necessary to manage the related 

risks are in place. 

Supervisors expect that risk management process reflect the size and the complexity of the 

product or service offered. 

Although the comprehensiveness and specificity of supervisory guidance relating to the 

approval of new products and major risk management initiatives varies (including in relation 

to the role of the Board), the assessors found evidence that supervisors do pursue issues in 

relation to product development and activities. 

EC9 The supervisor determines that banks have risk management functions covering all material 

risks with sufficient resources, independence, authority and access to the banks’ Boards to 

perform their duties effectively. The supervisor determines that their duties are clearly 

segregated from risk-taking functions in the bank and that they report on risk exposures 

directly to the Board and senior management. The supervisor also determines that the risk 

management function is subject to regular review by the internal audit function. 

Description and 

findings re EC9 

All Banks 

Supervisors have an expectation (under the Safety and Soundness provisions) that all banks 

and holding companies have in place comprehensive risk-management policies and processes 

for identifying, evaluating, monitoring, and controlling or mitigating all material risks. 

 

54 New products include those developed by the bank or by a third party and purchased or distributed by the bank. 
UNITED STATES 

128 INTERNATIONAL MONETARY FUND

Supervisors expect the Independent Risk Management function to identify and assess the 

bank’s material aggregate risks; determine if actions are needed to strengthen risk 

management or reduce risk given changes in the bank’s profile or other conditions; establish 

and adhere to enterprise policies that include concentration limits; and identify and 

communicate to the CEO and the board of directors material risks and significant instances 

where independent risk management’s assessment of risk differs from that of a front line unit 

and significant instances where a front line unit is not adhering to the risk governance 

framework. 

Supervisors ensure that the composition of the risk management function must comprise a 

well-qualified and trained group of individuals with a wide variety of skill sets. Initiatives 

should be in place to ensure education and training coincides with changes in the risk 

landscape. 

The assessors found conflicting evidence on the issue of whether the risk management 

function should be in the ‘control universe’ subject to review by Internal Audit. The interagency guidance of 2003 (e.g. SR03-5) describes the general role as assessing risk 

management and governance, but not the function. The Federal Reserve supplementary 

guidance (SR13-1) does however make it clear that Internal Audit should include the function. 

In practice the position of risk management is a key part of the examination process and the 

assessors saw substantial evidence of supervisory action in this respect. 

Publicly Traded Bank Holding Companies with at least $10bn of Assets 

A BHC's risk management framework must be commensurate with its capital structure, risk 

profile, complexity, activities, and size must include enumerated policies, procedures, 

processes, and systems. 

Banking Institutions with at least $50bn of Assets 

Bank Holding Companies are expected to have effective risk identification, measurement, 

management, and control processes in place to support their internal capital planning. In 

addition to the assessments of a BHC's stress scenario analysis and stressed loss- and 

revenue-estimation practices, supervisory assessments of Bank Holding Companies' internal 

capital planning will continue to focus on fundamental risk-identification,-measurement, and -

management practices, as well as on internal controls and governance. 

Specific controls should be in place to (i) ensure that management information systems are 

sufficiently robust to support capital analysis and decision making; (ii) provide for 

reconciliation and data integrity processes for all key reports; (iii) address the presentation of 

aggregate, enterprise-wide capital planning results, which should describe any manual 

adjustments made ensure that reports provided to senior management and the board contain 

the appropriate level of detail and are accurate and timely. 

Supervisors require Bank Holding Companies and individual banks to have risk evaluation, 

monitoring, and control or mitigation functions with duties clearly segregated from risk-taking 

functions and which report on risk exposures directly to senior management and the board or 

board committee. While organizations are generally given flexibility in how they accomplish 

this objective, most large, complex banks and Bank Holding Companies have established 

dedicated units to manage risk at the group level. 

EC10 The supervisor requires larger and more complex banks to have a dedicated risk management 

unit overseen by a Chief Risk Officer (CRO) or equivalent function. If the CRO of a bank is 

removed from his/her position for any reason, this should be done with the prior approval of 

the Board and generally should be disclosed publicly. The bank should also discuss the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 129

reasons for such removal with its supervisor. 

Description and 

findings re EC10 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve’s requirements for establishment of a CRO position at all Bank Holding 

Companies with at least $50bn in assets stem from the idea that the complexity and size of 

the operations of a BHC of this size warrant Bank Holding Companies having a designated 

executive in charge of implementing and maintaining the risk management framework and 

practices approved by the risk committee. The chief risk officer must have risk management 

expertise in a large, complex financial firm. The chief risk officer is responsible for overseeing: 

(i) the establishment of risk limits and monitoring compliance with those limits; (ii) the 

implementation and on-going compliance with appropriate policies and procedures for risk 

management governance, practices, and controls, including emerging risks; (iii) managing risk 

exposures and risk controls; (iv) monitoring and testing risk controls; (v) reporting risk 

management issues and emerging risks; and (vi) ensuring that risk management issues are 

timely and effectively resolved. The chief risk officer must report directly to both the risk 

committee and the chief executive officer of the BHC. The CRO may execute his or her 

responsibilities by working with, or through, others in the organization. 

The CRO is required to report directly to the risk committee and the BHC’s CEO, as this dual 

reporting helps the board of directors to oversee the risk-management function and may help 

disseminate information relevant to risk management throughout the organization. Finally, the 

compensation of a BHC’s CRO must be structured to provide for an objective assessment of 

the risks taken by the company. Current guidance is silent whether if a CRO of a bank is 

removed from his/her position for any reason, this should be done with the prior approval of 

the Board and generally should be disclosed publicly. The bank should also discuss the 

reasons for such removal with its supervisor.

Note 

Banking Institutions with at least $50bn of Assets 

The OCC formalized its "heightened expectations" for risk management and governance in its 

Heightened Standards Guidelines. The guidelines provide that the board or its risk committee 

approves all decisions regarding the appointment or removal of the Chief Risk Executive and 

approves the annual compensation and salary adjustment of the Chief Risk Executive.

EC11 The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, 

interest rate risk in the banking book and operational risk. 

Description and 

findings re EC11 

U.S. FBAs have issued standards related to credit, market, liquidity, interest rate risk in the 

banking book, and operational risk in the form of supervisory guidance and through the 

issuance of examination procedures and handbooks. Ratings reflect the results of the 

assessment of compliance with expectations appearing in these documents. 

EC12 The supervisor requires banks to have appropriate contingency arrangements, as an integral 

part of their risk management process, to address risks that may materialize and actions to be 

taken in stress conditions (including those that will pose a serious risk to their viability). If 

warranted by its risk profile and systemic importance, the contingency arrangements include 

robust and credible recovery plans that take into account the specific circumstances of the 

bank. The supervisor, working with resolution authorities as appropriate, assesses the 

adequacy of banks’ contingency arrangements in the light of their risk profile and systemic 

importance (including reviewing any recovery plans) and their likely feasibility during periods 

of stress. The supervisor seeks improvements if deficiencies are identified. 
UNITED STATES 

130 INTERNATIONAL MONETARY FUND

Description and 

findings re EC12 

All Banks 

Supervisors have an expectation under guidance (under the Safety and Soundness provisions) 

that all banks and holding companies have in place contingency plans, but there are no 

requirements. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve has taken a number of steps to improve its supervisory program for large 

financial institutions. These steps include the development of an overall “Consolidated 

Supervision Framework for Large Financial Institutions” that focuses on enhancing the 

resiliency of a firm through, among other things, recovery planning, and on reducing the 

impact of a firm’s failure through, among other things, resolution planning. In addition, the 

Federal Reserve has issued guidelines regarding its heightened supervisory expectations for 

recovery and resolution preparedness for the largest Bank Holding Companies and outlines 

the capabilities that an institution should have in connection with its recovery and resolution 

preparedness. These capabilities that a BHC should have include, but are not limited to: 

 Effective processes for managing, identifying, and valuing collateral it receives from 

and posts to external parties and affiliates; 

 A comprehensive understanding of obligations and exposures associated with 

payment, clearing, and settlement activities; 

 The ability to analyze funding sources, uses, and risks of each material entity and 

critical operation, including how these entities and operations may be affected under 

stress; 

 Demonstrated management information systems capabilities for producing certain 

key data on a legal entity basis that is readily retrievable and controls in place to 

ensure data integrity and reliability; and 

 Robust arrangements in place for the continued provision of shared or outsourced 

services needed to maintain critical operations that are documented and supported 

by legal and operational frameworks. 

The Federal Reserve, in conjunction with the FDIC, have also issued regulations requiring Bank 

Holding Companies and regulated nonbank financial companies, to develop resolution plans 

or “living wills” for how the companies would be resolved in a rapid and orderly manner under 

the Bankruptcy Code (or other applicable insolvency regime) in the event of material financial 

distress or failure. The FDIC also has promulgated rules that require banks with $50 billion or 

more in total assets to provide a living will plan to the FDIC. Federal Reserve and FDIC’s 

resolution plan regulations contain mechanisms through which the agencies can address 

weaknesses and inadequacies within any resolution plan, including requiring changes to the 

plan that would remediate such weaknesses. 

EC13 The supervisor requires banks to have forward-looking stress testing programs, 

commensurate with their risk profile and systemic importance, as an integral part of their risk 

management process. The supervisor regularly assesses a bank’s stress testing program and 

determines that it captures material sources of risk and adopts plausible adverse scenarios. 

The supervisor also determines that the bank integrates the results into its decision-making, 

risk management processes (including contingency arrangements) and the assessment of its 

capital and liquidity levels. Where appropriate, the scope of the supervisor’s assessment 

includes the extent to which the stress testing program: 

(a) promotes risk identification and control, on a bank-wide basis 
UNITED STATES 

INTERNATIONAL MONETARY FUND 131

(b) adopts suitably severe assumptions and seeks to address feedback effects and systemwide interaction between risks; 

(c) benefits from the active involvement of the Board and senior management; and 

(d) is appropriately documented and regularly maintained and updated. 

The supervisor requires corrective action if material deficiencies are identified in a bank’s 

stress testing program or if the results of stress tests are not adequately taken into 

consideration in the bank’s decision-making process 

Description and 

findings re EC13 

Banking Institutions with at less than $10bn of Assets 

There are no requirements for banks below $10bn of Assets. 

Banking Institutions with at least $10bn of Assets 

The agencies issued supervisory guidance on stress testing for all banking organizations with 

at least $10 billion in total assets. That guidance laid out principles and standards for a 

satisfactory stress-testing framework, including for capital and liquidity stress testing. It noted 

that stress testing should involve the board and senior management and be an integral part of 

the bank’s governance and capital planning. This includes establishing stress testing 

objectives, defining scenarios, review and discussion of stress test results, assessing potential 

actions and decision-making. An organization should continuously review scenarios and 

develop new ones, examine new products to identify potential risks, improve the identification 

risks and how they interact, and evaluate appropriate time horizons and feedback effects. 

EC14 The supervisor assesses whether banks appropriately account for risks (including liquidity 

impacts) in their internal pricing, performance measurement and new product approval 

process for all significant business activities. 

Description and 

findings re EC14 

All Banks 

Guidance lays out principles for sound compensation practices including the principle that 

incentive compensation arrangements should balance risk and financial results in a manner 

that does not encourage employees to expose their organizations to imprudent risks. An 

incentive compensation arrangement is balanced when the amounts paid to an employee 

appropriately take into account the risks (including compliance risks), as well as the financial 

benefits, from the employee’s activities and the impact of those activities on the organization’s 

safety and soundness. 

Supervisors also monitor incentive compensation systems to ensure that appropriate 

personnel, including risk-management personnel, have input into the organization’s processes 

for designing incentive compensation arrangements and assessing their effectiveness in 

restraining imprudent risk taking. 

Banking Institutions with at least $1bn of Assets 

The DFA requires the appropriate federal regulators, including the FBAs, to issue a joint 

rulemaking or guidance to prohibit incentive-based compensation arrangements at 

institutions with $1 billion or more in assets (covered financial institutions) that encourage 

inappropriate risks by providing excessive compensation, or potentially leading to material 

financial loss. The agencies, along with other federal agencies, have issued guidance and 

proposed rules to implement this requirement. 

Banking Institutions with at least $10bn of Assets 

Supervisors assess the incorporation of risks into pricing, performance measurement, and the 
UNITED STATES 

132 INTERNATIONAL MONETARY FUND

new product process. One approach (used in stress testing, review of incentive compensation, 

new approval and performance scorecards) is to look at internal pricing (e.g., funds transfer 

pricing, capital allocation), performance measurement (e.g., incentive compensation, returns 

on allocated risk based capital,) and new product approvals as an overall process across all of 

the business lines and control functions that they touch. 

An alternative approach is a bottom- up method. Where in reviews of business lines there is 

often examine or test how pricing, capital allocation, new product approval and incentive 

compensation are implemented at the business lines, and how risks are incorporated at the 

more micro-level for these processes.

Additional 

criteria 

AC1 The supervisor requires banks to have appropriate policies and processes for assessing other 

material risks not directly addressed in the subsequent Principles, such as reputational and 

strategic risks. 

Description and 

findings re AC1 

All Banks 

Agencies approaches differ as to whether or not they consider reputational and strategic risks 

as separately identifiable risks. Each agency requires its organizations and institutions to have 

in place appropriate policies and processes for assessing all material risks, including those not 

directly addressed in the subsequent Principles, such as reputational and strategic risk. The 

agencies consistently expect reputational risk to be factored into the formulation of business 

strategy, and a part of the approval process for new activities and products. Agencies also 

hold the board of directors responsible for overseeing that strategic plans are implemented in 

a safe and sound manner. The agencies issue specific guidance when necessary to address 

unique reputational and/or strategic risks associated with a particular activity for which 

existing guidance may not adequately address supervisory expectations. 

Banking Institutions with at least $250 billion in total consolidated assets or at least $10 

billion in total on-balance sheet foreign exposure 

For those institutions subject to the advanced approaches of Basel II-based capital adequacy 

guidelines, the agencies have issued supervisory guidance related to the supervisory review 

process of capital adequacy, which addresses the need for banks to consider all material risks 

in their internal assessments of capital adequacy, including, reputational and strategic risks. 

Assessment of 

Principle 15

Largely Compliant 

Comments The assessors were able to see substantial improvement in the risk management process, but 

it also has to be acknowledged from a low starting point. It was noted on several occasions by 

the assessors that some milestones heralded by the banks, which the assessors interviewed, as 

significant improvements would only be considered as standard practice in some jurisdictions. 

For example: 

 Increased frequency of board meetings; 

 Existence of independent risk committees; and 

 Board members with expertise relevant to the business of the bank 

There has been a key focus on risk aggregation and the material that is used in the risk 

oversight process and the assessors saw some good material on supervisory actions 

reinforcing those points. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 133

However, most have acknowledged that this remains very much work in progress—much of 

the guidance for the larger banks is new or yet to be implemented and the task of 

implementation at the firms is a substantial one—often coming with substantial data projects 

that can take years to complete. 

The assessors also noted that for Banking Institutions with less than $10bn of Assets, many 

aspects of the essential criteria were not met. In general, supervisory expectations are 

tailored to be less strict for smaller, non-systemic banks. This means that there is a 

shortfall from the criteria, but the assessors judged that this was not sufficiently 

material to alter their overall conclusions. The assessors welcome that supervisors are 

encouraging medium and small banks with higher risk activities to adopt better 

practices in corporate governance and risk management that are appropriate for the 

risk profile of these firms, moving them closer to the criteria and some of the 

principles outlined in the requirements for the larger banks.

On the whole, however, the assessors found that both in the guidance and from the 

supervisory files the assessors reviewed there was less weight placed on the role of the Board. 

On some occasions it seemed clear that the messages were failing to delineate the role of 

Board and management (the phrase “Board and Senior Management” was very common). 

What distinction existed was often at the most basic level—for example that it is the role of 

the Board to appoint management. The assessors noted that in the most recent material (both 

supervisory reviews and guidance), the role of the Board was gaining more attention and this 

was welcomed. More clearly needed to be done in this area. 

Policy was also in its infancy in relation to the Chief Risk Officer. It was also unclear what 

arrangements existed should a CRO be removed. The assessors would recommend that this be 

clarified. 

The level of commitment to stress testing is substantial and the assessors found significant 

consensus that the outputs and outcomes of that process were significant. The assessors 

noted that both supervisors and firms were becoming more efficient with each iteration and 

also that the standards required were also increasing. There is perhaps still some way to go 

before the Supervisory led stress tests achieve an optimum state of data granularity. The 

assessors would also make two further observations: 

 Firms’ own stress-testing—it was striking that a number of firms to which the 

assessors spoke gave us cause for concern as to how they approached the stress test. 

In essence they described a “Dutch Auction” process where a firm’s own test was felt 

to be generating insufficient losses. As a response to this management would add 

increasingly more extreme scenarios in order to increase the amount of loss. This 

would consequently detach the overall stress scenario from what the Board and 

management would consider a plausible business outcome. This would eventually 

render the stress more as a compliance issue rather than as one that improves the 

risk management conversation. There are probably two things going wrong here: 

(i) that the supervisors could offer more guidance on severity and (ii) that the base 

scenarios that firms run should be more severe and thus remove the need for the 

more extreme scenarios. 

 Disaggregation—supervisors could useful engage with firms more on the 

components of the stress test—i.e. which areas make up the larger losses in the 

regulatory run stress tests. This would foster a useful discussion on what the 

vulnerabilities are in the firms’ portfolios. 
UNITED STATES 

134 INTERNATIONAL MONETARY FUND

Principle 16 Capital adequacy.55 The supervisor sets prudent and appropriate capital adequacy 

requirements for banks that reflect the risks undertaken by, and presented by, a bank in the 

context of the markets and macroeconomic conditions in which it operates. The supervisor 

defines the components of capital, bearing in mind their ability to absorb losses. At least for 

internationally active banks, capital requirements are not less than the applicable Basel 

standards. 

Essential criteria 

EC 1 Laws, regulations or the supervisor require banks to calculate and consistently observe 

prescribed capital requirements, including thresholds by reference to which a bank might be 

subject to supervisory action. Laws, regulations or the supervisor define the qualifying 

components of capital, ensuring that emphasis is given to those elements of capital 

permanently available to absorb losses on a going concern basis. 

Description and 

findings re EC1 

Laws and regulations require banks and bank holding companies to calculate and maintain 

minimum capital ratios. Federal statutes authorize the FBAs to establish minimum capital 

requirements for banks and require the FBAs to impose two types of capital adequacy 

requirements on banks—a risk-based capital requirement and a leverage ratio requirement. 

The FBAs also have the authority to establish minimum capital requirements for certain 

affiliates of banks, including bank holding companies and savings and loan holding 

companies. Under those authorities, the FBAs adopted capital adequacy rules (“former capital 

standards”) for banks and certain top-tier bank and SLHCs. The risk-based capital requirement 

was based on Basel I and a generally applicable minimum leverage ratio, defined in terms of a 

banking organization’s tier 1 capital to total on-balance sheet assets, was set at 4 percent. 

In July 2013, the FBAs adopted a new capital rule implementing global capital reforms and 

certain changes required by the DFA. The new rule implements Basel III revisions related to 

minimum capital requirements, the definition of capital and additional capital “buffer” 

standards, and incorporates aspects of the Basel II standardized approach and applicable 

Basel III changes to the advanced approaches. See 12 CFR part 3 (national banks and federal 

savings associations), 12 CFR part 217 (state member banks, bank holding companies, and 

savings and loan holding companies) and 12 CFR part 324 (state nonmember banks and state 

savings associations). The new capital rule supersedes the general risk-based capital rules and 

restructures the FBAs’ regulatory capital rules into a harmonized, codified regulatory capital 

framework. Aspects of the former capital standards remain in effect as the new rule transitions 

to full effectiveness. 

The new capital rule has three forms of capital: common equity tier 1 capital, additional tier 1 

capital, and tier 2 capital. The rule also sets out a list of criteria that an instrument must meet 

to be included in each category of regulatory capital, which are largely consistent with Basel III 

and focus on the permanence of capital and the availability of capital to absorb losses on a 

going concern basis. See 12 CFR part 3, subpart C (OCC); 12 CFR part 217, subpart C (Federal 

Reserve), 12 CFR part 324, subpart C (FDIC). 

Under the new capital rule, individual banking organizations are subject to minimum riskbased capital requirements on a consolidated basis. These requirements are 4.5 per cent 

 

55 The Core Principles do not require a jurisdiction to comply with the capital adequacy regimes of Basel I, Basel II 

and/or Basel III. The Committee does not consider implementation of the Basel-based framework a prerequisite for 

compliance with the Core Principles, and compliance with one of the regimes is only required of those jurisdictions 

that have declared that they have voluntarily implemented it. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 135

common equity tier 1 capital, 6 per cent tier 1 capital and 8 per cent total capital. The new rule 

also incorporates a capital conservation buffer of 2.5 per cent and, for banking organizations 

using the advanced approaches risk-based capital rule, a countercyclical capital buffer of up to 

2.5 per cent; both buffers are composed of common equity tier 1 capital. 

The new capital regulatory framework continues the longstanding minimum 4 per cent 

leverage ratio requirement (tier 1 capital to total on- balance-sheet assets) for banking 

organizations. In addition, “core” banking organizations (those with total consolidated assets 

of at least $250 billion or total consolidated on-balance sheet foreign exposures of at least 

$10 billion) that are required to use the advanced approaches risk-based capital rule, and 

other banking organizations that elect to do so, are also required to meet a minimum 

“supplementary leverage ratio” of 3 per cent, consistent with the Basel III leverage ratio. The 

supplementary leverage ratio is defined in terms of tier 1 capital to total on- and off-balance 

sheet assets. See 12 CFR 3.10 (OCC); 12 CFR 217.10 (Federal Reserve); 12 CFR 324.10 (FDIC). 

Most banking organizations operate with capital levels well above these minimum 

requirements. In April 2014, the FBAs adopted an enhanced supplementary leverage ratio final 

rule for top-tier bank holding companies and their insured depository institution subsidiaries. 

(See EC4). 

The new capital rule requires compliance by different types of organizations at different times, 

commencing on 1 January 2014, and incorporates transition provisions consistent with Basel 

III. 

Bank holding companies with $500 million or less in total consolidated assets are exempt from 

the new rule and are instead subject to the standards in the Federal Reserve’s Small BHC 

Policy (see 12 CFR part 225, Appendix C). Savings and loan holding companies were not 

subject to the former capital standards, but most are or will be subject to the new capital rule. 

Certain savings and loan holding companies with substantial commercial or insurance 

operations are currently excluded from the new capital rule (see 12 CFR part 217, subpart A); 

however, consistent with legal requirements, the Federal Reserve anticipates applying capital 

requirements to these excluded holding companies in the future. (See 12 U.S.C. § 5371.) 

The FBAs review the quality and regulatory capital eligibility of more complex instruments as 

necessary on a case-by-case basis. A banking organization must request approval from its 

primary FBA before including a capital element in regulatory capital, unless certain conditions 

are satisfied. The FBAs consult with each other when determining whether a new element 

should be included in common equity tier 1, additional tier 1 or tier 2 capital, and such 

decisions are made publicly available, including a brief description of the capital element and 

the rationale for the conclusion. The banking agencies therefore retain flexibility to consider 

new instruments on a case-by-case basis as they are developed over time to satisfy different 

market needs. See 12 CFR part 3, subpart C (OCC); 12 CFR part 217, subpart C (Federal 

Reserve); 12 CFR part 324, subpart C (FDIC). 

The Prompt Corrective Action (PCA) requirements provide the FBAs with a framework to take 

necessary measures should a bank become less-than-well capitalized. A bank’s common 

equity tier 1, tier 1 and total risk-based capital ratios, and leverage ratios, including the 

supplementary leverage ratio if applicable, must be at or above the regulatory minimum 

requirements to be considered adequately capitalized. In practice, banks typically have a 

strong preference to remain well capitalized, as falling below this threshold results in certain 

restrictions on activities (e.g., inability to accept or roll over brokered deposits). The minimum 

ratio requirements for each level of capitalization under the PCA requirements may be found 

in 12 CFR part 6 (OCC); 12 CFR part 208, subpart D (Federal Reserve); 12 CFR part 324, subpart 

H, 12 CFR part 325, subpart B, and 12 CFR part 390, subpart Y (FDIC). The PCA framework is not 
UNITED STATES 

136 INTERNATIONAL MONETARY FUND

applicable to bank holding companies. 

The new capital rule and its relation to the PCA framework is summarized in the following 

table: 

"Well 

Capitalized"

"Adequately 

Capitalized"

"Undercapitalized" "Significantly 

Undercapitalized"

"Critically 

Undercapitalized"

A bank is "well 

capitalized" if it

significantly 

exceeds the 

required

minimum levels 

of capital

(risk-based and 

leverage).

A bank is 

"adequately 

capitalized" if it 

meets the 

required 

minimum levels 

of capital.

A bank is 

"undercapitalized" if it 

fails to meet any 

required minimum level

of capital

A bank is 

"significantly 

undercapitalized" if it 

is significantly below 

any required 

minimum level of

capital.

A bank is "critically 

undercapitalized" if it fails 

to meet the "critical capital"

level to be determined by 

the regulators

Total Capital ≥10% ≥8% <8% <6% Tangible Equity (defined as 

Tier 1 capital plus non Tier 1 

perpetual stock) to Total 

Assets ≤2%

Tier 1 Capital ≥8% ≥6% <6% <4%

Common Equity 

Tier 1

≥6.5% ≥4.5% <4.5% <3%

Leverage Ratio ≥5% ≥4% <4% <3%

Supplementary LR Not Applicable ≥3% <3% Not Applicable Not Applicable

Capital 

Distributions

Permitted if afterwards the bank is not 

classified as under capitalized

Not permitted 
UNITED STATES 

INTERNATIONAL MONETARY FUND 137

Restrictions None. Wellcapitalized banks 

actually benefit. 

They may accept 

brokered 

deposits and the

regulators may 

examine them 

less frequently.

None. Adequately 

capitalized banks 

are subject to some 

restrictions.

Significantly, 

although they 

may accept 

brokered 

deposits, they can 

do so only with an 

FDIC waiver. Even

with a waiver, the 

bank cannot pay a 

rate that 

"significantly" 

exceeds (75 bps) 

rates in the 

normal market 

area or the 

national rate on 

deposits outside 

such area. FHLB 

restrictions begin 

to apply. Riskbased deposit

premiums will also 

increase.

The appropriate 

regulator must closely 

monitor the condition of,

require a "capital 

restoration plan" from, 

limit growth by and limit

access to the Federal 

Reserve's discount 

window by an

undercapitalized bank. 

The appropriate 

regulator's approval is

required for acquisitions, 

branching or entering 

new lines of business.

Executive bonuses 

or raises without 

regulatory approval 

are prohibited. The 

regulators must

prohibit the 

payment of 

subordinated debt 

and must require 

the bank to 

undertake one or 

more of the 

following: 

-sale of securities,

-securities to be sold 

be voting stock, 

-eliminate the sister 

bank exemption to 

Section 23A, 

-further restrict 

transactions with

affiliates,

-limit interest rates 

paid,

-require the bank to 

limit or terminate 

"excessively" risky

activities,

-improve 

management by: 

-requiring a new 

board to be elected, 

- dismissing any 

director or executive 

officer who has served

at least 180 days, or

- requiring the bank to 

hire executive officers, 

-prohibit deposits 

from correspondent 

banks, 

- require divestitures: 

. by the bank of any 

subsidiary, 

. by the bank's parent 

of any non depository 

affiliate, or 

.by the bank's parent 

of the bank itself, 

-require any other 

actions 

A critically 

undercapitalized bank

must be placed in 

conservatorship or 

receivership within 90 

days of such a 

determination unless 

FDIC and appropriate 

regulators determine that 

other action would

protect the deposit fund.

Redetermination is 

required every 90 days. If 

bank is, on average,

critically undercapitalized 

for 270 days, then a 

receiver must be

appointed unless the 

bank:

• has positive net worth, 

• is in substantial 

compliance with an 

approved capital 

restoration plan,

• is profitable,

• is reducing its 

ratio of 

nonperformin

g loans to 

total loans, 

and 

• the FDIC 

chairperson and the

appropriate 

regulator certify that

the bank is both 

viable and not

expected to fail. The 

FDIC must by 

regulation or order 

prohibit a critically 

undercapitalized 

bank, without 

approval, from: 

• entering into any 

material

transaction not 

in the ordinary

course of 

business, 

• extending credit 

for any highly

leveraged 

transactions, 

• amending its Articles or

bylaws,

EC2 At least for internationally active banks,56 the definitions of capital, risk coverage, method of 

calculation and thresholds for the prescribed requirements are not lower than those 

established in the applicable Basel standards. 

 

56 The Basel Capital Accord was designed to apply to internationally active banks, which must calculate and apply 

capital adequacy ratios on a consolidated basis, including subsidiaries undertaking banking and financial business. 

Jurisdictions adopting the Basel II and Basel III capital adequacy frameworks would apply such ratios on a fully 

(continued) 
UNITED STATES 

138 INTERNATIONAL MONETARY FUND

Description and 

findings re EC2 

For internationally active banks (defined by the agencies for these purposes as the advanced 

approaches banking organizations), the new capital rule provides for definitions of capital and 

risk coverage that are largely consistent with the applicable Basel standards. However, the 

FBAs highlighted that there are differences in methods of calculation and in prescribed 

requirements between the U.S. advanced approaches and the advanced Basel II approaches, 

related in particular to: 

 the U.S. securitization framework, as the use of external ratings are prohibited by the 

DFA; and 

 the detailed minimum requirements of the advanced IRB approach. 

These differences have been explored in the recent Regulatory Consistency Assessment 

Programme (RCAP) review of the adoption of the Basel risk-based capital standards (Basel II, 

2.5 and III) by the U.S. 57 

Banking organizations that are subject to the advanced approaches under the new rule are 

also subject to a supplementary leverage ratio that is consistent with the Basel III leverage 

ratio. 

All banks and most bank holding companies are currently subject to the general risk-based 

capital framework that is broadly consistent with Basel I and, starting on January 1, 2015, will 

become subject to the corresponding rules under the new capital rule (standardized 

approach). The U.S. standardized approach is based on the Basel II standardized approach but 

has a number of differences. The FBAs highlighted that the U.S. approach: 

 excludes a capital charge for operational risk and for Credit Value Adjustment (CVA) 

risk; and 

 specifies risk-weights for a range of assets instead of basing those risk-weights on 

external credit assessments, as per the Basel II approach (due to DFA requirements). 

The BCP assessors were not in a position to quantify the materiality of these differences. 

However, in the absence of an explicit capital charge for operational risk and for the CVA, it is 

difficult for the assessors to satisfy themselves that the requirements of the new U.S. 

standardized approach are not lower than the applicable Basel standards. 

Under the new capital rule, a banking organization using the advanced approaches must use 

as its minimum capital ratio the lower of its ratios as calculated under the standardized 

approach or the advanced approaches. This creates a “floor” for the risk-based capital of such 

 

consolidated basis to all internationally active banks and their holding companies; in addition, supervisors must test 

that banks are adequately capitalized on a stand-alone basis. 

57 At the time of the assessment, the RCAP report had not been published and therefore was not used as a source by 

assessors. Assessors had access to the preliminary RCAP report based on draft U.S. rules, as published by the Basel 

Committee on Banking Supervision (BCBS) in October 2012. The final RCAP report for the U.S. was published on 5 

December 2014. The report concluded that the U.S. risk-based capital requirements for internationally active banks 

are “largely compliant” with the applicable Basel framework. The RCAP took into account a number of proposed 

amendments to the final capital rule announced by the U.S. authorities on 18 November 2014, after the preliminary 

RCAP assessment was completed. For the benefit of the reader, some references to the RCAP report finalized after 

this BCP assessment have been included in footnotes. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 139

organizations and thereby provides that organizations that are using internal-ratings-based 

models, and those that are not, are subject to generally applicable capital requirements.58

Banking organizations, including those using the advanced approaches, with significant 

trading activity are also subject to the market risk rule. Covered savings and loan holding 

companies will be subject to the market risk rule in the new capital rule in the same manner as 

bank holding companies. (See 12 CFR 3.201(b); 12 CFR 217.201(b); 12 CFR 324.201(b)). The 

FBAs stated that the market risk requirements in the new capital rule are broadly consistent 

with the Basel market risk framework, including the 2011 revisions, but differ in the treatment 

of securitizations—in particular, the maintenance of a transitional rule for non-modeled 

securitization positions.59

EC3 The supervisor has the power to impose a specific capital charge and/or limits on all material 

risk exposures, if warranted, including in respect of risks that the supervisor considers not to 

have been adequately transferred or mitigated through transactions (e.g. securitization 

transactions)60 entered into by the bank. Both on-balance sheet and off-balance sheet risks are 

included in the calculation of prescribed capital requirements. 

Description and 

findings re EC3 

The former capital standards require banks and bank holding companies to hold capital 

commensurate with the level and nature of all risks to which they are exposed. The new capital 

rule continues this requirement and also applies it to most savings and loan holding 

companies. The FBAs have broad statutory authority to establish minimum capital levels for a 

bank or holding company (see 12 U.S.C. §§ 3907(a)(2), 3909) and to impose specific capital 

charges on one or more exposures if the charge under the rules is not appropriate for the 

exposures. The Federal Reserve has also published guidance on how certain risk transfer 

transactions affect analysis of capital adequacy (SR 13-23, Risk Transfer Considerations When 

Assessing Capital Adequacy; SR 11-1, Impact of High-Cost Credit Protection Transactions on 

the Assessment of Capital Adequacy). However, the rules do not give the FBAs the power to 

directly limit material risk exposures, as mentioned in this EC. The FBAs can achieve the same 

result through their discretionary authority to alter capital requirements on a bank and 

through their general formal or informal enforcement actions in the case of threats to safety 

and soundness. The assessors saw ample evidence of this approach in the supervisory material 

reviewed, including setting specific minimum capital requirements for a bank or requiring a 

bank board to develop a capital plan to raise capital to a level commensurate with its risk 

profile. 

The FBAs consider risk-mitigating activities and off-balance sheet items directly in the 

regulations and in general when considering imposing higher requirements. The new capital 

rule expressly incorporates various risk-mitigating activities and off-balance sheet items such 

as guarantees, credit protection and collateral, in a manner consistent with the Basel capital 

framework. 

Under the FBAs’ Uniform Financial Institutions Rating System (UFIRS), supervisors assess a 

 

58 For information, the RCAP report broadly accepted that this “floor” would likely be at least as conservative as the 

Basel I floor for a typical U.S. bank. 

59 For information, taking this difference into account, the RCAP report concluded that the U.S. implementation of the 

market risk framework was “materially non-compliant”. Unlike the RCAP, the BCP assessment considers materiality 

but does not attempt to quantify it. 

60 Reference documents: Enhancements to the Basel II framework, July 2009 and: International convergence of capital 

measurement and capital standards: a revised framework, comprehensive version, June 2006.
UNITED STATES 

140 INTERNATIONAL MONETARY FUND

bank’s capital adequacy during every full-scope examination. This assessment is reflected in 

the Capital component of the CAMELS rating and is an important component of the overall 

CAMELS composite rating, which also factors into the PCA requirements for banks that are not 

adequately capitalized. The Federal Reserve’s RFI/C (D) rating system measures the overall 

performance and condition of bank holding companies. The “F” component rates the financial 

condition of the company, which includes an assessment of the adequacy of its capital. The 

RFI/C (D) is also used on an indicative basis for savings and loan holding companies. 

In assessing capital adequacy, the FBAs take into account, among other things: the level and 

severity of problem and classified assets; exposure to economic declines in capital as a result 

of interest rate, liquidity, funding, and market risks; the quality and level of earnings; 

investment, loan portfolio and other concentrations of credit; certain risks arising from 

nontraditional activities; the quality of loans and investments; the effectiveness of loan and 

investment policies; and management's overall ability to monitor and control financial and 

operating risks, including the risks presented by concentrations of credit and nontraditional 

activities. 

Supervisory material reviewed by the assessors confirmed the detail and thoroughness of 

assessments of capital adequacy across banks of varying sizes. 

EC4 The prescribed capital requirements reflect the risk profile and systemic importance of banks61

in the context of the markets and macroeconomic conditions in which they operate and 

constrain the build-up of leverage in banks and the banking sector. Laws and regulations in a 

particular jurisdiction may set higher overall capital adequacy standards than the applicable 

Basel requirements. 

Description and 

findings re EC4 

The former capital standards and new capital rule for banks and holding companies reflect the 

risk profile of individual banks and holding companies and capture both on-balance-sheet 

and off-balance-sheet risks. However, the FBAs acknowledge that the rules do not explicitly 

address all material risks that banks and holding companies may face, particularly in the most 

sophisticated and competitive financial markets. Both the former capital standards and new 

capital rule acknowledge that risk profiles are dynamic and, accordingly, the FBAs expect 

banks and holding companies to have forward-looking capital plans. They also expect that 

banks and holding companies will operate at all times at capital levels commensurate with the 

risks to which they are exposed, including those not explicitly addressed by the capital 

guidelines. An FBA can impose higher capital levels if, in the supervisor’s judgment, existing 

levels are not commensurate with the risks faced. 

In addition to the risk-based capital requirements, the FBAs also review a bank’s or holding 

company’s tier 1 leverage ratio when assessing its capital adequacy. Under the new capital 

rule, as noted above, banking organizations using the advanced approaches are also subject 

to a “supplementary leverage ratio”. Further, bank holding companies with $700 billion in total 

consolidated assets or more that $10 trillion in assets under custody are subject to an 

enhanced leverage buffer greater than 2 percentage points (above the minimum 3 percent 

supplementary leverage ratio). That is, they must meet a total leverage ratio (tier 1 capital to 

 

61 In assessing the adequacy of a bank’s capital levels in light of its risk profile, the supervisor critically focuses, 

among other things, on (a) the potential loss absorbency of the instruments included in the bank’s capital base, (b) 

the appropriateness of risk weights as a proxy for the risk profile of its exposures, (c) the adequacy of provisions and 

reserves to cover loss expected on its exposures and (d) the quality of its risk management and controls. 

Consequently, capital requirements may vary from bank to bank to ensure that each bank is operating with the 

appropriate level of capital to support the risks it is running and the risks it poses. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 141

total on- and off-balance sheet assets) of at least 5 percent to avoid restrictions on capital 

distributions and discretionary bonus payments to executive officers. In addition, the insured 

depository institution subsidiaries of those bank holding companies must maintain a 

supplementary leverage ratio of at least 6 per cent to be considered “well-capitalized” under 

each agency’s PCA framework. 

FBA supervisors generally expect and require banks and bank holding companies to operate 

at capital levels well above the required minimums. PCA requirements for banks generally 

result in higher de facto risk-based and leverage capital requirements because there are 

disincentives for banks to fall below the “well-capitalized” category. In addition, bank holding 

companies that have elected to be financial holding companies (FHCs) have the incentive to 

ensure their bank subsidiaries or affiliates remain well capitalized so they can retain their FHC 

status in order to establish and retain certain non-banking financial subsidiaries and merchant 

banking investments. FHCs and bank and savings and loan holding companies themselves do 

not have a PCA requirement. 

Under section 165 of the DFA, the Federal Reserve is required to impose enhanced prudential 

standards on large bank holding companies, including large foreign-based bank holding 

companies, and nonbank financial companies designated by the FSOC for supervision by the 

Federal Reserve. The enhanced prudential standards must include standards related to capital 

and to stress testing. The Act directs the Federal Reserve to increase the stringency of the 

standards in line with the systemic footprint of the company. For foreign-based bank holding 

companies specifically, the Federal Reserve is to take into account comparability of home 

country standards, national treatment and equality of competitive opportunity. (See 12 U.S.C. 

§ 5365). In applying these enhanced standards, the Federal Reserve is required to consider the 

systemic importance of the covered companies. 

In February 2014, the Federal Reserve approved a final rule pursuant to section 165 that 

establishes enhanced prudential standards for bank holding companies with more than $50 

billion in total consolidated assets. See 79 FR 17239. The rule is designed to enhance financial 

stability by addressing certain weaknesses in the U.S. regulatory framework that were revealed 

during the financial crisis and its aftermath. The capital plan rule (see EC 6), the stress-testing 

rule (see EC 6) and the enhanced supplementary leverage ratio rule represent the Federal 

Reserve’s capital-related enhanced prudential standards. A foreign-based BHC with a 

significant U.S. presence is required to establish an intermediate holding company over its U.S. 

subsidiaries, which will generally be subject to the same capital requirements as a U.S.-based 

BHC; this is intended to facilitate consistent supervision and regulation of the U.S. operations 

of the foreign bank. 

EC5 The use of banks’ internal assessments of risk as inputs to the calculation of regulatory capital 

is approved by the supervisor. If the supervisor approves such use: 

(a) such assessments adhere to rigorous qualifying standards; 

(b) any cessation of such use, or any material modification of the bank’s processes and 

models for producing such internal assessments, are subject to the approval of the 

supervisor; 

(c) the supervisor has the capacity to evaluate a bank’s internal assessment process in 

order to determine that the relevant qualifying standards are met and that the bank’s 

internal assessments can be relied upon as a reasonable reflection of the risks 

undertaken; 

(d) the supervisor has the power to impose conditions on its approvals if the supervisor 
UNITED STATES 

142 INTERNATIONAL MONETARY FUND

considers it prudent to do so; and 

(e) if a bank does not continue to meet the qualifying standards or the conditions 

imposed by the supervisor on an ongoing basis, the supervisor has the power to 

revoke its approval. 

Description and 

findings re EC5 

Under the advanced approaches framework in the former capital standards and the new 

capital rule, subject banks and holding companies are required to use internally generated 

assessments of credit and operational risk as the basis for their regulatory capital 

requirements The FBAs oversee the internal models created by subject banks and holding 

companies and, if the models are judged to be flawed, a bank or holding company can be 

required to change its models. 

Use of the advanced approaches framework is subject to rigorous qualifying criteria, described 

in the capital rules, which must be met on an initial and ongoing basis. Before moving to the 

advanced approaches, a banking organization must complete a parallel run of at least four 

consecutive calendar quarters, and during which the banking organization’s primary FBA 

supervisor deems compliance with the qualification requirements to be satisfactory. During 

the parallel run, a banking organization is subject to the general risk-based capital rules or the 

standardized approach (subject to transitions arrangements) for all applicable regulatory and 

supervisory purposes, but it must also calculate its capital ratios using the advanced 

approaches and report pertinent information to its primary FBA supervisor. If the FBA 

supervisor determines that a banking organization that has been approved to use the 

advanced approaches subsequently fails to comply with the qualification requirements, the 

banking organization will be notified and must submit a plan satisfactory to the FBA to return 

to compliance. Failure to so could result in revocation of the approval to use the advanced 

approaches, in which case a bank would be required to revert to the standardized approaches. 

A bank or holding company is required to notify its primary FBA supervisor when it makes any 

change to a system that would result in a material change to the risk-weighted asset amount 

of an exposure type, or when the bank or holding company makes any significant change to 

its modeling assumptions. 

If the primary FBA supervisor determines that a banking organization’s risk-based capital 

requirements are not commensurate with credit, market, operational or other risks, the 

supervisor may require the banking organization to calculate its risk-based requirements 

under the advanced approaches with any modifications established by the supervisor or under 

the general risk-based capital rule until January 1, 2015, and then the new capital rule after 

that date. In addition, a banking organization applying the market risk rule must obtain prior 

approval from its primary FBA supervisor before using an internal model to calculate market 

risk-weighted assets and must continue to satisfy specific requirements to continue using the 

internal model. These specific requirements include that the model’s sophistication be 

commensurate with the complexity and amount of covered positions, that the model properly 

measures all material risks and that the model conservatively assesses risks arising from less 

liquid positions. 

The general risk-based capital rules under the former capital standards generally do not allow 

use of internal estimates. A banking organization that meets strict requirements may use an 

internal risk-rating approach for certain exposures to asset-backed commercial paper 

programs. Similarly, the standardized approach under the new capital rule generally does not 

allow use of internal estimates; however, there are limited exceptions, which generally require 

supervisory approval prior to use. 

EC6 The supervisor has the power to require banks to adopt a forward-looking approach to capital 
UNITED STATES 

INTERNATIONAL MONETARY FUND 143

 management (including the conduct of appropriate stress testing).62 The supervisor has the 

power to require banks: 

(a) to set capital levels and manage available capital in anticipation of possible events or 

changes in market conditions that could have an adverse effect; and 

(b) to have in place feasible contingency arrangements to maintain or strengthen capital 

positions in times of stress, as appropriate in the light of the risk profile and systemic 

importance of the bank. 

Description and 

findings re EC6 

All banking organizations must hold capital commensurate with a forward-looking view of 

their risk profile. The FBAs have the power to require corrective action if, in their judgment, a 

bank’s current or prospective capital plans are inadequate and cause it to be in an unsafe or 

unsound condition. 

The Federal Reserve has established capital planning and stress testing requirements for bank 

holding companies with total consolidated assets greater than $50 billion. See 12 CFR part 

252; 12 U.S.C. 5365(i). The stress test requirements establish a framework for the Federal 

Reserve to conduct annual supervisory stress tests to evaluate whether these institutions have 

the capital necessary to absorb losses as a result of adverse economic conditions using 

scenarios provided by the FRB; these companies are also required to conduct semi-annual 

company-run stress tests. Additionally, in October 2012, the FBAs individually published final 

rules implementing section 165(i)(2) of the DFA, which requires financial companies with more 

than $10 billion in assets to conduct annual stress tests themselves (“annual company-run 

stress tests”) using scenarios provided by the FBAs. The FBAs have issued final guidance 

describing supervisory expectations for stress tests conducted by these companies. The 

scenarios for the supervisory and annual company-run stress tests are the sets of conditions 

that affect the U.S. economy or the financial condition of a covered company that the relevant 

FBA annually determines are appropriate including, but not limited to, baseline, adverse and 

severely adverse scenarios. 

