ASSESSMENT OF COMPLIAN

WITH THE

BASEL CORE PRINCIPL

FOR

EFFECTIVE BANKING SUPERV

Jurisdiction:

United States of America

Banking Agencies/Regulators:  Federal Reserve System Offi ce of the Comptroller of the Currency

 Federal Deposit Insurance Corporation Offi ce of Thrift Supervision

as of

July 31, 2009
Introduction to the Self-Assessment of Compliance with the Basel Core P

for Effective Banking Supervision by the U.S. Federal Banking Agen

The following introduction to the U.S. self-assessment of compliance with the Basel Core Principles for Effective Banking Sup

overview of the U.S. banking supervisory and regulatory structure and framework. The federal banking agencies’ respective re

roles over U.S. banks and holding companies (defined below) and mechanisms governing cooperation and consultation among 

functional regulators are briefly described as a complement to the detailed responses to the 25 BCPs. Legal and regulatory precbanking supervision are addressed in the Legal and Regulatory Framework under each BCP. For purposes of this self assessment, the following terminology will be used: 

• U.S. federal banking agencies – includes the Federal Reserve System (Federal Reserve), Office of the Comptroller of t

Deposit Insurance Corporation (FDIC), and Office of Thrift Supervision (OTS). Also referred to as the “federal bankin

“agencies.” 

• U.S. federal banking supervisors – includes the staff of the U.S. federal banking agencies. Also referred to as the “sup

context is interchangeable with “regulators” and “examiners.” 

• Banks – includes all FDIC-insured national banks (supervised by the OCC), FDIC-insured state-chartered banks (both 

(supervised by the Federal Reserve) and nonmember (supervised by the FDIC)) and FDIC-insured savings associations 

unless the content indicates otherwise. 

• Commercial banks – includes “banks” as described above, but excludes savings associations. 

• Foreign banking organizations – foreign banks that conduct commercial banking operations in the United States. 

• Bank holding companies (BHCs) and savings and loan holding companies (SLHCs) – includes any company that has c

savings association, respectively. For the purposes of this document, they are referred to as “holding companies” excepmaterial difference between BHCs and SLHCs (in terms of legal authority, operations, or structure). BHCs are supervi

and SLHCs are supervised by the OTS. 

• Financial holding companies – bank holding companies, whose depository institution subsidiaries meet enhanced capit

standards, that are authorized to engage in expanded financial activities, including securities, insurance, and merchant b

• Consolidated organization – the consolidated entity including the parent and its bank and nonbank subsidiaries. 

• Banking group or banking organization – the holding company and its banking subsidiaries. • Functionally regulated affiliate – entities within the consolidated organization that are regulated by the U.S. Securities 

the Commodity Futures Trading Commission, or state insurance regulators. 
Methodology The U.S. self-assessment was conducted in accordance with the Basel Core Principles for Effective Banking Supervision and C

published by the Basel Committee for Banking Supervision (BCBS) in October 2006. The general guidance for completing the those BCPs were the BCBS publication, Conducting a Supervisory Self-Assessment – Practical Application, published in April Sector Assessment – A Handbook, published by The World Bank and the IMF. To complete the self-assessment, legal staff and subject matter experts from each U.S. federal banking agency provided input in 

and their associated criteria. Special emphasis was placed on describing the practical application of the principles within the Uframework. Authors made every attempt to critically review the practical application of all regulatory requirements and activit

self-assessment offers U.S. regulators’ assessment of compliance in conformance with the BCP methodology. 

Background Information Current Structure and Supervisory Responsibilities U.S. federal banking agencies addressed in this self-assessment include the Federal Reserve, OCC, FDIC, and OTS. As agreed 

assessment does not include an assessment of the state banking agencies, the National Credit Union Administration, or the FedAuthority. The current framework for the regulation and supervision of financial institutions in the United States has developed over many response to a series of financial crises and other important social, economic, and political events. The structure of the financial degree of coordination among all relevant supervisors (both federal and, where applicable, state), both in formulating regulator

and supervising individual banks and holding companies. 

Responsibilities of the Federal Banking Agencies The United States operates under a “dual banking system.” A bank may choose to be chartered by the federal government or bcharters for “national banks” are issued by the OCC. The OTS issues charters for “federal savings associations.” OTS and OC

Treasury. National banks and federal savings associations operate pursuant to a federal grant of powers, subject to uniform natfederal law and regulations, and administered by the OCC or OTS, respectively. 
Each of the 50 states has a banking authority that charters banks under its own laws and regulations. These banks are generally banks” or “state savings associations.” Each U.S. bank, whether chartered under state or federal law, is subject to regulation, suexamination by a primary federal banking supervisor, irrespective of whether the bank is part of a broader organization: ● for national banks, this is the OCC; ● for state banks that choose to be members of the Federal Reserve System (state member banks), this is the Federal Reserve

● for state banks that choose not to become members of the Federal Reserve System (nonmember banks) this is the FDIC; an● for federal or state savings associations, this is the OTS. 

Summary of Primary Federal Supervisory Responsibilities – Table 1 

Component Supervisor and Regulator Bank holding companies (including financial holding companies 

Federal Reserve 

Nonbank subsidiaries of bank holding companies Federal Reserve/Functional Regulator National banks OCC State banks  Members  Nonmembers 

Federal Reserve FDIC 

Savings and loan holding companies OTS Savings and loan associations OTS U.S. offices of FBOs - subs, branches and agencies*  State-licensed  Federally licensed *There are some grandfathered, insured FBO branches. If they are state-chartered, the primary federal supervisor is the FDIC and if federally chartered, the primary federal supervisor is the OCC. 

Federal Reserve OCC 

The FDIC operates the federal deposit insurance program in the United States. Virtually all banks have deposit insurance cove

All banks are subject to regulation by a U.S. federal banking agency. In addition to its authority to examine state nonmember b
authority to examine for insurance purposes any bank, either directly or in cooperation with state or other federal supervisory abackup enforcement authority over all banks. The FDIC can recommend that another federal banking agency take action againcircumstances and may take such action directly if the other agency does not take action. Holding companies are either supervised by the Federal Reserve or the OTS. The Federal Reserve is responsible under the Banfor regulating and supervising any company that owns or controls a national or state bank. BHCs and their subsidiaries may enclosely related to banking. Certain BHCs, whose depository institution subsidiaries meet enhanced capital and managerial stanfinancial holding companies (FHCs) and engage in a broader array of financial activities, including securities, insurance, and mFederal Reserve is the consolidated supervisor of all BHCs and FHCs on a worldwide consolidated basis. As set forth in the HOTS regulates and supervises SLHCs. SLHCs may engage only in financial activities, although certain SLHCs that control a sacquired before 1999 are not subject to such limits. The OTS is the consolidated supervisor of all SLHCs. 

The U.S. federal banking agencies generally have the authority to examine affiliates of banks under their supervision. In additithe OTS have the authority to examine holding company affiliates. However, the Federal Reserve and the OTS must rely to the the bank examinations conducted by the primary federal banking supervisor. For example, for national banks, the Federal Rese

securities and insurance subsidiaries the Federal Reserve relies on other functional regulators for supervisory information. The supervisor can only conduct an examination of a functionally regulated subsidiary if the subsidiary is engaging in activities that bank or for other prudential reasons and the information cannot be obtained from the functional regulator. Foreign banking organizations (FBOs) may do business in the United States under a policy of “national treatment” which gives applies the same limitations as are given and applied to domestic banks. National treatment is embedded in the key governing International Banking Act of 1978 (IBA). No FBO may establish a branch or an agency, or acquire ownership or control of a commercial lending company, without the pReserve. Under the IBA, the Federal Reserve has broad supervisory oversight over the FBO’s U.S. banking operations. The FOCC or state banking agencies to perform examinations and supervision depending on the form of organization and the charter this country. All banks and branches or agencies of FBOs have a primary federal regulator. An insured, state nonmember bank owned or cosupervised primarily by the FDIC. A state-chartered member bank owned or controlled by an FBO is supervised primarily by t

national bank that is owned or controlled by an FBO is supervised and examined by the OCC. If the FBO acquires a savings aschartered or federally chartered, the OTS supervises the savings association and supervises the FBO as an SLHC.1

If the FBO chooses a federal license for a branch or agency, then it is supervised and examined solely by the OCC. If an FBO 

agency under a state license, then it is typically examined by the state banking authorities and also by the Federal Reserve on a rotating) basis. 

1 If the FBO controls both a savings association and at least one other type of bank, the FBO is supervised by the Federal Reserve as a BHC 
Information-Sharing and Coordination Among Supervisors The sharing of information among supervisors is an integral part of the U.S. supervisory process. To promote consistency in th

supervision of banks and holding companies, in 1978 Congress created the Federal Financial Institutions Examination Council 

composed of the chairpersons of the FDIC and the National Credit Union Administration, the Comptroller of the Currency, the governor of the Federal Reserve Board. As the result of legislation in 2006, the Chair of the FFIEC State Liaison Committee sthe FFIEC. The State Liaison Committee is composed of five representatives of state agencies that supervise financial institutiare to prescribe uniform federal principles and standards for the examination of depository institutions, to promote coordination the U.S. federal banking agencies, and to encourage better coordination of federal and state regulatory activities. Through the F

federal banking agencies may exchange views on important regulatory issues. Among other things, the FFIEC has developed ufederally supervised banks to file with their appropriate federal regulator. The U.S. federal banking agencies routinely share supervisory information with each other and with functional regulators, as nehave in place a number of formal and informal mechanisms for information sharing. For example, the federal banking agencie

examination, inspection reports, and other agency-to-institution communication. They also provide one another with access to structural, financial, and other supervisory information. The federal banking agencies have statutory authority to share relevanwith each other and with foreign financial sector (banking and functional) supervisors of banks and banking groups of interest t

supervisor. These are supplemented, in many instances, by written information-sharing arrangements or statements of coopera

Agency Independence, Accountability, and Transparency As discussed in the responses to the BCPs, each U.S. federal banking agency operates pursuant to an express statutory grant of 

defined objectives and responsibilities. Several circumstances ensure the operational independence and accountability of each circumstances for appointment and removal of agency heads; the self-funding nature of the agencies and independence from th

process; accountability to, consultations with, and testimony before and other submissions to Congress; multiple provisions for public reporting on, agency operations; requirements to make records of the agency available to the public through various specupon request, under certain circumstances; adherence to requirements for establishing, meeting, and reporting publicly on perio

performance targets; availability of judicial review for agency decisions; required annual reporting on regulatory and supervisoyear; legal protection for supervisory staff acting within the scope of their employment; and conflicts of interest, financial disclrestrictions applicable to agency personnel, including supervisory staff. These factors minimize the opportunity for governmen

which might compromise the agencies’ independence or impede the agencies’ ability to obtain and deploy the resources needed 
Legal Basis for Regulation and Supervision As discussed in detail for each BCP below, U.S. federal banking agencies issue and regularly update regulations and guidelines statutory authority and supplement these with policy statements, formal and informal interpretations, and supervisory guidance rulemaking is subject to procedural requirements intended to foster public and stakeholder participation in the formulation of re

The statutes and regulations provide for the licensing of banks and address permissible bank and nonbank affiliations, acquisiti

Together, the statutes, regulations, guidelines, policy statements, interpretations, and supervisory guidance and manuals establiprudential standards that banks must meet. The standards address, among other things, capital adequacy, single borrower and r

limits, asset quality, loan losses and provisioning, risk management (including requirements for addressing specific types of ris

audits, accounting standards, liquidity, and AML/CFT/anti-fraud measures. Holding companies also are subject to prudential requirements under governing statutes, regulations, guidelines, and supervisorthe principle that holding companies should serve as a source of financial and managerial strength to their subsidiary, insured bself-assessment, holding companies must comply with prudential measures governing capital adequacy, asset quality, risk mantransactions, and large exposures. The U.S. federal banking agencies keep apprised of industry, financial markets, and legislative developments, and continually e

changes in or additions to existing regulations, guidance, and policies. They also consider whether policies and procedures com

standards and collaborate with other supervisors in developing and implementing emerging best practices. 