In addition, bank holding companies with assets greater than $50 billion are subject to 

specific, annual capital planning requirements. See 12 CFR 225.8. Each company is required to 

submit an annual capital plan to the FRB that contains estimates of its minimum regulatory 

capital ratios and its tier 1 common ratio under expected conditions and a range of stressed 

scenarios over a nine-quarter planning horizon. A capital plan also must include a discussion 

of how the company will, under expected conditions and stressed scenarios, maintain 

regulatory capital ratios and a pro forma tier 1 common ratio above 5 per cent and maintain 

sufficient capital to continue its operations by maintaining ready access to funding, meeting 

its obligations to creditors and other counterparties, and continuing to serve as a credit 

intermediary. 

The Federal Reserve’s annual Comprehensive Capital Analysis and Review (CCAR) is an 

intensive assessment of the capital adequacy of bank holding companies with assets greater 

than $50 billion and of the practices these companies use to manage their capital. The 

Federal Reserve expects each company to incorporate, as part of its capital-planning process, 

analysis of the potential for significant and rapid changes in the risks it faces, including risks 

generated by a marked deterioration in the economic and financial environment, as well as 

pressures that may stem from firm-specific events. Through CCAR, a BHC’s capital adequacy is 

 

62 “Stress testing” comprises a range of activities from simple sensitivity analysis to more complex scenario analyses 

and reverse stress testing.
UNITED STATES 

144 INTERNATIONAL MONETARY FUND

evaluated on a forward-looking, post-stress basis; the companies are required to demonstrate 

in their capital plans and in a supervisory post-stress capital analysis (stress test) how they will 

maintain, throughout a very stressful period, capital above a tier 1 common ratio of 5 per cent 

and above minimum regulatory capital requirements. Additionally, in CCAR the Federal 

Reserve expands upon its firm-specific supervisory practices by undertaking a simultaneous, 

horizontal assessment of capital adequacy and capital planning practices at the largest bank 

holding companies. The Federal Reserve has significantly heightened supervisory expectations 

for the largest and most complex bank holding companies and expects them to have the most 

sophisticated, comprehensive and robust capital planning practices. After qualitative and 

quantitative assessment, the Federal Reserve either objects to, or provides a non-objection to, 

each company’s capital plan; these decisions and the supporting assessment are released 

publicly. In the case of an objection, the company may not make any capital distribution 

unless the Federal Reserve indicates that it does not object to the distribution. 

For banking organizations not subject to CCAR, the FBAs collect data on the organization’s 

quantitative projections of balance sheet assets and liabilities, income, losses and capital 

across a range of macroeconomic scenarios. They also review qualitative supporting 

information on the methodologies used to develop internal projections of capital across 

stressed economic scenarios. The results of the annual company-run stress tests are subject to 

onsite supervisory examination and inspection. These stress test results provide the FBAs with 

forward-looking information that assists in assessing an organization’s risk profile and 

whether it has sufficient capital to continue operations throughout times of economic and 

financial stress. 

A key component of the annual stress test is the stress test scenarios. Each scenario includes 

the values of the variables specified for each quarter over a nine-quarter stress test horizon. 

The variables generally address economic activity, asset prices and other measures of financial 

market conditions for the U.S. and key foreign countries. The FBAs consult with each other 

annually to determine scenarios that are appropriate for use for each annual stress test. 

Additional 

criteria 

AC1 For non-internationally active banks, capital requirements, including the definition of capital, 

the risk coverage, the method of calculation, the scope of application and the capital 

required, are broadly consistent with the principles of the applicable Basel standards relevant 

to internationally active banks. 

Description and 

findings re AC1 

As noted in EC2 above, all banks and most bank and savings and loan holding companies will 

become subject to the new capital rule (standardized approach), from January 1, 2015. The 

U.S. standardized approach provides for definitions of capital that are largely consistent with 

Basel III. However, the FBAs have highlighted that there are differences in risk coverage and 

method of calculation between the two approaches. The U.S. approach: 

 excludes a capital charge for operational risk and for CVA risk; and 

 specifies risk-weights for a range of assets instead of basing those risk-weights on 

external credit assessments as per the Basel II approach. 

The assessors were not in a position to quantify the materiality of these differences. However, 

in the absence of an explicit capital charge for operational risk and for the CVA, it is difficult 

for the assessors to satisfy themselves that the requirements of the new U.S. standardized 

approach are not lower than the applicable Basel standards. 

Section 171 of the DFA requires the FBAs to establish, on a consolidated basis, minimum risk-
UNITED STATES 

INTERNATIONAL MONETARY FUND 145

based and leverage capital requirements for bank holding companies, savings and loan 

holding companies, and nonbank financial companies that “shall not be less than” the 

generally applicable capital requirements for insured depository institutions. Further, the 

minimum capital requirements cannot be “quantitatively lower than” the generally applicable 

capital requirements for insured depository institutions that were in effect in July 2010. 

AC2 The supervisor requires adequate distribution of capital within different entities of a banking 

group according to the allocation of risks.63

Description and 

findings re AC2 

The FBAs apply minimum capital requirements at both the bank (including its subsidiaries) and 

holding company levels. Other prudential supervisors of holding company subsidiaries may 

set minimum capital requirements for those subsidiaries. 

The FBAs expect the distribution of capital among entities within a banking group to reflect 

the risks presented by those entities. Other subsidiaries also are expected to maintain 

appropriate levels of capital that are, if applicable, consistent with the expectations of 

supervisors with oversight responsibilities. If an FBA believes a bank or holding company is 

operating in an unsafe or unsound manner, including after taking into account affiliate capital 

adequacy, the FBA can require it to hold more capital. By statute, bank holding companies and 

savings and loan holding companies are required to serve as sources of financial strength for 

any subsidiaries that are depository institutions. See 12 U.S.C. § 1831o-1. However, the Federal 

Reserve is limited by statute in its ability to require that regulated broker-dealers or insurance 

companies within a holding company structure provide funds or other assets to an affiliated 

depository institution. See 12 U.S.C. § 1844(g). 

Bank holding companies with consolidated assets of less than $500 million are generally 

exempt from the calculation and analysis of risk-based capital ratios on a consolidated 

holding company basis, subject to certain terms and restrictions. However, the Federal Reserve 

may apply the risk-based capital rules at its discretion to any BHC, regardless of asset size, if 

such action is warranted for supervisory purposes. 

Assessment of 

Principle 16

Largely Compliant 

Comments The FBAs have a robust and comprehensive approach to setting prudent and adequate capital 

adequacy requirements for banks and most holding companies, and this approach has been 

strengthened since the financial crisis in response to the Basel and DFA reform initiatives. In 

the process, a number of concerns raised in the 2010 DAR have been addressed. The broad 

adoption of the Basel III definition of capital, when fully implemented, will improve the quality 

of bank capital by limiting the extent to which certain intangibles, which had previously 

counted for a high proportion of bank capital, can be included in regulatory capital. The 

introduction of risk-based capital rules based on Basel standards for most savings and loan 

holding companies removes an anomaly created by the previous case-by-case determination 

of capital requirements for such companies. However, savings and loan holding companies 

with substantial insurance or commercial activities are excluded from the new regulatory 

capital rules. Although such companies have a relatively small market share, their exclusion 

could over time create safety and soundness, and competitive neutrality, issues and the 

assessors would encourage the Federal Reserve to complete the task of establishing a 

comprehensive capital framework for holding companies. 

 

63 Please refer to Principle 12, Essential Criterion 7. 
UNITED STATES 

146 INTERNATIONAL MONETARY FUND

Stress testing has now become an essential element of capital adequacy assessments for 

banking organizations with more than $10 billion of assets. As it is evolving, the stress-testing 

regime is entrenching a forward-looking approach to capital needs and engaging boards and 

senior management more fully in the capital planning process. These are positive 

developments. At the same time, the regime is very data-and-resource-intensive, for both 

firms and supervisory agencies. Looking ahead, the assessors believe that the credibility of the 

stress-testing regime would be further enhanced if the regime were able to avoid excessive 

granularity and secure the continued engagement of boards by the use of scenarios that 

readily meet the “severe but plausible” test. 

Compliance with this CP requires the assessors to satisfy themselves that the capital adequacy 

regime for internationally active banks is “not lower” than the relevant Basel standards (EC 2) 

and that for non-internationally active banks is “broadly consistent” with the standards (AC1). 

The U.S. regulatory capital framework is in a state of transition. The FBAs have implemented 

major elements of the Basel II advanced approaches from I January, 2014 and the U.S. 

standardized approach based on Basel II will begin to come into effect from 1 January, 2015. 

Until that point, most banking organizations remain subject to the former capital standards, 

but the assessors saw little sense in assessing former standards against Core Principle 16 at 

this late stage. 

The assessors acknowledge that U.S. banking organizations generally have risk-based capital 

ratios above, and in many cases well above, relevant Basel minimum capital requirements. 

However, EC 2 and AC 1 refer not just to thresholds but also to definitions of capital, the risk 

coverage and the method of calculation. In those areas, the FBAs have indicated that there are 

a number of differences between the new capital rule and the relevant Basel framework. Some 

aspects of these differences have weighed particularly on the assessors’ judgment that a 

rating of “Largely Compliant” is warranted at this time. Firstly, the risk-based capital 

requirements for internationally active banks under the advanced approaches are different in a 

number of respects to the Basel framework, as detailed above. In addition, the U.S. 

standardized approach, which provides the “floor” for the advanced approach banking 

organizations and applies to all other banking organizations, does not impose a capital charge 

for operational risk or for CVA risk (and there are also some divergences regarding the 

standardized approach to market risk). This is a significant omission in risk coverage, and it 

distinguishes the U.S. capital regime from other major jurisdictions. While the leverage ratio 

requirements provide an important backstop against operational and other risks, a leverage 

ratio framework was never intended to replace the Basel risk-based framework, which requires 

that significant identifiable risks to banking organizations be explicitly incorporated in 

minimum capital requirements. In addition, the absence of capital charges for operational risk 

and CVA makes the “standardized” floor less binding than it may appear.64 

Principle 17 Credit risk.65 The supervisor determines that banks have an adequate credit risk management 

process that takes into account their risk appetite, risk profile and market and macroeconomic 

 

64 The conclusions of this assessment are independent from the RCAP findings. Nevertheless, the RCAP report 

published after this assessment corroborates the assessors’ understanding. The report considered the risk-based 

capital requirements for internationally active banks under the advanced approaches “largely compliant” with the 

applicable Basel framework. The report also concluded that the U.S. implementation of the market risk framework 

was “materially non-compliant” with the Basel framework. 

65 Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem 

assets. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 147

conditions. This includes prudent policies and processes to identify, measure, evaluate, 

monitor, report and control or mitigate credit risk66 (including counterparty credit risk)67 on a 

timely basis. The full credit lifecycle is covered including credit underwriting, credit evaluation, 

and the ongoing management of the bank’s loan and investment portfolios. 

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to have appropriate credit risk management 

processes that provide a comprehensive bank-wide view of credit risk exposures. The 

supervisor determines that the processes are consistent with the risk appetite, risk profile, 

systemic importance and capital strength of the bank, take into account market and 

macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, 

administration and monitoring. 

Description and 

findings re EC1 

All Banks 

Banks and holding companies are subject to extensive credit-risk management requirements 

which provide a comprehensive bank-wide view of credit exposures. . The U.S. federal banking 

regulations are set out in Table 17.1. 

Table 17.1 

Requirement 

Federal Reserve OCC 

Loan documentation 

and credit underwriting 

12 CFR part 208, 

appendix D-1, part II(C), 

(D) 

12 CFR part 30, 

appendix A, part II (C), 

(D) 

Capital adequacy 

guidelines 

12 CFR part 225, 

appendix G 

12 CFR part 3, appendix 

C 

Real estate lending 

standards and setting 

requirements for 

lending policies 

12 CFR part 208, subpart 

E 

12 CFR part 34, subpart 

D 

These references are further developed in extensive supervisory guidance and related 

materials. For example, on sub-prime (SR08-2), non-traditional mortgage guidance (SR06-15) 

and prudent commercial real estate loan workouts (SR09-7). Together, these sources require 

that banks and holding companies establish, review, update (as appropriate), and implement 

credit-risk management strategies, policies, and procedures for identifying, measuring, 

controlling, and reporting on credit risk (including counterparty risk). Also, the U. S. FBAs 

support the BCBS’s releases of Principles for the Management of Credit Risk (September 2000) 

and Sound credit risk assessment and valuation for loans (June 2006). 

Supervisors adhere to the Uniform Financial Institutions Ratings System (UFIRS) and evaluate 

every bank against UFIRS guidelines during on-site examinations. UFIRS has a specific 

component to rate asset quality (A), which directly couples supervisory assessments of each 

bank’s assets and the credit-risk management of those assets. These assessments incorporate 

 

66 Credit risk may result from the following: on-balance sheet and off-balance sheet exposures, including loans and 

advances, investments, inter-bank lending, derivative transactions, securities financing transactions and trading 

activities. 

67 Counterparty credit risk includes credit risk exposures arising from OTC derivative and other financial instruments.
UNITED STATES 

148 INTERNATIONAL MONETARY FUND

quantitative measurements of delinquent, troubled, and classified assets, as well as qualitative 

evaluations of the adequacy of board of directors (board) and senior management oversight, 

credit policies, procedures and limits, risk-management practices, internal control 

mechanisms, and management information systems. The relative importance of the qualitative 

considerations depends on the risk characteristics and circumstances particular to the bank. 

Further, peer practice comparisons and data analyses are also integral parts of the evaluation 

process and, when available and relevant, may be used in assigning a rating. 

EC2 The supervisor determines that a bank’s Board approves, and regularly reviews, the credit risk 

management strategy and significant policies and processes for assuming,68 identifying, 

measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk 

(including counterparty credit risk and associated potential future exposure) and that these 

are consistent with the risk appetite set by the Board. The supervisor also determines that 

senior management implements the credit risk strategy approved by the Board and develops 

the aforementioned policies and processes. 

Description and 

findings re EC2 

Supervisors assess whether the board understands (1) the credit risk involved in the activities; 

(2) communicates its risk appetite to management; and (3) delegates the development of 

comprehensive policies, procedures, and controls. Supervisors review the quality of 

aggregated management information provided to the board to test whether these reports are 

comprehensive and timely and accurately reflect the level and nature of credit risk. To assess 

board involvement in credit-risk oversight, supervisors will review minutes of board meetings 

and meetings of board committees, management committees, and other records, as needed. 

Furthermore, supervisors determine whether the board approves and regularly reviews the 

adequacy of significant policies and procedures for credit underwriting and for identifying, 

measuring, monitoring, and controlling credit-risk activities. 

Supervisors review compliance with supervisory guidance on credit-risk management (which is 

taken to be identification, measurement, monitoring and mitigation), as well as compliance 

with internal credit-risk management strategies and risk-management policies, by conducting 

interviews, reviewing internal policies and procedures, and performing transaction testing. 

EC3 The supervisor requires, and regularly determines, that such policies and processes establish 

an appropriate and properly controlled credit risk environment, including: 

(a) a well documented and effectively implemented strategy and sound policies and 

processes for assuming credit risk, without undue reliance on external credit 

assessments; 

(b) well defined criteria and policies and processes for approving new exposures (including 

prudent underwriting standards) as well as for renewing and refinancing existing 

exposures, and identifying the appropriate approval authority for the size and 

complexity of the exposures; 

(c) effective credit administration policies and processes, including continued analysis of a 

borrower’s ability and willingness to repay under the terms of the debt (including 

review of the performance of underlying assets in the case of securitization exposures); 

monitoring of documentation, legal covenants, contractual requirements, collateral and 

other forms of credit risk mitigation; and an appropriate asset grading or classification 

 

68 “Assuming” includes the assumption of all types of risk that give rise to credit risk, including credit risk or 

counterparty risk associated with various financial instruments. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 149

system; 

(d) effective information systems for accurate and timely identification, aggregation and 

reporting of credit risk exposures to the bank’s Board and senior management on an 

on-going basis; 

(e) prudent and appropriate credit limits, consistent with the bank’s risk appetite, risk 

profile and capital strength, which are understood by, and regularly communicated to, 

relevant staff; 

(f) exception tracking and reporting processes that ensure prompt action at the 

appropriate level of the bank’s senior management or Board where necessary; and 

(g) effective controls (including in respect of the quality, reliability and relevancy of data 

and in respect of validation procedures) around the use of models to identify and 

measure credit risk and set limits. 

Description and 

findings re EC3 

Supervisors have issued guidance on sound risk-management practices for credit-risk and 

loan portfolio management. They have published examination manuals that they supplement 

with specific topical guidance. 

During the course of examinations, supervisors review banks’ and holding companies’ 

compliance with the guidance including evaluating whether banks and holding companies 

have established effective risk management systems for identifying, measuring, monitoring, 

and controlling credit risk in their banking activities. When evaluating the adequacy and 

effectiveness of credit-risk management practices, supervisors generally consider, as 

applicable based on the size, complexity, and risk profile of the bank or holding company, 

whether: 

o Credit-risk policies are comprehensive and well documented, and whether they accurately 

reflect existing credit-risk strategies and objectives. Policies and procedures must provide 

for adequate identification, measurement, monitoring, and control of the credit risks 

posed by the lending, investing, trading, trust, fiduciary, and other significant activities. 

o Since the last BCP Assessment the Federal Reserve, for example, have issued new credit 

risk-related guidance

 Loan Coverage Requirements in Community State Member Banks (SR 14-7) 

 Interagency Guidance on Home Equity Lines of Credit Nearing Their End-of-Draw 

Periods (SR 14-5) 

 Supervisory Approaches for Qualified and Non-Qualified Mortgage Loans (SR 13-23) 

 Guidance on Managing Outsourcing Risk (SR 13-19) 

 Uniform Agreement on the Classification and Appraisal of Securities Held by 

Depository Institutions (SR 13-18) 

 Supervisory Guidance on Troubled Debt Restructurings (SR 13-17) 

 Interagency Guidance on Leveraged Lending (SR 13-3) 

 Guidance on a Lender’s Decision to Discontinue Foreclosure Proceedings (SR 12-11) 

 Questions and Answers for Federal Reserve-Regulated Institutions Related to the 

Management of Other Real Estate Owned (OREO) (SR 12-10) 

 Policy Statement on Rental of Residential Other Real Estate Owned (OREO) Properties 

(SR 12-5) 
UNITED STATES 

150 INTERNATIONAL MONETARY FUND

 Interagency Guidance on Allowance Estimation Practices for Junior Lien Loans and 

Lines of Credit (SR 12-3) 

 Agricultural Credit Risk Management (SR 11-14) 

 Disposal of Problem Assets Through Exchanges (SR 11-15) 

 Counterparty Credit Risk Management (SR 11-10) 

 Guidance on Model Risk (SR 11-7) 

 Underwriting Standards for Small Business Loans Originated under the Small Business 

Lending Fund Program (SR 10-17) 

 Interagency Appraisal and Evaluation Guidelines (SR 10-16)

o Proposed and current credit activities are consistent with the overall business strategy, 

stated goals and objectives, and established risk tolerances, as well as the overall financial 

strength. 

o Policies and procedures require the review and approval by key risk and control personnel 

of all new credit products and that the policies ensure that the bank or holding company 

establishes the necessary risk and control infrastructures to identify, monitor, and control 

the varied risks associated with new credit activities before these activities are initiated. 

o Credit administration practices include initial and on-going borrower and counterparty 

analyses; comprehensive legal documentation; credit covenant and collateral 

documentation; transaction due diligence; credit-underwriting criteria; pricing decision 

tools; borrower and portfolio limit and concentration monitoring; payment and collections 

procedures; workout and restructuring processes; and loan loss reserving. 

o The bank or holding company maintains documentation supporting its analysis of a 

customer’s ability and willingness to repay a loan or other exposure at the time it is 

extended, renewed, or restructured. Supervisors also consider whether the bank or 

holding company maintains (i) information relating to the borrower’s financial condition, 

collateral, and its valuation and (ii) other pertinent documents, such as guarantor 

information, loan agreements, proof of security interest in collateral, and adherence to 

loan covenants. 

o The bank or holding company employs risk rating/grading systems that accurately assess 

the absolute and relative credit risk across the bank’s or holding company’s credit 

portfolios. Supervisors also consider whether the risk-rating system accurately defines and 

delineates borrower/counterparty credit quality, allows measurement of credit migration, 

and drives management decision-making. 

o Stress testing processes are effective in identifying the impact of (i) portfolio-level stress 

events on asset quality, earnings, and capital; (ii) business-level stress on credit 

concentrations; and (iii) downside scenarios on individual credit exposures. 

o The bank or holding company management information systems are effective for 

reporting, managing, and monitoring portfolio-level and business-level credit risk 

exposures. Supervisors also consider whether the bank or holding company: 

 Has management information systems that are structured to monitor current and 

potential exposures against established limits and strategic goals and objectives; and 

 Submits reports to management that are timely and contain sufficient information for 

decision makers to evaluate the level and trend of credit risk faced by the bank or 

holding company, including reports that make the following information readily 
UNITED STATES 

INTERNATIONAL MONETARY FUND 151

available and routinely reviewable: total credit exposure, including loans and 

commitments; loans in excess of existing credit limits; new extensions of credit, credit 

renewals, and restructured credits; a listing of all delinquent and/or nonaccrual loans; 

credits adversely graded or requiring special attention; credits to insiders and their 

related interests; credits not in compliance with internal policies, laws, or regulations; 

and specific lending activity aspects, “outsized” credit exposures, and analyses of 

credit exposure by type, geographic areas, and collateral. 

o The bank or holding company has developed governance and control mechanisms for all 

aspects of model risk management, including the development, implementation, use, and 

validation procedures. Supervisors will also confirm that model risk management 

encompasses policies and procedures, as well as board and senior management 

oversight. 

o The bank or holding company has policies and procedures governing problem loan 

management including delinquency and charge-off practices. Supervisors determine 

whether (i) policies, procedures, and processes are in place for the timely identification of 

problem loans and (ii) there are criteria for providing a full awareness of the risk position, 

informing management and directors of that position, taking steps to mitigate risk, and 

properly assessing the adequacy of the allowance for credit losses and capital. 

o The loan review process discharges its duties appropriately. This may include verifying 

loan grading processes, assessing portfolio-management processes, evaluating credit-risk 

management, and confirming credit administration procedures, depending on the size 

and risk. 

o Management promptly and accurately identifies loans or portfolios with potential or welldefined credit weaknesses and ensures the development and implementation of an 

appropriate action plan, including restructuring and workout processes, to minimize credit 

losses. 

o Policies and procedures for the Allowance for Loan and Lease Losses comply with both 

accounting and supervisory guidance. 

o The bank or holding company has implemented a system that clearly identifies portfolio 

business risks, as well as transaction and portfolio risk limits, and includes processes to (i) 

confirm compliance with these limits, (ii) require review and approval of limits, and (iii) 

detect, address, and report exceptions to the limits. Supervisors also determine if risk 

limits are established to address borrower/counterparty, industry, and geographic 

concentration risks, as well as unique risk factors such as commodity-reliant industries or 

complex structured securitizations. If an exception to a limit is made, supervisors validate 

that the process ensures that specific credit oversight and approval procedures are 

required. 

o The bank or holding company has adequate risk-management practices for approving, 

monitoring, and controlling third-party (i.e., indirect) originations. Supervisors determine 

whether banks and holding companies perform comprehensive due diligence on thirdparty originators prior to entering a relationship. In addition, supervisors determine 

whether adequate audit procedures and controls verify that third parties are not 

generating credit exposure outside of the established underwriting criteria. Supervisors 

determine whether third-party audit procedures (i) include monitoring the quality of loans 

by origination source and (ii) enable management to identify problems, such as early 

payment defaults and incomplete packages, and take appropriate action, as needed. 

o The bank or holding company has comprehensive, formal strategies for managing risks in 
UNITED STATES 

152 INTERNATIONAL MONETARY FUND

secondary market activities. Supervisors determine whether contingency planning 

includes how the bank or holding company will respond to reduced demand in the 

secondary market. 

The expectations for each of these components will vary based on the size and complexity of 

the institution, but there are no hard and fast rules. Smaller, less complex banks and holding 

companies will generally not require every element in the above list but are required to have 

effective policies and procedures to identify, measure, monitor, and control their credit-risk 

exposures. 

EC4 The supervisor determines that banks have policies and processes to monitor the total 

indebtedness of entities to which they extend credit and any risk factors that may result in 

default including significant unhedged foreign exchange risk. 

Description and 

findings re EC4 

Supervisors recognize the importance of requiring an institution to assess a borrower’s global 

(total) indebtedness (including any unhedged foreign exchange risk), especially in times of 

economic stress. This principle was set out in the Interagency Policy Statement on the Review 

and Classification of CRE Loans (November 1991 guidance). More recently, in October 2009, 

the U.S agencies issued guidance to banks or holding companies on the importance of 

evaluating and monitoring a borrower’s ability to repay all debt obligations (that is, the total 

indebtedness or global debt of the borrowing entity) in credit and workout decisions. The 

October 30, 2009, Interagency Policy Statement on Prudent CRE Loan Workouts addresses this 

supervisory expectation by noting that a regulated institution is expected to analyze 

repayment capacity of the borrower by evaluating “the nature and degree of protection 

provided by the cash flow from business operations or the collateral on a global basis that 

considers the borrower’s total debt obligations.” Further, the guidance notes that an analysis 

of the borrower’s global debt service reflects a realistic projection of the borrower’s and 

guarantor’s expenses. The guidance explains that “global debt represents the aggregate of a 

borrower’s or guarantors financial obligations, including contingent obligations” and provides 

an example to explain that this analysis is important in determining accrual status of a 

particular loan. 

The assessors also saw a number of examples of supervisors requiring banks to consolidate 

debt positions for customers, where the bank had been treating them separately. 

EC5 The supervisor requires that banks make credit decisions free of conflicts of interest and on an 

arm’s length basis. 

Description and 

findings re EC5 

Supervisors require banks and holding companies to develop policies that (i) define and 

address real and potential conflicts of interest and (ii) acknowledge that credit decisions are to 

be given an independent and complete credit evaluation and, in certain situations, require 

board approval. They require banks and holding companies to establish a functionally 

independent credit-approval function to maintain consistency with credit-origination criteria, 

review the credit analysis, and check adherence to credit limits. Supervisors also expect that 

the risk-management function and the process of measuring, monitoring, and controlling risks 

are sufficiently independent from those individuals who have the authority to initiate 

transactions. The practices implementing these expectations vary, however, depending on the 

size and complexity of the supervised bank or holding company. 

Supervisors will determine whether banks and holding companies have developed policies 

and risk-management practices to prevent conflicts of interest from influencing creditunderwriting decisions. Supervisors will review credit-approval policies, credit analysis and 

approval procedures, credit files and approval records, credit committee minutes, loan/credit 

review, and internal audit procedures to ensure that conflicts of interest are appropriately 
UNITED STATES 

INTERNATIONAL MONETARY FUND 153

identified and properly controlled. 

During the course of examinations, supervisors review credit files and other information to 

ensure that loans are underwritten and approved on an arm’s length basis. Supervisors may 

review extensions of credit issued to employees, officers, directors, principle shareholders, or 

related interests of such persons. Such loans are reviewed to determine whether they (i) were 

made on substantially the same terms as those prevailing at the time for comparable arm’s 

length transactions, (ii) involve greater-than-normal risk of repayment or default, or (iii) have 

other unfavorable features, such as not being supported by adequate credit information or 

being in violation of lending limitations. Regulation O specifically addresses procedures for 

extensions of credit to executive officers, directors, principal shareholders and their related 

interests. 

Furthermore, supervisors review approved credit decisions to ensure that policies and 

procedures were followed and that assessments of a borrower’s ability to repay the credit 

were appropriately conducted and documented. Similar procedures apply to wholesale and 

consumer credit, trading, investment, and available for sale approvals, all of which should be 

independently reviewed as part of a bank’s internal credit review or internal loan review 

function. 

EC6 The supervisor requires that the credit policy prescribes that major credit risk exposures 

exceeding a certain amount or percentage of the bank’s capital are to be decided by the 

bank’s Board or senior management. The same applies to credit risk exposures that are 

especially risky or otherwise not in line with the mainstream of the bank’s activities. 

Description and 

findings re EC6 

Supervisors review policies and procedures to ensure that banks establish limits on their credit 

exposures and that such limits and approval authorities are clearly defined. Supervisors ensure 

that credit policies describe the manner in which exposures will be approved and ultimately 

reported to the board. However Supervisors would have to make a determination that the 

absence of clear limits for escalation to the Board or senior management would be an unsafe 

and an unsound practice in order to make this a requirement. 

Supervisors review the approved credit authorities to ensure that the levels of authority are 

granted to appropriate, experienced staff. Supervisors ensure that policies require that 

concentrations that involve excessive or undue risks receive close scrutiny by the bank and 

holding company, and may test credit transactions to ensure that credit approvals comply 

with policy requirements. For example, the agencies’ Interagency Guidance on Concentrations 

in Commercial Real Estate Lending, Sound Risk Management Practices directs banks and 

holding companies with commercial real estate concentrations to (i) evaluate the correlation 

between related real estate sectors, (ii) establish internal lending guidelines and concentration 

limits, and (iii) maintain adequate capital for those exposures. The board, or a committee 

thereof, is to periodically review and approve those risk-exposure limits. The Guidance also 

sets out exposure thresholds that are expressed as a percentage of a bank’s or holding 

company’s capital that may signify potential significant exposures that may warrant increased 

supervisory scrutiny. 

Supervisors also review policies, procedures, and controls to ensure they address adherence to 

regulatory mandated limits. For example, all member banks of the Federal Reserve System are 

subject to limits on extensions of credit to insiders and transactions with affiliates and loans 

and extensions of credit made by national banks and savings associations are subject to 

additional lending limits. State-chartered banks have limits imposed by each state regulator, 

but such limits are generally consistent with those established by the OCC. 

 Real estate lending regulations include supervisory loan-to-value limits for certain categories 
UNITED STATES 

154 INTERNATIONAL MONETARY FUND

of real estate loans and capital limitations on the aggregate amount of loans that exceed 

those limits. They also require that the aggregate amount of those exceptions must be 

reported at least quarterly to the board and that supervisors also review compliance with 

regulatory restrictions on granting credit for the purpose of purchasing stock or other 

securities. 

Supervisors have issued guidance on risk-management practices for specific product types, 

and they review practices during on-site examinations to ensure consistent and appropriate 

application. 

EC7 The supervisor has full access to information in the credit and investment portfolios and to the 

bank officers involved in assuming, managing, controlling and reporting on credit risk. 

Description and 

findings re EC7 

Under the U.S. FBAs’ statutory examination authority, supervisors may review all books and 

records maintained by a bank (and its affiliates) subject to the agencies’ supervision, as well as 

employees involved in a matter under review and bank service companies and independent 

servicers subject to the Bank Service Company Act. Supervisors also evaluate significant thirdparty service providers and require that banks and holding companies, in their contracts with 

third-party service providers, include agency access to the books, records, and operations of 

these entities. 

Supervisory guidance also specifies the credit management information that banks and 

holding companies are expected to maintain, including details on credit and investment 

portfolios. In addition, supervisors are allowed and generally given full access during 

examinations to this information and to employees, who assume, manage, control, and report 

on credit risk. 

EC8 The supervisor requires banks to include their credit risk exposures into their stress testing 

programs for risk management purposes. 

Description and 

findings re EC8 

Banking Institutions with less than $10bn of Assets 

There is no stress testing requirement. 

Banking Institutions with at least $10bn of Assets 

The DFA introduced some risk management and stress testing standards for institutions 

between $10bn and $50bn (such as annual company-run stress tests). These cover all credit 

risks. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve has established, through its Capital Plan Rule and its annual CCAR, 

additional requirements for Bank Holding Companies with at least $50bn in assets to ensure 

they properly assess their risks (including those arising during adverse conditions) and 

maintain sufficient capital to support those risks. The Federal Reserve’s Capital Plan Rule, 

along with subsequent capital planning guidance, establishes requirements for firms to have 

effective processes for ensuring they have sufficient levels of capital in both normal and 

stressed conditions. The firms are required to have internal processes for assessing their 

capital adequacy that reflect a full understanding of their risks and ensure that they hold 

capital corresponding to those risks to maintain overall capital adequacy. These cover all 

credit risks. 

Agencies will assess an institution’s stress testing framework in accordance with the above 

regulations and guidance that advise a banking organization to establish a stress testing 

framework that encompasses five principles: 
UNITED STATES 

INTERNATIONAL MONETARY FUND 155

 A stress-testing framework should include activities and exercises that are tailored to 

and sufficiently capture the banking organization’s exposures, activities, and risks. This 

principle specifically states that credit risk exposure may be included in the overall 

stress-testing framework. 

 An effective stress-testing framework employs multiple conceptually sound stress 

testing activities and approaches. 

 An effective stress-testing framework is forward-looking and flexible. 

 Stress test results should be clear, actionable, well supported, and inform decisionmaking. 

 An organization’s stress testing framework should include strong governance and 

effective internal controls. 

Assessment of 

Principle 17

Compliant 

Comment The U.S. Approach to Credit Risk is exceptionally codified in both regulation and guidance and 

reflects the emphasis placed on this risk by all of the Supervisors. Indeed the assessors did see 

examples of firms where even though the supervisor had evaluated that the major risks of an 

institution were not credit, say they were operational risk, there was still substantial material 

on credit in regular reports that they were compiling. There is a risk that the bias towards 

credit assessment (understandable though that is) could drown out adequate consideration of 

other risks in banks. 

The assessors judged that one of the Essential Criteria (6) was not met given there are no 

specific requirements to that effect. However the assessors found evidence that such limits 

were in place in the banks themselves and also in no doubt that if they were absent the 

agencies would determine such practice as unsafe and unsound and as such would have 

authority to require such limits and escalation criteria in individual cases. Our concerns on 

general Board involvement are expressed in CP 14. 

The absence of specific limits runs three risks as far as the assessors can determine: (i) a policy 

limit would provide a signal as to what authorities regard as acceptable, as such it can have a 

powerful preventative effect; (ii) the time gap between breaking a threshold and action is 

short and not as now where supervisors tend to first ask for a plan of rectification; (iii) a limit 

provides a useful reference point for offsite and continuous monitoring and can indicate when 

a bank might need to be reviewed by supervisory management. The assessors recognize that 

potentially this would restrict supervisory discretion. The assessors would however, still 

recommend that in forthcoming guidance, limits are codified. 

Principle 18 Problem assets, provisions and reserves.69 The supervisor determines that banks have 

adequate policies and processes for the early identification and management of problem 

assets, and the maintenance of adequate provisions and reserves.70

Essential criteria 

 

69 Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem 

assets. 

70 Reserves for the purposes of this Principle are “below the line” non-distributable appropriations of profit required 

by a supervisor in addition to provisions (“above the line” charges to profit). 
UNITED STATES 

156 INTERNATIONAL MONETARY FUND

EC1 Laws, regulations or the supervisor require banks to formulate policies and processes for 

identifying and managing problem assets. In addition, laws, regulations or the supervisor 

require regular review by banks of their problem assets (at an individual level or at a portfolio 

level for assets with homogenous characteristics) and asset classification, provisioning and 

write-offs. 

Description and 

findings re EC1 

The safety-and-soundness provision of the FDI Act (12 U.S.C. §1831p-i(b)) requires the FBAs to 

establish standards related to asset quality. The interagency safety-and-soundness guidelines 

implementing this provision require a bank to establish and maintain a system to identify 

problem assets and prevent deterioration in those assets. The system should be 

commensurate with the bank’s size and the nature and scope of its operations. In addition, the 

bank is expected to (a) conduct periodic asset quality reviews to identify problem assets; 

(b) estimate the inherent losses in those assets and establish allowances/reserves that are 

sufficient to absorb estimated losses; (c) compare problem asset totals to capital; (d) take 

appropriate corrective action to resolve problem assets; (e) consider the size and potential 

risks of material asset concentration; and (f) provide periodic asset reports with adequate 

information for management and the board to assess the level of asset risk. 

U.S. federal law provides that the accounting principles applicable to reports or statements 

required to be filed with FBAs generally must be uniform and consistent with U.S. GAAP. U.S. 

GAAP includes guidance on accounting for impairment in a loan portfolio and other credit 

exposures. In certain situations, the FBAs can prescribe alternative accounting principles, 

provided the alternate principles are “no less stringent” than U.S. GAAP. However, such 

prescriptions are rare. 

The FBAs have issued and, as warranted, periodically updated the December 2006 

“Interagency Policy Statement on the Allowance for Loan and Lease Losses (ALLL)’, addressing 

the supervisory expectations about the application of and documentation supporting a bank’s 

ALLL. This policy statement elaborates on the asset quality obligations set out in the 

interagency safety-and-soundness guidelines. The 2006 statement includes, among other 

matters, (a) the responsibilities of boards, management and supervisors of banks regarding 

the ALLL; (b) factors to be considered in the estimation of the ALLL; and (c) the objectives and 

elements of an effective loan review system, including a sound credit-grading system. The 

statement emphasizes that each bank is responsible for developing, maintaining and 

documenting a comprehensive, systematic and consistently applied process for determining 

the amounts of the ALLL and the provision for loan and lease losses. 

To fulfill this responsibility, each bank is expected to ensure that controls are in place to 

consistently determine the ALLL in accordance with U.S. GAAP, stated policies and procedures, 

management’s well-reasoned, supported and documented judgment, and relevant supervisory 

guidance. The 2006 statement requires banks to identify incurred losses estimated in 

accordance with U.S. GAAP, including credit losses in off-balance-sheet credit exposures, 

resulting from commitments and explicit and implicit recourse. Separate interagency guidance 

addresses the appropriate accounting and reporting treatment for certain loans that are sold 

directly from the loan portfolio or transferred to a held-for-sale account. The Federal Reserve 

expects holding companies to follow interagency policy statements and reviews this during 

examinations. 

The FBAs also expect banks and holding companies to perform reasonable stress tests based 

on adverse scenarios and assumptions that could have serious effects in the future. The FBAs 

expect banks and holding companies to consider the impact of contingent exposures arising 

from loan commitments, securitization programs, counterparty credit and other transactions. 

In December 2012, the Financial Accounting Standards Board (FASB) issued an exposure draft 
UNITED STATES 

INTERNATIONAL MONETARY FUND 157

of the proposed new accounting standard for credit losses on certain financial instruments. 

The FASB’s proposal would replace the current allowance method, under which credit loss 

recognition is delayed until a credit loss has been incurred, with a Current Expected Loss 

Model (CELM), under which an institution would be required to estimate all expected shortfalls 

in contractually required cash flows by considering past events, current conditions and 

reasonable and supportable forecasts. This proposal is still being finalized. 

EC2 The supervisor determines the adequacy of a bank’s policies and processes for grading and 

classifying its assets and establishing appropriate and robust provisioning levels. The reviews 

supporting the supervisor’s opinion may be conducted by external experts, with the supervisor 

reviewing the work of the external experts to determine the adequacy of the bank’s policies 

and processes 

Description and 

findings re EC2 

The FBAs confirm the adequacy of a bank’s loan classification, loss-provisioning process and 

overall capital adequacy during each supervisory cycle. External experts are generally not used 

to support the supervisor’s opinion (although see EC11 of CP10). Under the agencies’ Uniform 

Financial Institutions Rating system (UFIRS), supervisors assess and assign a composite rating 

based on an evaluation and rating of six essential components of a bank’s financial condition 

and operations. One of these component factors addresses the quality of assets. In assigning 

this component rating, supervisors consider the adequacy of the bank’s ALLL and other asset 

valuation reserves as well as the adequacy of its credit administration processes. Supervisors 

review the policies, procedures and internal controls for classification of, and provisioning for, 

credit risk as well as compliance with laws and regulations. 

To support this assessment, supervisors generally conduct transaction testing to assess the 

effectiveness of internal control processes. Supervisors also review the internal and external 

audit reports, internal management reports, models and model validation processes to 

determine that classifications and provisioning provide boards and senior management an 

accurate and timely picture of the bank’s or holding company’s credit risks. For example, 

supervisors evaluate and test each bank’s credit-risk-rating policy and procedures, and review 

and, if appropriate, adjust the classification or grading of the bank’s loan portfolio. 

The assessors reviewed a number of supervisory reports and confirmed that this assessment 

process is working effectively. 

Additionally, through the agencies’ Shared National Credit Program, interagency teams 

conduct an annual review of the classification of large syndicated loans held by multiple banks 

and holding companies. These reviews are conducted on-site at agent/lead banks and holding 

companies with assigned classifications applicable to all participating institutions. 

EC3 The supervisor determines that the bank’s system for classification and provisioning takes into 

account off-balance sheet exposures.71

Description and 

findings re EC3 

Pursuant to the FDI Act (12 U.S.C. §1831n(a)(3)(c)), all assets and liabilities, including 

contingent assets and liabilities, of banks and holding companies must be reported in, or 

otherwise taken into account in the preparation of, any balance sheet, financial statement, 

report of condition or other report required to be filed with an FBA. Supervisory guidance 

makes clear that systems for classification and provisioning should take into account off-

 

71 It is recognized that there are two different types of off-balance sheet exposures: those that can be unilaterally 

cancelled by the bank (based on contractual arrangements and therefore may not be subject to provisioning), and 

those that cannot be unilaterally cancelled.
UNITED STATES 

158 INTERNATIONAL MONETARY FUND

balance-sheet exposures. 

The 2006 statement on the ALLL requires the recognition of credit losses in off-balance-sheet 

exposures, including loan commitments, standby letters of credit, guarantees and recourse 

liabilities on loan transfers. The FBAs assess the structure of off-balance-sheet instruments to 

understand the explicit and implicit credit risk to the bank. 

EC4 The supervisor determines that banks have appropriate policies and processes to ensure that 

provisions and write-offs are timely and reflect realistic repayment and recovery expectations, 

taking into account market and macroeconomic conditions. 

Description and 

findings re EC4 

Under long-standing supervisory guidance, banks and holding companies are expected to 

establish appropriate policies and processes to ensure that provisions and write-offs reflect 

realistic repayment and recovery expectations. The FBAs confirm that banks and holding 

companies evaluate the ALLL reported on the balance sheet as at the end of each quarter, or 

more frequently if warranted. The determination of the ALLL and the necessary provision are 

to be based on the bank’s current judgments about the credit quality of the loan portfolio, 

and should consider all known relevant internal and external qualitative factors that affect loan 

collectability as of the evaluation date. The ALLL estimates are expected to reflect rigorous 

quantitative analyses supplemented by management judgment. The FBAs review bank 

policies, processes and practices to ensure that they achieve prompt and timely charge-off of 

loans when available information confirms the exposure to be uncollectible. 

From time to time, the FBAs may issue supplementary guidance for particular products or 

markets emphasizing the importance of realistic repayment and recovery expectations, 

including examples of what that means in practice for that product or market. 

EC5 The supervisor determines that banks have appropriate policies and processes, and 

organizational resources for the early identification of deteriorating assets, for ongoing 

oversight of problem assets and for collecting on past due obligations. For portfolios of credit 

exposures with homogeneous characteristics, the exposures are classified when payments are 

contractually in arrears for a minimum number of days (e.g. 30, 60, 90 days). The supervisor 

tests banks’ treatment of assets with a view to identifying any material circumvention of the 

classification and provisioning standards (e.g. rescheduling, refinancing or reclassification of 

loans). 

Description and 

findings re EC5 

Under supervisory guidance, banks and holding companies are expected to have appropriate 

policies and processes, and organizational resources, for the early identification of 

deteriorating assets, for ongoing oversight of problem assets and for collecting on past-due 

obligations. The FBAs require banks and holding companies to initiate additional or 

heightened oversight as the rating for a credit exposure deteriorates and to initiate 

appropriate corrective action, including potential escalation into the restructuring, foreclosure 

or collection processes. 

Based on a combination of on-site examinations and off-site monitoring, the FBAs assess the 

quality and timeliness of a bank’s or holding company’s rating system, classification process 

and credit workout processes to determine if they are appropriate. Supervisors also assess the 

trend in credit ratings migration and may direct a bank or holding company to re-grade any 

credit where the rating does not reflect the credit’s actual condition. The assessors saw ample 

evidence of the thoroughness of this assessment process. 

For retail transactions, supervisors evaluate a bank’s account management and collection and 

foreclosure processes to determine whether bank intervention is appropriately mitigating or 

reducing potential losses. Under supervisory guidelines, banks and holding companies are 

expected to classify loans and recognize losses when payments are contractually a minimum 
UNITED STATES 

INTERNATIONAL MONETARY FUND 159

number of days in arrears; they are also expected to establish explicit standards that control 

the use of extensions, deferrals, renewals and rewrites. Supervisors may deviate from the 

minimum classification guidelines if underwriting standards, risk management or account 

management standards are weak and present unreasonable credit risk. For other types of 

loans, supervisors consider credit risk factors beyond just arrears. 

EC6 The supervisor obtains information on a regular basis, and in relevant detail, or has full access 

to information concerning the classification of assets and provisioning. The supervisor requires 

banks to have adequate documentation to support their classification and provisioning levels. 

Description and 

findings re EC6 

Under the FBAs’ statutory examination authority, supervisors may review all books and records 

maintained by a bank or holding company (and its affiliates) subject to the agencies’ 

supervision. During the course of examinations, supervisors are provided with full access to all 

records related to credit risk management, and to all employees involved in assuming, 

managing, controlling and reporting on credit risk. This includes access to individual loan files, 

risk-management reports, internal and external audit reports and other material (such as 

board or committee minutes and reports). Banks and holding companies that do not supply 

requested information or access to premises and personnel are subject to supervisory 

sanctions and prosecution. Further, the quarterly Call Reports submitted by banks and holding 

companies include details on categories of credits and assets, delinquencies and provisioning.

EC7 The supervisor assesses whether the classification of the assets and the provisioning is 

adequate for prudential purposes. If asset classifications are inaccurate or provisions are 

deemed to be inadequate for prudential purposes (e.g. if the supervisor considers existing or 

anticipated deterioration in asset quality to be of concern or if the provisions do not fully 

reflect losses expected to be incurred), the supervisor has the power to require the bank to 

adjust its classifications of individual assets, increase its levels of provisioning, reserves or 

capital and, if necessary, impose other remedial measures. 

Description and 

findings re EC7 

If provisions are deemed to be inadequate, the FBAs will require corrective measures, such as 

additional provisions or other remedial measures, and have the authority to do so. (See 

12U.S.C. § 1818(b)). If a supervisor concludes that a bank’s or holding company’s ALLL is 

inadequate or based on an unreliable loan review system, the bank or holding company will 

be required to adjust its ALLL reported on its regulatory reports by an amount sufficient to 

bring the ALLL to an appropriate level as of the evaluation date, and to address process 

deficiencies. This adjustment should be reflected in the current period provision or through 

the restatement of prior period provisions, as appropriate. The FBAs can require the addition 

of capital or an adjustment of capital to reflect insufficient levels of provisions and ALLL. The 

FBAs may also take enforcement action against a bank or holding company, based on the 

magnitude of the observed deficiencies in the ALLL process, including the materiality of any 

error in the reported amount of the ALLL. Material shortfalls in the ALLL or regulatory capital 

are immediately met with supervisory action. Supervisors monitor the bank’s or holding 

company’s corrective actions to ensure that deficiencies have been addressed. 

A range of supervisory material reviewed by the assessors has confirmed the importance 

attached by the FBAs to achieving adequate levels of the ALLL. The assessors saw examples of 

rigorous supervisory examination of individual loan files and loan review systems, as well as 

requirements by the FBAs to increase the ALLL, by significant amounts in some cases. The 

assessors also saw examples of the willingness of the FBAs to use enforcement tools as 

necessary. The FBAs advised that the conversation between banks and examiners over the 

level of the ALLL has become more constructive and realistic in more recent years. The earlier 

“state of denial” by banks in many cases was punctured by the crisis; as the U.S. economy 

continues to improve, however, supervisors are coming under pressure to accept releases 
UNITED STATES 

160 INTERNATIONAL MONETARY FUND

from the ALLL. 

EC8 The supervisor requires banks to have appropriate mechanisms in place for regularly assessing 

the value of risk mitigants, including guarantees, credit derivatives and collateral. The 

valuation of collateral reflects the net realizable value, taking into account prevailing market 

conditions. 

Description and 

findings re EC8 

The FBAs expect banks and holding companies to establish and implement appropriate 

policies and procedures for periodically assessing the value of risk mitigants, including 

guarantees and collateral, at net realizable value. For real estate based credits, the agencies 

have appraisal and real estate lending standards and regulations that govern collateral 

valuation practices, underwriting standards (e.g., loan-to-value limits), credit administration 

and portfolio management expectations. These standards require that prevailing market 

conditions be taken into account. 

For loans individually evaluated for impairment and determined to be impaired, supervisors 

confirm that estimates of credit losses reflect consideration of all significant factors that affect 

the collectability of the loan as of the evaluation date, including risk mitigants. When a loan is 

identified as being impaired, a bank is to measure impairment based on the present value of 

expected future cash flows discounted at the loan's effective interest rate, except that, as a 

practical expedient, a bank may measure impairment based on a loan's observable market 

price, or the fair value of the collateral if the loan is collateral dependent. For individually 

impaired loans solely dependent on the sale or operation of the collateral for repayment, only 

the fair value of collateral valuation approach is allowed. The collateral valuation approach is 

based on the definition of “fair value” in U.S. GAAP. 

For loans evaluated for impairment on a pool basis, estimates of credit losses are expected to 

follow a systematic and consistently applied approach to select the most appropriate loss 

measurement methods, with written documentation and support for conclusions and 

rationales for the use and valuation of risk mitigants and collateral. 

EC9 Laws, regulations or the supervisor establish criteria for assets to be: 

(a) identified as a problem asset (e.g. a loan is identified as a problem asset when there is 

reason to believe that all amounts due, including principal and interest, will not be 

collected in accordance with the contractual terms of the loan agreement); and 

(b) reclassified as performing (e.g. a loan is reclassified as performing when all arrears have 

been cleared and the loan has been brought fully current, repayments have been made 

in a timely manner over a continuous repayment period and continued collection, in 

accordance with the contractual terms, is expected). 

Description and 

findings re EC9 

Pursuant to the safety-and-soundness provision of the FDI Act, the FBAs have established 

criteria for identifying an asset as “impaired” and measuring the impairment on these assets 

using criteria consistent with U.S. GAAP. (See 12 U.S.C. § 1831p-1(b)) 

The criteria for identifying problem assets are based on their degree of risk and likelihood of 

repayment. Supervisory guidance expects that analysis of the creditworthiness of a borrower 

will identify the borrower, document the borrower’s current and past financial condition, 

identify the purpose of the loan and sources of repayment, and identify any collateral and its 

value. Potential problem loans are then classified based on demonstration of a potential 

weakness or a well-defined weakness that could hinder the borrower’s ability to repay the 

loan. Supervisory guidance also focuses on the early identification of problem loans via an 

independent internal loan review system that assesses credit quality and renders an 

independent opinion of loan classifications. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 161

Banks and holding companies have the discretion to determine which individual loans are 

considered for evaluation of impairment. Generally, loans exceeding a certain materiality 

criterion, nonaccrual assets, severely delinquent credits and problem loan or “watch” lists 

generate the loans evaluated to determine which loans individually are impaired. 

The amount of impairment for a pool of loans is based on a bank’s or holding company’s 

ongoing loan review process and analysis of loan performance. One method of estimating 

loan losses for groups of loans is through the application of loss rates to the groups’ 

aggregate loan balances. Such loss rates typically reflect the bank’s or holding company’s 

historical loan loss experience for each group of loans, adjusted for relevant environmental 

factors (e.g., industry, geographical, economic, and political factors) and current conditions 

over a defined period of time. 

The FBAs have also established criteria for determining when an impaired asset may be 

reclassified as performing. The asset may be reclassified when none of its principal and 

interest is due and unpaid and the bank expects repayment of the remaining contractual 

principal and interest (e.g., after six months of sustained repayment performance), or when it 

otherwise becomes well secured and in the process of collection. 

EC10 The supervisor determines that the bank’s Board obtains timely and appropriate information 

on the condition of the bank’s asset portfolio, including classification of assets, the level of 

provisions and reserves and major problem assets. The information includes, at a minimum, 

summary results of the latest asset review process, comparative trends in the overall quality of 

problem assets, and measurements of existing or anticipated deterioration in asset quality and 

losses expected to be incurred. 

Description and 

findings re EC10 

Under the various guidance, banks and holding companies are expected to have policies and 

procedures in place to ensure that the board receives timely and appropriate information on 

the condition of the bank’s or holding company’s asset portfolio, including classification of 

credits, the level of provisioning, and major problem assets. 

Supervisors determine whether bank management provides clear, concise, and timely 

information about the loan portfolio and its attendant risks to the board. Supervisors 

determine that the board has approved strategic objectives and risk limits; supervisors also 

ensure that risk levels, trends, provisioning levels, significant problem assets, policy exceptions 

and compliance with laws and regulations are adequately reported to both senior 

management and the board. Supervisors determine whether the reports’ descriptions of loan 

portfolio risks are sufficient to enable the board to exercise its supervisory responsibilities. The 

agencies expect that a unit independent of the lending function will periodically evaluate the 

accuracy, completeness and timeliness of the information in these reports. If concerns exist 

about internal testing, supervisors conduct sufficient testing to reach an independent 

assessment. 

The assessors reviewed examination reports covering information on asset quality provided to 

boards. The assessors were advised that the FBAs have stepped up their focus on the quality 

of board reporting in this area, as part of the general supervisory thrust to improve risk 

governance frameworks. The OCC’s Heightened Standards for large banking organizations will 

reinforce this focus. 

EC11 The supervisor requires that valuation, classification and provisioning, at least for significant 

exposures, are conducted on an individual item basis. For this purpose, supervisors require 

banks to set an appropriate threshold for the purpose of identifying significant exposures and 

to regularly review the level of the threshold. 

Description and Pursuant to the 2006 statement on the ALLL, banks are expected to value, classify and allocate 
UNITED STATES 

162 INTERNATIONAL MONETARY FUND

findings re EC11 provisions for large exposures on an individual item basis. Loans determined to be impaired 

must be individually reviewed for appropriate valuation and provisioning. 

EC12 The supervisor regularly assesses any trends and concentrations in risk and risk build-up 

across the banking sector in relation to banks’ problem assets and takes into account any 

observed concentration in the risk mitigation strategies adopted by banks and the potential 

effect on the efficacy of the mitigant in reducing loss. The supervisor considers the adequacy 

of provisions and reserves at the bank and banking system level in the light of this 

assessment. 

Description and 

findings re EC12 

Pursuant to the safety-and-soundness provision of the FDI Act, the FBAs have stepped up 

their monitoring of trends and concentrations in credit risk across the banking sector, 

including through horizontal reviews of peer groups. The assessors saw a range of detailed 

reports and analysis of system-wide asset quality, including trends in the aggregate level of 

provisions and reserves. Based on these horizontal reviews, the agencies provide guidance to 

institutions and supervisors; in 2013, for example, the FBAs issued “Interagency Guidance on 

Leveraged Lending”, which outlines high-level principles related to safe and sound leveraged 

lending activities. The guidance forms the basis of supervisory review of banks and holding 

companies undertaking these activities, including problem credit management. However, the 

assessors saw no evidence that such guidance, and systemic risk reviews produced within the 

agencies, have translated into specific advice to supervisors on how to assess the adequacy of 

provisions and reserves. This assessment remains institution-specific. 

Assessment of 

Principle 18

Compliant 

Comments The FBAs have a long-established and rigorous process for evaluating banks’ approaches to 

problem assets and the maintenance of an adequate ALLL. The FBAs have shown a consistent 

willingness to challenge unrealistic bank estimates of the ALLL and to secure increases they 

judge necessary, taking enforcement action if required. This steadfastness in approach is likely 

to be tested as the U.S. economy improves. 

Supervisory judgments in this area, however, continue to be constrained by the “incurred loss” 

requirements of U.S. GAAP for objective evidence of impairment. As one example, a finding 

from a horizontal review that a bank’s ALLL was well below peers would be expected to trigger 

a supervisory response but the finding, of itself, would not be sufficient under U.S. GAAP to 

justify an adjustment to that bank’s ALLL; supervisors would also need to find objective 

evidence of credit losses specific to that bank. That said, the FBAs noted that supervisors and 

external auditors had developed a better understanding of each other’s perspectives and 

obligations, and the assessors saw examples where recommendations to banks to improve 

their loan classification systems were based on input from both supervisors and external 

auditors. 

The introduction of the FASB’s proposed Current Expected Loss Model (CELM), which will 

allow reasonable and supportable forecasts to be taken into account in calculating the ALLL, 

will permit more forward-looking provisioning. This proposal is still being finalized and 

methods of implementation have yet to be resolved by practitioners. In principle, however, the 

CELM should provide greater scope for supervisors to intrude their judgments about the 

circumstances of an individual bank, as well as system-wide assessments of risk (as per EC12), 

in assessing the adequacy of the bank’s ALLL. At this point, the FBAs lack a structured process 

for incorporating system-wide assessments into individual ALLL reviews. However, the 

assessors did not view this current gap as sufficient reason to downgrade the rating on CP 18, 

given the general rigor of the FBAs’ processes for problem assets. The assessors encourage 

the FBAs to work closely with accounting and auditing practitioners to ensure that information 
UNITED STATES 

INTERNATIONAL MONETARY FUND 163

on emerging systemic risks to asset quality can be incorporated into ALLL reviews once the 

CELM is implemented. 

Principle 19 Concentration risk and large exposure limits. The supervisor determines that banks have 

adequate policies and processes to identify, measure, evaluate, monitor, report and control or 

mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict 

bank exposures to single counterparties or groups of connected counterparties.72

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to have policies and processes that provide a 

comprehensive bank-wide view of significant sources of concentration risk.73 Exposures arising 

from off-balance sheet as well as on-balance sheet items and from contingent liabilities are 

captured. 

Description and 

findings re EC1 

Banks are expected to monitor a range of categories of credit concentrations, including single 

counterparty, groups of similar counterparties, economic sectors and countries. The FBAs have 

not set regulatory limits for lending to specific sectors or geographies, but supervisors expect 

banks to set prudent limits that are subject to supervisory review. Banks with poor internal risk 

management structures, including for dealing with concentration risk, can be subject to a wide 

range of supervisory consequences. 

 In the case of commercial real estate lending, the FBAs’ “Interagency Guidance on 

Concentrations in Commercial Real Estate Lending: Sound Risk Management Practices”, issued 

in 2006, directs banks and holding companies with concentrations in such lending to establish 

internal lending guidelines and concentration limits, to be periodically reviewed and approved 

by the board, and to hold adequate capital against those exposures. The guidance also sets 

out exposure thresholds (100 per cent of a bank’s or holding company’s risk-based capital for 

construction and land development loans and 300 per cent for commercial real estate (CRE) 

loans) that may signify potential significant exposures that may warrant increased supervisory 

scrutiny. 

The assessors were unclear about the supervisory force of these two exposure thresholds. In 

some supervisory reports examined, CRE exposures were well over double the thresholds, 

without supervisory comment or action. These exposures may well have been sound, but the 

assessors thought that graduated triggers for heightened supervisory attention would be 

helpful when exposures rose well above the thresholds and/or were rising rapidly. Supervisors 

interviewed in the “lessons learned” review of failed banks by the Office of Inspector General 

in the Federal Reserve had also expressed uncertainty about the force of these thresholds. 

Since the crisis, the FBAs have provided additional guidance on specific aspects of credit risk 

concentration. In 2010, the FBAs issued “Interagency Guidance on Correspondent 

Concentration Risks”, clarifying that banking organizations should consider developing 

concentration risk management policies and procedures for correspondent banks. In 2011, the 

 

72 Connected counterparties may include natural persons as well as a group of companies related financially or by 

common ownership, management or any combination thereof.

73 This includes credit concentrations through exposure to: single counterparties and groups of connected 

counterparties both direct and indirect (such as through exposure to collateral or to credit protection provided by a 

single counterparty), counterparties in the same industry, economic sector or geographic region and counterparties 

whose financial performance is dependent on the same activity or commodity as well as off-balance sheet exposures 

(including guarantees and other commitments) and also market and other risk concentrations where a bank is overly 

exposed to particular asset classes, products, collateral, or currencies. 
UNITED STATES 

164 INTERNATIONAL MONETARY FUND

FBAs issued “Interagency Counterparty Credit Risk Management Guidance”, which sets out 

sound practices and supervisory expectations for an effective counterparty credit risk (CCR) 

management framework. The guidance is intended primarily for banking organizations with 

large derivatives portfolios but is not generally applicable to community banking 

organizations or banking organizations with insignificant derivatives portfolios. The guidance 

indicates that banking organizations should consider the full range of credit risks in 

combination with CCR to manage concentration risk, including risks arising from on- and offbalance sheet activities, contractual and non-contractual risks, contingent and non-contingent 

risks, underwriting and pipeline risks. It provides that CCR concentration management should 

identify, quantify and monitor exposures to individual and affiliated entities, sectors, 

geographic regions and other risk concentrations. The board of directors or a board 

committee is expected to articulate clearly the banking organization’s risk tolerance for CCR 

by approving relevant policies, including a framework for establishing limits on individual 

counterparty exposures and concentrations of exposures. 

In 2013, the FBAs issued “Interagency Guidance on Leveraged Lending”, which sets out sound 

practices and supervisory expectations for leveraged lending activities. Banking organizations 

are expected to have a credit limit and concentration framework consistent with the 

organization’s risk appetite, including limits or guidelines for single obligors and transactions, 

and industry and geographic concentrations. Supervisors review a banking organization’s 

policies and processes for identifying, controlling and remediating concentration risk and 

large exposures in leveraged lending to ensure consistency with the guidance. 

The strong supervisory focus on credit risk concentration is not, at this point, matched by a 

comparable focus on other aspects of concentration risk, including market and other risk 

concentrations where a bank is overly exposed to particular asset classes, products, collateral 

or currencies, as required by this EC. Recent supervisory guidance, set out immediately below, 

is high-level and has not been reflected in detailed requirements for policies and processes to 

cover the full range of concentration risk. 

In 2012, the FBAs issued “Supervisory Guidance on Stress Testing for Banking Organizations 

with More Than $10 Billion in Total Consolidated Assets”, which sets out principles for stress 

testing as on ongoing risk management practice. The guidance stipulates that banking 

organizations are expected to maintain a stress-testing framework that covers all material 

exposures, activities and risks, whether on- or off-balance sheet, and that captures the 

interplay among different exposures, activities and risks, and their combined effects. Under 

section 165 of the DFA, all banking organizations with total consolidated assets of more than 

$10 billion are required to conduct and publically disclose the results of annual stress tests 

using scenarios specified by their primary supervisor. . 

In 2014, the OCC finalized its “Heightened Standards for Large Financial Institutions”, which 

applies to national banks, federal savings associations and federal branches of foreign banks 

with $50 billion or more in total consolidated assets. These standards, which are intended to 

strengthen governance and risk management practices, direct the institutions covered to 

include concentration risk limits in the risk governance framework that should limit excessive 

risk-taking and should not exceed the limits established in the institution’s risk appetite 

statement. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 165

EC2 The supervisor determines that a bank’s information systems identify and aggregate on a 

timely basis, and facilitate active management of, exposures creating risk concentrations and 

large exposure74 to single counterparties or groups of connected counterparties. 

Description and 

findings re EC2 

The FBAs have directed banks and holding companies to maintain adequate management 

information systems (MIS) that identify large borrower relationships, and that are appropriate 

to the size, complexity and global footprint of the banking organization. Supervisors assess 

the timeliness and quality of MIS reports to ensure that absolute and relative changes in 

exposure to individual counterparties and groups of connected counterparties are clearly 

identified in reports to boards and senior management. 

Under the FBA’s 2011 guidance on counterparty credit risk management, banking 

organizations with large derivatives positions are expected to have MIS with the capacity to 

measure exposures at various levels of aggregation (e.g. by business line, legal entity or 

consolidated by industry) and on a timely basis. Aggregation is expected to cover all CCR 

exposures and all other forms of credit risk to the same counterparty. Management is 

expected to strive for a single comprehensive CCR exposure measurement platform or, if not 

possible, to minimize the number of platforms and methodologies, and manual adjustment to 

exposure calculations. 

There are no explicit requirements that banks’ MIS identify sources of concentration risk other 

than credit risk/large exposures 

EC3 The supervisor determines that a bank’s risk management policies and processes establish 

thresholds for acceptable concentrations of risk, reflecting the bank’s risk appetite, risk profile 

and capital strength, which are understood by, and regularly communicated to, relevant staff. 

The supervisor also determines that the bank’s policies and processes require all material 

concentrations to be regularly reviewed and reported to the bank’s Board. 

Description and 

findings re EC3 

Under supervisory guidance, boards of banking organizations are expected to be actively 

involved in the approval, periodic review and oversight of implementation of the risk 

management framework, including strategies and policies for taking and managing credit risk. 

In this context, boards are expected to establish prudent concentration control processes, 

including escalation procedures and approval processes for exceptions to policy limits. 

Banking organizations are expected to establish internal thresholds for acceptable 

concentrations of credit and to report all material concentrations to the board for review. 

The OCC’s Heightened Standards (see above) direct the institutions covered to have policies 

and supporting processes in their risk management framework that effectively identify, 

measure, monitor and control the concentration of risk, on- and off-balance sheet. 

Supervisors confirm that management identifies, defines, measures, monitors and controls 

concentrations of credit risk, generally defined by the agencies as direct or indirect extensions 

of credit and contingent obligations that in aggregate exceed 25 per cent of tier 1 capital plus 

the Allowance for Loan and Lease Losses. Supervisors verify that new and existing credit 

concentrations are reported to the board or appropriate board committee on a regular basis, 

 

74 The measure of credit exposure, in the context of large exposures to single counterparties and groups of 

connected counterparties, should reflect the maximum possible loss from their failure (i.e. it should encompass actual 

claims and potential claims as well as contingent liabilities). The risk weighting concept adopted in the Basel capital 

standards should not be used in measuring credit exposure for this purpose as the relevant risk weights were devised 

as a measure of credit risk on a basket basis and their use for measuring credit concentrations could significantly 

underestimate potential losses (see “Measuring and controlling large credit exposures, January 1991).
UNITED STATES 

166 INTERNATIONAL MONETARY FUND

and in sufficient detail to enable an appropriate board response. 

The assessors reviewed a number of examination reports, which confirmed the strong 

supervisory attention given to the management of credit concentration risk. However, the 

assessors did not see detailed requirements or guidance, or supervisory assessments, related 

to the identification and management of material risk concentrations other than credit risk. 

EC4 The supervisor regularly obtains information that enables concentrations within a bank’s 

portfolio, including sectoral, geographical and currency exposures, to be reviewed. 

Description and 

findings re EC4 

Supervisors regularly obtain, through regulatory reports and on-site examinations, information 

that enables review of credit concentrations within a banking organization’s portfolio, 

including sectoral, geographical and currency exposures. Supervisors may follow up on any 

areas of concern, requesting additional information or directing a banking organization to 

reduce credit concentrations that present significant risks; more formal action may be taken as 

necessary. The assessors saw a number of examples of supervisory action in this area. The six 

largest U.S. bank holding companies also report exposure to top counterparties (individually) 

across a broad range of categories to the Federal Reserve on a weekly basis. Monitoring of 

concentrations other than credit risk is still evolving. 

EC5 In respect of credit exposure to single counterparties or groups of connected counterparties, 

laws or regulations explicitly define, or the supervisor has the power to define, a “group of 

connected counterparties” to reflect actual risk exposure. The supervisor may exercise 

discretion in applying this definition on a case by case basis. 

Description and 

findings re EC5 

OCC regulations define those individuals and entities whose interests will be attributed to the 

single borrower for purposes of computing the legal limits, under so-called “combination 

rules”. Under the regulations, a “corporate group” is defined for purposes of the lending limits 

as including a “person” and all of its subsidiaries (where the person owns or beneficially owns 

more than 50 per cent of the voting securities/interests of the subsidiaries. The OCC generally 

has discretion to apply these combination rules in a manner that reflects actual risk exposure. 

See 12 U.S.C. §84 and 12 CFR 32.5. The OCC has not often needed to exercise this discretion. 

The Federal Reserve is developing a large exposures regime for large bank holding companies 

and foreign banking organizations (total consolidated assets above $50 billion). Under this 

regime, the Federal Reserve has proposed a simple common ownership test to define when 

parties under common ownership would be treated as exposure to a single counterparty. 

Moreover, the definition of a subsidiary for these purposes differs from that in the 

combination rules in applying a 25 per cent rather than 50 per cent threshold for ownership of 

voting shares or equity by the parent. 

EC6 Laws, regulations or the supervisor set prudent and appropriate75 requirements to control and 

constrain large credit exposures to a single counterparty or a group of connected 

counterparties. “Exposures” for this purpose include all claims and transactions (including 

those giving rise to counterparty credit risk exposure), on-balance sheet as well as off-balance 

sheet. The supervisor determines that senior management monitors these limits and that they 

are not exceeded on a solo or consolidated basis. More generally, supervisors have broad 

authority to assess the risk posed by a credit risk concentration and consider the adequacy of 

capital to absorb the risk. 

 

75 Such requirements should, at least for internationally active banks, reflect the applicable Basel standards. As of 

September 2012, a new Basel standard on large exposures is still under consideration. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 167

Description and 

findings re EC6 

National banks are subject to a single-counterparty lending limit based on their unimpaired 

capital and surplus funds. See 12 U.S.C. §84. A bank’s total outstanding loans and extensions 

of credit to one borrower or group of connected borrowers not appropriately secured are 

limited to 15 per cent of the bank’s capital and surplus funds. A further 10 per cent may be 

extended if the loan is fully secured by readily marketable collateral. That is, there is an 

aggregate limit of 25 per cent of a bank’s capital and surplus funds. The limits cover on- and 

off-balance sheet extensions of credit and, since introduction of the DFA, counterparty credit 

risk from derivatives and securities financing transactions. 

In addition, a bank may not lend more than 50 per cent of its capital and surplus funds to a 

corporate group. However, the FBAs have explained that this particular limit rarely comes into 

play. Under the combination rules, the 15 per cent limit applies when the proceeds of a loan 

to one borrower are used for the direct benefit of another borrower or where a “common 

enterprise” is deemed to exist between the borrowers. A common enterprise is deemed to 

exist in any of four circumstances: (i) where borrowers represent a common source of 

repayment; (ii) where borrowers are related through common control and are substantially 

financially interdependent; (iii) where separate borrowers are acquiring more than 50 per cent 

of the voting interests of a company; and (iv) where the OCC (or other appropriate regulator) 

determines, based on an evaluation of the facts and circumstances of particular transactions, 

that a common enterprise exists. Only when one of these combination rules is not available 

would the 50 per cent corporate group limit be relevant. The FBAs see this limit as an 

additional limit on concentrations where, for example, a bank makes loans to companies that 

are related through common control but are financially independent. In such situations, the 15 

per cent limit would be applied to each member of the group and loans to the corporate 

group in the aggregate, while not combinable, while not combinable, would nonetheless be 

limited to 50 per cent. Examiners carefully review the financial condition and 

interdependencies of the borrowers in a corporate group and, if a common enterprise is 

deemed to exist, the loans to the members are combined and limited to 15 per cent. 

The legal limits on credit exposures also apply to all savings associations, with narrow 

exceptions, and to Federal branches and agencies of foreign banks (based in the latter case on 

the U.S. dollar equivalent of the foreign bank’s capital). The FBAs expect banking organizations 

to adhere to these limits and to have policies and processes to ensure that the limits are 

followed; where breaches of the limits are identified, the FBAs may seek restitution and civil 

money penalties against officers, directors and agents of the bank. See 12 U.S.C. §1818 and 12 

U.S.C. §93. 

In addition to these credit exposure limits, separate limits (10 or 25 per cent) apply on the 

amount of money market investments and securities issued by any one obligor (other than 

obligations of or guaranteed by the U.S. Government) that may be held by a banking 

organization on its own account. These separate limits do not apply to federal savings 

associations. 

The Federal Reserve’s proposed large exposures regime for large bank holding companies and 

foreign banking organizations would limit exposures to any unaffiliated company to 25 per 

cent of capital, or a lower amount as prescribed by the Federal Reserve. A more stringent 

credit exposure limit would apply between a major covered company and any other major 

counterparty. 

EC7 The supervisor requires banks to include the impact of significant risk concentrations into their 

stress testing programs for risk management purposes. 

Description and Under supervisory guidance, large banking organizations with significant CCR exposures are 
UNITED STATES 

168 INTERNATIONAL MONETARY FUND

findings re EC7 expected to maintain a comprehensive stress-testing framework, which is integrated into the 

organization’s CCR management. The framework should include measurement of the largest 

counterparty-level impacts across portfolios and consideration, at least quarterly, of stressed 

exposures arising from the joint movement of exposures and related counterparty 

creditworthiness. Senior management should evaluate stress test results for evidence of 

potentially excessive risk, take appropriate risk reduction strategies, and communicate the 

results to the board at an appropriate frequency. 

In addition, the Federal Reserve has implemented a comprehensive stress test framework for 

bank holding companies and state member banks in its Regulation YY, covering their material 

risks. Under this framework, the Federal Reserve annually develops scenarios for use in its 

supervisory stress tests for large bank holding companies, and requires these companies and 

state member banks to use the same scenarios in their company-run stress tests. In 2014, the 

Federal Reserve required eight large, interconnected bank holding companies to apply a 

counterparty default scenario component to their securities lending, repo and derivative 

exposures. 

As noted above, the FBAs’ 2012 supervisory guidance on stress testing sets out principles for 

stress testing as on ongoing risk management practice. The guidance stipulates that banking 

organizations are expected to maintain a stress-testing framework that covers all material 

exposures, activities and risks, whether on- or off-balance sheet, and that captures the 

interplay among different exposures, activities and risks, and their combined effects. The FBAs 

see this guidance, together with the company-run annual stress tests mandated under the 

DFA, as providing a holistic framework for assessing all material risks, including significant risk 

concentrations. In practice, however, concentration risk other than credit risk has not to date 

been imbedded in stress testing. 

Community banks are not subject to legal or supervisory requirements for enterprise-wide 

stress testing but are expected to have the capacity to analyze the potential impact of adverse 

outcomes on their financial condition. 

Additional 

criteria 

AC1 In respect of credit exposure to single counterparties or groups of connected counterparties, 

banks are required to adhere to the following: 

(a) 10 percent or more of a bank’s capital is defined as a large exposure; and 

(b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private 

sector non-bank counterparty or a group of connected counterparties. 

Minor deviations from these limits may be acceptable, especially if explicitly temporary or 

related to very small or specialized banks. 

Description and 

findings re AC1 

See description and findings under EC6. The FBAs do not apply a threshold of 10 per cent of 

capital to define a large exposure. 

Assessment of 

Principle 19

Largely compliant. 

Comments The FBAs have an effective supervisory framework for dealing with credit concentration risk 

and the assessors acknowledge the close focus on this risk in credit quality reviews. Guidance 

has also been issued on a number of specific areas of credit concentration risk and this is 

followed up in supervisory reviews; however, some reassessment of the supervisory force of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 169

the thresholds for commercial real estate exposures is warranted. Supervisors are also giving 

more attention to the treatment of concentration risk in counterparty credit risk management.

 At this point, however, a detailed supervisory framework and supervisory guidance for market 

and other risk concentrations where a bank is overly exposed to particular asset classes, 

products, collateral or currencies, as specified in EC1, EC 2, EC 3 and EC 4, is not well 

developed. Assessors were not shown any evidence that the identification and assessment of 

such risk concentrations is part of supervisory requirements for banks. In principle, the 

detailed stress-testing regime now in place can provide a comprehensive basis for identifying 

and assessing the impact of concentration risk, and the assessors would encourage the FBAs 

to consider scenarios that draw attention to this risk in areas beyond credit concentration. The 

OCC’s “Heightened Standards” will also put the onus on boards to ensure that their banking 

organizations have a robust risk management framework for concentration risk. However, 

these Standards only began to come into effect from September 2014. 

The widening of the definition of large exposures under the DFA to include counterparty 

credit risk from derivatives and securities financing transactions has brought the large 

exposure thresholds more into line with the requirements of AC1. However, some anomalies 

and omissions remain. The separate and additional limits available to banks for money market 

investments and security holdings continue to leave open the possibility of excessive risk 

concentrations. The 2010 DAR recommended that these additional exposures be included in 

the 15 plus 10 limits (as they are for federal savings associations), but this recommendation 

has not been taken up. The 50 per cent limit on exposures to a corporate group also appears, 

prima facie, to be out of line with AC1. The assessors acknowledge the view of the FBAs that 

this is an additional “catch-all” limit on aggregate exposures to group members and one that 

is rarely approached. Nonetheless, this limit is problematic and could result in excessive risk 

concentrations if, for example, reputational damage to a corporate group were to undermine 

the financial independence of individual group members. Moreover, this treatment of 

corporate groups does not appear consistent with the Federal Reserve’s proposed large 

exposures framework, under which common ownership alone defines whether exposure to a 

group of counterparties would be treated as exposure to a single counterparty. In its 

proposals, the Federal Reserve argued that a simpler, more objective approach to combination 

rules is more consistent with the objectives of a single-counterparty credit limit. The assessors 

would encourage the FBAs to reconcile these different approaches. 

Finally, the assessors note that the Federal Reserve is working actively to finalize its large 

exposures framework, with legal limits, for large bank holding companies and foreign banking 

organizations, in light of the release of the Basel Committee on Banking Supervision’s new 

large exposures regime for internationally active banks. 

Principle 20 Transactions with related parties. In order to prevent abuses arising in transactions with 

related parties76 and to address the risk of conflict of interest, the supervisor requires banks to 

enter into any transactions with related parties77 on an arm’s length basis; to monitor these 

 

76 Related parties can include, among other things, the bank’s subsidiaries, affiliates, and any party (including their 

subsidiaries, affiliates and special purpose entities) that the bank exerts control over or that exerts control over the 

bank, the bank’s major shareholders, Board members, senior management and key staff, their direct and related 

interests, and their close family members as well as corresponding persons in affiliated companies.

77 Related party transactions include on-balance sheet and off-balance sheet credit exposures and claims, as well as, 

dealings such as service contracts, asset purchases and sales, construction contracts, lease agreements, derivative 

transactions, borrowings, and write-offs. The term transaction should be interpreted broadly to incorporate not only 

(continued) 
UNITED STATES 

170 INTERNATIONAL MONETARY FUND

transactions; to take appropriate steps to control or mitigate the risks; and to write off 

exposures to related parties in accordance with standard policies and processes. 

Essential criteria 

EC1 Laws or regulations provide, or the supervisor has the power to prescribe, a comprehensive 

definition of “related parties.” This considers the parties identified in the footnote to the 

Principle. The supervisor may exercise discretion in applying this definition on a case by case 

basis. 

Description and 

findings re EC1 

Two major sets of laws define and establish limits on transactions with “related parties”; the 

laws apply to Federal Reserve member banks (state and national), state nonmember insured 

banks and all savings associations. 

First, sections 23A and 23B of the Federal Reserve Act are designed to prevent the misuse of a 

bank’s resources through preferential transactions with its affiliates. The transactions “covered” 

include loans and extensions of credit to an affiliate, investments in securities issued by an 

affiliate, asset purchases from an affiliate, the issuance of a guarantee or letter of credit on 

behalf of an affiliate, and credit exposures arising from derivative transactions and securities 

borrowing and lending transactions between a bank and an affiliate. Covered transactions do 

not include service and construction contracts, or lease agreements. Section 23A imposes 

quantitative limits and collateral requirements on covered transactions (see EC 5). 

Second, sections 22(g) and 22(h) of the Federal Reserve Act impose a number of restrictions 

on extensions of credit between a bank and its insiders and to insiders of its affiliates. 

Although the regulatory restrictions on transactions with affiliates and insiders apply only to 

the bank subsidiaries of holding companies, the FBAs encourage all banking organizations to 

adopt policies to avoid preferential transactions with affiliates or insiders. While related-party 

transactions that do not involve a supervised bank may be legal, the FBAs may still consider 

them “unsafe and unsound”. In addition, as consolidated supervisor, the Federal Reserve 

monitors material intra-group transactions and exposures, and ensures that holding 

companies have adequate risk management processes in place for the banking organization 

pertaining to such transactions. 

The Federal Reserve Act and its implementing regulations (Regulation O) clearly define the 

individuals and entities to which lending restrictions apply. The definitions are broad and 

provide some discretion to the supervisor in individual cases to determine whether a particular 

individual or entity should be subject to the restrictions. The assessors were informed that this 

discretion has rarely needed to be exercised. The term “affiliate” includes any entity that 

directly or indirectly controls, or is under common control with, the bank, but does not include 

the bank’s subsidiaries. The term “insider” includes executive officers, directors, and principal 

shareholders of a bank or any of its affiliates, as well as their related interests (companies 

controlled by such insiders), but does not explicitly include family members of insiders other 

than principal shareholders. Insiders are subject to general “duty of loyalty” obligations not to 

advance the interests of those with whom they have a personal or business relationship 

(Comptroller’s Handbook on “Insider Activities”); for insiders of federal savings associations, 

this duty is set out in 12 CFR 163.200. A transaction between a bank and a third party where 

the funds are transferred to, or used for the benefit of, an affiliate or insider is considered a 

 

transactions that are entered into with related parties but also situations in which an unrelated party (with whom a 

bank has an existing exposure) subsequently becomes a related party. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 171

transaction with that affiliate or insider. 

EC2 Laws, regulations or the supervisor require that transactions with related parties are not 

undertaken on more favorable terms (e.g. in credit assessment, tenor, interest rates, fees, 

amortization schedules, requirement for collateral) than corresponding transactions with nonrelated counterparties.78

Description and 

findings re EC2 

Section 23B of the Federal Reserve Act provides that covered transactions between a bank and 

its affiliates must be on terms and under conditions, including credit standards, that are 

substantially the same or at least as favorable to the bank as those prevailing at the time for 

comparable transactions with or involving non-affiliated companies. Under section 22(h), 

extensions of credit to an insider must (a) be made on substantially the same terms (including 

interest rates and collateral) as, and following credit underwriting procedures that are not less 

stringent than, those prevailing at the time for comparable transactions by the bank with noninsiders and (b) not involve more than the normal risk of repayment. Banks are required to 

maintain records to document compliance with these restrictions. 

Supervisors review and assess the adequacy of a bank’s procedures for ensuring that 

transactions with affiliates, insiders and related parties are not made on preferential terms and 

are otherwise consistent with safe and sound banking practices. Violations of these legal 

requirements can give rise to reimbursement and formal enforcement actions against a bank, 

and civil money penalties. 

EC3 The supervisor requires that transactions with related parties and the write-off of related-party 

exposures exceeding specified amounts or otherwise posing special risks are subject to prior 

approval by the bank’s Board. The supervisor requires that Board members with conflicts of 

interest are excluded from the approval process of granting and managing related party 

transactions. 

Description and 

findings re EC3 

Regulation O requires that extensions of credit to an insider be reviewed and approved by the 

board if the aggregate exposure would exceed $500,000 upon consummation of the new 

credit facility. A lower review threshold applies to smaller banks. Extensions of credit to 

insiders above the review threshold require the prior approval of a majority of board directors. 

The insider must not participate in the preparation of, or discussion and vote on, the credit. 

More generally, under regulations and supporting guidance, board members with conflicts of 

interest must recuse themselves from consideration of any matter in which they have an 

interest. 

Except for certain securities and asset purchases, there is no regulation requiring prior board 

approval for transactions between a bank and an affiliate, nor for write-offs of related-party 

transactions. Under the OCC’s “Heightened Standards” for risk governance by large banking 

organizations, which began to come into effect from September 2014, board oversight of the 

risk management function should cover compliance risk, which would include risk associated 

with affiliate transactions. 

EC4 The supervisor determines that banks have policies and processes to prevent persons 

benefiting from the transaction and/or persons related to such a person from being part of 

the process of granting and managing the transaction. 

Description and The regulatory requirements mentioned above, supported by supervisory guidance on 

 

78 An exception may be appropriate for beneficial terms that are part of overall remuneration packages (e.g. staff 

receiving credit at favorable rates).
UNITED STATES 

172 INTERNATIONAL MONETARY FUND

findings re EC4 conflicts of interest, prevent persons benefiting from the transaction or persons related to 

such individuals from being part of the process of granting and managing the exposure. Banks 

are expected to have policies and procedures to ensure compliance with these requirements, 

and these are reviewed by supervisors. As part of the regular examination process, supervisors 

will review lists of loans to directors and seek confirmation that directors did not involve 

themselves in any matter in which they have an interest. The assessors saw examples of such 

reviews. 

EC5 Laws or regulations set, or the supervisor has the power to set on a general or case by case 

basis, limits for exposures to related parties, to deduct such exposures from capital when 

assessing capital adequacy, or to require collateralization of such exposures. When limits are 

set on aggregate exposures to related parties, those are at least as strict as those for single 

counterparties or groups of connected counterparties. 

Description and 

findings re EC5 

The statutes mentioned in EC1 establish quantitative limits on affiliate and insider transactions 

and collateral requirements on certain affiliate transactions. Section 23A applies a general limit 

of 10 per cent of the bank’s capital and surplus to the aggregate amount of transactions with 

any one affiliate and a limit of 20 per cent to the aggregate amount of transactions with all 

affiliates. These limits are generally stricter than those for other counterparties. Moreover, any 

credit transaction with an affiliate generally must be fully secured and purchases of “lowquality assets” are generally prohibited. 

Insider transactions are subject to the single-borrower limits set out in 12 U.S.C. §84. That is, 

loans and extensions of credit to an individual insider, when aggregated with the amount of 

all other extensions of credit to that person’s related interests, generally may not exceed 15 

per cent of the bank’s capital and surplus. Insiders and their related interests are treated as a 

single borrower for the purposes of these limits Aggregate extensions of credit to insiders 

may not exceed a bank’s capital and surplus. For banks with deposits of less than $100 million, 

the limit is two times a bank’s capital and surplus, subject to certain restrictions (including that 

the board of directors determines that such a higher limit is consistent with prudent, safe and 

sound banking practices). Extensions of credit to an executive officer, other than loans with a 

residential housing or educational purpose, may not exceed $100,000. 

Supervisors can address problems with exposures to affiliates or insiders by requiring their 

deduction from capital when assessing capital adequacy and requiring the posting of 

additional capital. 

EC6 The supervisor determines that banks have policies and processes to identify individual 

exposures to and transactions with related parties as well as the total amount of exposures, 

and to monitor and report on them through an independent credit review or audit process. 

The supervisor determines that exceptions to policies, processes and limits are reported to the 

appropriate level of the bank’s senior management and, if necessary, to the Board, for timely 

action. The supervisor also determines that senior management monitors related party 

transactions on an ongoing basis, and that the Board also provides oversight of these 

transactions. 

Description and 

findings re EC6 

Banks must identify, through an annual survey, all insiders of the bank and maintain records of 

all extensions of credit to insiders. All banks that are in holding companies must report their 

covered transactions with affiliates on a quarterly basis to the Federal Reserve (see EC7). The 

FBAs require banks to develop policies to ensure that all credit decisions are based on an 

independent and complete credit evaluation. The FBAs also expect that a bank’s MIS identifies 

and quantifies credits to related parties and that loan management and review routinely 

review these transactions. However, other than general supervisory expectations that a board 

exercise proactive oversight over independent risk management and provide prior approvals 
UNITED STATES 

INTERNATIONAL MONETARY FUND 173

in certain cases, the assessors did not see specific supervisory guidance about the ongoing 

role of the board (or senior management) in overseeing related party transactions and 

monitoring exceptions to policies, processes and limits. 

EC7 The supervisor obtains and reviews information on aggregate exposures to related parties. 

Description and 

findings re EC7 

All top-tier bank holding companies and foreign banking organizations that own a U.S. 

insured depository institution must file the quarterly FR Y-8 report on transactions with 

affiliates. In Schedule RC-M of the Call Report, banks must report to the OCC the aggregate 

amount and number of extensions of credit to insiders when they exceed the lessor of 

$500,000 or 5 per cent of capital. The assessors were shown examples of Schedule RM-C. In 

the supervisory review process, supervisors note any transactions with affiliates or insiders that 

do not appear in regulatory reports. 

Assessment of 

Principle 20

Largely compliant 

Comments The CP requires a higher degree of board involvement and oversight than presently required 

by U.S. laws and supervisory guidance. There are no formal requirements for prior board 

approval of transactions with affiliated parties or of the write-off of related party exposures 

exceeding specified amounts (as per EC3), or for board oversight of related party transactions 

and exceptions to policies, processes and limits on an ongoing basis (as per EC6). However, 

the FBAs expect banks to apply a high degree of board oversight and monitoring of affiliate 

and insider transactions and review this as a matter of practice on offsite and onsite 

examinations. In addition, significant exposures to insiders – even within the formal limits – 

could be criticized by supervisors for endangering the safety and soundness of the bank. 

Statutes impose a set of limits on a bank’s exposures to affiliates and insiders that, with one 

exception, are at least as strict as those for single counterparties or groups of counterparties. 

The assessors acknowledge that a robust limit structure acts to constrain exposures in this 

area, but it does not absolve boards from the need for active and ongoing oversight of all key 

aspects of related party transactions to reduce the risk of abuse before formal limits are 

reached. 

The exception in the limit structure is of concern to the assessors, as it was in the 2010 DAR. 

This is the aggregate limit for lending to insiders of 100 per cent of a bank’s capital and 

surplus (and 200 per cent for smaller banks). This limit does not appear consistent with the 

general intent of this CP; it is higher than prudent practices and creates the risk that a small 

group of insiders could deplete the own funds of a bank. 

There are no regulated limits for holding company transactions with their affiliates or insiders, 

an omission also noted in the 2010 DAR. This omission can create the temptation for a bank 

to route insider loans through the holding company to avoid the formal bank limits, in turn 

requiring careful supervisory vigilance. A more formal limit framework for such transactions at 

the holding company level would facilitate monitoring and is needed for a comprehensive 

framework for transactions with related parties. 

The “related party” regime in the U.S. regulatory framework does not appear as broad as 

required by this CP. The definition of “covered transactions” in section 23 A does not include 

all elements contemplated by this CP, such as service and construction contracts, and lease 

agreements. In addition, the definition of affiliates excludes subsidiaries of the bank and the 

definition of “related interests” of insiders does not explicitly include their family members. 

Assessors recommend that the “related party” regime be amended to bring it into line with 

this CP. 
UNITED STATES 

174 INTERNATIONAL MONETARY FUND

Principle 21 Country and transfer risks. The supervisor determines that banks have adequate policies and 

processes to identify, measure, evaluate, monitor, report and control or mitigate country risk79

and transfer risk80 in their international lending and investment activities on a timely basis. 