Summary of Recent Events and Implications During the 24 months preceding the preparation of this self assessment, the United States faced the most severe financial crisis 

As noted in the Obama Administration’s June 2009 proposal for financial regulation reform2, the causes of the recent crisis em

involve numerous factors, including 

• complacency among financial intermediaries and investors bred from years without economic downturn resulted in inv

higher levels of risk for marginal, incremental returns; 

• rising asset prices, particularly in housing, hid weak credit underwriting standards and masked the growing leverage th

• among financial firms, risk-management systems did not keep pace with the complexity of new financial products; 

2 Financial Regulation Reform: A New Foundation, Department of the Treasury, June 2009. See www.financialstability.gov/docs/regs/Fi
• the lack of transparency and standards in markets for securitized loans helped to weaken underwriting standards; • market discipline broke down as investors relied excessively on credit rating agencies; and • compensation practices throughout the financial services industry rewarded short-term profits at the expense of long-te

It is clear to the U.S. federal banking agencies, in light of the recent credit and market stress, that supervisory changes are needworldwide. The year 2008 was marked by numerous, severe events, any of which could have been the most serious financial pfirst annual decline in nationwide housing prices, record foreclosure levels, substantial losses on subprime loans, the near shutd

markets, the liquidity freeze for asset-backed commercial paper and structured investment vehicles, government takeover of Fa

the failure of Lehman Brothers, Indy Mac and WaMu, the distress sales of Countrywide, Bear Stearns, and Wachovia, and the gplan to unfreeze the credit markets. In assessing U.S. compliance with the BCPs in light of these market events, the U.S. federal banking agencies considered the awell as the adequacy of U.S. implementation of them. In our view, the BCPs remain relevant and appropriate principles even daddition, we view the U.S. bank supervisors to be, for the most part, compliant with the principles—both before and during the has a rigorous supervisory regime, involving audit and attestation requirements, leverage ratios and prompt corrective action mfrequent disclosure and reporting requirements, sophisticated modeling capabilities, on-site examinations, and a strong focus on processes. However, the crisis highlights certain shortcomings: 

• Many banks' default models relied on historical correlations and, especially for various residential mortgage related exp

geography and borrower characteristics, but not on the aggregate risk exposure of subprime portfolios, including expossenior collateralized debt obligations and other structured securities. 

• Some off-balance-sheet structures were not fully considered due to the legal separateness of these structures from the r

many cases, although the bank did not have any legal obligation to support those transactions, the bank later chose to drelationships. 

• Liquidity contingency plans assumed a ready market existed for highly rated assets. This proved overly optimistic whe

concentration existed. 

• Because of abundant market liquidity, some banks began following a so-called originate-to-distribute lending model, o

loans whose risk/return characteristics may not have met the bank’s own internal investment hurdles but were sought oinvestors. In many cases, this led to loans with liberal repayment terms, reduced financial covenants, and higher borrow

• Weaknesses in executive compensation programs and corporate governance resulted in distorted incentives. 
• Weaknesses with respect to regulatory oversight and coordination existed. For example, many of the problems in the su

originated with mortgage brokers and lenders who were not affiliated with federally or state-chartered depository instit

to limited supervision. In other cases, there were not sufficient mechanisms to stabilize or resolve systemically importa

In addressing shortcomings, U.S. federal banking agencies are working with global policymakers (e.g., Basel Committee on BaFinancial Stability Board, Senior Supervisors Group, G-20) to identify existing policies needing revision or enhancement. To twithin the existing U.S. legal and regulatory framework, the U.S. supervisors will make appropriate enhancements and revision

documents are finalized, the U.S. supervisors will make appropriate changes to the U.S. framework. Policy changes are being areas, including liquidity supervision; treatment of shadow banking (off-balance-sheet vehicles, private equity, hedge funds; re

governance; enhanced regulatory capital standards (i.e., Basel II revisions); and cross-border resolution and supervisory coordi

the recent adoption by the Financial Accounting Standards Board (FASB) of two new accounting standards, Statement No. 166

of Financial Assets – an amendment of FASB Statement No. 140 (FAS 166) and Statement No. 167, Amendments to FASB Inter(FAS167). These standards become effective for an entity’s first fiscal year beginning after November 15, 2009, and will likely 

bank securitization activities and transactions as many transactions will lose sales accounting treatment. Finally, the U.S. supervisors have taken, and continue to plan for, actions to respond to the crisis including the following: 

• Performed stress assessments on 19 large banks that resulted in several banks immediately raising additional capital at 

with plans to do so. Even prior to the stress tests, banks had responded by aggressively raising capital (attracting over national banks) and improving their liquidity and reserve positions. 

• Established the FDIC’s Temporary Liquidity Guarantee Program to restore liquidity to the credit markets. 

• Joined international efforts to initiate supervisory colleges for large, globally active U.S. banks. • Directed large banks to improve their ability to aggregate risks across legal entities and product lines to identify potent

correlations, and required improved contingency funding plans. 

• Conducted targeted, leveraged lending reviews at the largest syndication banks, focusing on syndicated pipeline manag

limit setting. Also, asset quality reviews targeting banks with significant commercial real estate concentrations were co

• Initiated new data gathering, e.g., the OCC and OTS mortgage metrics project that provides data on over 60 percent of 

serviced in the United States. 
BCP Summary of Conclusions 

The following table provides an overview of assessment of compliance with the Core Principles: 

Core Principle Compliance Ra

C LC 

1 Objectives, independence, powers, transparency and cooperation: An effective system of 

banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. Each such authority should possess operational independence, transparent processes, sound governance and adequate resources, and be accountable for the discharge of its duties. A suitable legal framework for banking supervision is also necessary, including provisions relating to authorisation of banking establishments and their ongoing supervision; powers to address compliance with laws as well as safety and soundness concerns; and legal protection for supervisors. Arrangements for sharing information between supervisors and protecting the confidentiality of such information should be in place. 

X 

2 Permissible activities: The permissible activities of institutions that are licensed and 

subject to supervision as banks must be clearly defined and the use of the word “bank” in names should be controlled as far as possible. 

X 

3 Licensing criteria: The licensing authority must have the power to set criteria and reject 

applications for establishments that do not meet the standards set. The licensing process, at a minimum, should consist of an assessment of the ownership structure and governance of the bank and its wider group, including the fitness and propriety of Board members and senior management, its strategic and operating plan, internal controls and risk management, and its projected financial condition, including its capital base. Where the proposed owner or parent organisation is a foreign bank, the prior consent of its home country supervisor should be obtained. 

X 
Core Principle Compliance Ra

C LC 

4 Transfer of significant ownership: The supervisor has the power to review and reject any 

proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. 

X 

5 Major acquisitions: The supervisor has the power to review major acquisitions or 

investments by a bank, against prescribed criteria, including the establishment of crossborder operations, and confirming that corporate affiliations or structures do not expose the 

bank to undue risks or hinder effective supervision. 

X 

6 Capital adequacy: Supervisors must set prudent and appropriate minimum capital 

adequacy requirements for banks that reflect the risks that the bank undertakes, and must define the components of capital, bearing in mind its ability to absorb losses. At least for internationally active banks, these requirements must not be less than those established in the applicable Basel requirement. 

X 

7 Risk management process: Supervisors must be satisfied that banks and banking groups 

have in place a comprehensive risk management process (including Board and senior management oversight) to identify, evaluate, monitor and control or mitigate all material risks and to assess their overall capital adequacy in relation to their risk profile. These processes should be commensurate with the size and complexity of the institution. 

X 

8 Credit risk: Supervisors must be satisfied that banks have a credit risk management 

process that takes into account the risk profile of the institution, with prudent policies and processes to identify, measure, monitor and control credit risk (including counterparty risk). This would include the granting of loans and making of investments, the evaluation of the quality of such loans and investments, and the ongoing management of the loan and investment portfolios. 

X 

9 Problem assets, provisions and reserves: Supervisors must be satisfied that banks 

establish and adhere to adequate policies and processes for managing problem assets and evaluating the adequacy of provisions and reserves. 

X 
Core Principle Compliance Ra

C LC 

10 Large exposure limits: Supervisors must be satisfied that banks have policies and 

processes that enable management to identify and manage concentrations within the portfolio, and supervisors must set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. 

X 

11 Exposures to related parties: In order to prevent abuses arising from exposures (both on 

balance sheet and off balance sheet) to related parties and to address conflict of interest, 

supervisors must have in place requirements that banks extend exposures to related companies and individuals on an arm’s length basis; these exposures are effectively monitored; appropriate steps are taken to control or mitigate the risks; and write-offs of such exposures are made according to standard policies and processes. 

x 

12 Country and transfer risks: Supervisors must be satisfied that banks have adequate 

policies and processes for identifying, measuring, monitoring and controlling country risk 

and transfer risk in their international lending and investment activities, and for maintaining adequate provisions and reserves against such risks. 

X 

13 Market risks: Supervisors must be satisfied that banks have in place policies and processes 

that accurately identify, measure, monitor and control market risks; supervisors should have powers to impose specific limits and/or a specific capital charge on market risk exposures, if warranted. 

X 

14 Liquidity risk: Supervisors must be satisfied that banks have a liquidity management 

strategy that takes into account the risk profile of the institution, with prudent policies and processes to identify, measure, monitor and control liquidity risk, and to manage liquidity on a day-to-day basis. Supervisors require banks to have contingency plans for handling liquidity problems. 

X 
Core Principle Compliance Ra

C LC 

15 Operational risk: Supervisors must be satisfied that banks have in place risk management 

policies and processes to identify, assess, monitor and control/mitigate operational risk. These policies and processes should be commensurate with the size and complexity of the 

bank. 

X 

16 Interest rate risk in the banking book: Supervisors must be satisfied that banks have 

effective systems in place to identify, measure, monitor and control interest rate risk in the banking book, including a well defined strategy that has been approved by the Board and implemented by senior management; these should be appropriate to the size and complexity of such risk. 

X 

17 Internal control and audit: Supervisors must be satisfied that banks have in place internal 

controls that are adequate for the size and complexity of their business. These should 

include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent internal audit and compliance functions to test adherence to these controls as well as applicable laws and regulations. 

X 

18 Abuse of financial services: Supervisors must be satisfied that banks have adequate 

policies and processes in place, including strict “know-your-customer” rules, that promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities. 

X 

19 Supervisory approach: An effective banking supervisory system requires that supervisors 

develop and maintain a thorough understanding of the operations of individual banks and banking groups, and also of the banking system as a whole, focusing on safety and soundness, and the stability of the banking system. 

X 

20 Supervisory techniques: An effective banking supervisory system should consist of on-site 

and off-site supervision and regular contacts with bank management. 

X 
Core Principle Compliance Ra

C LC 

21 Supervisory reporting: Supervisors must have a means of collecting, reviewing and 

analysing prudential reports and statistical returns from banks on both a solo and a consolidated basis, and a means of independent verification of these reports, through either on-site examinations or use of external experts. 

X 

22 Accounting and disclosure: Supervisors must be satisfied that each bank maintains 

adequate records drawn up in accordance with accounting policies and practices that are 

widely accepted internationally, and publishes, on a regular basis, information that fairly reflects its financial condition and profitability. 

X 

23 Corrective and remedial powers of supervisors: Supervisors must have at their disposal an 

adequate range of supervisory tools to bring about timely corrective actions. This includes the ability, where appropriate, to revoke the banking licence or to recommend its revocation. 

X 

24 Consolidated supervision: An essential element of banking supervision is that supervisors 

supervise the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential norms to all aspects of the business conducted by the group worldwide. 

X 

25 Home-host relationships: Cross-border consolidated supervision requires cooperation and 

information exchange between home supervisors and the various other supervisors involved, primarily host banking supervisors. Banking supervisors must require the local operations of foreign banks to be conducted to the same standards as those required of domestic institutions. 

X 

* C = Compliant, LC = Largely Compliant, MNC = Materially Non-Compliant, NC = Non-Compliant, NA = Not A
Principle 1: Objectives, independence, powers, transparency and cooperation

An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the susuch authority should possess operational independence, transparent processes, sound governance and adequate resources, and discharge of its duties. A suitable legal framework for banking supervision is also necessary, including provisions relating to aestablishments and their ongoing supervision; powers to address compliance with laws as well as safety and soundness concerfor supervisors. Arrangements for sharing information between supervisors and protecting the confidentiality of such informaEC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(1) Responsibilities and objectives. An effective system of banking supervision will have clear responsibilit

authority involved in the supervision of banks. 

Criterion Laws are in place for banking, and for the authority (each of the authorities) involved in banking supervisi

and objectives of each of the authorities are clearly defined and publicly disclosed. 