Essential criteria 

EC1 The supervisor determines that a bank’s policies and processes give due regard to the 

identification, measurement, evaluation, monitoring, reporting and control or mitigation 

of country risk and transfer risk. The supervisor also determines that the processes are 

consistent with the risk profile, systemic importance and risk appetite of the bank, take 

into account market and macroeconomic conditions and provide a comprehensive bankwide view of country and transfer risk exposure. Exposures (including, where relevant, 

intra-group exposures) are identified, monitored and managed on a regional and an 

individual country basis (in addition to the end-borrower/end-counterparty basis). Banks 

are required to monitor and evaluate developments in country risk and in transfer risk 

and apply appropriate countermeasures. 

Description and 

findings re EC1 

The U.S. FBAs are required to evaluate banks’ and holding companies’ foreign country 

exposure and transfer risk as part of the examination and supervisory process. See 12 U.S.C. § 

3903(a). The agencies also must ensure that these risks are taken into account in evaluating a 

bank’s or holding company’s capital adequacy. Banks and holding companies meeting certain 

reporting criteria based on cross-border exposure are required to identify and monitor these 

risks and to provide quarterly reports to supervisors on their foreign country exposure. The 

quarterly reports detail each bank’s or holding company’s significant claims on foreign 

entities, specifying, among other things, the types of claims and country in which the 

borrowers are located. Banks and holding companies must have established policies and 

procedures for monitoring the risks associated with countries with which they are doing 

business and monitoring and evaluating their exposures to those countries. 

As required by statute, the agencies have issued regulations and guidance governing 

international lending. See e.g., 12 CFR 211, subpart D. However, the provisions of the 

International Lending Supervision Act, 12 U.S.C. §§ 3901-3911, do not apply to savings 

associations and SLHCs, which historically have not had large foreign country exposures and 

transfer risk. For purposes of Principle 21, therefore, the word “bank” does not include a 

savings association. The Federal Reserve examines large and complex SLHCs for country risk, 

however, and would require a SLHC to establish an A Allocated Transfer Risk Reserve (ATRR) 

pursuant to the Interagency Country Exposure Review Committee (ICERC)’s guidelines. Most 

of the discussion below includes any SLHC with foreign country exposure. 

Banks and holding companies are required to monitor and evaluate developments in country 

risk and in transfer risk and, as appropriate, establish an ATRR or take other appropriate 

countermeasures. See 12 CFR 211.43; 12 CFR 347.303, and 12 CFR 28.52. 

The FBAs have also implemented enhanced guidance concerning the elements of an effective 

 

79 Country risk is the risk of exposure to loss caused by events in a foreign country. The concept is broader than 

sovereign risk as all forms of lending or investment activity whether to/with individuals, corporates, banks or 

governments are covered. 

80 Transfer risk is the risk that a borrower will not be able to convert local currency into foreign exchange and so will 

be unable to make debt service payments in foreign currency. The risk normally arises from exchange restrictions 

imposed by the government in the borrower’s country. (Reference document: IMF paper on External Debt Statistics – 

Guide for compilers and users, 2003.)
UNITED STATES 

INTERNATIONAL MONETARY FUND 175

country risk management process for banking organizations. The guidance supplements and 

strengthens other guidance with regard to country risk and is part of an ongoing effort by the 

agencies, through their participation in the ICERC, to ensure that banking organizations' 

management of risks arising from their international activities are appropriately and 

adequately addressed during the examination process. See Federal Reserve SR 02-05, 

“Interagency Guidance on Country Risk Management.” See also Interagency statement on 

“Sound Risk Management Practices: Country Risk”. 

Country risk and transfer risk are monitored and measured through two independent 

supervisory processes: the bank examination process and the work of the ICERC. ICERC was 

established to provide a forum for U.S. FBAs to coordinate their assessments of cross-border 

risk and to promote a consistent approach to the supervisory process. The ICERC standards are 

communicated to the banking industry by supervisors and provide the banking industry with a 

general expectation for a bank’s or holding company’s sovereign risk management practices. 

During examinations, supervisors assess the bank’s or holding company’s overall identification 

and management of country and transfer risk. Banks and holding companies are expected to 

assess the level of their country risk exposure and evaluate the effect of prevailing and future 

economic, political, and social conditions on a country’s ability to sustain external debt service, 

and reflect the impact of these conditions on the credit risk of individual counterparties 

located in the country. The agencies expect banks and holding companies to have a 

comprehensive risk-management system to identify their cross-border exposure by borrower 

and by country, and to quantify exposure, including cross-border guarantees, derivatives, and 

reference assets, where appropriate. In order to effectively control country risk, riskmanagement systems are expected to include, at a minimum, oversight by the bank’s or 

holding company’s board of directors, well-defined policies and procedures for managing 

country risk, an accurate country exposure reporting system, an effective country analysis 

process, a country risk rating system, established country exposure limits, adequate 

monitoring of country conditions, effective stress testing and integrated scenario planning, 

and adequate risk management, internal controls, and audit (FDIC FIL 23-2002). 

In 2011-2012, the OCC conducted a horizontal examination of banks on their Country Risk 

Management (CRM) policies and practices. The examination had multiple objectives, including 

to identify best practices for CRM and to enhance coordinated supervisory practices on CRM 

monitoring. 

EC2 The supervisor determines that banks’ strategies, policies and processes for the 

management of country and transfer risks have been approved by the banks’ Boards and 

that the Boards oversee management in a way that ensures that these policies and 

processes are implemented effectively and fully integrated into the banks’ overall risk 

management process. 

Description and 

findings re EC2 

The agencies examine for and expect the involvement of a company’s board and management 

in developing and approving strategies, policies and processes for the management of 

country and transfer risks and the integration into overall risk management. As part of their 

regular examination process, U.S. federal supervisors determine whether an institution has 

developed an overall country and transfer risk strategy that is clear, consistent, documented 

and approved by the institution’s board of directors. Supervisors expect that any exception to 

such policies be justified, documented and approved by the appropriate level of management 

or/and the board. In the country and transfer risk area, as in all major areas of an institution’s 

business, supervisors expect that the board oversee management with the appropriate level of 

involvement, to ensure that policies are complied with and processes are followed. Supervisors 

determine in the course of examinations and as part of their regular monitoring work, that 
UNITED STATES 

176 INTERNATIONAL MONETARY FUND

country and transfer risk management is appropriately integrated in an institution’s 

enterprise-wide risk management system. The Comptroller’s Handbook for Examiners of 2008 

provides guidance for assessing Boards’ involvement in country risk matters. The horizontal 

examination mentioned under EC 1 included issues relating to Board involvement and 

oversight of CRM.

EC3 The supervisor determines that banks have information systems, risk management 

systems and internal control systems that accurately aggregate, monitor and report 

country exposures on a timely basis; and ensure adherence to established country 

exposure limits. 

Description and 

findings re EC3 

The agencies hold the banks’ or holding company’s management responsible for 

implementing sound, well-defined policies and procedures for managing country risk that 

establish risk tolerance limits, specify authorized activities, and identify desirable types of 

business. Supervisors confirm that banks and holding companies have appropriate risk 

management systems in place to evaluate sovereign risk, including a rating scale and a regular 

cycle of reviews. Supervisors also review a banking organization’s systems to evaluate 

individual countries’ economic, social, and other conditions and developments where the 

organization is exposed to risk. Supervisors expect a banking organization to establish 

procedures for dealing with exposures in troubled countries, including contingency plans for 

reducing risk, and if necessary, exiting the country. The horizontal examination mentioned 

under EC 1 included issues relating to information, risk management and control systems as 

well as issues relating to country limits and triggers for actions. 

EC4 There is supervisory oversight of the setting of appropriate provisions against country risk 

and transfer risk. There are different international practices that are all acceptable as long 

as they lead to risk-based results. These include: 

(a) The supervisor (or some other official authority) decides on appropriate minimum 

provisioning by regularly setting fixed percentages for exposures to each country 

taking into account prevailing conditions. The supervisor reviews minimum 

provisioning levels where appropriate. 

(b) The supervisor (or some other official authority) regularly sets percentage ranges 

for each country, taking into account prevailing conditions and the banks may 

decide, within these ranges, which provisioning to apply for the individual 

exposures. The supervisor reviews percentage ranges for provisioning purposes 

where appropriate. 

(c) The bank itself (or some other body such as the national bankers association) sets 

percentages or guidelines or even decides for each individual loan on the 

appropriate provisioning. The adequacy of the provisioning will then be judged by 

the external auditor and/or by the supervisor. 

Description and 

findings re EC4 

The requirements of the U.S. FBAs for banks’ and holding companies’ risk practices are 

embedded in the International Lending Supervision Act (ILSA) passed by the U.S. Congress 

in 1983. The ILSA requires banks and bank holding companies, when warranted, to set up 

an allocated reserve for assets subject to more severe transfer risk. The three FBAs have 

published regulations implementing the ATRR requirement. The regulations require that 

each affected organization write off or establish and maintain an ATRR for each asset with 

impaired value due to transfer risk. However, the ATRR requirement does not apply to U.S. 

branches, agencies, or commercial lending company subsidiaries of foreign banking 
UNITED STATES 

INTERNATIONAL MONETARY FUND 177

organizations. Nevertheless, each U.S. federal banking agency will determine the need, if 

any, for other special measures that may be warranted by conditions in the branch or 

agency, including, for example, increased monitoring of due-from/due-to head office 

accounts, asset maintenance requirements, and/or specific reserves. 

U.S. FBAs set country and transfer risk reserve requirements for selected countries. These 

requirements or ATRRs are determined through the ICERC process, which evaluates transfer 

risk for the U.S. banking system on an ongoing basis. ICERC evaluates higher-risk regions 

and countries and mandates ATRRs, where appropriate, for countries in default, by type of 

exposure and by tenor. 

The ICERC meets once a year (with ad hoc meetings, as circumstances warrant, at other 

times during the year) to review conditions in countries that (1) have defaulted by not 

complying with their external service obligations or are unable to service the existing loan 

according to its terms, and (2) where U.S. banks and holding companies have large 

exposures. Based on this review, the ICERC assigns a transfer risk rating to the country and 

determines whether U.S. banks and holding companies must hold a reserve (an “Allocated 

Transfer Risk Reserve” or “ATRR”) against exposures where the country of residence of the 

ultimate obligor is a defaulting country. The agencies require banks and holding companies 

to establish an ATRR for each applicable international asset where the ultimate obligor 

resides in a defaulted country. 

In addition to the specific mandated reserves, the agencies expect banks and holding 

companies to evaluate the risk profile of their foreign exposures (both cross-border and 

local), appropriately grade countries’ and individual obligor exposures, and establish limits 

that are consistent with the bank’s or holding company’s strategy, risk profile, and capital. 

Supervisors evaluate the establishment, appropriateness of, and compliance with such limits 

during the examination process 

EC5 The supervisor requires banks to include appropriate scenarios into their stress testing 

programs to reflect country and transfer risk analysis for risk management purposes. 

Description and 

findings re EC5 

The agencies, in coordination, have developed rules establishing a framework for 

conducting annual stress tests for institutions that they supervise. In May, 2012, the 

agencies issued guidance on Stress Testing for Banking Organizations with Total 

Consolidated Assets of More Than $10 Billion. The guidance outlines broad principles for a 

satisfactory stress testing framework. Risks addressed in a firm’s stress testing framework 

may include country risk. Moreover, banks and bank holding companies are required to 

have a country risk management framework that monitors and assesses the risks to 

international activities and exposures, including using appropriate scenario analysis and 

stress tests of country and transfer risk. 

Supervisors determine the adequacy of a BHC’s and bank’s stress testing of its international 

activities. This includes determining whether scenarios target countries, regions, business 

lines, and products with material foreign exposures; whether stress testing is commensurate 

with the complexity of a bank and its level of international activities; whether scenarios are 

based on the range of risk to which a bank is exposed; whether stress tests typically reveal 

countries and situations where a bank faces heightened risk; and whether stress testing 

incorporates contingency and action plans, such as holding more capital, risk mitigation, 

hedging, reducing lines of credit, and/or adjusting pricing. 

However, country risk has not been included in the stress tests conducted, so far. 

EC6 The supervisor regularly obtains and reviews sufficient information on a timely basis on 
UNITED STATES 

178 INTERNATIONAL MONETARY FUND

the country risk and transfer risk of banks. The supervisor also has the power to obtain 

additional information, as needed (e.g. in crisis situations). 

Description and 

findings re EC6 

Federal banking agencies require banking institutions with foreign country exposure to submit 

quarterly reports in prescribed format, as required by law (ILSA Section 907 Collection of 

International Lending Data). Federal banking agencies evaluate the foreign country exposure 

and transfer risk of banking institutions for use in examinations and supervision, also as 

required by law (ILSA Section 904 Supervision of International Lending). 

Banks and BHCs are thus required to report their various asset exposures quarterly on the 

Country Exposure Report FFIEC 009 and Country Exposure Information Report FFIEC 009a. The 

agencies maintain a publicly-available quarterly report (FFIEC E.16 Country Exposure Lending 

Survey) that contains aggregate cross-border and local foreign office exposure by individual 

country. A restricted version of this data, which contains more detailed information by 

individual banking organization, is used by supervisors in their foreign exposure monitoring 

process. 

 The FFIEC 009 reports contain information for on- and off-balance-sheet exposure by type of 

obligor (public, banks, non-bank financial institutions, corporates, and households). The 

agencies analyze the quarterly reports for levels, significant variations and trends. Also, agency 

economists evaluate, on an ongoing basis, political, economic, and social conditions and 

events for high impact countries. These analyses are supplemented by a more thorough 

review of country-risk exposure during regular supervisory activities. See the OCC’s Country 

Risk Management Booklet of the Comptroller’s Handbook 

In 2013, the ICERC implemented substantial enhancements to the data requirements for 

reporting institutions. The enhancements include a more detailed breakdown of exposures by 

type of obligor (government, corporate, household, non-bank financial institutions); the 

addition of several memorandum items, including netting of trading items; expanded 

reporting of credit derivatives; and the addition of the U.S. as a reporting country. 

The FBAs may use information sharing arrangements to obtain information bilaterally and/or 

through supervisory colleges and CMGs with foreign supervisors in large banks. Under the U.S. 

FBAs’ statutory examination authority, supervisors may review all books and records 

maintained by a bank (and its affiliates) subject to the agencies’ supervision. 

Assessment of 

Principle 21

Compliant 

Comments A robust framework exists for regulation and assessment of country and transfer risks and for 

the allocation of loan loss reserves reflecting country and transfer risks. 

However: 

The rules do not cover savings associations. (Due to their tradition of having limited 

international exposures). The assessors would, however, recommend the introduction of a de 

minimis regime being applied to all categories of banks. Nor are U.S. affiliates of foreign banks 

covered since they are expected to be under consolidated supervision from the home 

authorities. The assessors find this acceptable, provided that there is good cooperation and 

information-sharing between the FBAs and the relevant foreign supervisory authorities on 

country risk matters as well as consolidated supervision. 

Country risk has not yet been specifically tested in the stress tests mandated by the FBAs. 

While it has been covered on a case by case basis by internal stress testing conducted by 

banks, the assessors recommend that guidance and rules on stress test specifically include 
UNITED STATES 

INTERNATIONAL MONETARY FUND 179

country risk. 

Principle 22 Market risk. The supervisor determines that banks have an adequate market risk 

management process that takes into account their risk appetite, risk profile, and market and 

macroeconomic conditions and the risk of a significant deterioration in market liquidity. This 

includes prudent policies and processes to identify, measure, evaluate, monitor, report and 

control or mitigate market risks on a timely basis. 

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to have appropriate market risk 

management processes that provide a comprehensive bank-wide view of market risk 

exposure. The supervisor determines that these processes are consistent with the risk appetite, 

risk profile, systemic importance and capital strength of the bank; take into account market 

and macroeconomic conditions and the risk of a significant deterioration in market liquidity; 

and clearly articulate the roles and responsibilities for identification, measuring, monitoring 

and control of market risk. 

Description and 

findings re EC1 

As with many aspects of the supervisory regime, the approach is tiered. In the case of market 

risk this tiering is generally set by reference to the aggregate trading assets and trading 

liabilities (as reported in the most recent quarterly Consolidated Reports of Condition and 

Income (Call Report)). 

Table 22.1 1 2 3

Below Market Risk 

Rule Threshold

Above Market Risk 

Rule Threshold

Advanced Approach

U.S. Banking 

Organizations with 

$250bn or more in 

consolidated total 

assets or $10bn or 

more in 

consolidated total 

on-balance sheet

foreign exposure

National Banks An expectation (under 

the Safety and 

Soundness 

provisions) that all 

banks and holding 

companies have in 

place comprehensive 

risk-management 

policies and 

processes for 

identifying, 

evaluating, 

monitoring, and 

controlling or 

mitigating all material 

market risks. 

Same as Column 

1 plus provisions in 

12 CFR part 3 

subpart F 

Same as for Column 2 

except banks must 

use the Supervisory 

Formula Approach, if 

applicable, under the 

standardized 

measurement 

method for 

measuring the 

specific risk add-on 

for securitization 

positions. 

State Member 

Banks

Same as Column 

1 plus provisions in 

12 CFR part 208 

appendix E 

State Nonmember Banks

Same as Column 

1 plus provisions in 

12 CFR part 325, 

appendix C 
UNITED STATES 

180 INTERNATIONAL MONETARY FUND

The provisions listed in Column 2 (Table 22.1) above reflect the agencies’ implementation of 

the market risk amendments to the Basel framework (including the 2011 revisions). The 

Market Risk Rule threshold is set as banking organizations that have aggregated trading 

assets and liabilities of at least $1 billion or 10 percent of total assets. The impact on market 

risk of different market and macroeconomic conditions and the risk of a significant 

deterioration in market liquidity are taken into account in the stress testing program (see EC5 

and EC6). Guidance does not clearly articulate the roles and responsibilities for identification, 

measuring, monitoring and control of market risk. 

Banking Institutions with aggregated trading assets and liabilities less than $1 billion or 

10 percent of total assets 

FDIC’s independent assessment of risk is conducted in order to make a determination on 

insurance pricing. Insurance premiums need to be adjusted to compensate for riskier activities. 

The Federal Reserve has also issued guidance with respect to market risk. 

In addition, each agency supplements these requirements and guidance with procedures and 

programs that set out more specific supervisory guidance on risk-management expectations. 

The U.S. applied a modified version of Basel II Standardized Approach, which takes into 

account the 2009 “Enhancements to the Basel II Framework”. The requirements do not include 

references to credit ratings, consistent with section 939A of the Dodd Frank Act, but include 

alternative standards of creditworthiness. Although the regime differs in a number of areas 

from the Basel II standardized approach, the agencies expressed the view that they are 

“generally consistent with the goals of the international framework.” For example, the 

Simplified Supervisory Framework Approach (SSFA) has been introduced and is only available 

to banking organizations for which the Advanced Approach and/or the Market Risk Final Rule 

do not apply. If the SSFA is not applied, a gross-up approach can be used. If neither approach 

is used, a risk weight of 1,250 percent is applied, but the chosen securitization approach must 

be applied consistently across all securitization exposures. 

The assessors noted that the U.S. is currently undertaking a Basel Regulatory Capital 

Assessment Programme (RCAP), which will determine the materiality of deviations. 

Banking Institutions with aggregated trading assets and liabilities of at least $1 billion 

or 10 percent of total assets 

Supervisors expect all material market risks to be captured within the market risk rule. 

The Supervisors have set out standards for use of internal models for Value-at-Risk (VAR) 

calculations and Stressed Vary in market risk capital calculations including treatment of credit 

spread risk, correlations within and across risk categories, as well as risks arising from the 

nonlinear price movements. They have also set standards for specific risk capital requirements 

including use of internal models and the application of specific risk add-on factors. 

Banking Institutions with $250bn or more in consolidated total assets or $10bn or more 

in consolidated total on-balance sheet foreign exposure (Advanced Approach) 

From 1 January 2014, for banking organizations subject to the advanced approaches 

framework (column 3 – Table 22.1), market risk capital requirements are calculated under 

subpart F of the agencies’ new capital rule that implements the Basel capital framework, as 

modified by Basel II and Basel III. The market risk requirements in the new rule are 

substantively the same as those listed in Table 22.1. However, Advanced Approaches 

organizations will be required to calculate both a general risk-based capital requirement as 

well as an advanced risk-based capital requirement. Each measure of market risk (general or 
UNITED STATES 

INTERNATIONAL MONETARY FUND 181

advanced) will need to be multiplied by 12.5 to determine its market risk equivalent assets. 

Note 

From 1 January 2015 all other banking organizations subject to the agencies’ capital regulations 

will adopt the approach calculated under subpart F of the agencies’ new capital rule.

EC2 The supervisor determines that banks’ strategies, policies and processes for the management 

of market risk have been approved by the banks’ Boards and that the Boards oversee 

management in a way that ensures that these policies and processes are implemented 

effectively and fully integrated into the banks’ overall risk management process. 

Description and 

findings re EC2 

As described above, supervisors examine banks and holding companies to determine whether 

they have comprehensive risk-management policies and processes for identifying, evaluating, 

monitoring, and controlling or mitigating all material risks, including market risk. 

The Federal Reserve and OCC issued joint guidance on model risk management (SR 11-7 and 

OCC Bulletin 2011-12). This guidance sets out the overall responsibilities a banking 

organization’s board and senior management collectively are expected to deliver, including 

the establishment of a strong model risk management framework that fits into the broader 

risk management of the organization. 

The OCC issued supplemental guidance (Bulletin 2014-8) specifying examination procedures 

applicable to any national bank, federal branch or agency, or federal savings association that 

is an active end-user of derivatives or has significant trading activity. The guidance set out 

examination requirements on the evaluation of a bank's board of directors' ability to 

understand and oversee risks related to end-user derivatives and trading activities. 

EC3 The supervisor determines that the bank’s policies and processes establish an appropriate and 

properly controlled market risk environment including: 

(a) effective information systems for accurate and timely identification, aggregation, 

monitoring and reporting of market risk exposure to the bank’s Board and senior 

management; 

(b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and 

capital strength, and with the management’s ability to manage market risk and which 

are understood by, and regularly communicated to, relevant staff; 

(c) exception tracking and reporting processes that ensure prompt action at the 

appropriate level of the bank’s senior management or Board, where necessary; 

(d) effective controls around the use of models to identify and measure market risk, and 

set limits; and 

(e) sound policies and processes for allocation of exposures to the trading book. 

Description and 

findings re EC3 

Market risk capital requirements provide that banking organizations subject to the market risk 

rule requirements (e.g. SR09-1) must establish limits on positions and monitor them daily, and 

that senior management and qualified personnel must periodically (at least annually) reassess 

these limits. Banking organizations must also validate their models on an on-going basis in 

accordance with the various parameters set forth in the agencies’ new capital rule. Capital 

rules also includes oversight and audit requirements with respect to market risk models and 

requires banking organizations to adequately document all material aspects of the internal 

models, management and valuation of market risk positions, control, oversight, validation, and 

review processes and results. The rule also requires banking organizations to have a rigorous 

process for assessing overall capital adequacy in relation to their market risk; this includes the 
UNITED STATES 

182 INTERNATIONAL MONETARY FUND

allocation to the trading book. 

In addition, Federal Reserve and OCC jointly issued guidance (SR 11-7 and OCC Bulletin 2011-

12) specify supervisory expectations in relation to EC3 (d). 

Under the agencies’ general supervisory authority, supervisors may assess and monitor a 

supervised banking organization’s policies and procedures to determine whether it is 

adequately monitoring and controlling its market risk. 

The OCC’s Bulletin 2014-8 requires examiners to evaluate any bank that is an active end-user 

of derivatives or has significant trading activity. This review should include the market risk 

management information system and determine whether the reports are appropriate for 

effective supervision. Examiners must assess whether the information system can generate 

daily reports on the risk and other parameters at the portfolio level, the line-of-business level, 

and any other level appropriate for effective management or supervision. Examiners monitor 

limit breaches and the escalation of any breaches that are unapproved. The OCC requires 

banks to notify the agency, of models banks use to calculate risk-based capital requirements 

under the market risk rule, in advance of making any material changes, or extension of a 

model to a new business or product type. 

EC4 The supervisor determines that there are systems and controls to ensure that bank’ markedto-market positions are re-valued frequently. The supervisor also determines that all 

transactions are captured on a timely basis and that the valuation process uses consistent and 

prudent practices, and reliable market data verified by a function independent of the relevant 

risk-taking business units (or, in the absence of market prices, internal or industry-accepted 

models). To the extent that the bank relies on modeling for the purposes of valuation, the 

bank is required to ensure that the model is validated by a function independent of the 

relevant risk-taking businesses units. The supervisor requires banks to establish and maintain 

policies and processes for considering valuation adjustments for positions that otherwise 

cannot be prudently valued, including concentrated, less liquid, and stale positions. 

Description and 

findings re EC4 

Market risk capital requirements include provisions requiring banking organizations subject to 

the rule to mark positions to market or model on a daily basis and require banking 

organizations to have rigorous valuation processes. The market risk capital requirements also 

provide that banking organizations must have a risk control unit independent from the 

business trading units and a validation process independent of the model development, 

implementation, and operation, or otherwise subject to independent review. In addition, a 

banking organization must have an internal audit function independent of business-line 

management that assesses the market risk controls. Under the rule, a banking organization 

must also have a process for valuing its market risk positions that includes policies and 

procedures on the valuation of positions, marking positions to market or to model, 

independent price verification, and valuation adjustments or reserves. 

Federal Reserve and OCC jointly issued guidance (SR 11-7 and OCC Bulletin 2011-12) also 

contain supervisory expectations related to model validation. All model components are 

expected to be subject to validation. Validation should be subject to critical review by an 

independent party. Staff conducting validation work should have explicit authority to 

challenge developers and users and to elevate their findings, including issues and deficiencies. 

The individual or unit to whom those staff report should have sufficient influence or stature 

within the bank to ensure that any issues and deficiencies are appropriately addressed in a 

timely and substantive manner. There is an expectation of regular, and at least annual, reviews 

of models. This would include the validation of vendor models. In addition, the guidance sets 

out the supervisory expectation that an effective validation framework should include three 
UNITED STATES 

INTERNATIONAL MONETARY FUND 183

core elements: 

 Evaluation of conceptual soundness, including developmental evidence; 

 On-going monitoring, including process verification and benchmarking; and 

 Outcomes analysis, including back testing. 

Supervisors carry out targeted examinations and on-going supervisory monitoring programs 

to determine that there are systems and controls in place that ensure banks’ marked-tomarket positions are re-valued daily and are in compliance with regulatory requirements. The 

targeted examinations review the front office marked-to-market process as well as the 

financial control policies and procedures for independently verifying the front office valuation. 

The review also includes whether the bank has established sufficient thresholds for pricing 

variance and proper procedures for the escalation and resolution of disagreements. 

FDIC practices are two-fold. As the primary federal regulator for State Non-Member banks, 

the FDIC has dedicated staff to monitor and assess the banks’ valuation process, 

supplemented by periodic target examinations that involve transaction testing. As the back-up 

regulator for national banks and state-member banks, the FDIC participates in OCC and 

Federal Reserve led reviews of the financial controller’s group and front office business to 

assess valuation practices. These reviews can be conducted as part of evaluation of 

compliance with market requirements or as a separate review targeting the financial 

controller’s group. 

The OCC’s Bulletin 2014-8 requires examiners to determine whether the bank’s valuation 

policies, processes, and controls produce consistent and reliable valuation of positions. 

Examiners review the bank’s valuation policies and identify deficiencies. Examiners evaluate 

the valuation control function’s effectiveness at ensuring the accuracy of marks transferred to 

the bank’s general ledger through the review of price-testing results and fair value 

adjustments by the independent valuation control unit. 

EC5 The supervisor determines that banks hold appropriate levels of capital against unexpected 

losses and make appropriate valuation adjustments for uncertainties in determining the fair 

value of assets and liabilities. 

Description and 

findings re EC5 

Banking Institutions with aggregated trading assets and liabilities of at least $1 billion 

or 10 percent of total assets 

The Market Risk Capital rules require a banking organization to have a rigorous process for 

assessing its overall capital adequacy in relation to its market risk. In addition, a banking 

organization must have a process for prudent valuation of its trading positions covered by the 

market risk requirements, including policies and procedures on the valuation of positions, 

marking positions to market or to model, independent price verification, and valuation 

adjustments or reserves. The valuation process must consider, as appropriate, unearned credit 

spreads, closeout costs, early termination costs, investing and funding costs, liquidity, and 

model risk. 

Banking Institutions with at least $10bn of Assets 

The U.S. Federal Banking Agencies implement section 165(i)(2) of the DFA, which requires 

financial companies with more than $10 billion in assets to conduct annual company-run 

stress tests using scenarios provided by the FBAs. 

Banking Institutions with at least $50bn of Assets 
UNITED STATES 

184 INTERNATIONAL MONETARY FUND

Section 165(i)(1) of the DFA requires the Federal Reserve to conduct annual stress tests of U.S. 

Bank Holding Companies with total consolidated assets of $50 billion or more. The board of 

directors and senior management must use the results of the stress tests in (i) their capital 

plan and capital planning process; (ii) assessing their exposures, concentrations, and risk 

positions; and (iii) their update to the covered company's resolution plan. 

EC6 The supervisor requires banks to include market risk exposure into their stress testing 

programs for risk management purposes. 

Description and 

findings re EC6 

Capital rules require a banking organization to stress test the market risk of its covered 

positions at a frequency appropriate to each portfolio, taking into account concentration risk, 

illiquidity under stressed market conditions, and risks arising from the banking organization’s 

trading activities that may not be adequately captured in its internal models. In addition, 

banking organizations must calculate a stressed VaR. 

Banking Institutions with at least $10bn of Assets 

Guidance outlines broad principles for a satisfactory stress testing framework and describes 

the manner in which stress testing should be employed as an integral component of risk 

management that is applicable at various levels of aggregation within a banking organization, 

as well as for contributing to capital and liquidity planning. The guidance states that an 

effective stress testing framework covers a banking organization’s full set of material 

exposures, activities, and risks, whether on or off the balance sheet, based on effective 

enterprise-wide risk identification and assessment. Risks addressed in a firm’s stress testing 

framework may include (but are not limited to) credit, market, operational, interest-rate, 

liquidity, country, and strategic risk. 

Supervisors also published final rules implementing section 165(i)(2) of the DFA, which require 

financial companies with more than $10 billion in assets to conduct annual company-run 

stress tests using scenarios provided by the FBAs. The FBAs may require such financial 

companies with significant trading activity to include a market shock component into their 

stress tests. 

Under the Federal Reserve’s stress testing rule for Bank Holding Companies with total 

consolidated assets of between $10 billion and $50 billion, as well as for state member banks 

and Savings and Loan Holding Companies with total consolidated assets greater than $10 

billion, the Federal Reserve may similarly require Bank Holding Companies and Savings and 

Loan Holding Companies subject to that rule with significant trading activity to include a 

market shock component into their stress tests. This component may also be required for 

state member bank stress tests if the state member bank is subject to the Federal Reserve’s 

market risk capital requirements. 

The OCC requires nationally chartered banks and savings associations with consolidated 

assets of more than $10 billion to perform a company-run stress test annually. The annual 

stress-testing report collects detailed data on covered institutions’ quantitative projections of 

balance sheet assets and liabilities, income, losses, and capital across a range of 

macroeconomic scenarios. It also collects qualitative supporting information on the 

methodologies used to develop internal projections of capital across stressed economic 

scenarios. A key component of the annual stress test is the stress test scenarios. Scenarios are 

sets of conditions that affect the U.S. economy or the financial condition of covered 

institutions. Each scenario includes the values of the variables specified for each quarter over a 

nine-quarter stress test horizon. The variables specified for each scenario generally address 

economic activity, asset prices, and other measures of financial market conditions for the U.S. 

and key foreign countries. For banks with significant trading activities, the OCC may require a 
UNITED STATES 

INTERNATIONAL MONETARY FUND 185

“market shock” scenario to estimate projected losses in the trading portfolio. The OCC 

annually will determine scenarios that are appropriate for use for each annual stress test. 

Banking Institutions with at least $50bn of Assets 

In addition, under the Federal Reserve’s stress testing rules, the Federal Reserve may use a 

“market shock” scenario in its supervisory stress test, as well as require some companies 

subject to the rule to include such a scenario in their company-run stress tests. In including a 

market shock in the stress tests, the Federal Reserve may use a combination of methodologies 

(including companies’ internal models) to estimate projected losses in the trading portfolio. 

Currently, the market shock component for stress testing applies to Bank Holding Companies 

subject to the Federal Reserve’s market risk capital requirements and that have total 

consolidated assets greater than $500 billion. 

Assessment of 

Principle 22 

Compliant 

Comments The Market Risk regime is comprehensive and understood. 

The assessors found very active engagement from supervisors on implementing the regime 

they have in place and in dealing with material market risk issues, such as valuation 

allowances, profit and loss attributions, etc. They make appropriate use of peer-group 

comparison such as through Hypothetical Portfolio Exercises. 

The material weaknesses identified in the 2009 BCP—such as market risk monitoring and 

management—have been significantly improved. The Supervisors have implemented much of 

the Basel II approach and also supplemented that for those banks subject to the Market Risk 

Rule. This improved market risk measurement and monitoring processes and models at 

certain major firms and lack of reliable valuation of MTM positions. The Stress Test Regime 

mandated under DFA has also improved the completeness and use of market stress testing. 

Principle 23 Interest rate risk in the banking book. The supervisor determines that banks have adequate 

systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate 

risk81 in the banking book on a timely basis. These systems take into account the bank’s risk 

appetite, risk profile and market and macroeconomic conditions. 

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to have an appropriate interest rate risk 

strategy and interest rate risk management framework that provides a comprehensive bankwide view of interest rate risk. This includes policies and processes to identify, measure, 

evaluate, monitor, report and control or mitigate material sources of interest rate risk. The 

supervisor determines that the bank’s strategy, policies and processes are consistent with the 

risk appetite, risk profile and systemic importance of the bank, take into account market and 

macroeconomic conditions, and are regularly reviewed and appropriately adjusted, where 

necessary, with the bank’s changing risk profile and market developments. 

Description and 

findings re EC1 

The U.S. Supervisors define interest rate risk in the banking book to be the current or 

prospective risk to both earnings and capital arising from adverse interest rate movements 

that affect the bank’s and holding company’s banking book. The main sources of interest rate 

 

81 Wherever “interest rate risk” is used in this Principle the term refers to interest rate risk in the banking book. 

Interest rate risk in the trading book is covered under Principle 22. 
UNITED STATES 

186 INTERNATIONAL MONETARY FUND

risk in the banking book are re-pricing risk, yield curve risk, basis risk, and the option features 

embedded in many financial instruments. 

Unlike many of the other risks that are covered in this BCP Assessment, there is no specified 

tiering of the approach, instead guidance is written as requiring standards in proportion to the 

risk being run. The safety and soundness statutes and supervisory guidance provide the legal 

basis for the imposition and enforcement of these requirements by the U.S. FBAs. The U.S. 

Supervisors do not apply a specific, rules based, capital charge for interest rate risk. However, 

the agencies appear to have the ability, if necessary, to increase capital if they feel capital 

levels do not sufficiently support the firm’s risks, including interest rate risk. 

The principals-based approach to interest rate risk examinations relies on the interagency 

policy statement from 1996 (for example SR 96-13), the 2010 interagency Advisory on Interest 

Rate Risk Management (for example SR 10-1), and the FAQs on 2010 Interagency Advisory on 

Interest Rate Risk Management (for example SR 12-2). Supervisors adhere to the Uniform 

Financial Institutions Ratings System (UFIRS) and evaluate every bank against UFIRS guidelines 

during on-site examinations. UFIRS has a component to rate Sensitivity to Market Risk in the 

CAMELS ratings (S) that requires supervisors to evaluate the bank’s exposure to, and 

management of, the interest rate risk in its banking book. Specifically, this component reflects 

the degree to which changes in interest rates, foreign exchange rates, commodity prices, or 

equity prices can adversely affect a bank’s earnings or economic capital. For most U.S. banks 

and holding companies, the primary source of market risk is the interest rate risk that arises 

from non-trading positions in their banking book. In some larger banks and holding 

companies, foreign operations can be a significant source of market risk. For some banks and 

holding companies, trading activities are a major source of market risk. 

The Sensitivity to market risk evaluation is based upon, but not limited to, an assessment of 

the following evaluation factors: 

 The sensitivity of the bank’s earnings and the economic value of its capital to adverse 

changes in interest rates, foreign exchange rates, commodity prices, or equity prices. 

 The ability of management to identify, measure, monitor, and control exposure to 

market risk given the size, complexity, and risk profile. 

 The nature and complexity of interest rate risk exposure arising from non-trading 

positions. 

 Where appropriate, the nature and complexity of market risk exposure arising from 

trading and foreign operations. 

 Effectiveness of board and senior management oversight of a bank's interest rate risk 

activities; 

 Comprehensiveness and effectiveness of risk management processes and control of 

interest rate risk; 

 Assumed interest rate risk is effectively managed and that appropriate policies and 

practices are established to control and limit risks; 

 Accurateness and timeliness of the identification and measurement of interest rate 

risk to ensure proper risk management and control; and, 

 Quality of the system for monitoring and reporting risk exposures by senior 

management and associated reporting to the board. 

The safety-and-soundness statute explicitly requires the U.S. FBAs to prescribe standards for 

banks, savings associations and holding companies relating to interest rate exposure (see 12 
UNITED STATES 

INTERNATIONAL MONETARY FUND 187

U.S.C. § 1831p-1(a)(1)(D). The interagency safety-and-soundness guidelines specify that a bank 

should: (i) manage* interest rate risk in a manner appropriate to the size and complexity of its 

assets and liabilities; and (ii) provide for periodic reporting to management and the board of 

directors regarding interest rate risk with adequate information for management and the 

board of directors to assess the level of risk. Interest rate risk management also is integral to 

ensuring compliance with regulatory capital standards and the interagency capital rules. 

In our review of material the assessors also saw evidence of supervisors making assessments 

of the risk appetite and risk profile of banks taking into account market and macroeconomic 

conditions. 

 (*this would incorporate identification, management, monitoring and mitigation consistent with 

the U.S. approach for other risks) 

EC2 The supervisor determines that a bank’s strategy, policies and processes for the management 

of interest rate risk have been approved, and are regularly reviewed, by the bank’s Board. The 

supervisor also determines that senior management ensures that the strategy, policies and 

processes are developed and implemented effectively. 

Description and 

findings re EC2 

The Guidance set out in EC1 sets out the Supervisors’ expectations that the Board for setting 

the bank’s or holding company’s “tolerance for interest rate risk, including approving relevant 

risk limits and other key policies, identifying lines of authority and responsibility for managing 

risk, and ensuring adequate resources are devoted to interest rate risk management” as well 

as monitoring “the bank's overall interest rate risk profile and ensuring that the level of 

interest rate risk is maintained at prudent levels.” The policy statement also indicates that 

senior management is responsible for ensuring that interest rate risk is managed 

appropriately. In this regard, senior management should develop and implement policies and 

procedures; ensure adherence to board approved responsibilities for measuring, managing, 

and reporting interest rate risk exposures; oversee the implementation and maintenance of 

management information and other systems that identify, measure, monitor, and control the 

bank’s and holding company’s interest rate risk; and establish internal controls over the 

interest rate risk management process. U.S. federal banking supervisors confirm a bank’s or 

holding company’s compliance with this statement during on-site examinations. Additionally, 

the 2010 Interagency Advisory on Interest Rate Risk Management states that “management is 

responsible for maintaining: 

 Appropriate policies, procedures and internal controls addressing interest rate risk 

management, including limits and controls over risk taking to stay within boardapproved tolerances; 

 Comprehensive systems and standards for measuring interest rate risk, valuing 

positions, and assessing performance, including procedures for updating interest rate 

risk measurement scenarios and key underlying assumptions driving the institution’s 

interest rate risk analysis; and, 

 Sufficiently detailed reporting processes to inform senior management and the board 

of the level of interest rate risk exposure.” 

In assessing the strategy, policies, procedures and processes for the identification, 

measurement, monitoring, and control of interest rate risk, supervisors perform off-site risk 

assessments and on-site examinations. 

Supervisors obtain, review, and evaluate the interest rate risk and other relevant policies and 

procedures (written or unwritten); board and asset liability committee and other management 

meeting minutes; current strategic plan; and internal risk-management reports during the on-
UNITED STATES 

188 INTERNATIONAL MONETARY FUND

site examination. Examination procedures also call for supervisors to assess board and senior 

management oversight; evaluate the quality of interest rate risk management; evaluate the 

internal controls and internal audit function; and evaluate the exposure to interest rate risk 

from an earnings and economic-value perspective. 

EC3 The supervisor determines that banks’ policies and processes establish an appropriate and 

properly controlled interest rate risk environment including: 

(a) comprehensive and appropriate interest rate risk measurement systems; 

(b) regular review, and independent (internal or external) validation, of any models used 

by the functions tasked with managing interest rate risk (including review of key model 

assumptions); 

(c) appropriate limits, approved by the banks’ Boards and senior management, that reflect 

the banks’ risk appetite, risk profile and capital strength, and are understood by, and 

regularly communicated to, relevant staff; 

(d) effective exception tracking and reporting processes which ensure prompt action at the 

appropriate level of the banks’ senior management or Boards where necessary; and 

(e) effective information systems for accurate and timely identification, aggregation, 

monitoring and reporting of interest rate risk exposure to the banks’ Boards and senior 

management. 

Description and 

findings re EC3 

The Guidance set out in EC1 sets out the Supervisors’ expectations that the board is 

responsible for setting the bank’s or holding company’s “tolerance for interest rate risk, 

including approving relevant risk limits and other key policies, identifying lines of authority 

and responsibility for managing risk, and ensuring adequate resources are devoted to interest 

rate risk management” as well as monitoring “the bank's overall interest rate risk profile and 

ensuring that the level of interest rate risk is maintained at prudent levels.” The policy 

statement also indicates that senior management is responsible for ensuring that interest rate 

risk is managed appropriately. In this regard, senior management should develop and 

implement policies and procedures; ensure adherence to board approved responsibilities for 

measuring, managing, and reporting interest rate risk exposures; oversee the implementation 

and maintenance of management information and other systems (including models)that 

identify, measure, monitor, and control the bank’s and holding company’s interest rate risk; 

and establish internal controls over the interest rate risk management process. U.S. federal 

banking supervisors confirm a bank’s or holding company’s compliance with this statement 

during on-site examinations. Additionally, the 2010 Interagency Advisory on Interest Rate Risk 

Management states that “management is responsible for maintaining: 

 Appropriate policies, procedures and internal controls addressing interest rate risk 

management, including limits and controls over risk taking to stay within boardapproved tolerances; 

 Comprehensive systems and standards for measuring interest rate risk, valuing 

positions, and assessing performance, including procedures for updating interest rate 

risk measurement scenarios and key underlying assumptions driving the institution’s 

interest rate risk analysis; and, 

 Sufficiently detailed reporting processes (including exception tracking) to inform 

senior management and the board of the level of interest rate risk exposure.” 

In assessing the strategy, policies, procedures and processes for the identification, 

measurement, monitoring, and control of interest rate risk, supervisors perform off-site risk 
UNITED STATES 

INTERNATIONAL MONETARY FUND 189

assessments and on-site examinations. 

Procedures direct supervisors to obtain, review, and evaluate the interest rate risk and other 

relevant policies and procedures (written or unwritten); board and asset liability committee 

and other management meeting minutes; current strategic plan; and internal riskmanagement reports during the on-site examination. Examination procedures also call for 

supervisors to assess board and senior management oversight; evaluate the quality of interest 

rate risk management; evaluate the internal controls and internal audit function; and evaluate 

the exposure to interest rate risk from an earnings and economic-value perspective. 

EC4 The supervisor requires banks to include appropriate scenarios into their stress testing 

programs to measure their vulnerability to loss under adverse interest rate movements. 

Description and 

findings re EC4 

FBAs have an expectation (rather than a requirement) that the bank’s or holding company’s 

management should include both scenario and sensitivity analysis, as an integral component 

of interest rate risk management. Where this expectation is not met, FBAs would need to 

resort to a determination that failure to include appropriate scenarios into a bank’s stress 

testing program would be an unsafe or unsound practice. If they made such a determination 

they could then require banks to include such scenarios and sensitivities. In practice the 

assessors saw numerous examples of banks providing scenarios into their supervisory 

programs at the request of the supervisor. 

In general, scenario analysis uses a model to predict a possible future outcome given an event 

or series of events, while sensitivity analysis tests a model’s parameters without relating those 

changes to an underlying event or real world outcome. 

When conducting scenario analyses, institutions are expected to assess a range of alternative 

future interest rate scenarios in evaluating interest rate risk exposure. This range is expected to

be sufficiently meaningful to fully identify basis risk, yield curve risk and the risks of embedded 

options. In many cases, static interest rate shocks consisting of parallel shifts in the yield curve 

of plus and minus 200 basis points may not be sufficient to adequately assess an institution’s 

interest rate risk exposure. As a result, institutions are expected to assess regularly interest rate 

risk exposures beyond typical industry conventions, including changes in rates of greater 

magnitude (e.g., up and down 300 and 400 basis points) across different tenors to reflect 

changing slopes and twists of the yield curve. Institutions are also expected to ensure their 

scenarios are severe but plausible in light of the existing level of rates and the interest rate 

cycle. 