Legal Framework 

Federal law and the laws of each of the states provide for the establishment of banks and address their perm

U.S.C. § 21 (providing for the formation of national banks). Each federal and state banking agency operatstatutory grant of authority and has clearly defined objectives and responsibilities. See, e.g., 12 U.S.C. § 1 

§ 221 et seq. (Federal Reserve); 12 U.S.C. § 1461 et seq. (OTS); and 12 U.S.C. § 1811 et seq. (FDIC). Fo

agencies, the organizing statutes, implementing regulations, guidelines, and other resources are (and are republicly available, including on the website of each agency. See 5 U.S.C. § 552(a). The lines of responsibility for banking regulation and supervision are clear, and these are described in deta

this assessment. The objective of all banking agencies is to promote safe and sound banking practices in thmaintain stability and public confidence in the banking system. The Federal Reserve has the added objecti

risk and influencing money and credit conditions in the economy in pursuit of full employment and stable an additional objective of minimizing the disruptive effects that can occur within the banking system when associations fail. The OTS has the additional objective of encouraging savings associations to provide cresoundly. 

Practices and Procedures 

Each agency issues and regularly updates regulations implementing its authority and supplements these wipolicy statements, formal and informal interpretations, and supervisory guidance and manuals. 
EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation 

P1(1) Responsibilities and objectives. An effective system of banking supervision will have clear responsibilit

authority involved in the supervision of banks. 

Criterion The laws and supporting regulations provide a framework of minimum prudential standards that banks muLegal Framework 

Together, the banking statutes, regulations, guidelines, policy statements, interpretations and supervisory g

establish a framework of minimum prudential standards that banks must meet. The standards address capiunderwriting, single borrower and related party exposure limits, asset quality, loan losses and provisioning(including requirements for addressing specific types of risks), internal controls and audits, accounting stan

AML/CFT/anti-fraud measures, among others. In addition to statutory and regulatory authorities, the fede

issue policies and regulations as deemed necessary to ensure the safety and soundness of the banks under t12 U.S.C. § 93a (OCC); and 12 U.S.C. § 1831a (FDIC). 

Practices and Procedures 

Through their examination programs and based on the agencies’ Uniform Financial Institutions Rating Sys

and assign a supervisory rating to each bank that assesses the bank’s capital adequacy, asset quality, manaliquidity, and sensitivity to market risk. In addition to the framework of minimum prudential standards that apply to banks, consistent with the lonholding companies should serve as a source of financial and managerial strength to their subsidiary banks. 

expected to use available resources to provide adequate capital funds to subsidiary banks during periods of adversity. Holding companies also are expected to maintain financial flexibility and capital-raising capaciresources to assist subsidiary banks. See 12 CFR 225.4(a)(1) for BHCs and the OTS Holding Companies H

Accordingly, holding companies must comply with prudential measures governing capital adequacy, asset 

affiliate transactions, and large exposures. 

EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation P1(1) Responsibilities and objectives. An effective system of banking supervision will have clear responsibilit

authority involved in the supervision of banks. 

Criterion Banking laws and regulations are updated as necessary to ensure that they remain effective and relevant to 

regulatory practices. 

Legal Framework 

Several factors ensure that banking laws and regulations are regularly reviewed and updated as necessary t

relevant to changing industry and regulatory practices. A number of statutes require the U.S. federal banktheir regulations at regular intervals to ensure that they remain relevant and effective and to reduce the bur

See, e.g., 12 U.S.C. §§ 611a, 1817(a)(11), and 3311. These reviews are conducted through a process that apublic (including industry) participation in developing more efficient and relevant rules. In many instances, regulations are adopted or amended to implement specific legislative initiatives or requ
EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation 

gress. These statutory provisions may have been adopted by Congress in response to specific crises or ma

concerns or recommendations, or to update the nation’s banking laws to address changes in the marketplacmade in response to judicial decisions. In some cases, the U.S. federal banking agencies have the discretion to determine the most effective form guidelines, supervisory guidance, interpretations, etc.) in which to promulgate revised or new requirementurgency or nature of issues to be addressed, change may be made as part of the agencies’ regular, periodic 

may occur more quickly through the development and issuance of policy statements or guidelines. See, e.gon Subprime Mortgage Lending,” 72 Fed. Reg. 37569 (July 10, 2007); “Interagency Statement on Sound P

Elevated Risk Complex Structured Finance Activities,” 72 Fed. Reg. 1372 (Jan. 11, 2007). 

Practices and Procedures 

As a natural corollary to the continuous process of risk-based supervision, the agencies assess their supervprocedures on an ongoing basis to ensure that they address market innovations, enhancements, and emergi

keep apprised of industry, financial markets, and legislative developments, and continually evaluate the neadditions to, existing regulations, guidance, and policies. They also consider whether policies and proceduinternational standards and collaborate with other supervisors in developing and implementing emerging b

EC 4 Principle 1: Objectives, independence, powers, transparency and cooperation P1(1) Responsibilities and objectives. An effective system of banking supervision will have clear responsibilit

authority involved in the supervision of banks. 

Criterion The supervisor confirms that information on the financial strength and performance of the industry under i

available. 

Practices and Procedures 

The U.S. federal banking agencies regularly publish or make available to the public upon request informatfinancial strength, and performance of banks subject to their jurisdiction. The information is derived from generated regulatory reports and is updated regularly. Largely, this information is made available through websites and on the website for the Federal Financial Institutions Examination Council (FFIEC). The FFI

sets and the functionality to allow for peer group performance assessments of banks and banking groups. 

or banking groups, additional financial data is required to be published pursuant to Securities and Exchang

requirements. See following websites for further information: 

www.ffiec.gov/

www.sec.gov
AC 1 Principle 1: Objectives, independence, powers, transparency and cooperation 

P1(1) Responsibilities and objectives. An effective system of banking supervision will have clear responsibilit

authority involved in the supervision of banks. 

Criterion In determining supervisory programs and allocating resources, supervisors take into account the risks pose

banking groups and the different approaches available to mitigate those risks. 

Legal Framework 

By statute, 12 U.S.C. § 1820(d), the agencies, are required to conduct a full-scope, on-site exam of each baeach twelve month period. However, the agencies can lengthen this cycle to eighteen months for banks ththresholds and supervisory rating criteria. See 12 U.S.C. § 1820(d)(4). 

Practices and Procedures 

The U.S. federal banking agencies utilize a risk-based supervisory approach, and this is extensively detaile

(see, e.g, , Federal Reserve SR letter 97-24, “Risk-Focused Framework for Supervision of Large Complex 

Reserve SR letter 97-25, “Risk-Focused Framework for the Supervision of Community Banks”) and exam

OCC Comptroller's Handbook on Bank Supervision Process, Large Bank Supervision, and Community Ba

Reserve’s Commercial Bank Examination Manual (section 1000.1); FDIC Risk Management Manual of Ex

Examination Handbook (section 060) and Holding Companies Handbook (section 100)). Special examina

certain bank operations such as trust operations (see, e.g., FDIC’s Trust Examination Manual.) As part of 

supervisory programs that are appropriate to the geographic scope and degree of specialization, sophisticatcomplexity of the activities and organization of banks. Each program is staffed by supervisory personnel wexperience applicable to the entities covered. In general, those entities presenting the greatest risk receive and comprehensive scrutiny. All of the supervisory programs consider the best approaches available to mibanking agencies’ supervisory practices are discussed in greater detail in the response to subsequent princi

EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(2) Independence, accountability and transparency. Each such authority should possess operational indepe

processes, sound governance and adequate resources, and be accountable for the discharge of its duties. 

Criterion The operational independence, accountability and governance structures of each supervisory authority are 

publicly disclosed. There is, in practice, no evidence of government or industry interference which comproindependence of each authority, or in each authority’s ability to obtain and deploy the resources needed to 

head(s) of the supervisory authority can be removed from office during his (their) term only for reasons spreason(s) for removal should be publicly disclosed. 

EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation P1(2) Independence, accountability and transparency. Each such authority should possess operational indepe
EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation 

processes, sound governance and adequate resources, and be accountable for the discharge of its duties. 

Criterion The supervisor publishes objectives and is accountable through a transparent framework for the discharge 

those objectives. Please refer to Principle 1(1), EC 1. 

Legal Framework 

Each of the U.S. federal banking agencies complies with the Government Performance and Results Act of federal agencies, in consultation with Congress and outside stakeholders, to prepare a strategic plan coverisubmit an annual performance plan and performance report. See 5 U.S.C. § 306; and 31 U.S.C. § 1115. Tassessments are incorporated into the agencies’ annual reports, which are required to be made public. The required, by separate statute, to report annually on regulatory and supervisory actions taken during the yearequirements provide tangible and transparent measures of agency performance against statutory and state

EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation P1(2) Independence, accountability and transparency. Each such authority should possess operational indepe

processes, sound governance and adequate resources, and be accountable for the discharge of its duties. 

Criterion The supervisory authority and its staff have credibility based on their professionalism and integrity. Legal Framework 

The U.S. federal banking agencies insist that agency heads and all staff maintain high professional standarintegrity. Federal laws and regulations, as well as individual conflict-of-interest rules and codes of conducbanking agencies, help to ensure that these standards are met. For some of the agencies, there are specific statutes governing ethical conduct. For example, the Comptrothe Federal Reserve staff are subject to statutory restrictions on activities and affiliations that might raise ce.g., 12 U.S.C. §§ 27 (unlawful for the Comptroller to hold an interest in a national bank), 242, 244 (respe

Reserve members from holding office in or stock of a member bank). Similarly, FDIC employees are prohin any FDIC regulated entity. In addition, members of the FDIC Board of Directors are prohibited from hoor employment in any bank or holding company during their time in office and for two years after they leacertain exceptions. Senior examination staff of the agencies generally are subject to a one year post-employment “cooling off” entities they supervised. See, e.g., 12 U.S.C. § 1820(k); 12 CFR 4, subpart E; “One-Year Restrictions on P

Activities of Senior Examiners” (OCC). Violators are subject to civil monetary penalties, can be removed 

prohibited from participating in the affairs of the bank, the holding company, or any other company for up also are prohibited from accepting loans or gratuities from banks that they examine. See 18 USC § 213. Treinforced by a number of criminal statutes, including those prohibiting corruption, bribery, theft, and frauThese laws are actively enforced. 
EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation 

Practices and Procedures 

U.S. federal banking agencies have administrative policies to ensure that appropriate codes of conduct are agencies’ policies outline the requirements for examiners and other supervisory staff concerning investmenprohibitions and recusal requirements based on considerations such as family, debt, or prior employment rReserve (Federal Reserve Administrative Manual, FRAM 5-041 and 5-035), OCC (OCC’s Ethics Bulletin Directive 2410.6 Standards of Ethical Conduct for Employees), and OTS (Examination Handbook). Each agency has general requirements related to the initial appointment of an examiner, and promotion to 

In general, the guidance specifies standard information required for initial examiner appointments, such as qualifications, citizenship, and potential conflicts with banks, holding companies or other affiliates (i.e. the completed conflicts of interest form), and outlines general requirements to be considered for appointment o

commissioned examiners status, including proficiency tests that must be completed as well as practical suprigorous commissioning process for examiners promotes high standards of performance. References: Fed040), OCC (Policies and Procedures Manual (PPM 5400-7)), FDIC (Examiner Training and Developmen

(Individual Occupational Requirements in the Office of Personnel Management’s Qualifications Handboo

Institution Examining Series).

EC 4 Principle 1: Objectives, independence, powers, transparency and cooperation P1(2) Independence, accountability and transparency. Each such authority should possess operational indepe

processes, sound governance and adequate resources, and be accountable for the discharge of its duties. 

Criterion The supervisor is financed in a manner that does not undermine its autonomy or independence and perm

supervision and oversight. This includes: • a budget that provides for staff in sufficient numbers and with skills commensurate  with the size and complexity of the institutions supervised; • salary scales that allow it to attract and retain qualified staff; • the ability to commission outside experts with the necessary professional skills and 

 independence, and subject to necessary confidentiality restrictions to conduct  supervisory tasks; ● a training budget and program that provide regular training opportunities for staff; ● a budget for computers and other equipment sufficient to equip its staff with the tools 

 needed to review the banking industry and assess individual banks and banking  groups; and ● a travel budget that allows appropriate on-site work. 

Legal Framework 

Each of the U.S. federal banking agencies is self-funding and, thus, is not subject to the congressional budcongressional appropriations. See P1(2), EC1. 
EC 4 Principle 1: Objectives, independence, powers, transparency and cooperation 

Practices and Procedures 

The U.S. federal banking agencies have adequate resources to attract and retain sufficient numbers of qua

commensurate with the size and complexity of the institutions supervised. Each of the agencies undertakeprocess to ensure its staff meets its supervisory needs. Examples include annual skills gaps analysis to det

are meeting critical supervisory needs. This entails evaluating hiring and retention programs in place to athave critical and highly marketable skills. Existing efforts that the agencies have in place are variable-pay benchmarking, and bonus programs. The salary scales, benefits, and work-life programs of the federal banbased on the U.S. Federal Government standards (12 U.S.C. § 481 (OCC)) and provide more generous com

greater flexibility to attract and retain qualified staff at each respective agency. Each U.S. federal banking different salary structure, and these salary scales or compensation packages are made available to the publwebsites: 

o Board of Governors: http://www.federalreserve.gov/careers/salary.htm

o Office of the Comptroller of the Currency: http://www.occ.treas.gov/jobs/salaries.htm

o Federal Deposit Insurance Company: http://www.fdic.gov/about/jobs/offer.html

o Office of Thrift Supervision: http://www.ots.treas.gov/docs/4/480003.pdf

The agencies have the ability to commission outside experts or consultants when and where needed to fulfparticularly during periods of financial stress. Often these are former commissioned examiners who have familiarity with the agencies’ procedures, processes, and objectives. The agencies insist that staff undergo adequate and relevant training and ensure that sufficient resources arpurpose. Broadly, the U.S. federal banking agencies have two developmental objectives: to train field exacommissioned examiners and to accomplish continuing professional development for existing commissionstaff. The agencies use a combination of internal, external, and shared training programs to achieve these shared training programs include collaboration through the FFIEC to provide continuing professional devespecialized topics. In addition, the agencies collaborate through the organization of periodic conferences othe context of current developments within the financial services industry. The agencies approve annual trprovide employees with training opportunities each year.Federal banking agencies participate in training offered by the FFIEC (see www.ffiec.gov/exam/cour

certain other regulatory agencies. All agencies are involved in developing and implementing basic and ad

to various emerging issues as well as in specialized areas such as international banking, informatiolaundering, capital markets, payment systems risk, and consumer compliance. The U.S. federal bankinmember seeking an examiner’s commission to take proficiency exams or commissioning tests. 

The agencies’ supervisory staff have sophisticated technological equipment and support tools to review assess individual banks and banking groups. The agencies are heavily invested in electronic pro
EC 4 Principle 1: Objectives, independence, powers, transparency and cooperation 

Information Technology office. The agencies maintain electronic records, obtain bank data and informasophisticated analytical processes. They also dedicate resources for the development of software and otsupervisory staff in reviewing individual institutions and the overall banking industry. Numerous app

agencies contain confidential supervisory information not available to the public. However, other wavailable to the public and allow supervisory staff to collect the necessary financial information to conand oversight. Such applications found on the FFIEC website include:

o National Information Center: www.ffiec.gov/nicpubweb/nicweb/nichome.aspx

o Central Data Repository Public Data Distribution: https://cdr.ffiec.gov/public

All of the U.S. federal banking agencies include travel as part of the cost of supervisory work and approve 

Agency examination staff perform on-site inspections of all banks every 12 or 18 months, regardless of the 

AC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(2) Independence, accountability and transparency. Each such authority should possess operational indepe

processes, sound governance and adequate resources, and be accountable for the discharge of its duties. 

Criterion The head(s) of the supervisory authority is (are) appointed for a minimum term. Legal Framework 

The heads of the U.S. federal banking agencies are appointed by the President with the advice and consent 

in office. See Principle 1(2), EC 1. The heads of the OCC and the OTS are appointed to a five-year term. also serve as directors of the FDIC. The FDIC’s three remaining directors are appointed to six-year terms appointed members is designated as Chairman for a five-year term. Members of the Federal Reserve Boarappointed to a full or to an unexpired portion of a 14-year term. On appointment by the President and with the Senate, one of the members is designated to serve as Federal Reserve Chairman, and another of the meas Vice Chairman, for a four-year term. All of these agency positions are non-partisan, and there is no exp

will resign at the conclusion of the term of the President who appointed them. 

EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(3) Legal framework. A suitable legal framework for banking supervision is also necessary, including provi

authorization of banking establishments and their ongoing supervision. 

Criterion The law identifies the authority (or authorities) responsible for granting and withdrawing banking licensesLegal Federal and state laws provide for the creation and establishment of authorities (federal and state banking a
EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation 

Framework authority to issue and revoke bank licenses. Each state has its own bank or financial institution supervisor 

revoke state bank and savings association licenses. The OCC and OTS have licensing and revocation auth

with respect to national banks and federal savings associations, respectively. See, 12 U.S.C. § 27 (OCC), 

EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation P1(3) Legal framework. A suitable legal framework for banking supervision is also necessary, including provi

authorization of banking establishments and their ongoing supervision. 

Criterion The law empowers the supervisor to set prudential rules (without changing laws). The supervisor consults 

way on proposed changes, as appropriate. 

Legal Framework 

The U.S. federal banking agencies have the authority to set, implement, and modify prudential measures wstatutory changes. Federal statutes provide clear bases for the imposition of prudential standards. See, e.g1831o(c) and 3907, 3909 (capital standards); 84, 1464(u) (single borrower lending limits); 371c and 371c-1468(a),1828a, 1828(j)(1) (affiliate transactions); 375, 375a, 375b, 1468(b), 1828(j)(2) (related party transand-soundness standards, including operational and managerial measures, asset quality and underwriting s

stock valuation standards, and compensation standards). Essentially, these provisions and others empower agencies to prescribe the scope and substance of prudential measures by rules, regulations, guidelines, or o

and amend regulations in accordance with the notice and comment requirements of the Administrative Profor open and public participation in the process. The prudential standards, as implemented by the agencies, vary in the degree of specificity of requirementrules governing affiliate and related party transactions are prescriptive, see, e.g., 12 CFR 215 (related party 

(affiliate transactions). On the other hand, the interagency safety-and-soundness guidelines impose broad 

without dictating the methods of compliance, see, e.g., 12 CFR 208, appendix D-1. This format accommopractice across the industry and allows institutions to design the form and manner of managing their opera

have the flexibility to assess and timely address emerging issues or conditions of concern. Both approacheexercises of authority, and in each case, violations can lead to enforcement actions. 

Practices and Procedures 

The U.S. federal banking agencies have published detailed compliance expectations and best practices, pripublicly available supervisory guidance and examination manuals, addressing a number of areas presentinconcerns. Among other matters, these materials address internal controls, audit, information systems, risk

and assessments of specific risk types, and asset classifications and valuations. The agencies update these 

keep apace of supervisory and market developments and industry practices, taking into account feedback rsupervisory process and, where appropriate, through formal public consultation. 
EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation 

P1(3) Legal framework. A suitable legal framework for banking supervision is also necessary, including provi

authorization of banking establishments and their ongoing supervision. 

Criterion The law or regulations empower the supervisor to obtain information from the banks and banking groups i

it deems necessary. 

Legal Framework 

The U.S. federal banking agencies have broad authority under governing statutes and regulations to obtain any other information from banks and any of their affiliates (including holding companies) in the form and 

the agencies deem necessary to determine and enforce banking laws and assess the safety and soundness ocompanies. See, e.g., Books & Records laws and regulations 12 U.S.C. §§ 161(a) and (c), 481, 484, and 1

banks and their affiliates); 12 U.S.C. §§ 1464(v), 1467(h), and 1467a(b)(2) (savings associations and their holding companies); 12 U.S.C. §1817(a) (nonmember banks and insured foreign branches); 12 U.S.C. §321817(a)(3), 1844(c) (state member banks and their affiliates, including holding companies); 1867 (bank se3105(c)(2) and 3108 (U.S. offices of foreign banks and U.S. operations of any affiliates of the foreign banksubject potentially to significant monetary penalties for failure to make available information or reports, to 

timely basis, or for submitting or publishing any false or misleading report or information. See, e.g., 12 U

1467a(r), and 1817(c)(4); 18 U.S.C. §§ 1001, 1007, 1517, and 1519.Banks and holding companies are required to file consolidated reports of condition with their primary fedequarterly basis (http://www.ffiec.gov/forms031.htm). With limited exceptions, the content of these reports available on a timely basis following submission, including through the FFIEC’s website. The agencies resubmission of a host of additional information on banks and their affiliates. A list of required reports, alon

report contents and instructions for completion, is available on the Federal Reserve’s website. 

Practices and Procedures 

In addition to standardized collection of data through various financial and structure reports, the U.S. federcollect any information needed to fulfill their supervisory responsibilities. See Principles 21 and 22 for furinformation and data banks and holding companies submit to the agencies. As mentioned in the legal fram

banking agencies have broad authority to review the records of banks. 

EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(4) Legal powers. A suitable legal framework for banking supervision is also necessary, including powers to 

laws as well as safety and soundness concerns. 

Criterion The law and regulations enable the supervisor to address compliance with laws and the safety and soundne

supervision. The law and regulations permit the supervisor to apply qualitative judgment in safeguarding tthe banks within its jurisdiction. 

Legal Framework 

As discussed in detail under Principle 23 and EC 6 of Principle 6, statutes and regulation provide clear and supervisors to address compliance with laws and the safety and soundness of institutions under their jurisd

authorities provide supervisors with discretion in determining when supervisory action is warranted and a 
EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation 

remedial measures to address matters of concern. The measures include restricting the current activities anorganization, requiring new remedial activities, withholding or conditioning approval of new activities or asuspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals frestricting the powers of managers, board directors or controlling owners, facilitating a takeover by or merinstitution, providing for the interim management of the bank, revoking or recommending the revocation o

issuing monetary fines against institutions and individuals. In general, remedial measures are imposed accthe situation. 

EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation P1(4) Legal powers. A suitable legal framework for banking supervision is also necessary, including powers to 

laws as well as safety and soundness concerns. 

Criterion The supervisor has full access to banks’ Board, management, staff and records in order to review complian

limits as well as external laws and regulations. 

Legal Framework 

As discussed in detail under Principles 19, 21, and 22, the U.S. federal banking agencies have broad statutbroad array of information from supervised entities and their affiliates, including financial data and inform

operations, structure, corporate governance, risk management, and any other details necessary to determinwith applicable laws and ensure the safety and soundness of banks. See, e.g., 12 U.S.C. §§ 93a, 161(a) and 484, 602, 625, 1464 (d) and (v), 1467(h), and 1467a(b)(2), 1817(a), 1817(a)(2), 1817(a)(3), 1820(b), 18443108. Banks and their affiliates must provide supervisors with full and complete access to their books, recfailure to do so can result in the imposition of administrative sanctions. Specifically, bank records related 

must be made available to a U.S. federal banking agency within 120 hours of a request. See 31 U.S.C. § 3

extend to the foreign operations of banks and their affiliates; however, note that the laws of foreign host cobanks in such countries from sharing certain information with the U.S. banking agencies. Also, the agenciaccess to the workpapers, reports, and other relevant materials of external auditors responsible for conductbanks. 

EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation P1(4) Legal powers. A suitable legal framework for banking supervision is also necessary, including powers to 

laws as well as safety and soundness concerns. 

Criterion When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or is likely 

unsound practices, the supervisor has the power to: ● take (and/or require a bank to take) prompt remedial action; and 

● impose a range of sanctions (including the revocation of the banking license). 
EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation 

Legal Framework 

As noted under EC 1, above, and discussed at length under Principle 23 (on remedial powers of supbanking agencies have broad authority to take (or require the bank to take) remedial measures when, in holding company is not complying with laws or regulations or is likely to be engaged or is engaged in an u

This includes the authority to impose a range of sanctions, including, where appropriate, revocation of the 

Practices and Procedures 

When a bank or holding company is found to be out of compliance with laws or regulations, or is engaged 

practices, the U.S. federal banking agencies may require the bank to take prompt remedial action or immed

existing practice and may impose a varying degree of sanctions depending on the gravity of the bank’s vioagencies follow detailed prompt corrective action requirements to address inadequate levels of capital amoagency’s respective jurisdiction. The U.S. federal banking agencies may also take formal supervisory actio

consumer protection laws. (See Principles 6 and 23). 

EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(5) Legal protection. A suitable legal framework for banking supervision is also necessary, including legal pCriterion The law provides protection to the supervisory authority and its staff against lawsuits for actions taken and

discharging their duties in good faith. 