Depending on an institution’s interest rate risk profile, stress scenarios were expected to 

include but not be limited to: 

 Instantaneous and significant changes in the level of interest rates (instantaneous rate 

shocks); 

 Substantial changes in rates over time (prolonged rate shocks); 

 Changes in the relationships between key market rates (i.e., basis risk); and 

 Changes in the slope and the shape of the yield curve (i.e., yield curve risk). 

Additional 

criteria 

AC1 The supervisor obtains from banks the results of their internal interest rate risk measurement 

systems, expressed in terms of the threat to economic value, including using a standardized 

interest rate shock on the banking book. 
UNITED STATES 

190 INTERNATIONAL MONETARY FUND

Description and 

findings re AC1 

All Banks 

Supervisors use the bank’s or holding company’s internal measures of risk, require sound riskmanagement practices, and use surveillance screens to identify those banks and holding 

companies that appear to be taking excessive risk. The agencies’ regulatory Call Reports 

include maturity and re-pricing information on each bank’s investment, loan and deposit 

portfolios. Banks and holding companies must also report the current fair value of their 

investment portfolios. 

During on-site examinations, supervisors review the bank’s or holding company’s internal 

interest rate risk exposure reports and also evaluate whether the interest rate risk 

measurement system, structure and capabilities are adequate to accurately assess the risk 

exposure, support the risk management process, and serve as a basis for internal limits and 

authorizations. 

Interest rate risk exposure estimates, whether linked to earnings or economic value, use some 

form of forecasts or scenarios of possible changes in market interest rates. In conducting this 

analysis, supervisors confirm that a bank’s or holding company’s interest rate risk 

measurement systems assess all material interest rate risk associated with its assets, liabilities, 

and off-balance-sheet positions over an appropriate range of interest rate scenarios; use 

generally accepted financial concepts and risk-measurement techniques; and have well 

documented assumptions and parameters. 

Banking Institutions with at least $50bn of Assets 

At the largest banks and holding companies, the agencies maintain on-site examination staff 

that receives more detailed information on those banks’ and holding companies’ portfolios 

and risk exposures. 

AC2 The supervisor assesses whether the internal capital measurement systems of banks 

adequately capture interest rate risk in the banking book. 

Description and 

findings re AC2 

The 1996 Joint Agency Policy Statement: Interest Rate Risk (footnote 3) states that the 

adequacy and effectiveness of a bank’s or holding company’s interest rate risk management 

process and the level of its interest rate exposure are critical factors in an agency’s evaluation 

of the bank’s and holding company’s capital adequacy. A bank or holding company with 

material weaknesses in its risk-management process or high levels of exposure relative to its 

capital will be directed by the appropriate agency to take corrective action. Depending on the 

facts and circumstances, such actions could include recommendations or directives to raise 

additional capital, strengthen management expertise, improve management information and 

measurement systems, reduce levels of exposure, or some combination thereof. 

Assessment of 

Principle 23

Compliant 

Comments The assessors find the U.S. compliant. The principles-based approach seems to be backed by 

adequate supervision proportionate to the size and complexity of the bank and the risk being 

run. The assessors saw a number of examples of supervisors applying the guidance they have. 

The assessors would, however, make some comments in the spirit of further strengthening the 

framework in line with evolving international best practices. 

The assessors found that the approach to interest rate risk was in marked contrast to other 

risks in the BCP assessment. There is no tiering for example (although supervisory practice 

seems proportionate to the risk) and the philosophy is firmly one of a principles based 

approach. No specific capital is being set aside against a change in interest rates, nor any 
UNITED STATES 

INTERNATIONAL MONETARY FUND 191

supervisory limits. The assessors certainly did see active supervisory engagement at the 

individual bank level (for example interventions on the appropriateness of modeling 

assumptions) and in horizontal reviews (such as one on the risk arising from a sudden rise in 

interest rates—so called Snap Back risk). There was also evidence of prescribed stress testing 

scenarios. 

The assessors are however left with a concern that given the stage of the economic cycle in 

the U.S., the inherent interest rate exposure is high and that there are particular 

concentrations in the small bank (community bank) sector. The risk of a principles based 

approach is its inconsistency across a sector and also with time and as such banks or a group 

of banks may be overly exposed. 

The assessors would recommend that the Agencies consider revising their 1996 guidance to 

include more quantitative guidelines. The advantage of guidelines would be: (i) to provide a 

signal as to what authorities regard as acceptable, as such they can have a powerful 

preventative effect; (ii) the time gap between going past a guideline and action is short and 

not as now where supervisors tend to first ask for a plan of rectification; (iii) they provide a 

useful reference point for offsite and continuous monitoring and can indicate when a bank 

might need to be reviewed by supervisory management. Clearly this could be done in line 

with any initiative that the Basel Committee Banking Supervision might take. 

Principle 24 Liquidity risk. The supervisor sets prudent and appropriate liquidity requirements (which can 

include either quantitative or qualitative requirements or both) for banks that reflect the 

liquidity needs of the bank. The supervisor determines that banks have a strategy that enables 

prudent management of liquidity risk and compliance with liquidity requirements. The 

strategy takes into account the bank’s risk profile as well as market and macroeconomic 

conditions and includes prudent policies and processes, consistent with the bank’s risk 

appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk 

over an appropriate set of time horizons. At least for internationally active banks, liquidity 

requirements are not lower than the applicable Basel standards. 

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to consistently observe prescribed liquidity 

requirements including thresholds by reference to which a bank is subject to supervisory 

action. At least for internationally active banks, the prescribed requirements are not lower 

than, and the supervisor uses a range of liquidity monitoring tools no less extensive than, 

those prescribed in the applicable Basel standards. 

Description and 

findings re EC1 

As with many aspects of the supervisory regime, the approach is tiered. In the case of liquidity 

risk. The safety and soundness statutes and supervisory guidance provide the legal basis for 

the imposition and enforcement of liquidity-risk management requirements by the U.S. FBAs.

See Table 24.1 
UNITED STATES 

192 INTERNATIONAL MONETARY FUND

Note: 

Banking Institutions with at least $10bn of Assets 

The U.S. FBAs are also in the process of implementing in the U.S. an LCR requirement consistent 

with the Basel III LCR (as modified). On 29 November 2013, the U.S. FBAs jointly published a 

proposed rule to implement an LCR requirement in the U.S. (proposed rule or proposed LCR). The 

proposed rule would apply to all internationally active banking organizations (depository 

institutions, Bank Holding Companies, and those Savings and Loan Holding Companies not 

substantially engaged in insurance underwriting and commercial activities, and to the 

consolidated insured depository institution subsidiaries of the foregoing with $10 billion or more 

in total consolidated assets). The proposed rule would also apply to nonbank financial 

companies supervised by the Federal Reserve that do not have significant insurance operations. 

Under the proposed rule, an institution would be required to hold minimum amounts of highquality liquid assets such as central bank reserves and certain government and corporate debt 

that can be converted easily and quickly into cash. 

High quality liquid assets are broken into three levels: level 1 liquid assets (such as central bank 

excess reserves), level 2A liquid assets (such as U.S. government-sponsored agency debt), and 

level 2B liquid assets (such as corporate debt of nonfinancial companies) that are liquid and 

readily marketable and can be converted easily and quickly into cash. 

Each institution would be required to hold high-quality, liquid assets in an amount equal to or 

greater than its projected cash outflows minus its projected cash inflows during a 30-day stress 

period. The proposed rule is generally consistent with the Basel III LCR standard, but is more 

stringent in several areas, including the range of assets that will qualify as high-quality liquid 

assets and the assumed rate of outflows of certain kinds of funding. In addition, the proposed 

transition period is shorter than that included in the BCBS standard. 

Banking Institutions with at least $50bn of Assets, but not internationally active 

The Federal Reserve also proposed in the same rulemaking to apply a less stringent version of 

the LCR (based on a 21-day stress scenario) to Bank Holding Companies and Savings and Loan 

Holding Companies that are not internationally active, but have $50 billion or more in total 
UNITED STATES 

INTERNATIONAL MONETARY FUND 193

consolidated assets.

EC2 The prescribed liquidity requirements reflect the liquidity risk profile of banks (including onand off-balance sheet risks) in the context of the markets and macroeconomic conditions in 

which they operate. 

Description and 

findings re EC2 

All banking institutions 

Under the Liquidity Risk Policy Statement, banks and Bank Holding Companies are expected 

to have a liquidity management process sufficient to meet their daily funding needs and cover 

both expected and unexpected deviations from normal operations. This includes 

comprehensive liquidity risk measurement and monitoring systems that are commensurate 

with the complexity and business activities of an institution. Banks and Bank Holding 

Companies are also expected to conduct stress tests regularly for a variety of institutionspecific and market-wide events across multiple time horizons and take remedial or mitigating 

actions to limit exposures, build up a liquidity buffer, and adjust liquidity positions to the 

institution’s risk tolerance taking into consideration the results of the stress tests. They are 

expected to perform cash flow projections that assess the liquidity risk of complex assets, 

liabilities and off-balance positions. 

The U.S. FBAs’ historical approach to supervising liquidity risk has been qualitative in nature – 

focusing on sound practices instead of specific quantitative standards and tests. In general, 

supervisors confirm that a regulated bank or holding company has a process in place for 

managing liquidity that is commensurate with the size and complexity of its operation and its 

overall risk profile. As noted above, the U.S. FBAs assess each bank and holding company’s 

liquidity as part of the Uniform Financial Institutions Rating System (“UFIRS”). The rating 

system directs that: 

“In general, funds management practices should ensure that an institution is able to 

maintain a level of liquidity sufficient to meet its financial obligations in a timely 

manner and to fulfill the legitimate banking needs of its community. Practices should 

reflect the ability of the institution to manage unplanned changes in funding sources, as 

well as react to changes in market conditions that affect the ability to quickly liquidate 

assets with minimal loss. In addition, funds management practices should ensure that 

liquidity is not maintained at a high cost, or through undue reliance on funding sources 

that may not be available in times of financial stress or adverse changes in market 

conditions.” 

The U.S. FBAs’ regulatory Call Reports collect information on each bank and holding 

company’s liability and deposit mix, including information on deposit maturities and re-pricing 

characteristics. These reports also capture the level of large deposits that may not be covered 

by FDIC deposit insurance, non-maturity deposits, non-deposit borrowings that may be credit 

sensitive, and off-balance-sheet commitments. Each agency uses these and other marketrelated data in various surveillance and monitoring tools to identify banks and holding 

companies that may have high potential liquidity-risk exposures. 

Banking Institutions with at least $50bn of Assets 

U.S. Bank Holding Companies are subject to the enhanced liquidity standards in Regulation YY 

must fulfill a number of requirements of the rule that are intended to ensure that these 

institutions are managing their liquidity risk and maintaining a liquidity position that reflects 

their liquidity risk profile in the market and macroeconomic conditions in which they operate. 

For example, they must regularly produce cash flow projections for flows arising from assets, 

liabilities, and off-balance sheet exposures over, at a minimum, short- and long-term time 

horizons. The cash flows must be reviewed regularly by senior management to ensure that the 
UNITED STATES 

194 INTERNATIONAL MONETARY FUND

liquidity risk of the company is within the liquidity risk tolerance established by the board of 

directors. In addition, when conducting the internal liquidity stress tests required under 

Regulation YY, companies subject to those requirements must take into consideration the 

balance sheet exposures, off-balance sheet exposures, size, risk profile, complexity, business 

lines, organizational structure, and other characteristics of the company. In addition, each 

liquidity stress test must include, at a minimum, a stress scenario reflecting adverse market 

conditions, a scenario reflecting idiosyncratic stress event, and a scenario reflecting combined 

market and idiosyncratic stress. The company must also incorporate additional liquidity stress 

scenarios as appropriate based on the financial condition, size, complexity, risk profile, scope 

of operations, or activities of the company. Under Regulation YY, a buffer of highly liquid 

assets must be held to cover 30 days of net outflows identified by the internal stress tests. 

Additionally, the Regulation YY liquidity requirements are a part of a set of enhanced 

prudential standards that increase in stringency based on the nature, scope, size, scale, 

concentration, interconnectedness, and mix of the activities of the institution being 

supervised. As a result, the supervisors expect a range of sound practices based on the 

business activities, objectives, and risk profile of the bank and holding company. Through the 

examination process, supervisors evaluate each bank and holding company’s process for 

managing liquidity risk to ensure that it is appropriate for the nature and scale of the bank or 

holding company’s business activities and commensurate with the bank or holding company’s 

liquidity risk arising from both on and off-balance-sheet activities. The operational context of 

the bank or holding company’s liquidity risk profile, including international liquidity flows, 

must also be monitored. 

Furthermore, banks must constantly monitor and update their daily funding needs by legal 

entities. Banks are also required to develop an adequate intercompany liquidity/funding 

reporting framework, such as funding source and usage by legal entities and the legal entities’ 

liquidity buffer. These will provide a roadmap to the single point of entry approach under 

DFA's Title II—FDIC resolution planning. 

The Federal Reserve collects monthly liquidity information that provides information on each 

firm’s unencumbered liquidity buffer and funding structure. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 

the whole company, Board of Directors or Senior Management. The liquidity buffer for the 

Intermediate Holding Company must be sufficient to meet the projected "net stressed cashflow need" over the 30-day planning horizon of the liquidity stress tests, taking into account 

the various scenarios required for those liquidity stress tests. The liquidity buffer for the U.S. 

Branches must be sufficient to meet the projected net stressed cash-flow need over only the 

first 14 days of the 30-day planning horizon. The liquidity buffer must be composed of 

unencumbered highly liquid assets. 

Globally Systemically Important Banks 

As part of its supervision, the Federal Reserve has collected detailed daily liquidity information 

from the globally systemically important institutions that include funding risks as well as 

liquidity buffers. 

Note: 

In addition, under the proposed LCR, banking organizations and other institutions subject to the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 195

rule would be required to hold a minimum amount of high-quality liquid assets to cover net 

outflows calculated using a standardized regulatory stress scenario, consistent with the Basel 

standard. The net outflows calculation considers both on-and-off balance sheet risks.

EC3 The supervisor determines that banks have a robust liquidity management framework that 

requires the banks to maintain sufficient liquidity to withstand a range of stress events, and 

includes appropriate policies and processes for managing liquidity risk that have been 

approved by the banks’ Boards. The supervisor also determines that these policies and 

processes provide a comprehensive bank-wide view of liquidity risk and are consistent with 

the banks’ risk profile and systemic importance 

Description and 

findings re EC3 

All banking institutions 

The Liquidity Risk Policy Statement establishes the supervisory expectation that banks and 

Bank Holding Companies have a comprehensive management process for identifying, 

measuring, monitoring, and controlling liquidity risk, which is integrated fully into the 

institution’s risk management process. Under the guidance, the board of directors of a bank or 

BHC is expected to ensure that an institution’s liquidity risk tolerance is established and 

communicated to all levels of management, and that they or a committee of the board 

oversee the establishment and approval of liquidity risk management strategies, policies and 

procedures. Senior management is expected to appropriately execute board-approved 

strategies, policies, and procedures for managing liquidity risk, including overseeing the 

development and implementation of appropriate risk measurement and reporting systems, 

liquidity buffers, contingency funding plans, and internal control infrastructure. In addition 

(see EC2 above) under the guidance, banks and Bank Holding Companies are expected to 

conduct liquidity stress tests and adjust their liquidity position taking into account the results 

of those tests. 

Supervisors also confirm that these policies and procedures are approved by the board of 

directors of the bank and holding company or an appropriate committee of the board, and 

reflect the objectives, risk tolerances and goals of the board of directors. 

Generally, while formal supervisory approval of a bank or holding company’s policies and 

procedures is not required, the policies and procedures are reviewed through the supervisory 

process. Deficiencies and recommendations to rectify the deficiencies are noted in the report 

of examination (or similar communications) and discussed with senior management and, if 

necessary, the board of directors. 

U.S. Banking Institutions with at least $50bn of Assets 

Regulation YY requires firms subject to the rule to have a robust and comprehensive liquidity 

risk management framework as provided by the rule. Under Regulation YY, the board of 

directors must establish the liquidity risk tolerance for the company. Senior management must 

establish and implement strategies, policies and procedures designed to manage effectively 

the liquidity risk of the company and determine whether the company is operating in 

accordance with those policies and procedures. Senior management must report regularly to 

the board of directors or the company’s risk committee regarding the liquidity risk profile and 

liquidity risk tolerance of the company, and the board of directors must regularly review the 

procedures and policies established by senior management and whether the company is 

operating in accordance with its established liquidity risk tolerance. 

Regulation YY requires that firms conduct internal liquidity stress tests and sets out how these 

should be done. Firms must hold liquid assets sufficient to cover net outflows over 30 days as 

identified by the stress tests. 
UNITED STATES 

196 INTERNATIONAL MONETARY FUND

Through a combination of on-going monitoring and an annual comprehensive liquidity 

assessment review (CLAR), supervisors confirm that banks and holding companies have 

documented strategies for managing liquidity risk and clear policies and procedures for 

limiting and controlling risk exposures. Strategies should identify primary sources for meeting 

daily operating cash outflows as well as seasonal and cyclical cash flow fluctuations. In 

addition, the bank’s and holding company’s strategies and policies and procedures should 

address alternative responses to various adverse business scenarios including, but not limited 

to, deterioration in the institution’s asset quality or capital adequacy. When necessary, policies, 

procedures, and limits should address liquidity separately for major currencies in which the 

bank and holding company conducts business. Policies and processes should take into 

account both specific legal entities and an enterprise-wide view. 

Regulation YY also provides that firms must conduct regular stress tests on cash-flow 

projections by identifying liquidity stress scenarios based on the company’s full set of 

activities, exposures and risks, both on and off-balance sheet, and by taking into account noncontractual sources of risks, such as reputational risks. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 

the whole company, Board of Directors or Senior Management. 

Note 

In addition, under the proposed LCR, banking organizations and other institutions subject to the 

rule would be required to implement and maintain appropriate policies and procedures and 

systems to enable them to exercise operational control over high-quality liquid assets to ensure 

that they are available to provide liquidity when needed, consistent with the Basel standard.

EC4 The supervisor determines that banks’ liquidity strategy, policies and processes establish an 

appropriate and properly controlled liquidity risk environment including: 

(a) clear articulation of an overall liquidity risk appetite that is appropriate for the banks’ 

business and their role in the financial system and that is approved by the banks’ 

Boards; 

(b) sound day-to-day, and where appropriate intraday, liquidity risk management 

practices; 

(c) effective information systems to enable active identification, aggregation, monitoring 

and control of liquidity risk exposures and funding needs (including active 

management of collateral positions) bank-wide; 

(d) adequate oversight by the banks’ Boards in ensuring that management effectively 

implements policies and processes for the management of liquidity risk in a manner 

consistent with the banks’ liquidity risk appetite; and 

(e) regular review by the banks’ Boards (at least annually) and appropriate adjustment of 

the banks’ strategy, policies and processes for the management of liquidity risk in the 

light of the banks’ changing risk profile and external developments in the markets and 

macroeconomic conditions in which they operate. 

Description and 

findings re EC4 

All banking institutions 

Under the Liquidity Risk Policy Statement, banks and Bank Holding Companies are expected 
UNITED STATES 

INTERNATIONAL MONETARY FUND 197

to have a comprehensive liquidity risk management process and liquidity risk tolerance 

established by the board of directors or its risk committee. Policies and procedures should 

limit and control risk exposures and appropriately reflect the risk tolerance, and clearly 

articulate a liquidity risk tolerance appropriate for the business strategy of the company. The 

board of directors (or a delegated committee thereof) is also expected to oversee the 

establishment and approval of liquidity management strategies policies and procedures, and 

review them at least annually. The board of directors is expected to ensure that it understands 

the nature of liquidity risks and periodically reviews information necessary to maintain this 

understanding, establishes lines of authority and responsibility for managing liquidity risk, and 

enforces senior management’s duties to monitor and control liquidity risks. In addition, banks 

and Bank Holding Companies are expected to clearly identify the individual or committees 

responsible for implementing and making liquidity risk decisions. 

Institutions are expected to have the ability to calculate all of their collateral positions in a 

timely manner, including the value of assets pledged and assets available to be pledged, and 

the collateral should be monitored. Liquidity risk reports should provide aggregate 

information with sufficient supporting detail to enable management to assess the sensitivity of 

the institution to changes in market conditions, its own financial performance, and other risk 

factors. Institutions are expected to actively monitor and control liquidity risk exposures and 

funding needs within and across currencies, legal entities and business lines. Also, institutions 

with material payment, settlement, and clearing activities are expected to manage actively 

their intraday liquidity positions and risks to meet payment and settlement obligations on a 

timely basis under normal and stressed conditions. 

Banking Institutions with at least $50bn of Assets 

Regulation YY requires a robust and comprehensive liquidity risk management framework that 

requires the board of directors to establish a liquidity tolerance for the company and requires 

policies and procedures to conform to that liquidity risk tolerance. The board of directors must 

regularly review how liquidity risk is being managed, within the liquidity risk tolerance that is 

set. Regulation YY also requires establishment of a liquidity risk management review function 

that is independent of the management functions that execute funding. This review function 

must regularly review and evaluate the adequacy and effectiveness of the company’s liquidity 

risk management processes, including stress testing, and whether the liquidity risk 

management function complies with applicable law and sound business practices. This review 

function must report material risk management issues to the board of directors or its risk 

committee. Regulation YY also requires monitoring sources of liquidity risk and establishing 

limits on liquidity risks, including with regard to concentration and maturity mismatch risks. A 

company must also establish and maintain policies and procedures to monitor assets that 

have been, or are available to be, pledged as collateral, including calculating collateral 

positions regularly and monitoring shifts in the company’s funding position. 

With regard to intraday risk, Regulation YY provides that procedures must be established and 

maintained for monitoring intraday liquidity risk exposure of the company. These procedures 

must address how management will monitor and measure expected daily inflows and 

outflows, manage and transfer collateral for intraday credit, identify and prioritize obligations 

to meet them as needed, manage the issuance of credit, and consider collateral and liquidity 

needed to meet payment system obligations. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 
UNITED STATES 

198 INTERNATIONAL MONETARY FUND

the whole company, Board of Directors or Senior Management. 

EC5 The supervisor requires banks to establish, and regularly review, funding strategies and 

policies and processes for the on-going measurement and monitoring of funding 

requirements and the effective management of funding risk. The policies and processes 

include consideration of how other risks (e.g. credit, market, operational and reputation risk) 

may impact the bank’s overall liquidity strategy, and include: 

(a) an analysis of funding requirements under alternative scenarios; 

(b) the maintenance of a cushion of high quality, unencumbered, liquid assets that can be 

used, without impediment, to obtain funding in times of stress; 

(c) diversification in the sources (including counterparties, instruments, currencies and 

markets) and tenor of funding, and regular review of concentration limits; 

(d) regular efforts to establish and maintain relationships with liability holders; and 

(e) regular assessment of the capacity to sell assets. 

Description and 

findings re EC5 

All Banks 

Under the Liquidity Risk Policy Statement, banks and Bank Holding Companies are expected 

to establish a funding strategy that provides effective diversification in the sources and tenor 

of funding. Institutions should maintain an on-going presence in its chosen funding markets 

and strong relationships with funds providers to promote effective diversification of funding 

sources. Institutions are expected to regularly gauge capacity to raise funds quickly from each 

source and to diversify available funding sources over different horizons and by different types 

of sources. Management is expected to ensure that market access is being actively managed, 

monitored, and tested. Institutions should also, according to the guidance, identify alternative 

sources of funding to be accessed during liquidity shocks. In addition, under the Liquidity Risk 

Policy Statement, banks and Bank Holding Companies are expected to maintain a cushion of 

highly liquid assets available to be sold or pledged to obtain funds in a range of stress 

scenarios. 

All institutions, regardless of size and complexity, are also expected to have a formal 

contingency funding plan that sets out the strategies for addressing liquidity shortfalls in 

emergency situations, establishing clear lines of responsibility, and articulating clear 

implementation and escalation procedures. The contingency funding plan should be regularly 

tested and should identify stress events, assess levels of severity and timing, assess funding 

sources and needs, identify potential funding sources, establish liquidity event management 

processes and establish a monitoring framework for contingent events. It is expected that an 

institution have effective strategies for communication with counterparties, credit rating 

agencies and other stakeholders when liquidity problems arise. 

The Liquidity Risk Policy Statement sets out that liquid assets are an important source of both 

primary (operating liquidity) and secondary (contingent liquidity) funding at many institutions, 

noting that these assets must be unencumbered to properly serve a liquidity function. 

Supervisors view the availability of a cushion of highly liquid assets that can be sold or 

pledged without legal, regulatory, or operational impediments (i.e., unencumbered) to obtain 

funds in a range of stress scenarios as a critical component of an institution’s ability to 

effectively respond to potential liquidity stress. 

Institutions should establish a funding strategy with effective diversification in the sources and 

tenor of funding. An institution should regularly gauge its capacity to raise funds quickly from 
UNITED STATES 

INTERNATIONAL MONETARY FUND 199

each source. It should identify the main factors that affect its ability to raise funds and monitor 

those factors closely to ensure that estimates of fund raising capacity remain valid. 

Institutions should also maintain an on-going presence in their chosen funding markets and 

strong relationships with funds providers to promote effective diversification of funding 

sources. 

Supervisors expect banks and holding companies to have policies and processes to measure 

and monitor liquidity needs appropriate to the bank and holding company’s risk profile; the 

agencies do not mandate or consider specific implicit or explicit scenarios in their assessment 

of the liquidity position of a bank and holding company given the diversity of the U.S. banking 

industry. Rather, supervisors review the robustness of the scenario analyses and stress tests 

conducted by banks and holding companies based on the size, complexity, and risk profile of 

the institution. The resiliency of a bank’s or holding company’s funding liquidity to firmspecific and market-wide stress conditions is also assessed through the supervisory process, 

which includes off-site monitoring and targeted examinations. 

Supervisors ensure banks and holding companies conduct stress testing or scenario analysis 

of their liquidity position. Supervisors evaluate whether the stress tests or scenario analyses 

include an assessment of the potential impact of plausible stress events that are bank- and 

holding company-specific and/or externally-driven events. Also, supervisors determine 

whether events are stressed under different levels of severity, funding needs are quantified, 

funding sources are identified, and management processes, reporting, and external 

communication are addressed throughout a stress event. During the stress testing process, 

effective liquidity managers ensure that they choose potential adverse liquidity scenarios that 

entail appropriate degrees of severity; maintain an appropriate level of diversified funding 

sources; and model cash flows consistent with each level of stress. 

In evaluating the adequacy of a bank’s and holding company’s liquidity position, supervisors 

consider the current level and prospective sources of liquidity compared with funding needs, 

as well as the adequacy of funds-management practices relative to the bank’s and holding 

company’s size, complexity, and risk profile. In general, supervisors confirm that fundsmanagement practices ensure that a bank or holding company is able to maintain a level of 

liquidity sufficient to meet its financial obligations in a timely manner and to fulfill the 

legitimate banking needs of its community. Practices should reflect the ability of the bank or 

holding company to manage unplanned changes in funding sources, as well as react to 

changes in market conditions that affect the firm’s ability to quickly liquidate assets with 

minimal loss. In addition, supervisors evaluate whether funds-management practices limit a 

bank or holding company’s reliance on funding sources that may not be available in times of 

financial stress or in the face of adverse changes in market conditions. 

Banking Institutions with at least $50bn of Assets 

Regulation YY requires U.S. Bank Holding Companies to establish and maintain a contingency 

funding plan. The contingency funding plan must be commensurate with the company’s 

capital structure, risk profile, complexity, activities, size, and established liquidity risk tolerance. 

The company must update the contingency funding plan at least annually, and when changes 

to market and idiosyncratic conditions warrant. The contingency funding plan should include 

the identification of liquidity stress events and their potential impact on the company’s 

liquidity, the circumstances under which the plan would be implemented, and identification of 

alternative funding sources that may be used during liquidity stress events. The plan must also 

include an event management process that sets out the company’s procedures for managing 

liquidity during identified liquidity stress events. Additionally, the plan must include 

procedures for monitoring emerging liquidity stress events. The company must also test the 
UNITED STATES 

200 INTERNATIONAL MONETARY FUND

components of the plan regularly, including its operational elements, and the methods the 

company will use to access alternative funding sources. 

Regulation YY also requires U.S. Bank Holding Companies to hold a buffer of highly liquid 

assets sufficient to cover net outflows under the company’s liquidity stress tests using a 30-

day planning horizon. Highly liquid assets may be cash, U.S. Treasuries, or any other security 

that the company demonstrates to the satisfaction of the Federal Reserve meets criteria 

specified under the rule to be considered a highly liquid asset (typically one traded in a deep 

and active market that has been purchased by investors during crises as a “flight to quality”). 

Assets in the buffer must be free of regulatory and contractual restrictions and not have been 

pledged to secure credit. The buffer also must be diversified and not include significant 

concentrations of assets by issuer, business sector, region or other factor related to the risk of 

the company, except with respect to U.S. Treasuries and securities issued by U.S. governmentsponsored entities. 

In addition, assets used as cash flow sources during a liquidity stress test planning horizon 

must be diversified. The fair value of the asset must be discounted to reflect any credit risk 

and market volatility of the asset. 

Regulation YY liquidity requirements also recognize the importance of unencumbered assets 

as a source of liquidity. It requires a liquidity buffer that is composed of unencumbered highly 

liquid assets sufficient to meet projected net cash outflows for 30 days over the range of 

liquidity stress scenarios used in the internal stress testing. 

Regulation YY also requires that the buffer of unencumbered highly liquid assets be 

sufficiently diversified by instrument type, counterparty, geographic market, and other 

liquidity risk identifiers for institutions subject to the enhanced liquidity requirements. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 

the whole company, Board of Directors or Senior Management. The liquidity buffer for the 

Intermediate Holding Company must be sufficient to meet the projected "net stressed cashflow need" over the 30-day planning horizon of the liquidity stress tests, taking into account 

the various scenarios required for those liquidity stress tests. The liquidity buffer for the U.S. 

Branches must be sufficient to meet the projected net stressed cash-flow need over only the 

first 14 days of the 30-day planning horizon. The liquidity buffer must be composed of 

unencumbered highly liquid assets. 

Note 

As discussed above, the proposed LCR would also require institutions to maintain a buffer of 

high-quality liquid assets to cover net outflows as calculated using the standardized stress test in 

the proposed rule. In addition, it would require that assets in the buffer be diversified and that an 

institution have the operational capacity to liquidate the assets during a crisis by implementing 

and maintaining appropriate procedures and systems for liquidation and by periodically testing 

access to the market through actual monetization of a sample of the assets held in the buffer. 

Institutions would have to hold and report to regulators a measurable amount of unencumbered 

assets. The proposed LCR requires a covered company to demonstrate that it can periodically 

liquidate a representative sample of high-quality liquid assets in order to demonstrate that they 

are under management control and liquid and readily marketable. Supervisors anticipate that 

they will propose regulatory reporting requirements, which will provide supervisors with 
UNITED STATES 

INTERNATIONAL MONETARY FUND 201

additional data related to liquidity risk management. 

EC6 The supervisor determines that banks have robust liquidity contingency funding plans to 

handle liquidity problems. The supervisor determines that the bank’s contingency funding 

plan is formally articulated, adequately documented and sets out the bank’s strategy for 

addressing liquidity shortfalls in a range of stress environments without placing reliance on 

lender of last resort support. The supervisor also determines that the bank’s contingency 

funding plan establishes clear lines of responsibility, includes clear communication plans 

(including communication with the supervisor) and is regularly tested and updated to ensure 

it is operationally robust. The supervisor assesses whether, in the light of the bank’s risk 

profile and systemic importance, the bank’s contingency funding plan is feasible and requires 

the bank to address any deficiencies. 

Description and 

findings re EC6 

All Banks 

The Liquidity Risk Policy Statement sets out a set of supervisory expectations for contingency 

plans that all banks and Bank Holding Companies are expected to establish. 

Supervisors expect banks and holding companies to have an appropriate contingency funding 

plan in place. Supervisors review and assess a bank’s or holding company’s Contingency 

Funding Plan during examinations. These assessments consider whether the Contingency 

Funding Plan includes policies, procedures, and action plans for responding to contingent 

liquidity events, including changes in the funding markets or the bank’s and holding 

company’s market access (e.g., access to commercial paper markets) caused by either firmspecific or market-wide events. Action plans are expected to include the bank’s and holding 

company’s plans for dealing with retail customers and large funds providers, the press, and 

the bank’s and holding company’s supervisors. Supervisors evaluate if the Contingency 

Funding Plan is commensurate with the complexity, risk profile, and scope of operations of the 

bank and holding company and aligned with its business and risk-management objectives, 

strategies, and tactics. Supervisors confirm that senior management periodically reviews the 

Contingency Funding Plan as well as the bank’s and holding company’s liquidity-risk 

management strategies, policies, and procedures to ensure that they remain appropriate and 

sound. Supervisors evaluate if management also coordinates the Contingency Funding Plan 

with the bank’s and holding company’s liquidity risk management efforts for disaster, 

contingency, and strategic planning. The Contingency Funding Plan should also provide a 

reasonable timeframe to liquidate the liquidity buffer and address intercompany transactions. 

As part of the consideration of potential firm-specific events, a bank or holding company is 

also expected to consider the impact of potential declines in regulatory capital that would 

cause the bank or the BHC’s subsidiary depository institution(s) to be less than “well 

capitalized” for purposes of the Prompt Corrective Action (PCA) regulatory scheme. For 

example, a bank that relies upon brokered deposits should also incorporate PCA-related 

downgrade triggers into its Contingency Funding Plan because a change in PCA status could 

have a material bearing on the availability of this funding source. As outlined in the Joint 

Agency Advisory on Brokered and Rate Sensitive Deposits (SR0114a1), banks that are 

considered “adequately capitalized” must receive a waiver from the FDIC before they can 

accept, renew, or roll-over any brokered deposit. In addition, banks that are not “well 

capitalized” are subject to interest rate restrictions paid on deposits. 

In addition, when a bank becomes undercapitalized for purposes of PCA, limits are placed on 

its asset growth and its ability to acquire an interest in another bank. Additional limitations are 

placed on the bank if it becomes significantly or critically undercapitalized or if it fails to carry 

out its approved capital restoration plan. Critically undercapitalized banks generally may not 
UNITED STATES 

202 INTERNATIONAL MONETARY FUND

borrow from the discount window. 

Banking Institutions with at least $50bn of Assets 

Regulation YY requires U.S. Bank Holding Companies subject to the rule and covered FBOs 

with more than $50 billion in total U.S. assets to establish comprehensive and robust 

contingency funding plans. This includes (§252.34) clearly setting out the roles in relation to 

the contingency funding plan. 

Note 

The proposed LCR prescribes a process for reporting when a covered company falls below the 

minimum liquidity coverage ratio.

EC7 The supervisor requires banks to include a variety of short-term and protracted bank-specific 

and market-wide liquidity stress scenarios (individually and in combination), using 

conservative and regularly reviewed assumptions, into their stress testing programs for risk 

management purposes. The supervisor determines that the results of the stress tests are used 

by the bank to adjust its liquidity risk management strategies, policies and positions and to 

develop effective contingency funding plans. 

Description and 

findings re EC7 

All Banks 

Under the Liquidity Risk Policy Statement, banks and Bank Holding Companies are expected 

to conduct stress tests regularly for a variety of institution-specific and market-wide events 

across multiple time horizons and take remedial or mitigating actions to limit exposures, build 

up a liquidity buffer, and adjust liquidity positions to the institution’s risk tolerance taking into 

consideration the results of the stress tests. The results of the stress test are expected to play a 

key role in shaping an institution’s contingency planning. 

Supervisors view stress testing as a critical component of liquidity risk management and firms 

should have a liquidity stress testing framework that assesses the potential impacts of stressed 

scenarios and environments, and clearly identifies and quantifies the liquidity risk 

vulnerabilities of the firm. The set of scenarios within the stress testing framework should 

capture the vulnerabilities of the firm. The scenarios should assess the impacts to the firm 

across a range of severities, including highly severe and less likely but plausible scenarios. 

The Liquidity Risk Policy Statement emphasizes, among other things, that institutions should 

conduct stress tests. For example, the size of the cushion of high-quality liquid assets should 

be supported by estimates of liquidity needs performed under an institution’s stress testing. 

Banking Institutions with at least $50bn of Assets 

Regulation YY requires U.S. Bank Holding Companies to conduct internal liquidity stress tests 

at least monthly. The stress tests must take into consideration various aspects of the company 

and its activities and there must be policies and procedures governing the liquidity stress 

testing practices, methodologies, and assumptions that provide for the incorporation of the 

results of liquidity stress tests into future stress testing and for the enhancement of the stress 

testing practices over time. In addition, each liquidity stress test must include, at a minimum, a 

stress scenario reflecting adverse market conditions, a scenario reflecting idiosyncratic stress 

events, and a scenario reflecting combined market and idiosyncratic stress. The company must 

also incorporate additional liquidity stress scenarios as appropriate based on the financial 

condition, size, complexity, risk profile, scope of operations, or activities of the company. The 

company must also establish controls and oversight that ensure that each liquidity stress test 

appropriately incorporates conservative assumptions with respect to the stress scenarios and 

other elements of the stress test process, taking into consideration the capital structure, risk 
UNITED STATES 

INTERNATIONAL MONETARY FUND 203

profile, complexity, activities, size, business lines, legal entity or jurisdiction, and other relevant 

factors of the company. The results of the stress tests are used to determine the size of the 

buffer of highly liquid assets required by Regulation YY and results of the stress test must be 

incorporated into the contingency funding plan required by the rule. 

Regulation YY also includes requirements for regular stress tests on cash-flow projections by 

identifying liquidity stress scenarios based on the company’s full set of activities, exposures 

and risks, both on and off-balance sheet, and by taking into account non-contractual sources 

of risks, such as reputational risks. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 

the whole company, Board of Directors or Senior Management. 

EC8 The supervisor identifies those banks carrying out significant foreign currency liquidity 

transformation. Where a bank’s foreign currency business is significant, or the bank has 

significant exposure in a given currency, the supervisor requires the bank to undertake 

separate analysis of its strategy and monitor its liquidity needs separately for each such 

significant currency. This includes the use of stress testing to determine the appropriateness 

of mismatches in that currency and, where appropriate, the setting and regular review of 

limits on the size of its cash flow mismatches for foreign currencies in aggregate and for each 

significant currency individually. In such cases, the supervisor also monitors the bank’s 

liquidity needs in each significant currency, and evaluates the bank’s ability to transfer 

liquidity from one currency to another across jurisdictions and legal entities. 

Description and 

findings re EC8 

All Banks

Supervisors expect banks and holding companies to have a system in place to measure, 

monitor, and control the liquidity positions for each major currency in which business is 

conducted. The treatment of foreign currencies in a bank’s or holding company’s internal 

liquidity assessment is largely determined by the bank or holding company. Currency 

mismatches are reviewed during the examination process. Banks and holding companies are 

expected to be able to manage, monitor, and control their currency exposures. The 

assumptions regarding currency convertibility are left to each individual bank and holding 

company to determine. Supervisors review the reasonableness of these assumptions, under 

both normal and stressed conditions, and supporting documentation. Under the Interagency 

Country Exposure Review Committee, the supervisors review countries in default to provide an 

assessment of the degree of transfer risk that is inherent in the cross-border and crosscurrency exposures of U.S. banks and, if applicable, determine minimum allocated transfer risk 

reserves. Supervisors also evaluate cross-border concentrations. 

Banking Institutions with at least $50bn of Assets 

Regulation YY does not prescribe steps for addressing foreign currency liquidity 

transformation, but the Federal Reserve explained its expectations with respect to foreign 

currency mismatches in the preamble to the final rule. The currency matching of projected 

cash inflows and outflows is an important aspect of liquidity risk that companies subject to the 

rule should account for in their stress tests and the risks associated with currency mismatches 

should be incorporated in determining the liquidity buffer. When determining appropriate 

haircuts for buffer assets, currency mismatches should be considered as well as potential 

frictions associated with currency conversions in certain stress scenarios. Regulation YY does 

not disqualify foreign-currency denominated assets from inclusion in the buffer of highly 
UNITED STATES 

204 INTERNATIONAL MONETARY FUND

liquid assets. However, currency matching of projected cash inflows and outflows is an 

important aspect of liquidity risk management that is expected to be monitored on a regular 

basis and accounted for in the composition of a U.S. Bank Holding Companies or FBO’s 

liquidity buffer for its U.S. operations under the rule. 

Additional 

criteria 

AC1 The supervisor determines that banks’ levels of encumbered balance-sheet assets are 

managed within acceptable limits to mitigate the risks posed by excessive levels of 

encumbrance in terms of the impact on the banks’ cost of funding and the implications for 

the sustainability of their long-term liquidity position. The supervisor requires banks to 

commit to adequate disclosure and to set appropriate limits to mitigate identified risks. 

Description and 

findings re AC1 

All Banks 

Under the Liquidity Risk Policy Statement, institutions are expected to establish appropriate 

limits to mitigate their liquidity risks, including ensuring sufficient unencumbered liquidity 

resources. Institutions are expected to establish processes to provide to senior management 

and the board of directors a clear understanding of the institution’s liquidity risk exposure, 

compliance with risk limits, consistency between management’s strategies and tactics, and 

consistency between these strategies and the board's expressed risk tolerance. 

Currently, firms are required to disclose pledged securities to total securities in regulatory 

reports both at the bank and at the holding company, these reports are publicly available. 

The Liquidity Risk Policy Statement specifically discusses holding liquid assets as a source of 

primary and secondary funding, noting that these assets must be unencumbered to properly 

serve a liquidity function. 

Banking Institutions with at least $50bn of Assets 

Under Regulation YY, U.S. Bank Holding Companies must establish limits on liquidity risk, 

including limits on: (i) concentrations in sources of funding by instrument type, single 

counterparty, counterparty type, secured and unsecured funding, and as applicable, other 

forms of liquidity risk; (ii) the amount of liabilities that mature within various time horizons; 

and (iii) off-balance sheet exposures and other exposures that could create funding needs 

during liquidity stress events. Each limit must be consistent with the established liquidity risk 

tolerance for the company and must reflect the capital structure, risk profile, complexity, 

activities, and size of the company. Senior management must review the company’s 

compliance with the limits at least quarterly, or more often as conditions warrant. 

Regulation YY liquidity requirements also recognize the importance of unencumbered assets 

as a source of liquidity. A liquidity buffer must be composed of unencumbered highly liquid 

assets sufficient to meet projected net cash outflows for 30 days over the range of liquidity 

stress scenarios used in the internal stress testing. 

FBOs with Combined U.S. Assets of at least $50bn 

Regulation YY also applies to FBOs with Combined U.S. Assets of at least $50bn. The 

requirements are similar to those for U.S. Banking Institutions except that the requirements 

are placed on the U.S. Operations, U.S. Chief Risk Officer and U.S. Risk Committee rather than 

the whole company, Board of Directors or Senior Management. In terms of liquidity buffer 

requirements, the FBO must maintain in the U.S. separate liquidity buffers for its Intermediate 

Holding Company and its U.S. Branches. The liquidity buffer for the Intermediate Holding 

Company must be sufficient to meet the projected "net stressed cash-flow need" over the 30-
UNITED STATES 

INTERNATIONAL MONETARY FUND 205

day planning horizon of the liquidity stress tests, taking into account the various scenarios 

required for those liquidity stress tests. The liquidity buffer for the U.S. Branches must be 

sufficient to meet the projected net stressed cash-flow need over only the first 14 days of the 

30-day planning horizon. The liquidity buffer must be composed of unencumbered highly 

liquid assets. 

Once the LCR is finalized, the U.S. agencies anticipate proposing public reporting 

requirements consistent with the liquidity coverage ratio disclosure standards issues by the 

Basel Committee on Banking Supervision. The Enhanced Disclosure Task Force (EDTF) has 

provided recommendations for enhancing risk disclosures including a recommendation that 

firms provide a summary of encumbered and unencumbered assets. The Federal Reserve 

supports the work of the EDTF and has communicated its support of the EDTF's principles and 

recommendations to its supervised firms. 

Lastly, the proposed LCR would require certain institutions to hold a measurable amount of 

unencumbered assets, and the U.S. FBAs would collect additional data on those 

unencumbered assets. 

Assessment of 

Principle 24

Compliant 

Comments The Liquidity Risk Regime for banks below $50bn of Assets is quite high level, but the 

assessors did see numerous examples of supervisory action in support of the overall principle. 

Current levels of reporting for these banks (for example in respect of encumbered assets) are 

inadequate with only one line in the Call Report. The Authorities recognize this deficiency and 

have proposed a greater level of reporting depth as part of the implementation of the 

Liquidity Coverage Ratio. The assessors did not see evidence of encumbrance being a 

particular concern. 

For Banking Institutions with at least $50bn of Assets and indeed beyond that level those of 

Global Systemic Importance, the regime (mostly in Regulation YY) is comprehensive and 

robust. 

For example, the Federal Reserve has been conducting coordinated horizontal examinations of 

liquidity risk across large bank holding companies. For the largest firms, an annual 

Comprehensive Liquidity Assessment and Review (CLAR) have been conducted. A separate, 

tailored horizontal assessment has also been conducted for other large firms that are subject 

to the enhanced liquidity prudential standards under Regulation YY. These horizontal 

assessments are informed and augmented by firm-specific monitoring conducted by 

dedicated large bank supervisory examination teams. During these horizontal reviews, staff 

evaluated the following: 

 The firms’ quantitative liquidity position including its holding of unencumbered highly 

liquid assets and its structural funding profile, 

 Liquidity risk governance, 

 Liquidity risk management policies and procedures, 

 Liquidity risk limits, monitoring and escalation procedures, 

 Liquidity risk measurement and monitoring including cash flow projections, collateral 

location and encumbrance, currency, legal entity and intraday exposures, 

 The independence of liquidity risk oversight, 

 Liquidity stress test frameworks, including assumptions, production frequency, 
UNITED STATES 

206 INTERNATIONAL MONETARY FUND

outcomes and governance, and 

 The adequacy and suitability of contingency funding plans. 