Legal Framework 

The federal banking agencies and their staffs are generally protected against lawsuits for actions and/or omdischarging their duties in good faith. Sovereign immunity bars lawsuits without specific statutory authori

litigation. Common law qualified immunity protects federal banking agencies’ heads and staff from liabil

individual’s federal Constitutional rights in connection with employees’ performance of discretionary funcemployees’ conduct does not clearly violate established statutory or Constitutional rights. Lawsuits are permitted against federal banking agencies’ employees for acts and/or omissions that cause inthe scope of their employment pursuant to the Federal Tort Claims Act, 28 U.S.C. § 2679. In such a case, substitute itself as the defendant upon the Attorney General’s certification that an employee was acting wit

or employment at the time of the incident giving rise to the tort claim. 28 U.S.C. § 2679(d)(2). Moreoverprotects employees from lawsuits involving the execution of a statute or regulation or the exercise or perfoexercise or perform a discretionary function or duty, whether or not the employee abused the discretion inv

§ 2680(a). 

EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation P1(5) Legal protection. A suitable legal framework for banking supervision is also necessary, including legal pCriterion The supervisory authority and its staff are adequately protected against the costs of defending their actions 
EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation 

while discharging their duties in good faith. 

Legal Framework 

See P1 (5) EC 1, above. 

Practices and Procedures 

In practice, the U.S. federal banking agencies protect their agencies’ executives and staffs (during and follagainst the costs of defending their actions and/or omissions made while discharging their duties in good f

EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation P1(6) Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiali

should be in place. 

Criterion Arrangements, formal or informal, are in place for cooperation and information sharing between all domes

responsibility for the soundness of the financial system, and there is evidence that these arrangements wor

necessary. 

Legal Framework 

Unless authorized by law, it is a crime for an employee of the U.S. federal government to divulge, disclose

manner trade secrets or other confidential business information collected in the course of employment or oU.S.C. § 1905. However, the U.S. federal banking agencies have broad statutory powers that allow them tother banking supervisors both domestic and foreign. See, e.g., 12 U.S.C §§ 1817(a)(2)(A) and (C) (sharinfederal agency with supervisory or regulatory authority over the bank or other entity, or any appropriate pe(sharing of financial records, reports of examination or other information about a bank, holding company ocompany subsidiary among and between the five FFIEC member agencies, the SEC, Commodity Futures T(CFTC), and Federal Trade Commission (FTC). The importance and necessity of maintaining the confide

is highlighted in several statutory and regulatory provisions, as is the requirement that the information be u

purposes. Each of the U.S. regulatory authorities has promulgated rules and policies implementing the civrelating to the treatment of confidential supervisory and bank information. See, e.g., 12 CFR 4 (OCC); 26

Reserve); 12 CFR 309.6 (FDIC); and 12 CFR 510.5 (OTS).

Practices and Procedures 

U.S banking agencies (state and federal) have in place a number of formal and informal mechanisms for inamong other things, are an integral part of supervisory programs providing for the comprehensive consolidand holding companiess. (Also see Principle 24 for a discussion of consolidated supervision.) By statute, 

to coordinate on certain matters through the FFIEC. These matters include examinations, communication situations, and shared access to electronic databases containing examination reports, financial records, and information. For example, the FFIEC’s Task Force on Supervision and Task Force on Consumer Compliacoordination, consistent supervisory approaches, and uniform enforcement of laws and regulations. Speciand other cooperative supervisory efforts among the FFIEC agencies, are described in greater detail in the 
EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation 

(www.ffiec.gov/reports.htm). Domestically, the U.S. federal banking agencies routinely share information with each other. This typically formation of a banking group, authorization of a new activity, changes in a banking group’s structure, as wactivities, in crisis situations, and as part of periodic meetings among supervisors. Examination findings aagencies, as appropriate. The agencies refer suspected criminal violations to the law enforcement authoritThe U.S. federal banking agencies exchange information with functional regulators, such as the SEC and t

securities companies in a banking group or a financial conglomerate that includes a bank. The U.S. federal banking agencies have formal arrangements with state insurance supervisors to coordinat

activities, both on a routine and an emergency basis, with respect to particular banking groups having signoperations1. OTS has information sharing arrangements with state insurance departments in 49 states and 

These agreements generally provide for the sharing of relevant supervisory and enforcement information, 

information related to consumer complaints. The Federal Reserve and OTS make available relevant information to other banking agencies and function

financial condition, risk-management policies, and operations of a holding company that may have a mateindividual regulated subsidiary. The other banking agencies make information about bank subsidiaries of available to the Federal Reserve or OTS and to each other. Other functional regulators also provide inform

agencies concerning regulated entities within U.S. banking groups that may have an adverse effect on the bSuch sharing is an integral part of the U.S. supervisory process. The arrangements are effective in practicAdditionally, as required by section 305 of the Riegle Community Development and Regulatory Improvem

banking agencies submit a joint report annually to the U.S. Congress describing the coordination of exami

institutions that are subject to multiple supervisors. The basic principles governing these activities are set 

Policy Statement on Examination Coordination, issued in 1993. This report evidences the high priority the 

working together to identify and reduce regulatory burden and on coordinating supervisory activities, not o

1 In 2000, the OCC and the National Association of Insurance Commissioners (NAIC) agreed to a model Memorandum of Understanding th

insurance-related supervisory and enforcement information and the sharing of consumer complaints. This model agreement implements the 

requirements in GLBA and further increases cooperative efforts, supervisory coordination, and information sharing between the OCC and sof September 2008, the OCC has executed these insurance information-sharing agreements with the insurance departments of 49 states, the 

Puerto Rico. U.S. federal banking agencies maintain ongoing communication with the states through periodic meetings with the National ACommissioners (NAIC), whose members consist of the state insurance regulators.
EC 1 Principle 1: Objectives, independence, powers, transparency and cooperation 

state bank and thrift supervisors, but also with U.S. securities and insurance regulators and foreign financiaNotwithstanding the coordination that takes place among the federal and state supervisors, recent market ethat nonbank lenders and independent mortgage brokers have played in certain segments of the U.S. reside

The federal banking agencies worked with state supervisors to encourage states to adopt and apply the age

guidelines on nontraditional and subprime mortgage products to state licensed mortgage brokers. PursuanEconomic Recovery Act of 2008, the agencies also are developing a system to register mortgage loan origNationwide Mortgage Licensing System and Registry that has been developed by state regulators. 

EC 2 Principle 1: Objectives, independence, powers, transparency and cooperation P1(6) Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiali

should be in place. 

Criterion Arrangements, formal or informal, are in place, where relevant, for cooperation and information sharing w

supervisors of banks and banking groups of material interest to the home or host supervisor, and there is evarrangements work in practice, where necessary. 

Legal Framework 

The U.S. federal banking agencies have statutory and regulatory authority to share relevant supervisory inf

financial sector (banking and functional) supervisors of banks and banking groups of interest to the home o

e.g., 12 U.S.C §§ 326, 1817(a)(2)(C), 1818(v), 3109; 12 CFR 4.37(c). Under the International Banking A

specifically authorizes sharing with foreign banking supervisors, the U.S. agencies must determine that diswould not prejudice the interest of the United States. 12 U.S.C. § 3109(a).

Practices and Procedures 

The U.S. federal banking agencies have concluded multi- and bilateral cooperation arrangements with a nu

supervisors including those in Argentina, Australia, Brazil, Canada, Chile, China, Dubai, France, Germany

Netherlands, Panama, Poland, Spain, Switzerland, and the United Kingdom. A number of other arrangemcompletion. Additionally, federal banking agencies have exchanged letters outlining the conditions under 

be shared on a best efforts, case-by-case basis with supervisors from Bulgaria, El Salvador, Guatemala, JeQatar, and Slovakia. These arrangements generally cover the elements set forth in the Basel Committee’s of a Statement of Cooperation Between Banking Supervisors.” They are available to the public on requestinformation sharing arrangement with the French insurance supervisor and is negotiating similar arrangeminsurance supervisors. A formal arrangement is not required, and the federal banking agencies share infor

basis with foreign supervisors that have not entered such arrangements. The federal banking agencies rout

with banking and financial supervisors from other countries on an informal basis. In the experience of the the formal and informal arrangements for information sharing work in practice. See also Principle 25. 
EC 3 Principle 1: Objectives, independence, powers, transparency and cooperation 

P1(6) Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiali

should be in place. 

Criterion The supervisor may provide confidential information to another domestic or foreign financial sector superv

required to take reasonable steps to ensure that any confidential information released to another supervisor supervisory purposes and will be treated as confidential by the receiving party. The supervisor receiving co

from other supervisors is also required to take reasonable steps to ensure that the confidential information supervisory purposes and will be treated as confidential. 

Legal Framework 

As noted above, the U.S. federal banking agencies are authorized by statute and regulation to share informforeign banking and financial supervisors. See 12 U.S.C. §§ 326, 1817 (a)(2)(A) and (C), 1818(v), 3109, 3

In general prior to engaging in information sharing, the U.S. federal banking agencies require assurances t

be used only for lawful supervisory purposes and will be kept confidential. Under the International Bankin

specifically authorizes sharing with foreign banking supervisors, the U.S. agencies must determine that disand would not prejudice the interest of the United States. 12 U.S.C. § 3109(a). In addition, the banking agthe extent necessary, the recipient’s agreement to keep the information confidential to the “extent possible 12 U.S.C. § 3109(b). Each agency has implemented regulations and policies that restrict disclosure of confidential information. 

et seq. In addition, under a recently enacted amendment to the International Banking Act, confidential ma

foreign supervisor to a U.S. banking agency will have broad protection from compelled onward disclosure met. The information must have been obtained from the foreign supervisor through procedures used in coadministration and enforcement of U.S. federal banking laws or pursuant to a memorandum of understandbetween a federal banking agency and the foreign supervisor. In addition, the foreign supervisor must in gmake a written representation to the federal banking agency that public disclosure of the information woulapplicable to the foreign supervisor. If the requirements of the statute are met, the federal banking agencieto disclose such information except to duly authorized committees of the Congress or to comply with an or

United States in an action commenced by the United States or the federal banking agency. 12 U.S.C. § 310

Practices and Procedures 

Among examples of sharing of confidential supervisory information among domestic financial sector supeinteragency pilot program to review subprime lending practices conducted at nonbank subsidiaries of supecompanies] institutions. Under this program, the Federal Reserve, the OTS, the FTC, and a number of stat

have shared information, resources, and supervisory analyses regarding the consumer compliance posture Information sharing letters executed with the FTC and state banking supervisors enable the Federal Reserv

information with representatives of these agencies. The OCC and OTS have entered into information sharnumber of state banking supervisors as well as state insurance regulators. The information sharing arrangements discussed in response to EC 2 above generally contain detailed prov

information received pursuant to the agreements be used only for lawful supervisory purposes and addressonward sharing of information.
EC 4 Principle 1: Objectives, independence, powers, transparency and cooperation P1(6) Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiali

should be in place. 

Criterion The supervisor is able to deny any demand (other than a court order or mandate from a legislative body) fo

in its possession. 

Legal Framework 

The U.S federal banking agencies are able to deny demands for confidential information in their possessiosituations in which the federal banking agencies can be legally compelled to disclose otherwise confidentiainformation may be subpoenaed by a court, a grand jury, or a committee of the U.S. Congress. If the agenfrom a litigant, an agency, or Congress for confidential supervisory information and decline to produce the 

that obtained the subpoena may go to court to enforce it. When feasible, an agency that is being compelle

information received from another supervisor (domestic or foreign) will notify such supervisor and make r

disclosure. The federal banking agencies also must notify and provide information to U.S. law enforcemeinformation comes to their attention that indicates a possible violation of criminal law. Disclosure may als

certain statutes that provide for notification and disclosure to other agencies in specific circumstances. As 

subject to certain conditions, confidential information from foreign supervisors will have broad protection disclosure. 12 U.S.C. § 3109(c). 
Principle 2: Permissible activities

The permissible activities of institutions that are licensed and subject to supervision as banks must be clearly defined and the unames should be controlled as far as possible. EC 1 Principle 2: Permissible activities Criterion The term “bank” is clearly defined in laws or regulations. Legal Framework/ Practices and Procedures 

State and federal laws expressly provide for the establishment, operation, permissible activities and transac

entities referred to as “banks.” In general, a “bank” is an institution (a) incorporated or chartered under eit

(b) authorized to engage in activities as specified under applicable law, typically including accepting demain the business of making loans, and (c) subject to supervision by state and/or federal authorities. 1

State and federal laws also provide for the establishment of specialized institutions that engage in some ac

banks, but that generally are not called “banks”. These include “savings associations,” which provide “cregoods and services.” 12 U.S.C. 1464(a). They provide many of the services that banks provide and are sup

EC 2 Principle 2: Permissible activities Criterion The permissible activities of institutions that are licensed and subject to supervision as banks are clearly de

supervisors, or in laws or regulations. 