As a result of these horizontal assessments and other supervisory work, over one hundred 

Matters Requiring Attention (MRAs) were issued to improve liquidity risk management at the 

firms. Issues included: deficiencies in the stress-modeling framework, modeling of over-thecounter derivative collateral flows, limits for secured funding activities, inclusion of 

appropriately calibrated quantitative early warning indicators tailored to the firm's risk profile, 

updated contingency funding plans, contingent liquidity event and establishing guidelines 

and limits on buffer composition to avoid undue concentrations. 

Further the regime is supported by extensive reporting—some of which, for the large banks, is 

daily. Industry sources however did point out that small differences of interpretation between 

the agencies were creating implementation challenges for the LCR. 

Principle 25 Operational risk. The supervisor determines that banks have an adequate operational risk 

management framework that takes into account their risk appetite, risk profile and market and 

macroeconomic conditions. This includes prudent policies and processes to identify, assess, 

evaluate, monitor, report and control or mitigate operational risk82 on a timely basis. 

Essential criteria 

EC1 Law, regulations or the supervisor require banks to have appropriate operational risk 

management strategies, policies and processes to identify, assess, evaluate, monitor, report 

and control or mitigate operational risk. The supervisor determines that the bank’s strategy, 

policies and processes are consistent with the bank’s risk profile, systemic importance, risk 

appetite and capital strength, take into account market and macroeconomic conditions, and 

address all major aspects of operational risk prevalent in the businesses of the bank on a 

bank-wide basis (including periods when operational risk could increase).

Description and 

findings re EC1 

As with many aspects of the supervisory regime, the approach is tiered in the case of 

operational risk. The safety and soundness statutes and supervisory guidance provide the 

legal basis for the imposition and enforcement of these requirements by the U.S. FBAs. See 

Table 25.1.

 

82 The Committee has defined operational risk as the risk of loss resulting from inadequate or failed internal 

processes, people and systems or from external events. The definition includes legal risk but excludes strategic and 

reputational risk. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 207

All Banks 

Supervisors expect a banking organization to implement an appropriate risk-management 

program, corresponding to the size and the nature and complexity of its structure and 

products, and to ensure compliance with all consumer protection laws and regulations. 

The agencies have identified operational risk as one of the risk categories inherent in a 

banking organization’s activities and confirm that a banking organization has riskmanagement policies and processes to identify, assess, mitigate, and monitor operational risk. 

The agencies use on-going supervision techniques, including on-site and off-site examination 

procedures and surveillance processes, to evaluate the adequacy of a banking organization’s 

operational risk-management policies and processes in the context of its size, nature, and 

complexity of operations and activities, and considering the external environmental and 

market factors in which it operates. The supervision process includes an identification and 

evaluation of a banking organization’s critical and/or key operational risks and an evaluation 

of associated risk-management policies and processes, including the banking organization’s 

periodic re-evaluation of operational risk exposure in light of changes in its activities and risk 

profile and developments in external markets and the environment. Supervisors also review 

how a banking organization addresses operational risks in its capital planning process. There 

is no standardized capital charge however. 

Supervisory assessment of a banking organization’s risk-management processes and practices 

are largely captured in the agencies’ Uniform Financial Institutions Rating System (UFIRS) that 

evaluates each bank’s capital, asset quality, management, earnings, liquidity, and sensitivity to 

market risk. Risk management is found in all of the ratings. The agencies also consider the risk 

management practices captured in the Uniform Rating System for Information Technology 

(URSIT) and the Uniform Interagency Trust Rating System (UITRS). The agencies have various 

internal risk-assessment systems that they use to evaluate the adequacy of a banking 

organization’s risk-management processes. For example, OCC supervisors use a Risk 

Assessment System to evaluate the quantity of risk, the quality of risk management, the level 

of supervisory concern (measured as aggregate risk) and the direction of risk across various 

categories of risk, including transaction/operational risk. 
UNITED STATES 

208 INTERNATIONAL MONETARY FUND

In addition, a banking organization is encouraged to manage operational risk consistent with 

the principles outlined in the BCBS’s Principles for the Sound Management of Operational Risk. 

Supervisors also expect a banking organization to implement an appropriate riskmanagement program, again corresponding to its size and the nature and complexity of its 

structure and products, to ensure compliance with all consumer protection laws and 

regulations. 

The U.S. FBAs have also issued supervisory guidance on various aspects of operational risk 

management, including internal controls, information technology, outsourcing of financial 

services, payment systems, audit, business continuity planning, compliance, insurance, and 

fiduciary operations. In all cases, risk-management practices are expected to be 

commensurate with the size, complexity, and risk profile of the entity. 

Banking Institutions with $250bn or more in consolidated total assets or $10bn or more 

in consolidated total on-balance sheet foreign exposure (Advanced Approach) 

Risk-based capital rules effective 1 January 2014 for advanced approaches banks, establish an 

integrated regulatory capital framework that addresses shortcomings in capital requirements. 

The rules implement in the U.S. the Basel III regulatory capital reforms from the Basel 

Committee on Banking Supervision and certain changes required by the DFA. In addition to 

the credit and market risk requirements, the rule imposes specific regulatory requirements for 

operational risk, as well as specific qualification requirements, including the development of 

operational-risk management processes, operational-risk data and assessment systems, and 

operational-risk quantification systems for estimating operational risk capital exposure and 

the associated capital charge. While section 171 of the DFA requires the agencies to establish 

minimum risk-based and leverage capital requirements subject to certain limitations, the 

agencies have general authority to establish capital requirements under other laws and 

regulations, including under the National Bank Act, Federal Reserve Act, FDI Act, BHC Act, 

International Lending Supervision Act, and Home Owners Loan Act. The operational risk 

aspects of the risk-based capital rules parallel the U.S. FBAs’ rules implementing the advanced 

approaches published in December 2007. 

In addition, in June 2011, the U.S. FBAs issued “Interagency Guidance on the Advanced 

Measurement Approaches for Operational Risk,” which discusses certain common 

implementation issues, challenges, and key considerations for addressing these challenges in 

order to implement a satisfactory advanced approaches framework. Also, in June 2014 the U.S. 

FBAs issued “Supervisory Guidance for Data, Modeling, and Model Risk Management Under 

the Operational Risk Advanced Measurement Approaches,” which addresses supervisory 

expectations for data, modeling, and model risk management under the operational risk 

advanced measurement approaches (AMA) to calculate a regulated banking organization’s 

operational risk. The supervisory evaluation of a banking organization’s capital adequacy may 

consider, among other things, whether a banking organization has significant exposure due to 

operational risks. Advanced approaches banking organizations are subject to an explicit 

operational risk capital requirement. For the 8 bank holding companies that have received 

approval to exit parallel run, the operational risk capital requirement as a percentage of 

common equity tier 1 capital on a weighted average basis is 16.7%, based on data from public 

reports as of the second quarter of 2014. 

Supervisors have increased their oversight of banks’ and holding companies’ management of 

operational risk, and have adopted final rules imposing an explicit operational-risk capital 

requirement. This has been in the wake of recent, highly visible breakdowns in internal 

controls and corporate governance that have exposed banks and holding companies to large 

losses. These facts combined with several key factors, including greater use of technology; 
UNITED STATES 

INTERNATIONAL MONETARY FUND 209

proliferation of new and highly complex products; growth of e-banking transactions and 

related business applications; large scale acquisitions, mergers, and consolidations; greater use 

of outsourcing arrangements; rapid and significant changes in the regulatory and operating 

environments; and evolving and increasingly sophisticated cyber threats have contributed to 

increased operational risk exposures at banks and holding companies.

EC2 The supervisor requires banks’ strategies, policies and processes for the management of 

operational risk (including the banks’ risk appetite for operational risk) to be approved and 

regularly reviewed by the banks’ Boards. The supervisor also requires that the Board oversees 

management in ensuring that these policies and processes are implemented effectively.

Description and 

findings re EC2 

All Banks 

The U.S. Federal Banking Agencies take the view that Boards have ultimate accountability for 

the level of risk taken by their banking organization. They do however set out a series of 

expectations (under the Safety and Soundness provisions), on areas such as whether the 

board understands the nature and extent of operational risks and takes steps necessary to 

ensure management identifies, measures, monitors, and controls such risks. More specifically, 

supervisors’ examination procedures require verification that a board periodically reviews and 

approves significant operational risk management-related strategies, policies, and processes. 

While the volume and content of such strategies, policies, and processes at each banking 

organization vary according to its size and the nature and complexity of its activities, the 

expectation for board review and approval of such policies, and for a board’s active oversight 

of management’s execution/implementation of them, are universal. More detailed 

requirements usually fall to bank senior management. 

Largely through on-site examinations, and secondarily through on- and off-site supervisory 

activities, supervisors identify a banking organization’s operational risk management-related 

strategies, policies, and processes and verify that they are current, reflect the organization’s 

actual operating characteristics. Additionally, supervisors evaluate the board oversight of 

management’s effectiveness in implementing operational risk-management policies. This 

assessment is conducted in several ways: i) review of board and committee minutes; ii) 

evaluation of the frequency, coverage, and quality of external and internal audit reports; and 

iii) assessment of the reporting frequency, nature, and integrity of applicable management 

information systems that reflect effective policy/control implementation through reported 

residual risk levels. 

The OCC's Large Bank Supervision and Community Bank Supervision handbooks establish a 

risk-focused supervision process that builds on an annual assessment of the quality of risk 

management—including operational risk—through an evaluation or policies, processes, 

personnel, and controls; this includes periodic review and approval of policies by the board or 

an appropriate committee of the board. 

Setting of risk appetite is covered by general risk management guidelines. There is no specific 

guidance on operational risk appetite. 

Banking Institutions with at least $50bn of Assets 

Supervisors also assess the oversight and controls applied to operational risk models used for 

the CCAR capital adequacy assessment. 

Banking Institutions with $250bn or more in consolidated total assets or $10bn or more 

in consolidated total on-balance sheet foreign exposure (Advanced Approach) 

With respect to a banking organization that is required to use, or chooses to opt-in and use, 

the advanced approaches under the new risk-based capital rules, the board must at least 
UNITED STATES 

210 INTERNATIONAL MONETARY FUND

annually review the effectiveness of and approve the organization’s advanced systems. The 

Board must approve operational risk management-related strategies, policies, and processes 

and these must reflect the organization’s actual operating characteristics. 

EC3 The supervisor determines that the approved strategy and significant policies and processes 

for the management of operational risk are implemented effectively by management and fully 

integrated into the bank’s overall risk management process. 

Description and 

findings re EC3 

All Banks 

Supervisors review and evaluate the same information inputs available to a banking 

organization’s board. External and internal audit reports and selected management 

information system reports are reviewed and evaluated to verify that management has 

implemented the board-approved operational risk-management strategies, policies and 

procedures effectively. Additionally, on a risk-focused basis and/or where warranted based on 

initial evaluation findings or other changes in circumstances, on-site supervisors will perform 

select transaction testing to validate conformance with, and effectiveness of, operational risk 

management and control policies and processes. 

Banking Institutions with $250bn or more in consolidated total assets or $10bn or more 

in consolidated total on-balance sheet foreign exposure (Advanced Approach) 

The U.S. banking supervisors have also established uniform review procedures for use in all 

advanced approaches institutions. The procedures ensure even implementation and 

evaluation of the advanced measurement approaches, which include operational risk 

management processes, throughout the jurisdiction. Additionally U.S. regulators participated 

in, and served as the central processor for, the 2008 LDCE (loss data collection exercise) 

sponsored by the Basel Committee. This effort, on a voluntary basis, provided supervisors and 

institutions with a broad base of information to ensure consistent and even implementation of 

strategies and to help ensure that regulatory expectations are met. In addition, supervisors 

evaluate operations risk implementation during periodic stress testing. 

EC4 The supervisor reviews the quality and comprehensiveness of the bank’s disaster recovery and 

business continuity plans to assess their feasibility in scenarios of severe business disruption 

that might plausibly affect the bank. In so doing, the supervisor determines that the bank is 

able to operate as a going concern and minimize losses, including those that may arise from 

disturbances to payment and settlement systems, in the event of severe business disruption. 

Description and 

findings re EC4 

All Banks 

Supervisors have adopted examination procedures and perform risk-focused reviews of a 

banking organization’s business resumption and contingency plans during on-site 

examinations, with the scope/breadth of review contingent upon the risk profile of the 

organization. The risk profile is based on i) the size and nature of the organization’s current 

operations and activities, considering any significant changes since the previous regulatory 

review; ii) the scope/breadth and findings of previous regulatory reviews; and iii) any 

significant changes in the external or environmental factors that can materially impact 

business continuity risk. Additionally, under certain circumstances, the business resumption 

and contingency plans of banking organizations, individually by organization and/or 

horizontally across groups of banking organizations, are the subject of both on-site and offsite supervisory activities at the U.S. FBAs. When applicable, supervisors require banks to 

periodically test Business Continuity Plans and review the results with supervisors. 

Various supervisory policies, standards, and/or guidance statements relevant to business 

resumption and contingency planning have been issued on an interagency basis. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 211

In addition, supervisors have issued policy statements and guidance on a wide variety of bank 

activities that routinely address the importance of contingency planning, and the supervisory 

expectation that a banking organization will implement and test continuity plans, and report 

results of testing activities to the board or its designated committee. 

Banking Institutions with at least $50bn of Assets 

Key financial firms and market utilities that support critical financial markets have dedicated 

supervisory teams that assess the adequacy of governance and risk management of critical 

business/service lines on an on-going basis. These firms generally provide core clearing and 

settlement services that are the backbone of the U.S. financial and international financial 

systems. As such, U.S. federal supervisors have adopted guidelines that are outlined in the 

April 2003 Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. 

Financial System. These guidelines outline recovery and resumption objectives for clearance 

and settlement activities that support critical financial markets, with the specific goal of 

limiting systemic/disruption risk to the U.S. financial system. Supervisory programs have 

integrated these guidelines into their continuous monitoring program and periodic targeted 

control validation reviews, both of which leverage work already performed by, or conducted in 

concert with, other banking supervisors and functional regulators. 

 A related principle in the consolidated supervision framework is that large holding companies 

should provide sufficient resiliency measures for the recovery and/or resumption of their most 

important business processes in the event of a business disruption. The Federal Reserve’s 

supervisory approach focuses on the areas of the greatest systemic risk, e.g., clearing and 

settlement activities related to critical financial markets. The resulting supervision program 

establishes a mechanism to conduct on-going evaluations of the adequacy of risk 

management over the resiliency and recovery of clearing and settlement activities related to 

critical financial markets as originally contemplated under SR letter 03-09 and OCC Bulletin 

2003-14, the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. 

Financial System. The supervisory program combines an examination team’s continuous 

monitoring activities, an annual assessment of any material changes in a firm’s related 

activities or characteristics, and periodic targeted control validation reviews. Also, the OCC and 

the FDIC expect banks under their jurisdiction to also provide for sufficient resiliency 

measures. 

Note 

FFIEC Business Continuity Planning Booklet is also in the process of being updated with a new 

appendix that will stress the importance of resiliency in the use of business critical third parties, 

as well as guidance published for responses to Hurricanes Katrina and Rita. 

EC5 The supervisor determines that banks have established appropriate information technology 

policies and processes to identify, assess, monitor and manage technology risks. The 

supervisor also determines that banks have appropriate and sound information technology 

infrastructure to meet their current and projected business requirements (under normal 

circumstances and in periods of stress), which ensures data and system integrity, security and 

availability and supports integrated and comprehensive risk management. 

Description and 

findings re EC5 

Supervisors address information security and system development through on-site 

examinations that consider the risk profile of the banking organization, and have supervisory 

procedures to determine if a banking organization has appropriate policies and procedures in 

place to effectively respond to cyber-attacks. The agencies have examiners with specialized IT 

skill sets who can lead or assist in examinations of a banking organization that has a complex 

IT or operating environment. Also, consumer compliance examiners work with IT examiners to 
UNITED STATES 

212 INTERNATIONAL MONETARY FUND

review a banking organization’s compliance with statutory consumer privacy provisions to 

ensure that controls are in place to protect sensitive customer information and that 

appropriate disclosures are made regarding the banking organization’s information sharing 

practices. 

Various supervisory policies, standards, and guidance statements relevant to risk management 

of IT activities have been issued on an interagency basis, many through the FFIEC’s IT Subcommittee, a standing subcommittee of the FFIEC Task Force on Supervision. 

The FFIEC’s Information Security booklet provides extensive guidance and examination 

procedures to evaluate IT security practices. The FFIEC’s IT Sub-committee develops and 

publishes IT-related risk-management policies and guidance statements based on 

industry/market trends or developments in the broader IT environment. 

EC6 The supervisor determines that banks have appropriate and effective information systems to: 

(a) monitor operational risk; 

(b) compile and analyse operational risk data; and 

(c) facilitate appropriate reporting mechanisms at the banks’ Boards, senior management 

and business line levels that support proactive management of operational risk. 

Description and 

findings re EC6 

All Banks 

As part of the supervisory process supervisors evaluate the quality of a banking organization’s 

management information systems and their ability to facilitate appropriate board and senior 

management risk management. During the course of our assessment work the assessors saw a 

number of examples of the Supervisors making determinations on the appropriateness and 

effectiveness of banks’ management information systems and appropriate reporting to the 

Board (in particular through regular assessment of Board Risk packs). This was in both vertical 

examinations, horizontal reviews and continuous monitoring in the case of the larger 

institutions. 

Banking organizations use a variety of tools exist for the management of operational risk, 

including, scenario analysis; risk and control self-assessments; scorecards; key risk indicators; 

risk assessment processes for information security risk under the Gramm-Leach-Bliley Act; and 

business continuity, internal audit, and internal control assessments under the Sarbanes-Oxley 

Act. Regardless of the specific tools used by a banking organization, the U.S. banking agencies 

expect an accurate assessment of operational risk levels and appropriate risk-management 

controls or mitigants to effectively manage that risk. It was, however, readily acknowledged 

that assessment of some rare and tail risk losses are hard to evaluate – the particular examples 

being quoted were the severe losses from litigation and cyber attacks. 

Banking Institutions with $250bn or more in consolidated total assets or $10bn or more 

in consolidated total on-balance sheet foreign exposure (Advanced Approach) 

Banking organizations subject to the advanced measurement approaches are subjected to 

targeted examinations of their AMA implementation, including data and management 

information system quality. 

EC7 The supervisor requires that banks have appropriate reporting mechanisms to keep the 

supervisor apprised of developments affecting operational risk at banks in their jurisdictions. 

Description and 

findings re EC7 

Supervisors do not require reporting. They instead rely upon a combination of their 

supervisory activities and required regulatory and public disclosures and reporting by banking 

organizations (public requirements stem from accounting and audit-related statutes and rules 
UNITED STATES 

INTERNATIONAL MONETARY FUND 213

applicable to publicly held firms, such as Gramm-Leach Bliley (largely in relation to personal 

data) and the requirements under FDIA 363(b) to make a statement on financial controls) to 

keep apprised of developments affecting operational risk at their supervised entities. 

Furthermore, regulations requiring a banking organization to file a formal, written application 

or notification with its primary federal banking agency regarding proposed mergers, 

acquisitions, changes in control, and/or expansions into certain new activities, provide each 

agency with indicators of events that could potentially affect the banking organization’s 

inherent operational risk profile. 

Supervisors maintain on- and off-site supervisory monitoring of firms’ current and planned 

activities on an on-going basis. At larger banking organizations, this may include supervisors 

with specialized skills in IT or operational risks. Supervisory analysis of a banking 

organization’s operational risk and risk management also draws upon public disclosures of 

financial and managerial information and audit-related internal controls attestations required 

of publicly held banks and holding companies. Moreover, the agencies maintain surveillance 

units that analyze the balance sheet, profit/loss, and supplemental information routinely 

submitted by all banking organizations through required quarterly regulatory financial reports. 

Performance trends in various financial indicators can directly or indirectly point to 

developments in a particular organization’s operational risk profile. 

Under safety and soundness standards banking organizations’ internal controls and 

information systems must ensure compliance with applicable laws and regulations. 

Supervisors assess a banking organization’s compliance with applicable laws and regulations 

as part of their supervision activities. 

EC8 The supervisor determines that banks have established appropriate policies and processes to 

assess, manage and monitor outsourced activities. The outsourcing risk management program 

covers: 

(a) conducting appropriate due diligence for selecting potential service providers; 

(b) structuring the outsourcing arrangement; 

(c) managing and monitoring the risks associated with the outsourcing arrangement; 

(d) ensuring an effective control environment; and 

(e) establishing viable contingency planning. 

Outsourcing policies and processes require the bank to have comprehensive contracts and/or 

service level agreements with a clear allocation of responsibilities between the outsourcing 

provider and the bank. 

Description and 

findings re EC8 

Supervisors maintain that although a banking organization may outsource data processing 

and/or other business processes to outside parties, the banking organization’s board of 

directors and management remain responsible and accountable for the safe and sound 

performance and legitimacy/legality of the outsourced activity. Safety and soundness 

considerations associated with outsourcing include the security, integrity, and availability of 

any sensitive data or other assets transferred to the service provider. 

Supervisors’ examination procedures ensure supervisors evaluate, through on-site exams, that 

a banking organization establishes appropriate policies and processes to assess, manage, and 

monitor outsourced activities. Supervisors confirm that each banking organization’s program 

includes conducting due diligence on potential service providers; structuring the outsourcing 

arrangement; assessing, managing, and monitoring applicable risk; ensuring effective controls; 
UNITED STATES 

214 INTERNATIONAL MONETARY FUND

and establishing and testing back-up plans. Interagency guidance on this topic has been 

issued through the FFIEC. While both Guidance on the Risk Management of Outsourced 

Technology Services (Federal Reserve, November 2000) and the Outsourcing Technology 

Services Booklet (FFIEC, June 2004) address regulatory risk-management expectations largely 

from the perspective of IT-related outsourcing, the same risk-management elements are 

applied in practice to any material outsourcing arrangement at banking organizations, 

whether technology or business process related. These include contingency planning 

arrangements. Indeed the OCC have published OCC Bulletin 2013-29 “Third Party 

Relationships – Risk Management Guidance” which addresses outsourcing risks well beyond 

those related to IT. 

Additional 

criteria 

AC1 The supervisor regularly identifies any common points of exposure to operational risk or 

potential vulnerability (e.g. outsourcing of key operations by many banks to a common service 

provider or disruption to outsourcing providers of payment and settlement activities). 

Description and 

findings re AC1 

All Banks 

Supervisors regularly assess and evaluate potential common points of exposure to operational 

risk or potential vulnerability. 

Banking Institutions with at least $10bn of Assets 

In addition, resolution plan documents required under the DFA are reviewed and assessed to 

evaluate whether banks have common risk exposures from business activities, markets or 

products, or are subject to concentration risks associated service providers, central 

counterparties, and central clearinghouses. Furthermore, the supervisory agencies have 

internal risk committees that evaluate the ranges of risks to which their supervised banks are 

exposed to provide early identification of common or systemic risk exposures. Examples 

include transaction processing and BCP service provider concentrations, software vendor 

concentrations, payment system dependency concentrations, and clearinghouse and central 

counterparty (CCP) membership concentrations. The OCC publishes its Semi-annual 

Perspective on Risk, which provides a public assessment of significant risk exposures, including 

operational risks. The FDIC publishes Supervisory Insights, a journal that promotes sounds 

principles and practices for bank supervision. 

Deriving authority and jurisdiction from the Bank Service Company Act, supervisors pool 

resources to perform IT-related risk management evaluations/examinations of data processing 

service providers with significant client bases comprised of supervised banking organizations. 

For large service providers whose performance is identified as having systemic implications, 

periodic evaluations are performed under the Multi-regional Data Processing Servicers (MDPS)

Program administered by the FFIEC IT Subcommittee. Other data processing service providers 

with less significance, yet multiple client banks and holding companies, are identified and 

evaluated under the Regional Technology Service Provider (Regional TSP) program 

administered by the agencies’ regional or local offices. 

Assessment of 

Principle 25

Largely Compliant 

Comments The U.S. Federal Agencies are placing increasing emphasis on operational risk issues and are 

co-coordinating on the production of additional inter-agency guidance, as well as identifying 

and seeking mitigation of a number of issues in their vertical and horizontal issues. They are 

also alert to the changing threat landscape, such as the escalation of fines and other penalties 
UNITED STATES 

INTERNATIONAL MONETARY FUND 215

from litigation and cyber. 

The overall regime, however, has not reached a sufficient level of maturity (equivalent to 

market and credit risk for example). Guidance for banks under AMA (at the time of this 

assessment, only 8 banks) is well specified, however for all other bank operational risk 

management falls within the scope of “general” risk management (see CP 15). Guidance for 

other banks is highly disparate, and the weakness is compounded by the absence of a 

comprehensive reporting regime—only certain operational risks are covered by GLBA 501(b). 

It was also noted that there is not a standardized capital charge for operational risk. 

 The assessors saw some positive developments on aspects of operational risk aimed at 

Banking Institutions with at least $50bn of Assets, for example the Federal Reserve published 

Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of 

Current Practice in August 2013, which covers operational loss data and the OCC’s proposed 

formalizing of its "heightened expectations" for risk management and governance in its 

Heightened Standards Guidelines , which seeks to bring operational risk (and strategic and 

reputational risks) to the same level as market and credit risk in Board Risk Appetite 

statements for example. 

The absence of a comprehensive reporting regime is also a weakness as so much of the 

assessment of operational risk is assessing what could happen in terms of operational risks. At 

the time of the assessment, such initiatives were yet to bear fruit and documentation indicates 

a more structured approach to operational risk management for non-AMA banks is 

recommended. 

The assessors also noted the priority all of the agencies were attaching to Cyber Risk and also 

the establishment of working groups at the FFIEC, but the assessors agree that this will not be 

an easy task given the challenge of co-coordinating across not just the banking agencies but 

beyond given the nature of the risk. 

Principle 26 Internal control and audit. The supervisor determines that banks have adequate internal 

control frameworks to establish and maintain a properly controlled operating environment for 

the conduct of their business taking into account their risk profile. These include clear 

arrangements for delegating authority and responsibility; separation of the functions that 

involve committing the bank, paying away its funds, and accounting for its assets and 

liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate 

independent83 internal audit and compliance functions to test adherence to these controls as 

well as applicable laws and regulations. 

Essential criteria 

EC1 Laws, regulations or the supervisor require banks to have internal control frameworks that are 

adequate to establish a properly controlled operating environment for the conduct of their 

business, taking into account their risk profile. These controls are the responsibility of the 

bank’s Board and/or senior management and deal with organizational structure, accounting 

policies and processes, checks and balances, and the safeguarding of assets and investments 

(including measures for the prevention and early detection and reporting of misuse such as 

fraud, embezzlement, unauthorized trading and computer intrusion). More specifically, these 

 

83 In assessing independence, supervisors give due regard to the control systems designed to avoid conflicts of 

interest in the performance measurement of staff in the compliance, control and internal audit functions. For 

example, the remuneration of such staff should be determined independently of the business lines that they oversee. 
UNITED STATES 

216 INTERNATIONAL MONETARY FUND

controls address: 

(a) organisational structure: definitions of duties and responsibilities, including clear 

delegation of authority (e.g. clear loan approval limits), decision-making policies and 

processes, separation of critical functions (e.g. business origination, payments, 

reconciliation, risk management, accounting, audit and compliance); 

(b) accounting policies and processes: reconciliation of accounts, control lists, information 

for management; 

(c) checks and balances (or “four eyes principle”): segregation of duties, cross-checking, 

dual control of assets, double signatures; and 

(d) safeguarding assets and investments: including physical control and computer access.

Description and 

findings re EC1 

As with many aspects of the supervisory regime, the approach is tiered. In the case of internal 

control and audit. The safety and soundness statutes and supervisory guidance provide the 

legal basis for the imposition and enforcement of these requirements by the U.S. FBAs. See 

Table 26.1.

All Banks 

The safety-and-soundness provisions of the Federal Deposit Insurance Act (“FDIA”) (section 

39) require the Supervisors to prescribe standards relating to internal controls, information 

systems and audits. These are further amplified by Section 36 of FDIA. Interagency guidelines 

implement the standards, such as SR 95-51. They specify that a bank and holding company 

should have internal controls and information systems that are appropriate to the size of the 

company and the nature, scope and risk of its activities and that provide for (a) an 

organizational structure that establishes clear lines of authority and responsibility for 

monitoring adherence to established policies; (b) effective risk assessment; (c) timely and 

accurate financial, operational, and regulatory reports; (d) adequate safeguards to manage 

assets; and (e) compliance with laws and regulations. A bank and holding company should 

also have an internal audit system that is appropriate to the size of the company and the 

nature and scope of its activities and that provides for (a) adequate monitoring of the system 

of internal controls through an internal audit function (for smaller banks: a system of 

independent reviews of key internal controls); (b) independence and objectivity; (c) qualified 

persons; (d) adequate testing and review of information systems; (e) adequate documentation 

of tests and findings and any corrective actions; (f) verification and review of management 

actions to address material weaknesses; and (g) review by the bank's and holding company's 
UNITED STATES 

INTERNATIONAL MONETARY FUND 217

audit committee or board of directors of the effectiveness of the internal audit system. The 

effectiveness of internal controls, information systems, and audits is evaluated as part of the 

supervisory process. 

An agency may require the bank to submit a plan to achieve compliance, or take other 

supervisory actions. 

Supervisors evaluate the adequacy of bank and BHC’s internal control during on-site 

examinations, on- and off-site periodic monitoring and supervisory activities, and through 

various surveillance activities. In conducting these activities, supervisors determine that banks 

and holding companies have in place an internal control structure that is adequate for the 

nature and scale of their business. When evaluating the adequacy of a bank’s and holding 

company’s internal control and audit procedures, supervisors consider whether: 

 The system of internal control is appropriate to the type and level of risks posed by the 

nature and scope of the bank’s and holding company’s activities. 

 The organizational structure of the bank and holding company establishes clear lines of 

authority and responsibility for monitoring adherence to policies, procedures, and 

limits. 

 Reporting lines for the control areas are independent from the business lines, and 

there is adequate separation of duties throughout—such as duties relating to 

accounting, trading, custodial, and back-office activities. 

 Official organizational structures reflect actual operating practices. 

 Financial, operational, and regulatory reports are reliable, accurate, and timely, and, 

when applicable, exceptions are noted and promptly investigated. 

 Adequate procedures exist for ensuring compliance with applicable laws and 

regulations. 

 Internal audit or other control-review practices provide for independence and 

objectivity. 

 Internal control and information systems are adequately tested and reviewed. The 

coverage of, procedures for, and findings and responses to audits and review tests are 

adequately documented. Identified material weaknesses are given appropriate and 

timely high-level attention, and management’s actions to address material weaknesses 

are timely, and objectively verified and reviewed. 

 The bank’s and holding company’s audit committee or the board of directors 

reviews the effectiveness of internal audits and other control-review activities. 

Supervisors review documentation that banks and holding companies produce for internal 

control reviews, including those under section 404 of Sarbanes-Oxley, to determine whether 

there are any material weaknesses or significant deficiencies that should be followed up 

during the course of examination work. Supervisors will also assess the risks inherent in the 

bank and/or holding company, and the risk mitigants and controls as part of the on-going 

examination processes. Supervisors conduct horizontal examinations and use this information 

in assessing the risks of the bank and/or holding company relative to its peers. 

Supervisors assess a bank’s and holding company’s compliance with the Interagency Policy 

Statement on the Internal Audit Function and Its Outsourcing (for example SR13-01a1). Also, 

supervisors determine the quality and reliability of the bank’s and holding company’s policies, 

procedures, and processes with respect to internal control functions and reach an overall 
UNITED STATES 

218 INTERNATIONAL MONETARY FUND

assessment of the internal control system. During targeted examinations of specific product 

areas within the bank and holding company or as part of an annual review, supervisors 

evaluate the adequacy of internal control. When supervisors determine that the work 

performed by internal audit is effective, they will leverage off that work to evaluate the 

effectiveness of internal control. 

Supervisors review various external assurance reports as well as the list of weaknesses or 

deficiencies from auditor’s opinions under Sarbanes-Oxley to determine where control 

weaknesses exist and whether management is addressing these deficiencies in a timely 

manner. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve published Capital Planning at Large Bank Holding Companies: Supervisory 

Expectations and Range of Current Practice in August 2013 which set out their expectations of 

the internal practices and policies a firm uses to determine the amount and composition of 

capital that should be adequate, given the firm's risk exposures and corporate strategies as 

well as supervisory expectations and regulatory standards. Two of the seven principles are 

particularly relevant to this Core Principle: Principle 6 - Robust Internal Controls that requires 

Bank Holding Companies to have robust internal controls governing capital adequacy process 

components, including policies and procedures; change control; model validation and 

independent review; comprehensive documentation; and review by internal audit; and 

Principle 7 – Effective Governance - that requires Bank Holding Companies to have effective 

board and senior management oversight of the capital adequacy process, including periodic 

review of the BHC's risk infrastructure and loss- and resource-estimation methodologies; 

evaluation of capital goals; assessment of the appropriateness of stressful scenarios 

considered; regular review of any limitations and uncertainties in all aspects of the capital 

adequacy process; and approval of capital decisions. 

Note 

Banking Institutions with at least $50bn of Assets 

The OCC issued its Heightened Standards Guidelines in September 2014. It established minimum

standards for the design and implementation of a Risk Governance Framework and the role of 

the board of directors in the oversight of the framework. The guidelines apply to large national 

banks, federal savings associations, and insured Federal branches of foreign banks with average 

total consolidated assets of $50bn or more. The guidelines are consistent with the principles 

embedded in the Federal Reserve's expectations for large bank holding companies. The 

Guidelines will be phased in according to the bank's size: (i) banks with average total 

consolidated assets of $750 billion or more should comply with the Guidelines on 10 November 

2014; (ii) banks with average total consolidated assets of $100 billion or more but less than $750 

billion should comply by 10 May 2015; (iii) banks with average total consolidated assets of $50 

billion or more but less than $100 billion should comply by 10 May 2016; (iv) banks with 

average total consolidated assets of less than $50 billion that are subject to the Guidelines by 

virtue of being a subsidiary of a parent company that controls another bank subject to the 

Guidelines should comply with the Guidelines on the same date that the affiliated bank should 

comply; and (v) banks with average total consolidated assets of less than $50 billion on the 

effective date (November 10, 2014) that subsequently becomes subject to the Guidelines should 

comply within 18 months as of date of the most recent Call Report used to calculate the average.

EC2 The supervisor determines that there is an appropriate balance in the skills and resources of 

the back office, control functions and operational management relative to the business 
UNITED STATES 

INTERNATIONAL MONETARY FUND 219

origination units. The supervisor also determines that the staff of the back office and control 

functions have sufficient expertise and authority within the organization (and, where 

appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an 

effective check and balance to the business origination units. 

Description and 

findings re EC2 

As part of on-site examinations, on- and off-site periodic monitoring and supervisory 

activities, and various surveillance activities, supervisors evaluate a bank’s and holding 

company’s internal control functions when assessing the control functions and processes of 

the bank and holding company as a whole and for specific activities and operations. 

Supervisors coordinate the review of internal control with the reviews of other areas of the 

bank and holding company (e.g., credit, capital markets, compliance, and information systems) 

as a cross check of the bank’s and holding company’s compliance and process integrity. 

Supervisors also perform periodic reviews of control monitoring functions such as internal 

audit. If internal audit is effective, supervisors may take into account internal audit results as 

part of risk-focused examinations. Supervisors regularly conduct targeted reviews of high-risk 

areas such as trading to determine whether effective controls, including segregation of duties, 

are in place. Supervisory guidance cautions supervisors to be alert for indications that adverse 

circumstances may exist (such as inappropriate balance of skills and resources between 

operational and back office functions) when reviewing internal controls. Supervisors evaluate 

the competency and skills of personnel assigned to various control functions and the 

adequacy of resources the bank and holding company has available to effectively meet its 

internal control objectives. 

EC3 The supervisor determines that banks have an adequately staffed, permanent and 

independent compliance function84 that assists senior management in managing effectively 

the compliance risks faced by the bank. The supervisor determines that staff within the 

compliance function are suitably trained, have relevant experience and have sufficient 

authority within the bank to perform their role effectively. The supervisor determines that the 

bank’s Board exercises oversight of the management of the compliance function. 

Description and 

findings re EC3 

Supervisors’ guidance and examination procedures set out how to determine whether the 

bank and holding company have an effective compliance function. Supervisors confirm that 

the compliance function is independent of the bank’s and holding company’s business 

activities and has controls commensurate with the bank’s and holding company’s size and 

activities. The guidance also indicates that the bank’s and holding company’s board of 

directors is ultimately responsible for developing and administering a compliance 

management system that ensures compliance with laws and regulations. Supervisors confirm 

that the board of directors and management collectively establish and maintain an effective 

compliance management system including: 

 demonstrating clear and unequivocal expectations about compliance; 

 adopting clear policy statements; 

 appointing a compliance officer with authority and accountability; 

 allocating resources to compliance functions commensurate with the level and 

complexity of the bank’s and holding company’s operations (e.g., sufficient to address 

 

84 The term “compliance function” does not necessarily denote an organisational unit. Compliance staff may reside in 

operating business units or local subsidiaries and report up to operating business line management or local 

management, provided such staff also have a reporting line through to the head of compliance who should be 

independent from business lines. 
UNITED STATES 

220 INTERNATIONAL MONETARY FUND

compliance in specialty areas such as leverage leasing, insurance and private banking); 

 conducting periodic compliance audits; 

 ensuring that business lines have appropriate personnel with compliance expertise; and

 providing for recurrent reports by the compliance officer.

EC4 The supervisor determines that banks have an independent, permanent and effective internal 

audit function85 charged with: 

(a) assessing whether existing policies, processes and internal controls (including risk 

management, compliance and corporate governance processes) are effective, 

appropriate and remain sufficient for the bank’s business; and 

(b) ensuring that policies and processes are complied with. 

Description and 

findings re EC4 

All Banks 

Under the “Interagency Guidance on Internal Audit and its Outsourcing and the Federal 

Reserve’s Supplemental Guidance on Internal Audit and its Outsourcing”, each bank’s and 

holding company’s audit committee and management must consider the type of internal 

audit oversight that is necessary to ensure that internal controls are effective. While the 

benefits of a full-time audit function will largely outweigh the costs at a large bank or holding 

company, the cost may not outweigh the benefits at smaller ones. Small banks and holding 

companies should still have a comprehensive review of significant internal controls by an 

independent party. Supervisors determine the adequacy of the internal audit function through 

their on-going supervisory activities. 

Banking Institutions with less than $50bn of Assets 

Current guidance suggests annual evaluation of changes to Internal Audit through continuous 

monitoring and a full scope review of Internal Audit every three years. 

Banking Institutions with at least $50bn of Assets 

The Federal Reserve published Capital Planning at Large Bank Holding Companies: Supervisory 

Expectations and Range of Current Practice in August 2013 which set out their expectations of 

the role Internal audit should play a key role in evaluating internal capital planning and its 

various components. Audit should perform a review of the full process, not just of the 

individual components, periodically to ensure that the entire end-to-end process is 

functioning in accordance with supervisory expectations and with a BHC's board of directors' 

expectations as detailed in approved policies and procedures. Internal audit should review the 

manner in which deficiencies are identified, tracked, and remediated. Audit staff should have 

the appropriate competence and influence to identify and escalate key issues, and the internal 

audit function should report regularly on the status of all aspects of the capital planning 

process—including any identified deficiencies related to the BHC's capital plan—to senior 

management and the board of directors. 

Note 

Banking Institutions with at least $50bn of Assets 

 

85 The term “internal audit function” does not necessarily denote an organisational unit. Some countries allow small 

banks to implement a system of independent reviews, e.g. conducted by external experts, of key internal controls as 

an alternative.
UNITED STATES 

INTERNATIONAL MONETARY FUND 221

The OCC issued its Heightened Standards Guidelines in September 2014. The guidelines expect 

institutions to develop and maintain appropriate audit functions to control risk taking that 

includes keeping the board of directors informed of the covered bank’s risk profile and risk 

management practices to allow the board of directors to provide credible challenges to 

management’s recommendations and decisions.. It also calls for the establishment of an Internal 

Audit QAIP program.. 

Supervisors assess the quality and scope of a bank’s and holding company’s internal audit 

function, regardless of whether it is performed by the bank’s and holding company’s employees 

or by an outsourcing vendor. Specifically, supervisors consider whether 

 The internal audit function’s control risk assessment, audit plans, and audit programs are 

appropriate for the bank’s and holding company’s activities; 

 The internal audit activities have been adjusted for significant changes in the bank’s and 

holding company’s environment, structure, activities, risk exposures, or systems; 

 The internal audit activities are consistent with the long-range goals and strategic 

direction of the bank and holding company and are responsive to its internal control 

needs; 

 The internal audit manager’s impartiality and independence is promoted by having him 

or her directly report audit findings to the audit committee; 

 The internal audit manager is placed in the management structure in such a way that 

the independence of the function is not impaired; 

 The bank and holding company have promptly responded to significant identified 

internal control weaknesses; 

 The internal audit function is adequately managed to ensure that audit plans are met, 

programs are carried out, and results of audits are promptly communicated to senior 

management and members of the audit committee and board of directors; 

 Work papers adequately document the internal audit work performed and support the 

audit reports; 

 Management and the board of directors use reasonable standards, such as the Institute 

of Internal Auditor’s Standards for the Professional Practice of Internal Auditing, when 

assessing the performance of internal audit; and 

 The audit function provides high-quality advice and counsel to management and the 

board of directors on current developments in risk management, internal control, and 

regulatory compliance. 

These standards apply to large national banks and are consistent with the principles embedded 

in the Federal Reserve's expectations for large bank holding companies. The Guidelines will be 

phased in according to the bank's size: (i) banks with average total consolidated assets of $750 

billion or more should comply with the Guidelines on 10 November 2014; (ii) banks with average 

total consolidated assets of $100 billion or more but less than $750 billion should comply by 10 

May 2015; (iii) banks with average total consolidated assets of $50 billion or more but less than 

$100 billion should comply by 10 May 2016; (iv) banks with average total consolidated assets of 

less than $50 billion that is subject to the Guidelines by virtue of being a subsidiary of a parent 

company that controls another bank should comply with the Guidelines on the same date that 

the affiliated bank should comply; and (v) banks with average total consolidated assets of less 

than $50 billion on the effective date that subsequently becomes subject to the Guidelines 

should comply within 18 months as of date of the most recent Call Report used to calculate the 
UNITED STATES 

222 INTERNATIONAL MONETARY FUND

average.

EC5 The supervisor determines that the internal audit function: 

(a) has sufficient resources, and staff that are suitably trained and have relevant experience 

to understand and evaluate the business they are auditing; 

(b) has appropriate independence with reporting lines to the bank’s Board or to an audit 

committee of the Board, and has status within the bank to ensure that senior 

management reacts to and acts upon its recommendations; 

(c) is kept informed in a timely manner of any material changes made to the bank’s risk 

management strategy, policies or processes; 

(d) has full access to and communication with any member of staff as well as full access to 

records, files or data of the bank and its affiliates, whenever relevant to the 

performance of its duties; 

(e) employs a methodology that identifies the material risks run by the bank; 

(f) prepares an audit plan, which is reviewed regularly, based on its own risk assessment 

and allocates its resources accordingly; and 

(g) has the authority to assess any outsourced functions. 

Description and 

findings re EC5 

In addition to supervisory guidance, supervisors also use widely accepted industry standards 

(e.g., those of the Institute of Internal Auditors although industry guidance is not formally 

endorsed or adopted by the Supervisory Agencies) to assess the adequacy of their work 

against these standards. 

The scope of periodic reviews includes audit independence and competency, the role of the 

Board and Audit Committee, the identification of the audit universe, audit’s planning and risk 

assessment methodology, audit’s plans, audit work including work papers and sampling 

methodology, audit reports and ratings, follow-up of audit issues, and audit’s interaction with 

management. 

In addition, the “Interagency Policy Statement on the Internal Audit Function and Its 

Outsourcing” and the “Supplemental Policy Statement on the Internal Audit Function and Its 

Outsourcing” instruct supervisors to perform additional steps when reviewing outsourcing 

arrangements. Supervisors are required to determine whether: 

 The arrangement maintains or improves the quality of the internal audit function and 

the bank’s and holding company’s internal control; 

 Key employees of the bank and holding company and the outsourcing vendor clearly 

understand the lines of communication and how any internal control problems or 

other matters noted by the outsourcing vendor are to be addressed; 

 The scope of the outsourced work is revised appropriately when the bank’s and 

holding company’s environment, structure, activities, risk exposures, or systems change 

significantly; 

 The directors have ensured that the outsourced internal audit activities are effectively 

managed by the bank or holding company; 

 The arrangement with the outsourcing vendor satisfies the independence standards 

described in this policy statement and thereby preserves the independence of the 

internal audit function, whether or not the vendor is also the bank’s and holding 
UNITED STATES 

INTERNATIONAL MONETARY FUND 223

company’s independent public accountant; and 

 The bank and holding company has performed sufficient due diligence to satisfy itself 

of the vendor’s competence before entering into the outsourcing arrangement and has 

adequate procedures for ensuring that the vendor maintains sufficient expertise to 

perform effectively throughout the arrangement. 

Supervisors also assess the competence of the bank’s and holding company’s internal audit 

staff and management by considering the education, professional background, and 

experience of the principal internal auditors. 

Assessment of 

Principle 26

Compliant 

Comments The Federal Banking Agencies are clearly raising the bar for control functions. In respect of this 

particular Core Principle, this is particularly true of Internal Audit and the assessors have seen 

evidence that the supervisors are finding issues with Internal Audit that are classified as 

Matters Requiring Attention—at the OCC there were 405 outstanding at the time of this 

report. The general view the assessors established was that Internal Audit had improved since 

the last BCP review, but that, in technical areas in particular; these functions still have some 

way to go. 

By contrast the assessors found very little mention of Compliance except with reference to the 

very robust regime in respect of the BSA and Anti-Money Laundering. Compliance functions 

for example are not mentioned in The Federal Reserve published Capital Planning at Large 

Bank Holding Companies: Supervisory Expectations and Range of Current Practice in August 

2013 or the OCC’s proposals to formalize its "heightened expectations" in its Heightened 

Standards Guidelines. As the assessors state in CP29, there is a risk that given both legislative 

and regulatory focus on BSA/AML issues, the assessors found evidence of significant resource 

deployed within the authorities and within firms to meet the very stringent standards. The 

vulnerabilities to other forms of criminal abuse (e.g. fraud) are more disparate within the 

regime and within the banks themselves and risk being deemphasized. The assessors would 

recommend that the authorities seek to find an appropriate balance in their surveillance and 

also in their guidance - perhaps by consolidating it into fewer places than at present. 

Principle 27 Financial reporting and external audit. The supervisor determines that banks and banking 

groups maintain adequate and reliable records, prepare financial statements in accordance 

with accounting policies and practices that are widely accepted internationally and annually 

publish information that fairly reflects their financial condition and performance and bears an 

independent external auditor’s opinion. The supervisor also determines that banks and parent 

companies of banking groups have adequate governance and oversight of the external audit 

function. 

Essential criteria 

EC1 The supervisor86 holds the bank’s Board and management responsible for ensuring that 

financial statements are prepared in accordance with accounting policies and practices that 

are widely accepted internationally and that these are supported by recordkeeping systems in 

order to produce adequate and reliable data. 

 

86 In this Essential Criterion, the supervisor is not necessarily limited to the banking supervisor. The responsibility for 

ensuring that financial statements are prepared in accordance with accounting policies and practices may also be 

vested with securities and market supervisors. 
UNITED STATES 

224 INTERNATIONAL MONETARY FUND

Description and 

findings re EC1 

Banks below the minimum asset threshold of $500 million are exempt from requirements to 

publish financial statements, which are reviewed by an independent public accountant. That 

said, many of those banks do not avail themselves of this exemption. (See also EC 5 which 

describes what is required from exempt banks). 

Banks exceeding a minimum asset threshold of $500 million are required to prepare annual 

financial statements in accordance with U.S. generally accepted accounting principles (U.S. 

GAAP). See U.S.C §1831m(b)1 and section 37 of FDI Act, 12 U.S.C §1831n. These banks may 

comply with the requirement at the holding company level under certain conditions. The 

appropriate federal banking agency may determine that the application of any U.S. GAAP 

principle to any bank is inconsistent with the objective of section 37 and may prescribe an 

accounting principle applicable to such banks and holding companies which is no less 

stringent than U.S. GAAP. 

Banks between $500 million and $1bn must produce audited comparative annual financial 

statements; and an independent public accountant’s report on the audited financial 

statements and a management report that contains a statement of management’s 

responsibilities for preparing the annual financial statements; establishing and maintaining an 

adequate internal control structure over financial reporting; and complying with the 

designated safety and soundness laws and regulations pertaining to insider loans and 

dividend restrictions. 

If the bank has assets of $1bn or greater than the management and independent public 

accountant reports are further expanded. The management report must also include an 

assessment of the effectiveness of the internal control structure over financial reporting. The 

independent public accountant’s attestation report concerning the institution’s internal 

control structure over financial reporting include the Call Report and/or the FR Y-9C report. 

If a bank is $5bn or greater and has a CAMELS rating of 1 or 2 it may comply with these 

requirements through the bank’s holding company if the holding company holds at least 

75 percent of the consolidated group’s assets. . If the CAMELS rating is lower, the supervisor 

may accept compliance through the holding company. 

To ensure accuracy and reliability, banks and holding companies must establish and maintain 

adequate financial record-keeping systems. See, e.g., 12 U.S.C §§161, 1464(v), 1831m. The 

FBAs have been provided broad remedial authority to take enforcement actions against a 

bank and its IAPs, including board members and management, if they provide false or 

misleading information. 

EC2 The supervisor holds the bank’s Board and management responsible for ensuring that the 

financial statements issued annually to the public bear an independent external auditor’s 

opinion as a result of an audit conducted in accordance with internationally accepted auditing 

practices and standards. 

Description and 

findings re EC2 

For financial statements prepared in accordance with the Acts mentioned under EC1, 

U.S.C.1831(m)(d)1 prescribes that they must be audited by an independent public accountant. 

Publicly traded institutions registered with the SEC are required to undergo a quarterly review 

of their financial statements by an independent public accountant, who must report findings 

to the bank’s audit committee, That committee, in turn, must provide the report to the 

relevant federal or state banking agency. Supervisory guidance requires audits of banking 

organizations to be performed in accordance with the Public Company Accounting Oversight 

Board (PCAOB)’s and American Institute of Certified Public Accountants (AICPA)’s auditing 

standards. 

The supervisors have broad enforcement powers for holding board members and 
UNITED STATES 

INTERNATIONAL MONETARY FUND 225

management responsible for ensuring that financial statements issued annually to the public 

are reviewed and properly verified by an independent, appropriately credentialed public 

accountant, for those banks or holding companies that have external audit requirements. 

U.S. supervisors require banks and holding companies to file reports that include financial 

statements and reports of condition that reflect the capital to be accurate. These reports, for 

both public and non-public banks and holding companies, are made public by the FBAs with 

the exception of certain information deemed as confidential. Such financial statements are 

required to be certified by the bank’s or holding company’s CFO and a specified number of 

directors (trustees). 

EC3 The supervisor determines that banks use valuation practices consistent with accounting 

standards widely accepted internationally. The supervisor also determines that the framework, 

structure and processes for fair value estimation are subject to independent verification and 

validation, and that banks document any significant differences between the valuations used 

for financial reporting purposes and for regulatory purposes. 

Description and 

findings re EC3 

As noted under EC1, banks must apply U.S. GAAP or other, no less stringent principles. Such 

principles encompass the standards and practices for valuation. The accounting rules allow for 

assets and liabilities to be reported on different accounting bases including historical cost, 

amortized cost, the lower of cost and fair value, and fair value. FASB ASC Topic Fair Value 

Measurement defines fair value and establishes a framework for measuring the fair value of 

assets and liabilities, based on a three-level hierarchy, and for making disclosures about fair 

value measurements. The FBAs, through guidance and examination procedures, determines 

that institutions have robust controls and documentation on the accounting policies and 

processes surrounding the valuation processes. 

EC4 Laws or regulations set, or the supervisor has the power to establish the scope of external 

audits of banks and the standards to be followed in performing such audits. These require the 

use of a risk and materiality based approach in planning and performing the external audit. 

Description and 

findings re EC4 

In general, external auditors determine and report whether the financial statements of a bank 

are presented fairly in accordance with GAAP. Further, the external audits must meet or 

exceed the scope and procedures required by GAAS or PCAOB auditing standards. See 12 

U.S.C §1831(m)(f)1. The scope of the audit shall be sufficient to permit an auditor to determine 

whether the financial statements taken as a whole are presented fairly and in accordance with 

U.S. GAAP. While some banks and holding companies are not subject to independent audit 

requirements, the agencies encourage them to obtain independent audits. GAAS and PCAOB 

auditing standards generally require an auditor to adequately plan the audit on a risk-based 

basis, e.g. focusing on major exposures and significant activities and risks. 

When external auditors and supervisors meet before an audit is finalized, the supervisor may 

encourage, but not require, the auditor to expand the scope of the audit, for instance based 

on the supervisor’s specific knowledge about the bank. 

EC5 Supervisory guidelines or local auditing standards determine that audits cover areas such as 

the loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and 

other securities activities, derivatives, asset securitizations, consolidation of and other 

involvement with off-balance sheet vehicles and the adequacy of internal controls over 

financial reporting. 

Description and 

findings re EC5 

Those banks and holding companies which meet the criteria set out in legislation are required 

to obtain annual audits of financial statements and external audits of internal control over 

financial reporting. Such audits cover, as a minimum, all the areas mentioned in this 
UNITED STATES 

226 INTERNATIONAL MONETARY FUND

assessment criterion (EC5). 

For smaller banks, not subject to the audit requirements, a non-audit agreed-upon procedure 

is commonly used. Alternatively, an attestation engagement may be performed for all internal 

controls relating to the preparation of financial statements or specified schedules of the 

bank’s regulatory reports. This type of engagement is performed under generally accepted 

standards for attestation engagements. There must be an agreed-upon procedure which is 

objective and verified. It must also be integrated with the audit of internal controls. 

EC6 The supervisor has the power to reject and rescind the appointment of an external auditor, 

who is deemed to have inadequate expertise or independence, or is not subject to or does not 

adhere to established professional standards. 

Description and 

findings re EC6 

Independent public accountants providing audit services to banks must meet certain statutory 

qualifying criteria. See U.S.C §1831m(g)(3).The FDIC or another appropriate federal banking 

agency may remove, suspend, or bar and independent public accountant upon a showing of 

good cause. This would include, for example, when the auditor is determined to have 

inadequate expertise or independence or not to follow established professional standards. 

If a supervisor concludes that the auditor does not have the requisite expertise, independence, 

or does not follow established professional standards, the agency may talk with the bank’s 

senior management, board of directors and the external auditor. If the issue cannot be 

resolved, the agency can bar the accountant from performing audits under the act. Such 

enforcement action has only rarely taken place; and never against a whole audit firm. 

In addition, each bank is required to provide the appropriate agency with written notice of the 

engagement of an independent public accountant, or the resignation or dismissal of such a 

person and must include a statement of the reason for such event. In addition, a person who 

ceases to be the accountant of a bank is required to notify the appropriate agency in writing 

of such termination and set forth the reasons for the termination. 

EC7 The supervisor determines that banks rotate their external auditors (either the firm or 

individuals within the firm) from time to time. 

Description and 

findings re EC7 

Section 203 of the Sarbanes-Oxley Act of 2002 made it unlawful for a registered public 

accounting firm to provide audit services to an issuer if the lead (or coordinating) audit 

partner having primary responsibility for the audit or the audit partner responsible for 

reviewing the audit, has performed audit services for that issuer in each of the five previous 

fiscal years. See 15 U.S.C §78j-1. In addition, the rules also mandate a five year “timeout” 

period after rotation. The rules provide an alternative for accounting firms with fewer than five 

public audit clients and fewer than ten partners. The assessors saw evidence that the 

supervisors determine that banks adhere to these rules. For instance, there were orders from 

the supervisors to banks to rotate external auditors. 

Part 363 of the FDIC rules includes some (but not comprehensive) requirements for non-public 

banks to rotate their auditors. 

EC8 The supervisor meets periodically with external audit firms to discuss issues of common 

interest relating to bank operations. 

Description and 

findings re EC8 

The FBAs meet periodically with external audit firms as well as the FASB, the SEC, the AICPA 

and the PCAOB to discuss general accounting, audit, and financial disclosure issues related to 

banks and holding companies. Supervisors also meet periodically with external audit firms 

with respect to individual banks and holding companies to discuss general and specific issues 

with respect to their accounting and disclosure practices. In addition, external auditors will 
UNITED STATES 

INTERNATIONAL MONETARY FUND 227

typically ask to speak to the supervisors before signing off on annual financial statements to 

ensure that supervisors do not have information that would preclude their sign-off. See 

Interagency Guidance on Coordination and Communication Between External Auditors and 

Examiners (July 1992). 

EC9 The supervisor requires the external auditor, directly or through the bank, to report to the 

supervisor matters of material significance, for example failure to comply with the licensing 

criteria or breaches of banking or other laws, significant deficiencies and control weaknesses 

in the bank’s financial reporting process or other matters that they believe are likely to be of 

material significance to the functions of the supervisor. Laws or regulations provide that 

auditors who make any such reports in good faith cannot be held liable for breach of a duty of 

confidentiality. 

Description and 

findings re EC9 

There is no requirement for the external auditor to report directly to the FBAs, and there is no 

“safe harbor” protection for auditors who do report. However, according to Part 363 of the 

FDIC rules, the bank itself must inform the supervisors within 15 days of any written 

information from the auditor about a violation. Also, supervisors generally meet the auditors 

of banks and will then be informed. Supervisors do not use auditors for supervisory purposes. 

However, as part of the evaluation of a bank’s compliance with part 363 of the FDIC rules, 

supervisors would review communication to the management and audit committee made by 

the external auditors. External auditors must also notify management and the audit committee 

(or the full board of directors) of any control issues noted as the result of the financial 

statement audit. 

As noted, supervisory guidance requires audits of banking organizations to be performed in 

accordance with the PCAOB’s and AICPA’s auditing standards. Under those standards, when 

an auditor concludes that an illegal act, including violations of laws or government 

regulations, has or is likely to have occurred, he must ensure that those charged with 

governance are informed of the illegal act and this must be documented in writing. 

Additional 

criteria 

AC1 The supervisor has the power to access external auditors’ working papers, where necessary. 

Description and 

findings re AC1 

External auditors of large banks are required to agree to provide related audit work papers, 

policies and procedures to supervisors, if requested. See 12 U.S.C. §1831m(g)(3)(A). As a 

matter of best practice, supervisors expect all banks – regardless of size – to obtain agreement 

of an independent public accountant or other external auditor in the engagement letter to 

grant supervisors access to all the accountant’s work papers and other material pertaining to 

the bank prepared in the course of performing the external auditing program. Banks that fail 

to grant access of such working papers are subject to informal or formal enforcement action. 

Assessment of 

Principle 27

Largely compliant 

Comments Not all banks are required to issue full financial statements which are reviewed by an 

independent accountant in accordance with independent audit requirements. 

There is no requirement for external auditor to report immediately directly to the supervisor, 

but rather through the bank, should they identify matters of significant importance. 

There is no comprehensive requirement, apart from some provisions, only an expectation for 

non-public banks to rotate their external auditors. 

The supervisor cannot set the scope of the external audit but could encourage the auditor, 
UNITED STATES 

228 INTERNATIONAL MONETARY FUND

after the preliminary audit but before it is finalized, to include new issues. (This deficiency 

does not affect the rating of compliance, since EC 4 only requires that “Laws or regulations set, 

or the supervisor has the power to establish the scope...” The U.S. legislation clearly sets out 

the minimum scope of the external audit making the U.S. compliant with this proviso. 

However, the assessors recommend that the FBAs are given legal powers to add issues to the 

scope of the external audit in specific cases in order to address a relevant issue not normally 

covered in an external audit). 

Principle 28 Disclosure and transparency. The supervisor determines that banks and banking groups 

regularly publish information on a consolidated and, where appropriate, solo basis that is 

easily accessible and fairly reflects their financial condition, performance, risk exposures, risk 

management strategies and corporate governance policies and processes.

Essential criteria 

EC1 Laws, regulations or the supervisor require periodic public disclosures87 of information by 

banks on a consolidated and, where appropriate, solo basis that adequately reflect the bank’s 

true financial condition and performance, and adhere to standards promoting comparability, 

relevance, reliability and timeliness of the information disclosed. 

Description and 

findings re EC1 

All banks regardless of size must submit regulatory reports that include financial and other 

information, while holding companies with assets of U.S.D500 million or more and SLHC of all 

sizes must submit regulatory reports that include financial and other information on a 

consolidated basis. This reporting includes information about balance sheet items, offbalance-sheet-exposures, profit and loss, capital adequacy, asset quality, loan loss 

provisioning as well as some information on interest rate risk sensitivity and market risk. See 

12 U.S.C.§§161 and 1464(v). 

The FBAs ensure the periodic public disclosure of information in these regulatory reports and 

require that they adequately reflect the true financial condition of the bank or holding 

company. The disclosure and reporting requirements are subject to uniform submission 

deadlines, and ensure the timeliness and relevance of information. Uniform standards for 

reporting ensure comparability of information. 

Under the Basel III disclosure framework, U.S. banks and holding companies adopting the 

Advanced Approaches and certain U.S. banks and holding companies adopting the 

Standardized Approach rules will, from January, 1st, 2015, also be subject to the Pillar 3 

disclosure requirements. 

Each bank with consolidated assets of more than U.S.D 500 million is required to prepare a 

Part 363 Annual Report and submit it to the FDIC, the appropriate federal banking agency (if 

other than the FDIC) and any appropriate state bank supervisor. The bank must also make this 

report available to the public. The report includes audited financial statements and the 

auditor’s opinion thereon, and a management report that contains (1) a statement of 

management’s responsibilities for preparing the annual financial statements, for establishing 

and maintaining an adequate internal control structure and procedures for financial reporting, 

and for complying with certain designated laws and regulations relating to safety and 

soundness, and (2) an assessment by management of the bank’s compliance with such laws 

and regulations during the year. 

 

87 For the purposes of this Essential Criterion, the disclosure requirement may be found in applicable accounting, 

stock exchange listing, or other similar rules, instead of or in addition to directives issued by the supervisor. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 229

It should be noted that the U.S. interpretation of “solo basis” is different from the one used in 

the BCP Methodology. Namely, in the U.S. “solo basis” is considered to encompass the bank 

and its subsidiaries. (In the Methodology “solo basis” means the bank on a stand-alone basis).

EC2 The supervisor determines that the required disclosures include both qualitative and 

quantitative information on a bank’s financial performance, financial position, risk 

management strategies and practices, risk exposures, aggregate exposures to related parties, 

transactions with related parties, accounting policies, and basic business, management, 

governance and remuneration. The scope and content of information provided and the level 

of disaggregation and detail is commensurate with the risk profile and systemic importance of 

the bank. 

Description and 

findings re EC2 

As noted under EC1 and further elaborated under CP 10, the FBAs have a robust reporting 

framework from which disclosures will be selected. 

In addition, some of the regulatory reports provide the opportunity for the reporting banks to 

provide footnotes or narrative disclosures, which may be either quantitative or qualitative in 

nature. Regulatory reports that allow banks to provide additional information include, but are 

not limited to, the following: call reports (FFIEC 031 and FFIEC 041), FR Y-9C, FR Y-9LP, FR Y-9 

SP, FR Y-11, FR 2314, and FR Y-7N. See BCP #10 Supervisory Reporting for additional 

information on these reports. As mentioned previously, U.S. banks adopting Basel III will be 

subject to the Pillar 3 disclosure requirements; these disclosures are both qualitative and 

quantitative in nature as well. 

EC3 Laws, regulations or the supervisor require banks to disclose all material entities in the group 

structure. 

Description and 

findings re EC3 

Pursuant to Regulation Y (12 CFR 225.5(b) for BHCs and LL (12 CFR 238.4 for SLHCs, and FR Y6 report is filed by all top-tier holding companies. Inter alia, the report requires the submission 

of an organizational chart and an annual verification of domestic branches within the 

organization and includes information on the identity, percentage ownership, and business 

interests of principal shareholders, directors and executive officers. In addition, report FR Y-10 

provides data on organizational structural changes for reportable companies in the group. The 

FR Y-7 and FFIEC 002 are required for foreign banking organizations (FBOs) that have a U.S. 

banking presence. The report collects financial statements, organizational structure 

information, shares and shareholder information, and data on the eligibility to be a qualified 

FBO as defined in Regulation K. All these reports are publicized unless the reporting institution 

provides reason for an exemption. This has never happened. 

EC4 The supervisor or another government agency effectively reviews and enforces compliance 

with disclosure standards. 

Description and 

findings re EC4 

As discussed under Principle 10, U.S. FBAs require by statute that banks comply with 

reporting requirements and ensure the disclosure of relevant financial information. Failure 

to comply can provide the basis for informal or formal enforcement measures, including 

cease-and-desist (C&D) proceedings and the imposition of civil monetary penalties (CMP), 

against a bank and/or its IAPs. See 12 U.S.C. §§ 164, 1813(u), 1817(a), and 1818(b) and (i). 

The remedial provisions are structured to be appropriate to the severity of the violation. 

The supervisory review of a bank’s and a holding company’s safety and soundness includes 

review of internal controls related to financial reporting and Basel III Pillar 3 disclosures 

when implemented for applicable U.S. banks and holding companies. 

The SEC has the primary responsibility for ensuring review of public disclosures of public 
UNITED STATES 

230 INTERNATIONAL MONETARY FUND

companies and for taking enforcement action, as necessary. The SEC coordinates with the 

appropriate federal banking agency on enforcement matters affecting banks and holding 

companies 

EC5 The supervisor or other relevant bodies regularly publishes information on the banking system 

in aggregate to facilitate public understanding of the banking system and the exercise of 

market discipline. Such information includes aggregate data on balance sheet indicators and 

statistical parameters that reflect the principal aspects of banks’ operations (balance sheet 

structure, capital ratios, income earning capacity, and risk profiles). 

Description and 

findings re EC5 

The FBAs publish aggregate information on the banking system, including balance sheet 

indicators and statistical parameters reflecting the principal aspects of banks’ operations 

(e.g., balance sheet structure, capital ratios, income earning capacity, and risk profiles). This 

facilitates public understanding of the banking system and the exercise of market discipline. 

For each bank, the FBAs publish quarterly Uniform Bank Performance Reports (UBPR) that 

are primarily based on the information reported in the Call Reports. The UBPR include 

various indicators and ratios involving financial position, financial performance, and capital 

for peer groups, including deposit composition and stability, ratios of loan commitments to 

total loans and of standby letters of credit to total loans, the loan-to-deposit ratio (at 

community banks), the ratio of temporary investments to volatile liabilities, and the ratio of 

pledged securities to total securities. A similar report is produced by the Federal Reserve for 

aggregated BHC information, the BHC Performance Report (BHCPR). 

The FDIC publishes the Quarterly Banking Profile (QBP), which provides the public with a 

comprehensive summary of financial results for all banks each quarter. The QBP includes 

aggregate balance sheet and income statement data, key performance ratios, loan 

performance and quality data, and data on holdings of derivative contracts as well as 

servicing, securitization, and asset sales activities. The QBP also includes breakdowns of 

these data for banks by asset size range and geographic area. The FDIC publishes Statistics 

on Depository Institutions (SDI) each quarter, which is a publicly available and searchable 

database that provides industry information. SDI includes a set of frequently used financial 

data reports in standardized formats and provides the public with the ability to create 

reports containing customized peer groups of banks and bank holding companies 

The OCC and the Federal reserve each publishes a quarterly report on developments of 

banks’ credit underwriting criteria 

Additional 

criteria 

AC1 The disclosure requirements imposed promote disclosure of information that will help in 

understanding a bank’s risk exposures during a financial reporting period, for example on 

average exposures or turnover during the reporting period. 

Description and 

findings re AC1 

There are no examples of such disclosures. 

Assessment of 

Principle 28

Compliant 

Comments There are no examples of disclosures of information which covers ongoing developments 

during a financial reporting period, except for occasional analytical papers. Since the 

periodicity of the most comprehensive published report is quarterly (call reports), the 

assessors did not consider this deficiency significant. Nevertheless, the authorities are 
UNITED STATES 

INTERNATIONAL MONETARY FUND 231

encouraged to promote the disclosure of such information, where relevant. 

The FBAs do not collect data from banks at the solo level (i.e. at the level of the bank 

excluding its subsidiaries). In principle, this means that regulatory requirements such as Basel 

III capital that are intended to be imposed on a bank on both a stand-alone and consolidated 

basis can only be tracked on the latter basis. The assessors are satisfied, however, that in 

practice this omission has no prudential significance. The FBAs have explained that U.S. bank 

subsidiaries tend to be small relative to the parent bank and can only undertake activities that 

the bank itself could undertake in its own name. 

Principle 29 Abuse of financial services. The supervisor determines that banks have adequate policies 

and processes, including strict customer due diligence (CDD) rules to promote high ethical 

and professional standards in the financial sector and prevent the bank from being used, 

intentionally or unintentionally, for criminal activities.88

Essential criteria 

EC1 Laws or regulations establish the duties, responsibilities and powers of the supervisor related 

to the supervision of banks’ internal controls and enforcement of the relevant laws and 

regulations regarding criminal activities. 

Description and 

findings re EC1 

The FBAs have clear statutory authority to regulate banks and holding companies, examine 

them for compliance with laws and regulations relating to the prevention of criminal misuse, 

and enforce these requirements through civil enforcement actions. See e.g. 12 U.S.C. §§ 

1818(s)(2) and (s)(3); 1818 (i). These provisions are enforced by the agencies and, over the 

years, a number of banks and holding companies have been assessed penalties for BSA/AML 

failures (Note: BSA refers also to fraud and tax evasion transactions). In addition to the FBAs, 

certain other federal or state government agencies play critical roles in safeguarding the U.S. 

financial sector from criminal activities. The FBAs issue a BSA/AML Examination Manual that is 

frequently updated to ensure compliance with the rules and regulations. Fin CEN also provides 

guidance on emerging fraud and AML threats. The FBAs meet regularly to coordinate and 

share information, e.g. through the National Bank Fraud Working group, the FFIEC BSA/AML 

Working Group and the BSA Advisory Group. 

The Bank Protection Act, 12 U.S.C. §1882, requires the agencies to promulgate rules applicable 

to banks with respect to the installation and operation of security devices and procedures to 

discourage robberies, burglaries, and larcenies and to assist in the identification and 

apprehension of persons who commit such acts. See e.g. 12 CFR 21, subpart A (Minimum 

Security Devices and Procedures (OCC); 12 CFR 326 (FDIC), and 12 CFR 208.61 (Federal 

Reserve). The Interagency Guidelines Establishing Information Security Standards 12 CFR 30, 

appendix B (OCC); 12 CFR 364 appendix B (FDIC); and 12 CFR appendix D-2 (Federal Reserve) 

and 12 CFR 225, appendix F (Federal Reserve) set standards for banks to develop and 

implement safeguards for the security, confidentiality, and integrity of customer information, 

including protecting against unauthorized access, and advise banks to perform background 

checks for employees with responsibilities for, or access to, customer information. See 31 

U.S.C. §5318(l); 12 CFR 21.21(b)(2), 12 CFR 163.177(b)(2) (OCC); 12 CFR 208.63(b)(2) (Federal 

 

88 The Committee is aware that, in some jurisdictions, other authorities, such as a financial intelligence unit (FIU), 

rather than a banking supervisor, may have primary responsibility for assessing compliance with laws and regulations 

regarding criminal activities in banks, such as fraud, money laundering and the financing of terrorism. Thus, in the 

context of this Principle, “the supervisor” might refer to such other authorities, in particular in Essential Criteria 7, 8 

and 10. In such jurisdictions, the banking supervisor cooperates with such authorities to achieve adherence with the 

criteria mentioned in this Principle. 
UNITED STATES 

232 INTERNATIONAL MONETARY FUND

Reserve); 12 CFR 326.8(b)(2) (FDIC); and 31 CFR 1010.220 (FinCEN). 

EC2 The supervisor determines that banks have adequate policies and processes that promote 

high ethical and professional standards and prevent the bank from being used, intentionally 

or unintentionally, for criminal activities. This includes the prevention and detection of criminal 

activity, and reporting of such suspected activities to the appropriate authorities. 

Description and 

findings re EC2 

The FBAs and Treasury have issued regulations requiring banks to establish and maintain 

BSA/AML Compliance Programs that include the following elements, at a minimum: 

(a) internal controls to ensure BSA compliance, (b) independent testing of compliance, (c) an 

individual responsible for coordinating and monitoring day-to-day compliance and 

(d) training for appropriate personnel. The agencies and Treasury have issued separate 

regulations requiring banks to establish a customer identification program (CIP). The agencies 

and Treasury have issued regulations requiring banks and holding companies to file a 

suspicious activity report with Fin CEN within 30 days of the initial detection of certain facts 

(within 60 days if attempting to identify a subject). 

The Bank Protection Act requires the agencies to promulgate rules applicable to banks with 

respect to the installation and operation of security devices and procedures to discourage 

robberies, burglaries, larcenies and to assist in the identification and apprehension of persons 

who commit such acts. 

The Interagency Guidelines Establishing Information Security Standards set standards for 

banks to develop and implement safeguards for the security, confidentiality and integrity of 

customer information, including protecting against unauthorized access, and advise banks to 

perform background checks for employees with responsibilities for, or access to, customer 

information. 

Section 12 U.S.C 1818 (e) allows the FBAs to remove or to prohibit an institution affiliated 

party (IAP) from engaging in an act, omission or practice which constitutes a violation of law 

or written agreement with the bank supervisors, an unsafe or unsound practice, or breach of 

such party’s fiduciary duty, provided certain additional factors are satisfied (such as loss to the 

bank, gain to the IAP, etc.). 

Supervisors promote high ethical and professional standards through various means, such as 

conducting outreach, providing training opportunities, or issuing guidance on appropriate 

compliance with BS/AML regulations. The FBAs have also brought enforcement actions 

against banks and individuals based upon failures to meet ethical and professional standards. 

The FBAs have publicly issued their FFIEC BSA/AML Examination Manual with the aim to 

inform banks of examination criteria and disseminate uniform guidance on supervisory 

expectations. 

The federal and state supervisors also assess more broadly whether a bank or holding 

company have adequate policies and processes in place to promote high ethical and 

professional standards to prevent the bank from being used for criminal activities. However, 

beyond requirements on the fitness and propriety of management there are no explicit 

requirements that banks must have policies to ensure high ethical and professional standards. 

As a part of the BSA/AML Compliance Program, the FBAs examine whether a bank has the 

appropriate policies, procedures and processes in place to monitor, identify and report 

unusual activity, concentrating on high-risk products, services, customers and geographic 

locations. The FBAs also confirm that an institution’s board meets the regulatory mandate of 

formally approving the bank’s BSA/AML program. 

EC3 In addition to reporting to the financial intelligence unit or other designated authorities, banks 
UNITED STATES 

INTERNATIONAL MONETARY FUND 233

report to the banking supervisor suspicious activities and incidents of fraud when such 

activities/incidents are material to the safety, soundness or reputation of the bank.89

Description and 

findings re EC3 

In cases involving violations requiring immediate attention, an example being an intrusion into 

the bank’s IT-systems, the filing institution must immediately notify law enforcement and the 

relevant FBA. Banks and holding companies are required at all times to conduct their business 

and exercise their powers with due regard to safety and soundness. As part of this obligation, 

the FBAs expect banks to report to them directly any suspicious activities and incidents of 

fraud which might be material to the safety, soundness, or reputation of the institution. 

As part of its examination scoping process, the FBAs review BSA data (including SARs) to 

identify BSA/AML and fraud risks and document the examination plan based upon these risks 

and other risks to the institution. Additionally, the agencies review SARs that report known or 

suspected criminal activities by current of former officials, directors, employees, and other IAPs 

to ensure that appropriate enforcement actions are brought against such parties. 

EC4 If the supervisor becomes aware of any additional suspicious transactions, it informs the 

financial intelligence unit and, if applicable, other designated authority of such transactions. In 

addition, the supervisor, directly or indirectly, shares information related to suspected or 

actual criminal activities with relevant authorities. 

Description and 

findings re EC4 

The agencies are authorized to inform relevant authorities, including Treasury and Fin CEN, of 

suspicious transactions. Within these prescribed procedures, the agencies may also share such 

information with judicial authorities. The Right to Financial Privacy Act provides exceptions 

with respect to disclosures for law enforcement purposes. The FBAs and FinCEN have specific 

regulations that address the disclosure of SARs to other government agencies. Assessors have 

verified this takes place. In most cases, however, suspicious activities are reported by the 

banks themselves, and reporting is verified by FBAs. When noncompliance indicates possible 

criminal activity, matters are also referred to the U.S. Department of Justice (DOJ). 

EC5 The supervisor determines that banks establish CDD policies and processes that are well 

documented and communicated to all relevant staff. The supervisor also determines that such 

policies and processes are integrated into the bank’s overall risk management and there are 

appropriate steps to identify, assess, monitor, manage and mitigate risks of money laundering 

and the financing of terrorism with respect to customers, countries and regions, as well as to 

products, services, transactions and delivery channels on an ongoing basis. The CDD 

management program, on a group-wide basis, has as its essential elements: 

(a) a customer acceptance policy that identifies business relationships that the bank will 

not accept based on identified risks; 

(b) a customer identification, verification and due diligence programme on an ongoing 

basis; this encompasses verification of beneficial ownership, understanding the 

purpose and nature of the business relationship, and risk-based reviews to ensure that 

records are updated and relevant; 

(c) policies and processes to monitor and recognize unusual or potentially suspicious 

transactions; 

(d) enhanced due diligence on high-risk accounts (e.g. escalation to the bank’s senior 

 

89 Consistent with international standards, banks are to report suspicious activities involving cases of potential money 

laundering and the financing of terrorism to the relevant national centre, established either as an independent 

governmental authority or within an existing authority or authorities that serves as an FIU. 
UNITED STATES 

234 INTERNATIONAL MONETARY FUND

management level of decisions on entering into business relationships with these 

accounts or maintaining such relationships when an existing relationship becomes 

high-risk); 

(e) enhanced due diligence on politically exposed persons (including, among other things, 

escalation to the bank’s senior management level of decisions on entering into 

business relationships with these persons); and 

(f) clear rules on what records must be kept on CDD and individual transactions and their 

retention period. Such records have at least a five year retention period. 

Description and 

findings re EC5 

The agencies have enforced supervisory guidance that directs banks to establish CDD policies, 

procedures and processes, which are risk based and integrated into the bank’s overall risk 

management strategy. The agencies have identified failures of such during examinations 

evidenced by recent public enforcement actions (as shown on the website of each agency). 

Over 300 such enforcement actions related to AML/CFT have been initiated in the last 4 years. 

Pursuant to 31 U.S.C §5318(1), the FBAs and Treasury have issued regulations requiring various 

account opening procedures, including verifying the identity of any persons seeking to open 

an account and maintaining records of such information. Banks must establish a Customer 

Identification Program and maintain records of the information used to verify the person’s 

identity. The BSA and CIP regulations generally require that the banks properly safeguard and 

maintain copies of reports and records for a period of five years following the completion of 

the transaction or after the account has been closed. 

The CIP also must include procedures for responding to circumstances in which the bank 

cannot form a reasonable belief that it knows the true identity of a customer. For certain nonU.S. accounts and transactions, banks must identify all beneficial owners. For U.S. transactions 

where the client is a legal entity, the identification of the ultimate beneficial owner is not 

required. 

The FBAs evaluate whether the CIP enables a bank to form a reasonable belief of the 

customer’s true identity at account opening and to ensure that account profiles are kept 

current. In addition, supervisors will review if the bank has identified PEPs and, if so, how the 

corresponding risks are managed. There is, however, no explicit requirement that decisions on 

entering into relationship with such persons shall be escalated to the bank’s senior 

management. The current definition of PEPs in the U.S. only includes foreign nationals. 

Domestic PEPs are not defined, but are expected to be included in high net worth individuals 

monitoring as a higher risk category. 

12 U.S.C §5318(i) and 31 CFR Part 1010 requires risk based due diligence for U.S. private 

banking and correspondent accounts involving foreign persons. The statute requires 

reasonable steps to ascertain the identity of nominal and beneficial owners (except of legal 

entities) of, and the source of funds deposited into, such accounts. Stricter requirements apply 

when the customer is defined as a foreign PEP. However, in practice banks are expected to, 

and do, apply these higher standards to all other transactions and accounts. 

Banks must have an adequate BSA/AML compliance program in place that includes ongoing 

monitoring to detect criminal and suspicious activities. Specifically, the program must have 

sufficient internal controls for monitoring suspicious activity, a qualified BSA compliance 

officer to oversee the program, independent testing to verify vulnerabilities in the program, 

and regular BSA/AML compliance training for all relevant personnel. The FFIEC BSA/AML 

Examination Manual specifically addresses the regulatory expectations pertaining to internal 

controls, including CDD requirements, which are an essential component of a bank’s internal 

controls. See, e.g. 12 CFR Part 1010, subpart D. The Manual also states that the Board of 
UNITED STATES 

INTERNATIONAL MONETARY FUND 235

Directors is responsible in setting policies regarding BSA/AML risk, which include prescribing 

the relationships with high risk accounts and countries the bank will enter into. 

Supervisors determine whether the internal controls include prudent account opening 

procedures and ongoing monitoring systems, including a customer acceptance policy 

identifying business relationships the bank will not accept, if any, and that standards are 

followed on an ongoing basis The FFIEC Manual also states that “Management should have a 

thorough understanding of the money laundering terrorist financing risk of its customer base. 

Under this approach the bank will obtain information at account opening sufficient to develop 

an understanding of normal and expected activity of the customer's occupation or business 

operations." 

EC6 The supervisor determines that banks have in addition to normal due diligence, specific 

policies and processes regarding correspondent banking. Such policies and processes include:

(a) gathering sufficient information about their respondent banks to understand fully the 

nature of their business and customer base, and how they are supervised; and 

(b) not establishing or continuing correspondent relationships with those that do not have 

adequate controls against criminal activities or that are not effectively supervised by 

the relevant authorities, or with those banks that are considered to be shell banks. 

Description and 

findings re EC6

31 U.S.C §5318(i) and its implementing regulation at 31 CFR 1010.610 require banks to 

establish risk-based due diligence policies and procedures reasonably designed to detect and 

report money laundering through correspondent accounts established, maintained, 

administered or managed in the U.S. for a foreign financial institution. 

In addition, banks must perform enhanced due diligence for foreign correspondent banks 

operating under certain high-risk banking licenses. Enhanced due diligence includes obtaining 

ownership information about certain correspondents, conducting additional scrutiny of the 

transactions routed through these accounts, and ascertaining whether the foreign 

correspondent provides access to other foreign financial institutions. 31 U.S.C §5318(j) prohibit 

U.S. banks from providing correspondent accounts to foreign shell banks. 

The FFIEC BSA/AML Examination Manual has a chapter specifically addressing correspondent 

banking relationships. The agencies supervise banks to ensure compliance with foreign 

correspondent banking requirements. Supervisors are provided a number of significant high 

profile BSA/AML factors that may be used to help identify potential risk characteristics of a 

foreign correspondent customer in the Manual. 

The agencies have enforced (in several cases) requirements that banks establish enhanced due 

diligence policies and processes regarding correspondent banking and have cited failures of 

such rules as a concern during examinations. 

U.S. agencies generally view BSA/AML risks in domestic correspondent banking as low 

compared to other types of financial services. Nevertheless, U.S. agencies evaluate the policies 

and procedures for U.S. banks that offer correspondent banking services to domestic 

respondent banks, particularly with a view to detecting and reporting suspicious activities. 

These requirements, including that correspondent relationship are not initiated when 

adequate controls are not in place by the counterpart, are detailed in 31CFR 103.176. 

EC7 The supervisor determines that banks have sufficient controls and systems to prevent, identify 

and report potential abuses of financial services, including money laundering and the 

financing of terrorism. 

Description and The FBAs are responsible for examining banks and holding companies within their respective 
UNITED STATES 

236 INTERNATIONAL MONETARY FUND

findings re EC7 jurisdictions for safety and soundness and compliance with applicable laws. For instance, 

supervisors expect that the internal audit and compliance functions of a bank would identify 

and report instances of potential abuse. Specifically, federal law requires that each federal 

banking agency’s examination of a bank includes a review of the BSA Compliance Program 

and that its reports of examination describe any problems identified within the BSA 

Compliance Program. See 12 U.S.C. § 1818(s). 

A key component of the BSA/AML on-site examination is to ensure that the bank maintains an 

effective BSA/AML Compliance Program for its business activities that is commensurate with 

the bank’s risk profile. Prior to the examination, banking supervisors routinely conduct an offsite review of the FinCEN databases relative to bank SARs and CTRs to determine if the bank 

has filed such reports, and to determine if those reports were filed completely and in a timely 

manner. The agencies assess a bank’s compliance with BSA/AML and OFAC obligations using 

the core examination procedures detailed in the FFIEC BSA/AML Examination Manual during 

each examination. For larger and more complex banking organizations, the agencies maintain 

resident on-site supervisors who perform continuous monitoring of the control infrastructure 

and annually assess the organization’s condition and risk assessment. 

Supervisors also determine that banks comply with relevant standards for dealing with 

operational risks, including risks of criminal abuse of the bank. 

EC8 The supervisor has adequate powers to take action against a bank that does not comply with 

its obligations related to relevant laws and regulations regarding criminal activities. 

Description and 

findings re EC8 

An agency may take formal or informal enforcement actions to address violations of BSA/AML 

requirements (including those related to BSA Compliance Programs and SAR and CTR 

regulatory obligations), OFAC deficiencies, and unsafe and unsound practices or breaches of 

fiduciary duty, involving failure to comply with obligations related to criminal activity. 12 U.S.C. 

§1818(s)(3) requires an agency to issue a cease and desist order to address a violation of the 

BSA Compliance Program requirement for banks. Actions also may be taken to enforce 

compliance with the requirements of the Bank Protection Act. See 12 U.S.C. § 1882. 

The FBAs and FinCEN also have the authority to assess penalties for violations of the BSA. See 

31 U.S.C. § 5321. The Department of Justice (DOJ) has the authority to bring criminal cases 

against banks or holding companies for violations against criminal statutes, including parts of 

the BSA. See 31 U.S.C. § 5322; 18 U.S.C. §§ 1956 and 1957. The DOJ has the authority to bring 

criminal cases against banks and holding companies for violations of criminal statutes, 

including certain provisions of the BSA, 31 U.S.C. § 5322; 18 U.S.C. §§ 1956 and 1957. The FBAs 

are also authorized to take formal administrative action against an IAP of any banking 

organization and are able to take informal actions with respect to less serious deficiencies or 

more technical violations of the BSA/AML requirements. See 12 U.S.C. § 1813(u) and 1818. The 

most serious sanction that the FBAs may impose upon a bank that has been found guilty of 

certain criminal offenses relating to money laundering is to terminate the activities of a 

financial institution (including a branch or agency of a foreign bank). 

Depending on the degree of noncompliance, an agency can issue written orders that impose 

remedial actions; impose civil money penalties; reprimand individuals or bar them from 

employment within the industry; restrict or suspend the specific activities of the organization; 

revoke the charter or deposit insurance coverage of the organization; and/ or refer the matter 

to the DOJ for possible criminal penalties. 

The assessors found numerous evidences of supervisory criticisms and actions against 

deficient BSA/AML compliance. Thousands of AML/CFT inspection actions are carried out by 
UNITED STATES 

INTERNATIONAL MONETARY FUND 237

the FBAs each year, and hundreds of related enforcement actions have been initiated. 

EC9 The supervisor determines that banks have: 

(a) requirements for internal audit and/or external experts90 to independently evaluate the 

relevant risk management policies, processes and controls. The supervisor has access 

to their reports; 

(b) established policies and processes to designate compliance officers at the banks’ 

management level, and appoint a relevant dedicated officer to whom potential abuses 

of the banks’ financial services (including suspicious transactions) are reported; 

(c) adequate screening policies and processes to ensure high ethical and professional 

standards when hiring staff; or when entering into an agency or outsourcing 

relationship; and 

(d) ongoing training programs for their staff, including on CDD and methods to monitor 

and detect criminal and suspicious activities. 

Description and 

findings re EC9 

The agencies have issued guidelines that advise banks to use reasonable employment 

screening processes and perform background checks for employees in particular with 

responsibilities for, or access to, customer information to minimize the risk of fraud, 

embezzlement, money laundering, and other crimes. The agencies have also issued risk 

management guidance for third party relationships. The agencies consider that a reasonable 

policy might include checking references, performing credit and/or background checks, 

Internet searches, and performing criminal background checks, including an FBI fingerprint 

check, for prospective employees. Further, the FDIC issued a FIL-46-2005, “Pre-employment 

Background Screening”, that provided guidance on such a policy. The agencies have also 

issued guidance to the industry concerning best practices in this area. 

The agencies have also issued risk management guidance for third party relationships (OCC 

Bulletin 2013-29) and payment processors (OCC Bulletin 2008-12). 

Banks may not hire an IAP convicted of a crime involving dishonesty, breach of trust or money 

laundering, or who attended a pretrial diversion or similar program without the written 

consent of the FDIC (12 U.S.C. 1829(a)). Similarly, a bank or savings association holding 

company cannot hire an IAP convicted of a crime involving dishonesty, breach of trust or 

money laundering, or who attended a pretrial diversion or similar program without the written 

permission of the Federal Reserve (12 U.S.C. § 1829 (d) & (e)). However, referring to 

subsection (c) in the EC 9 there is no supervisory requirement that banks have screening 

policies for hiring staff in general. 

Referring to subsection (d) above, banks are required to regularly arrange training programs 

for their staff on BSA/AML issues. Banks are expected, but not required, also to arrange 

training on other criminal abuse issues. 

Banks are examined for compliance with these obligations in accordance with the standards 

set forth in the FFIEC BSA/AML Examination Manual on a regular, scheduled basis. A bank 

must have an adequate BSA/AML Compliance Program in place that includes: internal controls 

for the operation and function of the bank’s program; independent testing of the bank’s 

compliance; a designated individual or individuals responsible for coordinating and 

 

90 These could be external auditors or other qualified parties, commissioned with an appropriate mandate, and 

subject to appropriate confidentiality restrictions. 
UNITED STATES 

238 INTERNATIONAL MONETARY FUND

monitoring day-to-day compliance of BSA/AML matters including SAR reporting; ongoing 

training programs on all BSA/AML obligations, including CDD and suspicious activity 

monitoring; and CIP and methods to detect criminal and suspicious activities. The FFIEC 

Manual requires that the compliance officer must have the expertise and authority to 

undertake the job. 