Legal Framework/ Practices and Procedures 

Federal and state banking laws and regulations provide clear parameters on permissible activities and transThe National Bank Act, the Home Owners’ Loan Act (HOLA), and implementing regulations specify the ptransactions of national banks and federal savings associations. For national banks, see12 U.S.C. §§ 24 (c(acting as insurance broker), and 92a (trust powers); 12 CFR 1 (investment securities activities), 2 (sales o

(initial and expanded activities), 7 (corporate powers), 9 (fiduciary activities), 23 (leasing). For federal savU.S.C. § 1464(b) and 12 CFR 557 (deposit taking and related powers); 12 U.S.C. § 1464(c) and 12 CFR 5investments); 12 CFR 559.4(f)(3)(acting as insurance broker); 12 U.S.C. § 1464(n) and 12 CFR 550 (fiduc560.37 (leasing). 

1 For the purposes of this principle, the nomenclature for banks and holding companies described in the introduction does not apply. 2 Because of the similarity in the regulation and supervision of savings associations, the federal banking agencies agreed to include them in 

assessment. This self-assessment does not address several more specialized institutions that may engage in some traditional banking activitcompanies, trust companies, credit unions, and single purpose banks. Collectively, these specialized institutions comprise only a small percmarket. 
EC 2 Principle 2: Permissible activities 

The state laws under which state banks and state savings associations are chartered and authorized to operaregulation) the permissible activities of the state banks and state savings associations. Federal law providestates’ authority to determine the permissible activities and transactions of state chartered banks and savingU.S.C. §§ 321-339a and 1828; 12 CFR 208, 303 and 362 (banks); 12 U.S.C. §§ 1463(c) and 1831e (savinggeneral, insured state chartered banks and savings associations may only engage in activities permissible f

federal savings associations respectively, unless the FDIC determines that an activity poses no significant insurance fund and the banks or savings associations is in compliance with certain capital requirements. S378, 1831a (banks); 12 U.S.C. § 1831e (savings associations). 

EC 3 Principle 2: Permissible activities Criterion The use of the word “bank” and any derivations such as “banking” in a name is limited to licensed and sup

circumstances where the general public might otherwise be misled. 

Legal Framework/ Practices and Procedures 

No entity may operate as a “bank” and engage in banking operations in the United States without a charter 

banking agency. Federal law makes it a crime for any person or entity to purport to be a bank that accepts licensed as such by an appropriate banking agency. See 12 U.S.C. § 378. In addition, states generally prousing the word “bank” in the corporation’s name unless the corporation has a bank charter. Federal law al

entity that engages in banking operations to make unauthorized use of those terms (e.g., "national", "Feder"reserve", or "Deposit Insurance") that indicate the entity has a federal banking charter, membership in the 

federal deposit insurance. 

EC 4 Principle 2: Permissible activities Criterion The taking of deposits from the public is generally reserved for institutions that are licensed and subject to Legal Framework/ Practices and Procedures 

All persons or entities engaged in demand deposit-taking are required to be subject to some degree of reguoversight by state or federal authorities. See 12 U.S.C. § 378. Persons violating this requirement are subjeincluding fines and imprisonment. In practice, most entities engaged in retail deposit-taking are licensed aas banks or savings associations. 

EC 5 Principle 2: Permissible activities 
EC 5 Principle 2: Permissible activities Criterion The supervisory or licensing authority publishes, and keeps current, a list of licensed banks and branches o

within its jurisdiction. 

Legal Framework/ Practices and Procedures 

Collectively (through the FFIEC) and separately, the U.S. federal banking agencies publish and regularly ubanks and holding companies (domestic and foreign) subject to their jurisdiction. Data accessible through 

Information Center (NIC) includes detailed financial information (including detailed information on capita

savings associations, bank holding companies, and savings and loan holding companies, on consolidated aorganizational charts for banks and bank holding companies, detailing all of their direct and indirect bank U.S. offices and bank subsidiaries of foreign banks; foreign branches and direct and indirect foreign bank 

and Edge and agreement holdings of U.S. banks; limited historical structural data; and functionality and daanalyses for individual banks and holding companies. The financial information is populated by data obtained from regulatory reports (primarily, the Call ReporReport) that are filed by banks and holding companies with the appropriate agencies quarterly and/or annu

structure data generally is updated on an event-generated basis. The website for each federal banking agenNIC website. Additional relevant data is published directly by the individual agencies. See, e.g., Annual ROperating Subsidiaries that do Business Directly with Consumers on OCC’s website.3

3 www.occ.gov/consumer/OperatingSubsidiaries.pdf 
Principle 3: Licensing criteria

The licensing authority must have the power to set criteria and reject applications for establishments that do not meet the standprocess, at a minimum, should consist of an assessment of the ownership structure and governance of the bank and its wider gand propriety of Board members and senior management, its strategic and operating plan, internal controls and risk managemefinancial condition, including its capital base. Where the proposed owner or parent organization is a foreign bank, the prior cosupervisor should be obtained. EC 1 Principle 3: Licensing criteria Criterion The licensing authority could be the banking supervisor or another competent authority. If the licensing au

supervisory authority are not the same, the supervisor has the right to have its views considered on each sp

addition, the licensing authority provides the supervisor with any information that may be material to the s

institution. 

Legal Framework/ Practices and Procedures 

Banks, whether organized under federal or state law, are regulated and supervised by their licensing authorare subject to concurrent regulation and supervision by one or more additional banking agencies. Establishinvolves obtaining related authorizations (i.e., for a license, federal deposit insurance, membership in the F

more than one agency. Under well-established practices and procedures, the licensing and other banking authorities communicate 

with respect to supervised entities. See Principle 1(6) for further information on information-sharing arrandecisions taken on related applications for licensing, deposit insurance, and Federal Reserve membership. U.S. federal banking agencies are required by law (statute or regulation) in some instances, and statutory psharing of relevant confidential information among supervisors. Often, the licensing authorities and the FD

investigations on related licensing and deposit insurance applications.

EC 2 Principle 3: Licensing criteria Criterion The licensing authority has the power to set criteria for licensing banks. These may be based on criteria set Legal Framework/ Practices and Procedures 

The authority to license banks is conferred by statute, and the criteria to be considered are set forth in statuThe authority for licensing national banks is conferred on the OCC by statute, see 12 U.S.C. § 21 et seq. w

considered and procedures to be followed are set forth in regulations issued by the OCC, see 12 CFR 5.20authorized to license federal savings associations and must make certain findings in order to approve a liceU.S.C. § 1464(e). Procedures and additional factors to be considered in licensing are prescribed by OTS r

516 (general application procedures); Id. § 552 (criteria for establishing a de novo federal savings associat

the states has the authority to license banks headquartered and operating within its jurisdiction. 
EC 2 Principle 3: Licensing criteria 

Typically, the OCC, the OTS, and the states condition licensing approvals on the receipt of deposit insuran

banks. The factors to be considered by the FDIC in authorizing deposit insurance coverage are established 1816. The application and authorization procedures are set forth in FDIC regulation, see 12 CFR 303, sub

EC 3 Principle 3: Licensing criteria Criterion The criteria for issuing licenses are consistent with those applied in ongoing supervision. Legal Framework/ Practices and Procedures 

Although not expressly required by statute, the criteria for issuing licenses are generally consistent with thsupervision. For example, in evaluating an application for approval to establish a national bank, OCC conproposed bank: (a) has organizers who are familiar with national banking laws and regulations; (b) has co

has ability and experience relevant to the type of products and services to be provided, and the scope and s(c) has capitalization, access to liquidity, and risk-management systems that are sufficient to support the prof business; (d) can reasonably be expected to achieve and maintain profitability; and (e) will operate in a See 12 CFR 5.20(f)(2). The OCC also considers other factors, including the convenience and needs of the the risk to the deposit insurance fund, and whether the proposed bank’s corporate powers are consistent wiAct and the National Bank Act. The U.S. federal banking agencies evaluate these same factors and othersgreater detail, in the course of ongoing supervision. 

EC 4 Principle 3: Licensing criteria Criterion The licensing authority has the power to reject an application if the criteria are not fulfilled or if the inform

inadequate.

Legal Framework/ Practices and Procedures 

Authority to establish and operate a bank is a privilege, not a right. Accordingly, each licensing agency haapplication if the agency determines that the applicants have not met the established criteria or if the inform

inadequate. Merely presenting evidence of compliance with each of the qualifying criteria is not sufficienlicensing agencies must evaluate the evidence and, in this respect, may conduct investigations and exercise based on all of the information presented and collected in determining whether the qualifying criteria are aparticular circumstances. 

EC 5 Principle 3: Licensing criteria Criterion The licensing authority determines that the proposed legal, managerial, operational and ownership structur

wider group will not hinder effective supervision on both a solo and a consolidated basis. 
EC 5 Principle 3: Licensing criteria 

Legal Framework/ Practices and Procedures 

Developing a complete understanding of the proposed legal, managerial, operational, and ownership struct

solo and consolidated basis, is an essential component of the licensing process. Each banking agency is re

the safety and soundness of banks. In order to fulfill this responsibility agencies must have a clear underst

internal operating and external ownership (including group) structures and be able to assess (at authorizati

supervision) the impact that those structures may have on the integrity of an bank. See “Joint Agency Stat

Banking Organizations” (April 23, 2002) (emphasizing the importance of structural assessments to safety-evaluations). If impediments exist or arise, the agencies may take appropriate remedial measures, includin

bank’s license, deposit insurance coverage, or Federal Reserve membership. 

EC 6 Principle 3: Licensing criteria Criterion The licensing authority identifies and determines the suitability of major shareholders, including the ultima

others that may exert significant influence. It also assesses the transparency of the ownership structure and capital. 

Legal Framework/ Practices and Procedures 

As part of the licensing process, applicants are required to identify prospective shareholders and key policyultimate beneficial owners. Each prospective principal shareholder (generally, those owning or controlling class of a bank’s shares) and key policymakers who are not considered “known to banking” of a bank or h

federal supervision must complete fingerprint cards and an “Interagency Biographical and Financial Reporon their current and past work experiences and financial holdings. The appropriate agency conducts a bac

investigation for information on criminal convictions, financial capacity, and expertise in the financial indu5400-9, “Bank Supervision: De Novo and Converted Banks.”1

Assessments regarding principal shareholders primarily consider whether they have the ability to provide f

proposed bank. A necessary part of this evaluation is identifying the sources of initial capital and ensuring ownership structures. 

EC 7 Principle 3: Licensing criteria Criterion A minimum initial capital amount is stipulated for all banks. Legal Framework/ Practices and 

In general, a de novo bank must have a minimum amount of initial capital. For federal savings association$2 million, net of pre-opening expenses charged to capital after the institution commences business. See 1Although the OCC does not stipulate a minimum dollar amount, see 12 CFR 5.20(h)(4) (requiring sufficie

1 http://occnet.occ/examinerlibrary/ppm/ppm-5400-9.pdf 
EC 7 Principle 3: Licensing criteria 

Procedures support the “projected volume and type of business”), national banks are de facto subject to a $2 million n

the FDIC’s imposition of that requirement for all banks receiving deposit insurance coverage. See FDIC’s Applications for Deposit Insurance”. The FDIC also expects the initial capital injection to be sufficient to 

leverage capital ratio of no less than 8 percent throughout the first three years of operation, based on a realmust retain a minimum stated amount of paid in capital funds as a condition of continuing deposit insurancPrior to issuing a license and allowing a bank to commence operations, the licensing agency will ensure thappropriate capitalization as proposed in the application and that this is available and ready to be deployed

agency will do this by verifying that the capital funds are fully available and on deposit with the institution

EC 8 Principle 3: Licensing criteria Criterion The licensing authority, at authorization, evaluates proposed directors and senior management as to expert

proper test), and any potential for conflicts of interest. The fit and proper criteria include: (i) skills and expfinancial operations commensurate with the intended activities of the bank; and (ii) no record of criminal a

regulatory judgments that make a person unfit to uphold important positions in a bank. 

Legal Framework/ Practices and Procedures 

The licensing agencies carefully evaluate proposed directors and senior management with respect to experpotential for conflicts of interest. The agencies generally consider each individual’s (a) financial institutio

experience; (b) duties and responsibilities with respect to the proposed bank and, if applicable, holding compersonal and professional financial responsibility; (d) reputation for honesty and integrity; and (e) familiar

financial needs, and general character of the community in which the bank will operate. Applicants must dprospective director has sufficient competence, experience, and ability to direct the policies of the bank in Officers must show their ability to perform their proposed duties successfully. In conducting their evaluations, the licensing agencies rely on diverse sources of information, including (a

application regarding qualifications and expertise and all positions and offices currently held or to be held 

bank’s holding company and affiliates, if applicable; (b) organizational charts, business plans, and propose

in an effort to understand the role and expectations of directors and officers; (c) completed “Interagency BReports,” including details on educational and professional experience and financial resources and dealingfingerprint cards and background checks by law enforcement to determine if the individual has any criminverify financial condition and professional positions. Reviews by supervisory staff include evaluations of the bank’s strategic objectives and corporate values to which the board of directors is actually involved in the corporate planning and budgeting processes. This rdirectors and officers respond to changes in the operating environment and adapt to changing dynamics. Aand officers also are required when a bank is not in compliance with minimum capital requirements or othcondition. 
EC 9 Principle 3: Licensing criteria 

Criterion The licensing authority reviews the proposed strategic and operating plans of the bank. This includes deter

system of corporate governance, risk management and internal controls, including those related to the detecriminal activities, as well as the oversight of proposed outsourced functions, will be in place. The operatioreflect the scope and degree of sophistication of the proposed activities of the bank. 

Legal Framework/ Practices and Procedures 

As part of the licensing process, applicants are required to submit and the licensing agencies evaluate inforproposed strategic and operating plans. See 12 CFR 5.20(h) and 543.3(c). Applicants must show that the viable and that the proposed management team has the ability to implement the plan successfully. The plaestablish the bank’s ability to achieve a reasonable market share; (b) show that the bank has reasonable ear

ability to attract and maintain adequate capital; (c) demonstrate that the bank will be responsive to commusupported by adequate policies, procedures, and management expertise so that the bank can be operated in 

Typically, applicants must provide a documented analysis of the market environment and realistic financiareasonable assumptions related to interest rates, growth, expenses, and potential losses. To evaluate corporate governance structures, the agencies must understand the board’s involvement in settclear lines of responsibility and accountability by reviewing organizational charts, business plans, and propprocedures. They specifically determine how a bank’s board of directors will approve, oversee, and commstrategic objectives and otherwise exercise its fiduciary responsibilities. Board members are expected to exercise the duties of loyalty and care, and this requires directors and officprudent and diligent business persons in conducting the affairs of the bank. Directors are responsible for (monitoring, and evaluating competent management; (b) establishing business strategies and policies; (c) massessing the progress of business operations; (d) establishing and monitoring adherence to policies and prby statute, regulation, and principles of safety and soundness; and (e) making business decisions based on meaningful deliberation. Also in evaluating the effectiveness of corporate governance systems, the agencies consider the relationshibank (its affiliates and holding company, if applicable) and any related parties, including directors, officerprincipal shareholders. This extends to evaluating (a) potential conflicts of interest; (b) the terms and cond

contracts, or business relationships, and (c) the terms of compensation (including stock-based) plans. With respect to risk-management systems and policies, applicants are expected to develop appropriate wrifunds management, and liquidity policies. They also must establish an acceptable internal control structurincluding policies and procedures necessary to prevent the bank from being used for criminal purposes (in
EC 9 Principle 3: Licensing criteria 

and terrorist financing) and for exercising appropriate oversight over outsourced functions. The operation

management framework are expected to be consistent with the complexity, risk, and scope of proposed op

Plans that involve high risk lending, a special purpose market, or significant funding from sources other thotherwise diverge from conventional bank-related financial services, require specific documentation as to proposed activities for a bank. Similarly, additional documentation is required where markets to be entereor economic conditions are marginal. 

EC 10 Principle 3: Licensing criteria Criterion The licensing authority reviews pro forma financial statements and projections for the proposed bank. This 

the adequacy of the financial strength to support the proposed strategic plan as well as financial informatioshareholders of the bank. 

Legal Framework/ Practices and Procedures 

An evaluation of the inherent risks of the applicant’s business model and reasonableness of the financial pthe licensing process since a proposed de novo bank has no financial history on which to base a financial aassessment of the adequacy of financial strength, including capital levels, to support the proposed strategic 

agencies require estimates to be fully documented, supported, and based on established growth patterns in 

market area. They also evaluate concentrations of funding sources for safety and soundness concerns and contingency funding plans are adequate for the bank’s complexity and risk profile. 

With respect to asset growth projections, the agencies generally review the nature and risk profile of the as

asset concentrations, and consider whether risk-management systems and policies sufficiently measure, idDepending on the risk profile of the assets contemplated, the licensing authority may require stress tests to maintain required minimum capital ratios and adequate profitability under adverse market conditions. 

In addition, with respect to financial projections the applicant must demonstrate that the proposed bank can 

operations and be operated profitably. The applicant must demonstrate, through realistic and supportable e

of the applicant will be sufficient to generate an adequate profit within a reasonable period of time (typicalAs previously noted, the licensing agencies assess the suitability of principal shareholders (generally defin

controlling 10 percent or more of a class of a bank’s shares). This includes consideration of whether these ability to provide financial support to the proposed bank. 

2 Pre-opening examinations of national banks evaluate readiness to begin operations. These examinations include a review of policies, proc

structures, and corporate governance. See OCC PPM 5400-9, “Bank Supervision: De Novo and Converted Banks.” See http://occnet.occ/e

5400-9.pdf. 
EC 11 Principle 3: Licensing criteria 

Criterion In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the host superviso

objection (or a statement of no objection) from the home supervisor has been received. For purposes of th

well as ongoing supervision of cross-border banking operations in its country, the host supervisor assesses supervisor practices global consolidated supervision. 

Legal Framework/ Practices and Procedures 

Foreign banks establishing a branch, agency, or a subsidiary bank in the U.S. must obtain approval both fr(the OCC in the case of federal branches and national banks or the state banking authority in the case of stbanks) and from the Federal Reserve. The licensing authority may, and the Federal Reserve generally muforeign bank, and any parent foreign bank, is subject to comprehensive and consolidated supervision by its The Federal Reserve and the licensing authority also assess the extent, if at all, to which home country supmonitor any operations between a foreign bank and any foreign nonbank parent. The adequacy of home c

evaluated at authorization and as part of ongoing supervision. The Federal Reserve and the licensing authhome country supervisor during the application process and, in making a decision on an application, take ihome country supervisor has approved (or expressed no objection) to the proposal. See 12 CFR § 28.12(b)

A foreign entity that is not a BHC must obtain OTS approval before establishing or acquiring a suassociation in the United States. If the foreign entity is a foreign bank, the OTS must determine thany foreign bank parent are subject to comprehensive and consolidated supervision by the home cmake this determination, the OTS follows procedures similar to those of the Federal Reserve. 

EC 12 Principle 3: Licensing criteria Criterion If the licensing, or supervisory, authority determines that the license was based on false information, the liLegal Framework/ Practices and Procedures 

Providing false or misleading information can provide a basis for civil, administrative, and criminal liabiliinclude license revocation. See12 U.S.C. § 93(a); see also 12 U.S.C. § 327 (forfeiture of Federal Reserve 

application to establish a de novo bank, the organizers must certify that the information contained in the apexamined carefully and that it is true, correct, and complete as of the date submitted. They also acknowledmisrepresentations or omissions of material facts with respect to the application may be grounds for denial license. Similar representations are made on applications for federal deposit insurance coverage and for m

Reserve. 

EC 13 Principle 3: Licensing criteria Criterion The Board, collectively, must have a sound knowledge of each of the types of activities the bank intends to 

risks. 
EC 13 Principle 3: Licensing criteria Legal Framework/ Practices and Procedures 

In general, the licensing agencies require applicants to show that the members of a bank’s board of directoestablish and operate the bank in a safe and sound manner, considering the economic and competitive envibe served. See 12 CFR 5.20(g)(1) and 12 CFR 543.3(d)(2). At a minimum, this standard presumes that thcollectively, has a sound knowledge of each of the types of activities the bank intends to pursue and the as

AC 1 Principle 3: Licensing criteria Criterion The assessment of the application includes the ability of the shareholders to supply additional financial supLegal Framework/ Practices and Procedures 

As noted, assessments regarding principal shareholders primarily consider whether they have the ability to to the proposed bank. In addition, a holding company that controls a bank is expected to serve as source ostrength to its subsidiary banks. The holding company is expected to use available resources to provide adsubsidiary banks during periods of financial stress or adversity. The holding company also is expected to flexibility and capital-raising capacity to obtain additional resources to assist subsidiary banks. See 12 CF

AC 2 Principle 3: Licensing criteria Criterion The licensing or supervisory authority has policies and processes in place to monitor the progress of new e

business and strategic goals, and to determine that supervisory requirements outlined in the license approv

Legal Framework/ Practices and Procedures 

The U.S. federal banking agencies monitor the progress of de novo banks in meeting business plans and stof time after licensing (generally, two or three years) during annual on-site reviews. These reviews also inwhether the banks have complied with any other conditions imposed as part of licensing3. After this perio

activities, if permissible under state and federal law, are subject to review during periodic safety-and-sounaddition, de novo banks are required to give the licensing and insurance agencies prior notice of any changplan during the first three years of operation. 

3 In addition to annual, full scope examinations, an on-site examination of national banks is conducted within 180 days of opening to assess 

relation to its business plan and the effectiveness of its internal controls and to test its compliance with policies. See OCC PPM 5400-9, “Ba

Converted Banks (http://occnet.occ/examinerlibrary/ppm/ppm-5400-9.pdf). A national bank must receive no objection from the OCC befor

deviation from its business plan. 
Principle 4: Transfer of significant ownershipThe supervisor has the power to review and reject any proposals to transfer significant ownership or controlling interests held existing banks to other parties. (Reference documents: Basel Committee Parallel-owned banking structures, January 20031; and Shell banks and booking offEC 1 Principle 4: Transfer of significant ownership Criterion Laws or regulations contain clear definitions of “significant” ownership and “controlling interest”. Legal Framework/ Practices and Procedures 

Four federal statutes (and their implementing regulations) define significant ownership and controlling inteproposed changes in ownership, control, or structure of banks. In each instance, the circumstances triggeri

authorization are clear. The U.S. federal banking agencies have statutory authority under the Change in Bank Control Act (CIBC A§ 1817(j), to review and reject proposals involving significant changes in ownership or control of banks. Iauthorization by the appropriate federal banking agency is required for any person to acquire “control” of 

purpose is defined as “the power, directly or indirectly, to direct the management or policies of an insured 

vote 25 per centum or more of any class of voting securities of an insured depository institution.” Id. §181

circumstances a rebuttable presumption of control arises when a person, as a result of a proposed transactiohold with the power to vote 10 percent or more of any class of voting securities. A “person” for purposes 

an individual, a group of individuals acting in concert, or certain entities (e.g. corporations, partnerships, trbanks but that do not qualify as bank holding companies. The agency processing the notice is required by 

appropriate state banking agency when the proposal involves a state chartered bank. The agencies have auacquisitions based upon criteria enumerated in the CIBC Act. In general, prior authorization of the Federal Reserve is required under the Bank Holding Company Act (B

1842(a), for a company that is subject to the BHC Act to directly or indirectly acquire control of a bank or 

purpose generally includes direct or indirect ownership, control, or the power to vote 25 percent or more of securities of a bank or BHC. A rebuttable presumption of control is presented when the company, as a restransaction, would own, control, or hold with the power to vote between 10 percent and 24.99 percent of a addition, a presumption of control may exist at the 5 percent share level under certain circumstances. “Coninclude (a) control over the election of a majority of directors (or persons exercising similar functions); or 

directly or indirectly a controlling influence over the management or policies of the bank or BHC. See 12 existing BHCs, Federal Reserve authorization is required before the BHC can acquire, directly or indirectly

1 www.bis.org/publ/bcbs94.pdf 2 www.bis.org/publ/bcbs95.pdf 
EC 1 Principle 4: Transfer of significant ownership 

class of voting shares of another bank. See 12 U.S.C. § 1842(a)(3). The Federal Reserve generally is requstate banking agency and/or the OCC (as appropriate) in processing the request for authorization. See 12 Ustatute, the Federal Reserve cannot approve a BHC application under certain enumerated circumstances. Sand 12 CFR 225.13. Prior authorization of the OTS is required under the Home Owners’ Loan Act (HOLA), 12 U.S.C. § 1467aor indirectly to acquire control of a savings association or savings and loan holding company (SLHC). The under the HOLA is similar to the BHC Act definition of control. Approval criteria for SLHC applications criteria for BHC Act applications, and by statute OTS cannot approve a SLHC application under certain ci

U.S.C. § 1467a(e)(2). In addition, subject to statutorily enumerated exceptions, OTS approval is required bacquire, directly or indirectly, more than 5 percent of a class of voting securities of another savings associa

U.S.C. § 1467a(e)(1)(A)(iii). Changes of control or ownership of a bank resulting from a merger transaction fall under the Bank Merger 

1828(c). The BMA requires prior approval of the appropriate U.S. federal banking agency before any bank insured or an uninsured bank. The agency must consider the views of the U.S. Department of Justice regaraspects of any proposed bank merger involving unaffiliated insured depository institutions. An agency maapplication based upon the factors enumerated in the BMA; denial is required where the agency determine

in a monopoly. Mergers of BHCs must be approved under the BHC Act, and mergers of SLHCs must be a

EC 2 Principle 4: Transfer of significant ownership Criterion There are requirements to obtain supervisory approval or provide immediate notification of proposed chan

change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threcontrolling interest. 