EC10 The supervisor determines that banks have and follow clear policies and processes for staff to 

report any problems related to the abuse of the banks’ financial services to either local 

management or the relevant dedicated officer or to both. The supervisor also determines that 

banks have and utilize adequate management information systems to provide the banks’ 

Boards, management and the dedicated officers with timely and appropriate information on 

such activities. 

Description and 

findings re EC10 

Banks are required to have BSA compliance programs that have procedures that are 

reasonably designed to detect and report suspicious activity to FinCEN and an officer 

responsible for the program, including adequate management information systems. See EC 2; 

12 CFR 21.11(h). Whenever a bank files a SAR, it must promptly notify the board of directors 

or the relevant board committee. See 12 CFR 21.11(h) (OCC); id. at 208.62(h) (Federal Reserve); 

and id. at 353.3(f) (FDIC). Under these rules, banks must file SARs on insiders regardless of the 

amount involved in the suspicious activities. In addition to the SAR requirements, the audit 

committees of publicly held banks and holding companies that are subject to section 301 of 

Sarbanes-Oxley must establish procedures for the confidential, anonymous submission by 

employees of the issuer of concerns regarding questionable accounting or auditing matters. 

See 15 U.S.C. § 78j-1(m)(4). 

The Bank Protection Act, 12 U.S.C. § 1882, requires the agencies to promulgate rules 

applicable to banks with respect to the installation, maintenance, and operation of security 

devices and procedures to discourage robberies, burglaries, and larcenies and to assist in the 

identification and apprehension of persons who commit such acts. See e.g. 12 CFR 21, subpart 

A (Minimum Security Devices and Procedures) (OCC); and 12 CFR 326 (FDIC). 

SAR filing, monitoring and investigation activities are important components to a bank’s BSA 

compliance program (i.e., internal controls). The agencies assess a bank’s and holding 

company’s policies, procedures, and processes, including internal controls and day-to-day 

supervision, for monitoring and identifying unusual activity and for referring unusual activity 

from all business lines to the personnel or department responsible for evaluating unusual 

activity. Banking supervisors evaluate the effectiveness of the monitoring systems by 

considering the bank’s overall risk profile, the volume of transactions, and the adequacy of 

staffing assigned to the identification, research, and reporting of suspicious activities. 

Additionally, the agencies evaluate the escalation process from the point of initial detection to 

disposition of the investigation to determine whether management’s documented decisions 

to file or not file a SAR are reasonable, and whether SARs are filed in a timely manner. Finally, 

the agencies review management information systems to ensure that they inform the board 

(or board committee) and senior management of suspicious activities, compliance 

deficiencies, and corrective action. 

EC11 Laws provide that a member of a bank’s staff who reports suspicious activity in good faith 

either internally or directly to the relevant authority cannot be held liable. 

Description and 

findings re EC11 

The BSA and the agencies’ SAR regulations provide protection to financial institutions and 

their employees from civil liability for filing a SAR or for making disclosures in a SAR. The 

agencies and Fin CEN have issued interagency guidance on the scope of this “safe harbor”, as 

judicially interpreted, on May 24, 2004. Federal law provides protection from civil liability for 
UNITED STATES 

INTERNATIONAL MONETARY FUND 239

all reports of suspicious transactions made to appropriate authorities, regardless of whether 

such reports are filed pursuant to the SAR instructions. Specifically, the law provides that a 

bank or holding company and its directors, officers, employees, and agents that make a 

disclosure of any possible violation of law or regulation, including a disclosure in connection 

with the preparation of SARs “shall not be liable to any person under any law or regulation of 

the U.S., any constitution, law, or regulation of any state of political subdivision of any state to 

provide notice of such disclosure to the person who is the subject of such disclosure or any 

other person identified in the disclosure.”. Each of the FBAs has applicable regulations that 

specifically include a safe harbor provision for the filing of SARs. 

The agencies regularly review that appropriate procedures are being conducted. The FFIEC 

BSA/AML Examination Manual—Suspicious Activity Reporting Overview reiterates the safe 

harbor provision. 

Note that the “safe harbor” provision only applies to SARs and not to suspicions of other 

criminal activities. 

EC12 The supervisor, directly or indirectly, cooperates with the relevant domestic and foreign 

financial sector supervisory authorities or shares with them information related to suspected 

or actual criminal activities where this information is for supervisory purposes. 

Description and 

findings re EC12 

The FBAs have broad authority to share relevant supervisory information. Upon request, the 

FBAs work cooperatively with relevant domestic and foreign counterparts to share non-public 

information involving potentially criminal activities. In addition, MOUs are in place that set 

forth the framework for the routine sharing of information. When criminal activity is identified, 

the FBAs will coordinate directly with all domestic banking supervisors. The agencies may also 

share information with other supervisory and enforcement agencies, subject to confidentiality 

restrictions. 

Under the relevant statutes and regulations, the agencies may share information with foreign 

bank supervisors, spontaneously or upon request. They also have authority to exchange 

information with foreign bodies other than banking supervisors, including the relevant law 

enforcement agencies. See 12 CFR 4.37(c); 12 CFR 309; 12 U.S.C. § 1817(2)(C). All of the 

agencies have established procedures under which requests for information are processed. On 

cooperation, see CP 3 and CP 13. 

EC13 Unless done by another authority, the supervisor has in-house resources with specialist 

expertise for addressing criminal activities. In this case, the supervisor regularly provides 

information on risks of money laundering and the financing of terrorism to the banks. 

Description and 

findings re EC13 

The FBAs employ expertise for a number of specialties, including BSA/AML compliance and 

terrorist financing offences. The experts are skilled, receive ongoing training, are deployed in 

the most complex and high-risk institutions, and are prepared to identify unusual or 

potentially criminal activities. In addition, the agencies have fraud experts on staff to handle 

fraud cases and liaise with law enforcement agencies. The FBAs also alert the industry of fraud 

schemes through issuing guidance and conducting presentations at industry conferences. In 

addition the FinCEN routinely issues alerts and notices to banks via the established network 

and through guidance documents. 

Assessment of 

Principle 29 

Largely Compliant 

Comments There rules and supervisory expectations on BSA/AML issues are comprehensive. In relation to 

the requirements of the BCP further improvements should be made, as the assessors did not 

see evidence that these deficiencies in the legislation were compensated for in the supervisory 
UNITED STATES 

240 INTERNATIONAL MONETARY FUND

process: 

 Supervisors should explicitly require, rather than “expect”, that a bank’s decision to 

enter into relationships with high-risk accounts and countries, including with foreign 

and domestic PEPs, should be escalated to the senior management level. 

 Current legal and regulatory framework does not require the identification of the 

ultimate beneficiary owner of legal entity clients. Proposed amendments open for 

public consultation will introduce requirements to address this deficiency. Assessors 

welcome the proposed rule and understand its approval and implementation will 

improve compliance with this CP. 

CP 29 deals with all forms of criminal abuse and the need to protect banks. It is clear that 

there is strong political and supervisory focus on BSA/AML and the assessors saw evidence 

that significant resources are deployed within the authorities and banks to meet very stringent 

standards. The vulnerability to other forms of criminal abuse is more disparately addressed 

within the regime and risk being deemphasized. The assessors would recommend that the 

authorities seek to find an appropriate balance in their surveillance and also in their guidance 

– perhaps by consolidating the related issues in fewer places than at present. 

SUMMARY COMPLIANCE WITH THE BCP 

Core Principle Grade Comments 

1. Responsibilities, 

objectives and 

powers 

LC The DFA reforms have resulted in some rationalization of responsibilities 

in the U.S. supervisory structure, with the dissolution of the OTS and the 

establishment of a specialized, stand-alone consumer protection 

regulator. Nonetheless, the problems associated with multiple 

regulators with distinct but overlapping mandates remain. Further effort 

can be made to clarify the priorities of the FBAs in their mission 

statements and to make the division of responsibilities between the 

FBAs and the CFPB more coherent at the working level. In the assessors’ 

view, there remains further work on making the new supervisory 

structure more focused and effective. 

2. Independence, 

accountability, 

resourcing and legal 

protection for 

supervisors 

C Since the crisis, the FBAs have strengthened their accountability and 

transparency, and have improved their internal decision-making 

processes. Further steps could be taken to assure the independence of 

the Federal Reserve’s supervisory role. The FBAs have also been able to 

strengthen their capacities through active hiring and training programs. 

The challenge will be to retain those capacities as U.S. economic 

conditions continue to improve and specialist skills become even more 

attractive to industry. The assessors encourage the FBAs to keep their 

hiring programs flexible and responsive, and their training programs 

fully funded. 

3. Cooperation and 

collaboration 

C The FBAs have made a substantial effort since the crisis to improve their 

cooperation and collaboration to ensure that consolidated supervision is 

targeted, comprehensive and timely. International cooperation would 

be further strengthened if state supervisory agencies consulted fully, in 

all cases, with the FBAs and foreign supervisors on impending 

enforcement actions. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 241

Core Principle Grade Comments 

4. Permissible 

activities 

C There is a well-established framework for defining the permissible 

activities of banks and protecting the integrity of the term “bank”. 

Though not a specific responsibility of the FBAs, it is important that the 

U.S. authorities closely monitor the disclosure practices of “bank-like” 

institutions to ensure the community is well informed about the security 

of their savings. 

5. Licensing criteria C The evaluation processes for banks seeking a national charter and 

access to the deposit insurance fund appear thorough and testing. The 

DFA has given statutory force to interagency initiatives to address 

inappropriate regime shopping, but further guidance could be provided. 

The FBAs need to guard against creating perceptions of differences in 

supervisory style or intensity in their regional offices that could sway the 

choices made by banks on charter conversions. 

6. Transfer of 

significant ownership 

C The FBAs have comprehensive definitions for “controlling interest”, 

taking into account both quantitative and qualitative factors of control. 

There are clear rules for prior approval or notifications of changes in 

ownership. Supervisors may deny improper changes in ownership and 

may in certain circumstances require the reversal of completed 

transactions or require other remedial actions. The assessors saw 

evidence of supervisors taking such actions. 

The concept of “significant ownership” is not defined per se. However, in 

practice the international practice of a five percent threshold for the 

reporting of significant shareholders is applied. 

The assessors saw evidence, including supervisors’ responses to 

applications for ownership changes, that the above rules and policies 

are applied in practice. 

There is no explicit regulatory requirement for a bank to immediately 

report if they find that a major shareholder is no longer suitable. Nor did 

the assessors see any evidence of such reporting in the written 

documentation. The assessors recommend that such a supervisory 

requirement is introduced, with the aim to ensure that supervisors are 

promptly informed if a major shareholder is no longer suitable, since 

this might have a negative impact on the safety and soundness of the 

bank. Assessors chose to address this shortcoming under CP 9. 

7. Major acquisitions C Laws and regulations exist to define which acquisitions and investments 

that require prior approval by the authorities, a notification after-thefact or may be made under general consent. There are also clear criteria 

by which the authorities assess the applications. 

Legislation and regulations also put clear restrictions on the scope of 

permissible investments and acquisitions, such as in non-bank related 

activities. 

Assessors saw evidence, including supervisors’ reports on banks’ 

applications for investments/acquisitions, that the above rules and 

policies are applied in practice. 
UNITED STATES 

242 INTERNATIONAL MONETARY FUND

Core Principle Grade Comments 

8. Supervisory 

approach 

C The U.S. system of regulation is changing rapidly. These changes have 

broadened the role of supervision and have introduced a greater level 

of tiering into the regime (e.g. Banking Institutions with at least $50bn 

of Assets). 

The assessors find that the net effect of these changes has been 

positive. The supervisory regime is effective and risk-based. There is an 

increasing focus on resolution (for the larger firms). 

However, the agencies need to review approach to communication with 

firms. The system of supervisory issues requiring action (e.g. MRAs) 

needs to be simplified and ideally moved to a common interagency 

approach. The agencies need to continue their efforts in dealing with 

MRA that have been outstanding for a long time. 

9. Supervisory 

techniques and tools 

LC The U.S. agencies have an array of tools and techniques to carry out 

their supervisory responsibilities and furthermore that they are also 

developing new techniques, such as stress testing and horizontal 

reviews. These new techniques are altering the balance of the work 

done by supervisors. The absence of formal reporting requirements on 

banks to inform supervisors of key changes and developments is a 

weakness in the system, which not only could undermine monitoring 

work but also delay supervisory action. 

The agencies need to ensure that their intentions for each horizontal 

review are clear from the outset and in particular whether firms are 

being judged against an absolute or relative standard. 

Communication with banks also needs to be improved: key messages 

need to be better brought out; the roles and expectations of boards and 

senior management should not be conflated; feedback needs to be 

appropriately balanced on should not stray into excessive praise or 

excessive reporting on recent history. 

Agencies should go further in aligning planning cycles to maximize the 

opportunities of joint working. 

10. Supervisory 

reporting 

C The FBAs have a long-established and effective regulatory reporting 

framework, with the flexibility, demonstrated through the crisis, to 

expand reporting requirements in response to pressing supervisory 

needs. With the crisis passed, the FBAs are encouraged to review the 

level of granularity of data collected, particularly for stress testing and 

liquidity analysis purposes, to ensure that data continues to be needed 

at that level. The FBAs do not collect data from banks at the solo level 

(i.e. at the level of the bank excluding its subsidiaries) but the assessors 

understand that, in practice, this omission is not sufficiently material in 

its impact to warrant a lower rating for CP 12 under current 

circumstances. 

11. Corrective and 

sanctioning powers 

of supervisors 

C The authorities are recommended to consider implementing rules for 

promoting early action also for other issues than bank capital and 

liquidity 

 The assessors acknowledge that the U.S. legislation, regulations, and 
UNITED STATES 

INTERNATIONAL MONETARY FUND 243

Core Principle Grade Comments 

processes for taking supervisory action (informal or formal) are robust 

and have been further strengthened in recent years. For instance, the 

assessors noted earlier cases in which the escalation of supervisory 

measures, when warranted, took longer than appropriate given the 

severity of the deficiency at hand. However, in recent years there has 

been a clear reduction in such cases, reflecting the authorities’ new and 

more explicit rules and stricter implementation. The assessors 

recommend the authorities to continue on this path, for instance by 

setting even more explicit rules for the ageing of MRAs and MRIAs. The 

evolving practice of setting timelines for the completion of remedial 

actions, and requiring regular reporting of progress, is encouraged by 

the assessors. The assessors also encourage the implementation of 

planned OCC guidance on supervisory practices relating to MRAs. 

12. Consolidated 

supervision 

LC A lack of full compliance with this principle is based on the fact that 

regulatory and supervisory rules, guidance, and a formal rating system 

for SLHCs have not been adopted, and on the absence of a capital rule 

for corporate and insurance company SLHCs. Capital standards are not 

required at the diversified financial group level under the Basel capital 

framework ( which are to be calculated at the banking holding group 

level and banking group level), however the lack of an established 

supervisory assessment framework will likely hamper the supervisors in 

reviewing and taking action at the holding company (SHLC) level As 

noted in CP 10, the FBAs do not collect data from banks at the solo level 

(i.e. at the level of the bank excluding its subsidiaries). The assessors are 

satisfied; however, that in practice this omission has no prudential 

significance under the current circumstances as U.S. bank subsidiaries 

tend to be small relative to the parent bank and can only undertake 

activities that the bank itself could undertake in its own name. 

13. Home-host 

relationships 

C Reflecting the large cross-border activities of U.S. banks abroad, and of 

foreign banking groups in the U.S., there exist a comprehensive 

framework of policies and processes for co-operation and exchange of 

information between the FBAs and foreign supervisory authorities. This 

is currently being strengthened by the work in supervisory colleges and 

in CMGs. 

The assessors encourage the authorities to establish agreements with 

their foreign counterparts on a framework of communication strategies, 

especially for crisis situations. International cooperation would be further 

strengthened if state supervisory agencies consulted fully, in all cases, 

with the FBAs and foreign supervisors on impending enforcement 

actions. The assessors were made aware of circumstances where this was 

not the case. Although this is a clear deficiency in cooperation 

arrangements, the assessors did not judge it as sufficient to lower the 

“Compliant” rating for CP 13, but improvements in such consultations 

should be a high priority. 

There remain some instances in which specific rules apply to foreign 

institutions, such as the shorter run-off period for foreign branches in 

the liquidity, asset maintenance requirements for branches and 
UNITED STATES 

244 INTERNATIONAL MONETARY FUND

Core Principle Grade Comments 

requirements on large FBOs to set up intermediate U.S. holding 

companies. The mandate of the BCP assessment is limited to ensure that 

prudential rules and supervision are applied to ensure a minimum level 

of safety and soundness of banks. The assessors find that these rules are 

aimed to obtain such effect. The BCP mandate and assessment and do 

not include a judgment of level playing field issues 

14. Corporate 

governance 

LC Since the financial crisis of 2008-09 major changes have taken place in 

supervisors ́ demands on banks’ corporate governance and in the bank’s 

own approaches to these issues. Laws and regulations have gradually 

raised the requirements, although from a low level In particular, the 

expectations have been strengthened in those areas: (i) Board 

involvement in setting the bank’s risk appetite; (ii) the establishment of 

Risk Management Committees and; (iii) the increased frequency of 

Board meetings. The BCP assessors saw evidence of this, for instance in 

the reports from supervisory examinations, including when taking 

informal supervisory actions or formal enforcement actions for noncompliance. Assessors’ discussions with banks also indicate a clearly 

heightened focus by boards and management on corporate governance 

issues. One prominent area concerns the role and mandates of banks ́ 

boards relative to that of the senior management. Until very recently in 

the U.S., there was not a clear distinction between the two; for example 

the assessors saw numerous examples both in regulation and in actual 

supervision where the standard term “board and senior management” 

was used in situations where good current international practices would 

dictate that only one of the two should have the specific role and 

responsibility. The demands on board involvement and skills have 

increased substantially and this has also in many instances led to 

consequential changes in board compositions and calls for wider skill 

sets of directors. That said, both supervisors and banks agree that 

further steps need to be taken and implemented in the field of 

corporate governance. For instance, the stricter requirements and 

expectations by the supervisors seem to apply primarily to large banks. 

There seems to be a process of “trickling down”, i.e., that strengthened 

corporate governance practices also reach midsize and smaller banks, 

but this will probably take some more time before reaching desired 

levels. 

The LC rating is based on the fact that some key regulations, such as the 

SR 12-17 by the FRB and Heightened Standards by the OCC, have only 

recently come into force and have therefore not yet been fully 

implemented (and, as mentioned above, they primarily refer to large 

banks.) The new requirements will imply a substantial improvement but, 

in fact, the new, higher level is no more than standard practice in some 

other jurisdictions. In addition, there continue to exist areas where the 

requirements on the roles and responsibilities of bank boards fall short 

of international standards (See for instance the comments on CP 20 on 

Lending to related parties). In addition, on AC1, the requirements that 

bank informs the supervisors promptly about material developments 

that affect the fitness and propriety of Board directors or senior 
UNITED STATES 

INTERNATIONAL MONETARY FUND 245

Core Principle Grade Comments 

management are defined only for a narrow scope of events and should 

be broadened 

15. Risk management 

process 

LC The assessors were able to see substantial improvement in the risk 

management process, but it also has to be acknowledged from a low 

starting point. Some of the changes could only be said to have brought 

the U.S. up to standard practice in other jurisdictions such as frequency 

of board meetings, composition of the board and the existence of risk 

committees. 

Risk aggregation has improved. 

Risk oversight is still work in progress with much of the guidance being 

new or yet to be implemented. Guidance for Banking Institutions with 

less than $10bn of Assets is needed as the supervision of these fails to 

meet many aspects of the essential criteria, but not sufficient to warrant 

material non-compliance. 

Greater weight in communication needs to be placed on the role of the 

Board and greater efforts should be made to delineate their role from 

that of senior management. 

Aspects of the role of the Chief Risk Officer, particularly surrounding 

their departure need to be clarified. 

Further work is needed on firm-led stress tests, where firms seem to 

prefer to stretch their scenarios (often beyond the point of credibility) 

rather than examine whether they are producing the appropriate level of 

losses from a given severity of shock. 

16. Capital adequacy LC The FBAs have a robust and comprehensive approach to setting prudent 

and adequate capital adequacy requirements for banks and most 

holding companies, and this approach has been strengthened in 

response to Basel and DFA reform initiatives. In particular, stress testing 

has now become an essential element of capital adequacy assessments 

for banking organizations with more than $10 billion of assets. As well, a 

number of concerns raised in the 2010 DAO about the quality of capital 

and the coverage of most savings and loan holding companies have 

been addressed in the new regulatory capital rule. However, savings and 

loan holding companies with substantial insurance or commercial 

activities are excluded from the new rule. At the same time there are a 

number of differences between the new capital rule and the relevant 

Basel framework in terms of definitions of capital, the risk coverage and 

the method of calculation. These differences warrant a “Largely 

Compliant” rating for this CP. Firstly, the risk-based capital requirements 

for internationally active banks under the advanced approaches are 

different in a number of respects to the Basel framework. In addition, 

the U.S. standardized approach, which provides the “floor” for the 

advanced approaches banking organizations and applies to all other 

banking organizations, does not impose a capital charge for operational 

risk or for CVA risk (and there are also some divergences regarding the 

standardized approach to market risk). This omission in risk coverage 

may be significant for a broad segment of the banking system, and it 
UNITED STATES 

246 INTERNATIONAL MONETARY FUND

Core Principle Grade Comments 

distinguishes the U.S. capital regime from other major jurisdictions. It 

also makes the “standardized” floor less binding than it may appear. 

17. Credit risk C The U.S. Approach to Credit Risk is exceptionally codified in both 

regulation and guidance and reflects the emphasis placed on this risk by 

all of the Supervisors. 

Although the agencies do not set limits, the assessors found evidence 

that such limits were in place in the banks themselves and also in no 

doubt that if they were absent the agencies would determine such 

practice as unsafe and unsound and as such would have authority to 

require such limits and escalation criteria in individual cases. 

We would however recommend that the use of limits be considered 

when the guidelines are next reviewed. 

18. Problem assets, 

provisions, and 

reserves 

C The FBAs have a long-established and rigorous process for evaluating 

banks’ approaches to problem assets and the maintenance of an 

adequate ALLL. The FBAs have shown a consistent willingness to 

challenge unrealistic bank estimates of the ALLL and to secure increases 

they judge necessary, taking enforcement action if required. This 

steadfastness in approach is likely to be tested as the U.S. economy 

improves. Supervisory judgments in this area, however, continue to be 

constrained by the “incurred loss” requirements of U.S. GAAP, but 

proposed reforms in this area will permit more forward-looking 

provisioning. 

19. Concentration risk 

and large exposure 

limits 

LC The FBAs have a sound supervisory framework for dealing with credit 

concentration risk. Guidance has been issued on specific areas of credit 

concentration risk and this is followed up in supervisory reviews; some 

reassessment of the supervisory force of the thresholds for commercial 

real estate exposures is warranted. However the assessors saw little 

evidence of a comparable supervisory framework and supervisory 

guidance for other risk concentrations, as EC 1 requires. The widening of 

the definition of large exposures under the DFA to include counterparty 

credit risk from derivatives and securities financing transactions has 

brought the large exposure thresholds more into line with the 

requirements of AC1. However, the separate and additional limits for 

money market investments and security holdings available to banks (but 

not federal savings associations) continue to leave open the possibility 

of excessive risk concentrations. The 50 per cent limit on exposures to a 

corporate group also appears to be out of line with AC1 and the Federal 

Reserve’s proposed large exposures framework for large bank holding 

companies and foreign banking organizations. 

20. Transactions with 

related parties 

LC The “related party” regime in the U.S. regulatory framework does not 

appear as broad as required by this CP, in terms of the definition of 

covered transactions, affiliates and insiders. In addition, the CP requires 

a higher degree of board involvement and oversight than presently 

required by U.S. laws and supervisory guidance. There are no formal 

requirements for prior board approval of transactions with affiliated 

parties or the write-off of related party exposures exceeding specified 
UNITED STATES 

INTERNATIONAL MONETARY FUND 247

Core Principle Grade Comments 

amounts (as per EC3) or for board oversight of related party 

transactions and exceptions to policies, processes and limits on an 

ongoing basis (as per EC6). However, the FBAs expect banks to apply a 

high degree of board oversight and monitoring of affiliate and insider 

transactions and review this as a matter of practice. The aggregate limit 

for lending to insiders of 100 per cent of a bank’s capital and surplus 

(and 200 per cent for smaller banks) does not appear consistent with the 

general intent of this CP and creates the risk that a small group of 

insiders could deplete the own funds of a bank. There are no regulated 

limits for holding company transactions with their affiliates or insiders. 

21. Country and 

transfer risks 

C A robust framework exists for regulation and assessment of country and 

transfer risks and for the allocation of loan loss reserves reflecting 

country and transfer risks. 

However: 

 The rules do not cover savings associations. (Due to their 

tradition of having limited international exposures). The assessors 

would, however, recommend the introduction of a de minimis 

regime being applied to all categories of banks. Nor are U.S. 

affiliates of foreign banks covered since they are expected to be 

under consolidated supervision from the home authorities. The 

assessors find this acceptable, provided that there is good 

cooperation and information-sharing between the FBAs and the 

relevant foreign supervisory authorities on country risk matters as 

well as consolidated supervision. 

 Country risk has not yet been specifically tested in the stress tests 

mandated by the FBAs. While it has been covered on a case by 

case basis by internal stress testing conducted by banks, the 

assessors recommend that guidance and rules on stress test 

specifically include country risk.

22. Market risk C The Market Risk regime is comprehensive and understood. 

The assessors found very active engagement from supervisors on 

implementing the regime they have in place and in dealing with material 

market risk issues, such as valuation allowances, profit and loss 

attributions, etc. They make appropriate use of peer-group comparison 

such as through Hypothetical Portfolio Exercises. 

The material weaknesses identified in the 2009 BCP—such as market risk 

monitoring and management—have been significantly improved. The 

Supervisors have implemented much of the Basel II approach and also 

supplemented that for those banks subject to the Market Risk Rule. This 

improved market risk measurement and monitoring processes and 

models at certain major firms and lack of reliable valuation of MTM 

positions. The Stress Test Regime mandated under DFA has also 

improved the completeness and use of market stress testing. 

23. Interest rate risk 

in the banking book 

C The assessors find the U.S. compliant. The principles-based approach 

seems to be backed by adequate supervision proportionate to the size 
UNITED STATES 

248 INTERNATIONAL MONETARY FUND

Core Principle Grade Comments 

and complexity of the bank and the risk being run. The assessors saw a 

number of examples of supervisors applying the guidance they have. 

Given the concentrations that exist in small and community banks, the 

agencies approach would benefit from some tiering (as they do with 

other risks) and also should include quantitative guidelines that would 

serve as a preventative indicator of supervisory risk appetite, provide a 

quicker route to action and a useful point of reference and escalation 

within the agencies themselves. 

24. Liquidity risk C The Liquidity Risk Regime for banks below $50bn of Assets is quite high 

level, but the assessors did see numerous examples of supervisory 

action in support of the overall principle. Current levels of reporting for 

these banks (for example in respect of encumbered assets) are 

inadequate with only one line in the Call Report. The Authorities 

recognize this deficiency and have proposed a greater level of reporting 

depth as part of the implementation of the Liquidity Coverage Ratio. 

The assessors did not see evidence of encumbrance being a particular 

concern, but liquidity issues more generally were prominent in the 

supervisory actions directed at the firms. 

For Banking Institutions with at least $50bn of Assets and indeed 

beyond that level those of Global Systemic Importance, the regime 

(mostly in Regulation YY) is comprehensive and robust. Further the 

regime is supported by extensive reporting. 

We would recommend that efforts are extended in developing an 

interagency approach to the implementation of LCR. 

25. Operational risk LC The U.S. Federal Agencies are placing increasing emphasis on 

operational risk issues and are co-coordinating on the production of 

additional inter-agency guidance, as well as identifying and seeking 

mitigation of a number of issues in their vertical and horizontal issues. 

They are also alert to the changing threat landscape, such as the 

escalation of fines and other penalties from litigation and cyber. 

The overall regime, however, has not reached a sufficient level of 

maturity (equivalent to market and credit risk for example). Guidance for 

banks under AMA (at the time of this assessment, only 8 banks) is well 

specified, however for all other bank operational risk management falls 

within the scope of “general” risk management (see CP 15). Guidance for 

other banks is highly disparate, and the weakness is compounded by the 

absence of a comprehensive reporting regime—only certain operational 

risks are covered by GLBA 501(b). It was also noted that there is not a 

standardized capital charge for operational risk. 

The absence of a comprehensive reporting regime is also a weakness as 

so much of the assessment of operational risk is assessing what could 

happen in terms of operational events. 

The assessors also noted the priority all of the agencies were attaching 

to Cyber Risk and also the establishments of working groups at the 

FFIEC, but the assessors agree that this will not be an easy task given the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 249

Core Principle Grade Comments 

challenge of co-coordinating across not just the banking agencies but 

beyond given the nature of the risk. 

26. Internal control 

and audit 

C The Federal Banking Agencies are clearly raising the bar for control 

functions. In respect of this particular Core Principle, this is particularly 

true of Internal Audit and the assessors have seen evidence that the 

supervisors are finding issues with Internal Audit that are classified as 

Matters Requiring Attention—at the OCC there were 405 outstanding at 

the time of this report. 

By contrast the assessors found very little mention of Compliance except 

with reference to the very robust regime in respect of the BSA and AntiMoney Laundering. The vulnerabilities to other forms of criminal abuse 

(e.g. fraud) are more disparate within the regime and within the banks 

themselves and risk being deemphasized. The assessors would 

recommend that the authorities seek to find an appropriate balance in 

their surveillance and also in their guidance—perhaps by consolidating 

it into fewer places than at present. 

27. Financial 

reporting and 

external audit 

LC Not all banks are required to issue full financial statements which are 

reviewed by an independent accountant in accordance with 

independent audit requirements. 

There is no requirement for external auditor to report immediately 

directly to the supervisor, but rather through the bank, should they 

identify matters of significant importance. 

There is no comprehensive requirement, apart from some provisions, 

only an expectation for non-public banks to rotate their external 

auditors. 

The supervisor cannot set the scope of the external audit but could 

encourage the auditor, after the preliminary audit but before it is 

finalized, to include new issues. (This deficiency does not affect the 

rating of compliance, since EC 4 only requires that “Laws or regulations 

set, or the supervisor has the power to establish the scope...” The U.S. 

legislation clearly sets out the minimum scope of the external audit 

making the U.S. compliant with this proviso. However, the assessors 

recommend that the FBAs are given legal powers to add issues to the 

scope of the external audit in specific cases in order to address a 

relevant issue not normally covered in an external audit). 

28. Disclosure and 

transparency 

C There are no examples of disclosures of information which covers 

ongoing developments during a financial reporting period, except for 

occasional analytical papers. Since the periodicity of the most 

comprehensive published report is quarterly (call reports), the assessors 

did not consider this deficiency significant. Nevertheless, the authorities 

are encouraged to promote the disclosure of such information, where 

relevant. 

The FBAs do not collect data from banks at the solo level (i.e. at the level 

of the bank excluding its subsidiaries). In principle, this means that 

regulatory requirements such as Basel III capital that are intended to be 
UNITED STATES 

250 INTERNATIONAL MONETARY FUND

Core Principle Grade Comments 

imposed on a bank on both a stand-alone and consolidated basis can 

only be tracked on the latter basis. The assessors are satisfied, however, 

that in practice this omission has no prudential significance. The FBAs 

have explained that U.S. bank subsidiaries tend to be small relative to 

the parent bank and can only undertake activities that the bank itself 

could undertake in its own name. 

29. Abuse of financial 

services 

LC There rules and supervisory expectations on BSA/AML issues are 

comprehensive. In relation to the requirements of the BCP further 

improvements should be made as the assessors did not see evidence 

that these deficiencies in the legislation were compensated for in the 

supervisory process: 

 Supervisors should explicitly require, rather than “expect”, that a 

bank’s decision to enter into relationships with high-risk accounts 

and countries, including with foreign and domestic PEPs, should be 

escalated to the senior management level. 

 Current legal and regulatory framework does not require the 

identification of the ultimate beneficiary owner of legal entity 

clients. Proposed amendments open for public consultation will 

introduce requirements to address this deficiency. Assessors 

welcome the proposed rule and understand its approval and 

implementation will improve compliance with this CP. 

CP 29 deals with all forms of criminal abuse and the need to protect 

banks. It is clear that there is strong political and supervisory focus on 

BSA/AML and the assessors saw evidence that significant resources are 

deployed within the authorities and banks to meet very stringent 

standards. The vulnerability to other forms of criminal abuse is more 

disparately addressed within the regime and risk being deemphasized. 

The assessors would recommend that the authorities seek to find an 

appropriate balance in their surveillance and also in their guidance—

perhaps by consolidating the related issues in fewer places than at 

present. 

 
UNITED STATES 

INTERNATIONAL MONETARY FUND 251

RECOMMENDED ACTIONS AND AUTHORITIES 

COMMENTS 

A. Summary of Recommended Actions 

Recommended Actions to Improve Compliance with the BCP and the Effectiveness of Regulatory 

and Supervisory Frameworks

Reference Principle Recommended Action 

Principle 1 FBAs revisit their “mission and vision” statements to ensure they give primacy to 

safety and soundness and to clarify that the pursuit of other objectives must be 

consistent with, and if necessary subordinate to, that goal. 

FBAs and the CFPB explore ways to reduce duplication of effort, in matters such as 

risk reviews, and over time look to pursue opportunities for a more coherent division 

of responsibilities between safety and soundness, and consumer protection. 

Principle 2 The Federal Reserve further assure the independence of its supervisory role by 

making the governance rules for the boards of Federal Reserve district banks 

consistent with emerging global good practice. 

Principle 3 FBAs ensure that the preparation of supervisory plans is on the same cycle, if 

practicable, and consider other ways of ensuring that collaboration becomes fully 

engrained in the modus operandi of each agency. 

Principle 5 Incorporate handover “protocols” that would discourage inappropriate regime 

shopping in the FFIEC Statement on Regulatory Conversions. 

Principle 6 Introduce explicit requirement for banks to immediately report if they find that a 

major shareholder is no longer suitable. 

Principle 8 Develop interagency approach to communicate issues of supervisory important to 

banks (MRAs, MRIAs, MRBAs). 

Develop interagency method of prioritization of such matters requiring attention. 

Principle 9 Introduce requirements for banks to report developments to the supervisor, in 

particular for banks under less intensive supervision. 

Develop guidance to clearly distinguish, in supervisory recommendations and matters 

requiring attention, which are of Boards responsibility and which are the responsibility 

of senior management. 

Implement interagency guidance with more clarity regarding aging of MRAs. 

Carry out a combined interagency planning process for individual firms. 

Develop a supervisory best practice approach for horizontal reviews, which includes 

initial statements of expected minimum standards and the expected process of 

feedback to those that participate and the feedback to the wider population of firms 

to which it might be relevant. 
UNITED STATES 

252 INTERNATIONAL MONETARY FUND

Principle 11 Implement rules/policies promoting early action also for other issues than bank 

capital and liquidity. 

Implement more explicit rules for supervisory action, such as setting timelines for 

completion, partially or fully, of remedial action and requiring regular reporting of 

progress. 

Principle 12 Develop and implement regulatory and supervisory rules, guidance, and a formal 

rating system for SLHCs. 

Principle 14 Introduce clearer expectations and requirements for corporate governance also for 

banks not subject to heightened standards. 

On issues where still lacking, clarify supervisory expectations and requirements on the 

role and responsibilities of the bank board versus those of the bank management. 

Introduce explicit requirement that banks inform the supervisors promptly about 

material developments that affect the fitness and propriety of Board directors or 

senior management. 

Principle 15 Introduce clear expectations and requirements regarding risk management standards 

applicable to banks with less than $10bn of Assets. 

Introduce clear guidance on responsibilities of the Board with regards to risk 

management. 

Introduce clear requirements on the arrangements for the removal of CROs. 

Introduce clearer supervisory guidance on the severity of scenarios for stress tests run 

by the firms. 

Introduce clearer feedback mechanisms to firms on the components of supervisory 

run stress tests. 

Principle 16 Introduce a comprehensive capital framework for savings and loan holding 

companies with substantial insurance or commercial activities. 

Clarify requirements for capital to be held against operational risk by non-AMA banks. 

Clarify supervisory expectations for capital to be held against interest rate risk in the 

banking book. 

Principle 17 Introduce specific requirements that major credit risk exposures exceeding a certain 

amount or percentage of the bank’s capital are to be decided by the bank’s Board or 

senior management. 

Introduce specific requirements that credit risk exposures that are especially risky or 

otherwise not in line with the mainstream of the bank’s activities must be decided by 

the bank’s Board or senior management. 

Principle 19 Reassess the supervisory force of the thresholds for commercial real estate exposures. 

Develop a robust supervisory framework and supervisory guidance for other risk 

concentrations comparable to that for credit concentration risk. 

Review the separate and additional limits for money market investments and security 

holdings by banks, with a view to including them within the 15 plus 10 limits. 
UNITED STATES 

INTERNATIONAL MONETARY FUND 253

Review the 50 per cent limit on exposures to a corporate group, which could result in 

excessive risk concentrations. 

The Federal Reserve complete the development of its large exposures framework, 

with limits, for large bank holding companies and foreign banking organizations. 

Principle 20 Introduce formal requirements for prior board approval of transactions with affiliated 

parties and the write-off of related party exposures exceeding specified amounts. 

Introduce formal requirements for board oversight of related party transactions and 

exceptions to policies, processes and limits on an ongoing basis. 

Review the aggregate limit for lending to insiders of 100 per cent of a bank’s capital 

and surplus (and 200 per cent for smaller banks). 

Introduce limits for holding company transactions with their affiliates or insiders. 

Amend the coverage and details of the “related party” regime to bring it into line with 

this CP. 

Principle 21 Introduce de minimis regime to be applied to all categories of banks, and include 

savings associations. 

Introduce explicit reference to country risk in guidance and rules on stress tests 

guided by the authorities. 

Principle 23 Revise the 1996 guidance to include more quantitative guidelines regarding interest 

rate risk in the banking book. 

Principle 25 Introduce guidance on operational risk management and supervisory expectations 

applicable to non-AMA banks. 

Introduce appropriate reporting regime regarding operational risk. 

Principle 27 Introduce requirements for all banks to issue full financial statements in accordance 

with agreed accounting standards that are reviewed by an independent accountant in 

accordance with independent audit requirements. 

Introduce requirement for external auditor to report immediately directly to the 

supervisor, should they identify matters of significant importance. 

Review supervisory powers to allow the supervisor to set the scope of the external 

audit. 

Introduce a requirement for non-public banks to rotate their external auditors. 

Principle 29 Supervisors should explicitly require, rather than “expect”, that a bank’s decision to 

enter into relationships with high-risk accounts and countries, including with foreign 

and domestic PEPs, should be escalated to the senior management level. 

Current legal and regulatory framework does not require the identification of the 

ultimate beneficiary owner of legal entity clients. Proposed amendments open for 

public consultation will introduce requirements to address this deficiency. Assessors 

welcome the proposed rule and understand its approval and implementation will 

improve compliance with this CP. 

 
UNITED STATES 

254 INTERNATIONAL MONETARY FUND

B. Authorities’ Response to the Assessment 

The U.S. authorities strongly support the IMF’s Financial Sector Assessment Program (FSAP), which 

promotes the soundness of financial systems in member countries and contributes to improving 

supervisory practices around the world. The authorities appreciate the complexity of assessing the 

U.S. financial system and the time and resources dedicated by the IMF and its assessment teams to 

this exercise. The authorities commend the IMF on its diligence and constructive approach in 

undertaking the assessment. The U.S. authorities welcome the opportunity to provide the following 

comments. 

The IMF rightly holds the United States to the highest and most stringent grading standard, given 

the complexity, maturity, and systemic importance of our financial sector. Despite this higher 

grading standard, the assessment found the U.S. regulatory system to be very strong and, in many 

ways, more rigorous than international standards. 

We are pleased to note that the Report acknowledges that the U.S. federal banking agencies have 

improved considerably in their effectiveness since the previous FSAP was completed in 2010. This is 

particularly noteworthy since, compared to the 2010 assessment, the federal banking agencies were 

assessed against four additional Core Principles for Effective Banking Supervision (29 total) and 

significantly more Essential Criteria and Additional Criteria. This assessment also is more rigorous 

than the one completed in 2010 since the revised Core Principles have a heightened focus on risk 

management. The U.S. authorities are pleased that, even under these more stringent principles and 

when applying a higher standard, the IMF’s assessment of the U.S. system broadly indicates 

compliance with the Core Principles. Moreover, while the approach of the federal banking agencies 

is principles-based, the Report reaches its conclusions against the backdrop of an assessment 

regime that places a premium on specificity in regulations. 

The Report recognizes that global and domestic reforms implemented since the 2010 assessment, 

particularly the Dodd-Frank Act (DFA), have increased the intensity of the supervisory programs of 

the federal banking agencies. Since the previous review, substantial improvements have been made 

in risk management and the oversight of large bank organizations by putting enhanced emphasis 

on banks’ capital planning, stress testing, and corporate governance. The U.S. authorities concede 

that some reforms are still pending and will take time to fully implement. Notably, the Report 

acknowledges that additional implementation of the reform programs will further improve the 

United States’ compliance with the Core Principles. 

The Report acknowledges that the federal banking agencies are operationally independent and have 

clear mandates for safety and soundness of the banking system. However, it concludes there are 

duplicative efforts by the federal banking agencies and a lack of delineation between safety and 

soundness and other missions. Although there is not a formal statement that safety and soundness 

is the sole or primary mission of a federal banking agency, there is no confusion on the part of the 
UNITED STATES 

INTERNATIONAL MONETARY FUND 255

agencies, the public, or the industry that the focus of supervision and regulation relates to safety 

and soundness. The U.S. authorities believe that responsibilities, such as assuring compliance with 

consumer laws and taking account of financial stability considerations, in no way conflict with the 

assessment of safety and soundness. Indeed, given the potential high level of operational and 

reputational risk associated with significant consumer compliance weaknesses, considerations 

related to such compliance are part of an overall safety and soundness risk assessment. 

Furthermore, in practice, there is clarity of mission among the agencies. Clear distinctions exist 

between prudential safety and soundness responsibilities and consumer protection responsibilities 

that are shared between the Consumer Financial Protection Bureau (CFPB) and the federal banking 

agencies. In the view of the U.S. authorities, the federal banking agencies have met the requirement 

of collaboration required by DFA and have addressed the issue of duplicative efforts by coordinating 

with each other and the CFPB, as evidenced by interagency Memoranda of Understanding. 

The federal banking agencies have taken a number of substantive actions that are not fully reflected 

in the Report. These include: 

 Establishing forward-looking stress testing requirements for banks with less than $10 billion 

in assets. Although banks with assets less than $10 billion are not required to complete 

formal DFA capital stress tests, federal banking agencies require stress testing on certain 

high-risk and volatile activities, and all banks are expected to have appropriate capital 

planning processes. 

 Publishing federal banking agencies’ examination manuals and directors’ guides, and 

conducting outreach and training initiatives, which articulate the responsibilities of boards of 

directors. 

 Issuing extensive guidance on business resumption planning, which is included in the 

Federal Financial Institutions Examinations Council’s booklets. 

 Requiring institutions with total assets of less than $500 million in certain instances to have 

an independent audit of their financial statements. 

 Applying stricter regime standards for affiliate transactions, which include, among other 

things: 

 tighter U.S. quantitative limits of 10 percent of bank capital for transactions with a single 

affiliate and 20 percent of capital for the aggregate transactions with all bank affiliates, 

instead of 25 percent of the bank’s capital, 

 inclusion of asset purchases by a bank from affiliates in the 10/20 limit structure noted 

above, 

 prohibition on a bank having any unsecured credit exposure to an affiliate, 

 prohibition on a bank purchasing low-quality assets from an affiliate. 
UNITED STATES 

256 INTERNATIONAL MONETARY FUND

Additionally, U.S. authorities not only meet many Basel III international standards, but significantly 

exceed some of the most important ones, especially those related to capital and liquidity. Examples 

include: 

 

 Requiring the largest U.S. bank holding companies to have risk-based capital ratios that 

exceed Basel minimum capital requirements via the Federal Reserve’s Comprehensive 

Capital Analysis and Review and annual stress tests programs. 

 Utilizing a Global Systemic Important Bank surcharge to reflect short term wholesale 

funding, which increases banks’ capital conservation buffer. 

 Exceeding the Basel standard, the largest, most global, systemic U.S. bank holding 

companies must maintain a supplementary leverage ratio buffer greater than 2 percentage 

points above the 3 percent minimum, for a total of more than 5 percent, to avoid restrictions 

on capital distributions and discretionary bonus payments. Insured depository institution 

subsidiaries of these firms must maintain at least a 6 percent supplementary leverage ratio 

to be considered “well capitalized.” 

The U.S. authorities look forward to continuing a dialogue with the IMF and global counterparts to 

jointly promote the mission of the FSAP to enhance global financial sector stability and supervisory 

practices. In terms of this Report’s recommendations, specifically, the U.S. authorities will review 

them carefully. Action will be taken, where permissible, on items that enhance communication and 

information sharing among the agencies and ensure more effective oversight of systemic risk.