Legal Framework/ Practices and Procedures 

The implementing regulations for the CIBC Act, the BHC Act, and the HOLA set forth procedures that mu

change in ownership (including beneficial ownership), the exercise of voting rights over a particular threshor holding company. Submission of a prior notice under the CIBC Act is required, but the Act exempts vatransactions from this requirement or requires 90-days after-the-fact notice for other categories of transactiFederal Reserve’s and OTS’s regulations provide for the filing of either an application or prior notice with 

acquisition of a bank, identify a limited set of transactions not requiring agency approval, and allow for a wrequirements under certain circumstances. See 12 CFR 225, subpart B, and 12 CFR 574. Prior approval rbank merger transactions are set forth in the BMA. 
EC 3 Principle 4: Transfer of significant ownership Criterion The supervisor has the power to reject any proposal for a change in significant ownership, including benef

controlling interest, or prevent the exercise of voting rights in respect of such investments, if they do not m

those used for approving new banks. 

Legal Framework/ Practices and Procedures 

The federal banking agencies have the power to reject a proposal for a change in ownership. In general, th

respect to proposed changes in significant ownership (including beneficial ownership) or control of banks 

used in approving new banks. Common criteria include (a) the financial condition and integrity of the own

competence, experience, and integrity of management; (c) the future prospects of the bank; (d) business pl

the impact of the proposal on the safety and soundness of the bank and (f) the convenience and needs of thserved. These same factors are considered under the BMA, the BHC Act, and the HOLA. In addition, und

BMA, the BHC Act, and the HOLA, the agencies also evaluate the competitive effects of the proposal. A under any of these statutes may be denied on any of the grounds considered, or an agency may impose con

limiting an acquirer’s exercise of voting rights. 

EC 4 Principle 4: Transfer of significant ownership Criterion The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and hold

shareholders or those that exert controlling influence, including the identities of beneficial owners of sharecustodians and through vehicles which might be used to disguise ownership. 

Legal Framework/ Practices and Procedures 

The agencies obtain from banks and holding companies through annual reporting and/or on-site examinatsignificant shareholders, including those that may exert a controlling influence and the identities of beneficReserve, for example, requires the annual submission of the identities of those shareholders who own or coa class of voting shares of a bank or BHC. OTS on-site examinations will review stock ownership and repshareholders owning more than 5 percent of the outstanding stock. Controlling shareholders are monitored surveillance. 

EC 5 Principle 4: Transfer of significant ownership Criterion The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change o

place without the necessary notification to or approval from the supervisor. 

Legal Framework/ Practices and 

The agencies can and, as appropriate, do require after-the-fact requests for authorization for changes in connecessary notice to, or approval of, the agencies. In evaluating such requests, the agencies consider whethauthorization in the first instance was a knowing violation of the law. (Such a violation could result in the monetary penalties against participants and sanctions against any “institution-affiliated party” up to and in
EC 5 Principle 4: Transfer of significant ownership Procedures agencies also consider whether appropriate policies and procedures have been put in place to ensure that fu

occur. The agencies have the authority to deny or condition an after-the-fact request for authorization. 

AC 1 Principle 4: Transfer of significant ownership Criterion Laws or regulations provide, or the supervisor ensures, that banks must notify the supervisor as soon as the

material information which may negatively affect the suitability of a major shareholder. 

Legal Framework/ Practices and Procedures 

The agencies expect controlling shareholders, or the bank(s) with which they are affiliated, to provide the notice of any material information that would impact the shareholders’ continued suitability. Federal statuan institution submits false or misleading report or information to an agency. See, e.g., 12 U.S.C. § 164(a)disclose material information regarding a controlling shareholder when providing information to an agency provisions. Also, federal banking agency supervisors meet with and, in that connection, generally assess t

integrity of officers and directors during on-site reviews. At times, these meetings and evaluations include 

Nevertheless, these evaluations do not impact the affirmative disclosure obligation, noted above. Further, section 19 of the Federal Deposit Insurance Act (FDIA), 12 U.S.C. § 1829, prohibits a person who 

any criminal offense involving dishonesty or a breach of trust, or money laundering, or has agreed to enter or similar program in connection with a prosecution for such offense, from becoming, or continuing as, an with respect to a bank or holding company; from owning or controlling, directly or indirectly, any bank; or directly or indirectly, in the conduct of the affairs of any bank. Section 19(b) of the FDIA, 12 U.S.C. §1829(b), states that whoever knowingly violates the statute shall b

$1,000,000 for each day the prohibition is violated or imprisoned for not more than five years or both.
Principle 5: Major acquisitionsThe supervisor has the power to review major acquisitions or investments by a bank, against prescribed criteria, including the border operations, and confirming that corporate affiliations or structures do not expose the bank to undue risks or hinder effeEC 1 Principle 5: Major acquisitions Criterion Laws or regulations clearly define what types and amounts (absolute and/or in relation to a bank’s capital) 

investments need prior supervisory approval. 

Legal Framework/ Practices and Procedures 

Federal and state laws limit and define the types of acquisitions or investments banks may make. For bankactivities and investments are set forth in the statutes discussed under Principle 2 and the agencies’ implem

agencies have established regulatory criteria for prior review of major acquisitions or investments of bank

Edge and agreement corporations). Not every investment or acquisition must be reviewed in advance by tprocedural criteria have been designed to allow the banking supervisors to review acquisitions or investmesignificant effect on a bank’s condition (e.g., mergers and acquisitions of subsidiaries). Under the Federal Reserve’s Regulation K (12 CFR 211), foreign investments by member banks may be mconsent, prior notice, or application procedures. Similarly, the FDIC’s International Banking regulations (

state nonmember banks to make foreign investments under general consent or with prior approval after the 

The regulations set forth criteria for determining the appropriate procedure in 12 CFR 347.117, 347.118, aCFR 28.3, national banks acquiring an interest in an Edge or Agreement corporation, foreign bank or other 

provide notice to the OCC. 

With respect to federal savings associations, the OTS’s Lending and Investment Regulation, 12 CFR 560, Organization Regulation part 559, apply to both domestic and foreign activities and investments. The Banand the Savings and Loan Holding Company Act (section 10 of the HOLA) set forth the permissible activirespectively. See 12 U.S.C. §§ 1843(c) and 1843(k) and 12 U.S.C. § 1467a(c). The OTS’s SLHC regulatidomestic and foreign activities and investments. See 12 CFR 584.

EC 2 Principle 5: Major acquisitions Criterion Laws or regulations provide criteria by which to judge individual proposals. Legal Framework/ Practices and Procedures 

Major acquisitions and business combinations are subject to approval by federal authorities. Implementing 

criteria by which individual proposals are to be judged. In some instances, these criteria also are specified 

considered in reviewing such proposals include competitive concerns, financial and managerial resources, concerns, and future prospects of the affected bank (see 12 CFR 5.33(e)). Where acquisitions by a holding 
EC 2 Principle 5: Major acquisitions 

require agency approval, applicable statutes and regulations provide review criteria1. The federal banking agencies’ regulations set forth preconditions for foreign activities and investments. Tagencies expect that investments and foreign activities, whether conducted directly or indirectly, will be cobanking or financial nature and those necessary to carry on such activities2. At all times, investors must ac

standards of banking or financial prudence, with due regard for diversification of risks, suitable liquidity, aTo be eligible to make foreign investments, the investor and its parent(s) must be in compliance with appli

adequacy standards. In order to make investments under general consent authority, the investor and any inhave received at least a composite rating of “satisfactory” at the most recent examination. 

EC 3 Principle 5: Major acquisitions Criterion Consistent with the licensing requirements, among the objective criteria that the supervisor uses is that any 

investments do not expose the bank to undue risks or hinder effective supervision. The supervisor can prohmajor acquisitions/investments (including the establishment of foreign branches or subsidiaries) in countri

other regulations prohibiting information flows deemed necessary for adequate consolidated supervision. 

Legal Framework/ Practices and Procedures 

In all instances in which a notice or application is required for a proposed acquisition or investment, the ag

acquisition or investment would expose a bank to undue risk or would hinder effective supervision. When 

organizations to establish foreign operations (including an office or subsidiary), the federal banking agenc

to show, and the federal banking agencies must determine, that the laws or regulations of the foreign jurisdthe federal banking agencies from obtaining information needed to determine and enforce compliance with federal banking agencies have the authority to deny a request for authorization if they determine that they obtain adequate information for the exercise of consolidated supervision. See Principles 24 and 25 for furt

CFR 211.13(a)(3). 

EC 4 Principle 5: Major acquisitions Criterion The supervisor determines that the bank has, from the outset, adequate financial and organizational resourc

acquisition/investment. 

Legal For those proposals requiring authorization, the federal banking agencies consider whether the bank or hol

1 In considering some types of applications, federal banking agencies are required to assess bank’s record of helping to meet the credit need

which the bank is chartered, consistent with the safe and sound operation of the bank, and to take this record into account in the agency’s evcombination. 

2 A small number of “grandfathered” SLHCs are not subject to this limitation. 
EC 4 Principle 5: Major acquisitions Framework/ Practices and Procedures 

financial and organizational resources to support the acquisition or investment. This includes, but is not lithe amount and source of initial funding, the capital condition and examination ratings of the investor (andholding company), the policies and procedures that would be implemented at the target (including to ensurAML/CFT requirements), and the measures that the investor/bank or holding company would use to overstarget. For examples, see OCC’s Licensing Manual: Business Combinations Booklet3; Investment in Sub

sections 230 and 510 of the OTS Applications Processing Handbook.4

EC 5 Principle 5: Major acquisitions Criterion Laws or regulations clearly define for which cases notification after the acquisition or investment is suffici

primarily refer to activities closely related to banking and the investment being small relative to the bank’s 

Legal Framework/ Practices and Procedures 

Implementing regulations define the circumstances under which acquisitions or investments may be made (i.e., without prior approval of, or notice to, a federal banking agency). In general, the general consent procapital levels and quality of management of the investor and its parents, if any, or otherwise are restricted investment. The Federal Reserve requires after-the-fact notification for a bank or holding company’s acquisition of int

company (i.e., a company that is not a BHC, bank organized under U.S. law, or foreign banking organizatiactivities closely related to banking. A specific reporting form (Y-10) is used for this purpose. 

For national banks, the OCC regulations define cases where after-the-fact notification is available for acqu

These instances involve activities which have been previously determined to be permissible activities and standards of being well-capitalized and well-managed. Other cases require prior approval. The acquisitio

another bank by merger always requires prior approval. For examples, see OCC’s Licensing Manual: Bus

SLHCs file periodic reports with OTS and are required to disclose material investments. 

EC 6 Principle 5: Major acquisitions Criterion The supervisor is aware of the risks that non-banking activities can pose to a banking group and has the me

mitigate those risks. 

Legal Framework/ 

The federal banking agencies are aware of the risks that nonbanking activities can pose to a bank Significant nonbanking activities must be approved in advance by the federal banking agencies an

3http://www.occ.gov/corpbook/group2/public/pdf/bizcombo.pdf 4 http://www.occ.gov/corpbook/group2/public/pdf/opsubs.pdf 
EC 6 Principle 5: Major acquisitions Practices and Procedures 

agencies have the authority to supervise and examine all of the bank’s affiliates and subsidiaries, providers. See, for example, OCC’s Licensing Manual: Investment in Subsidiaries and Equities5

Agencies6. The Federal Reserve is responsible for approving the establishment of BHCs and the

and examines the activities of BHCs on a consolidated basis. The OTS examines savings associatconsolidated basis, examines SLHCs and their subsidiaries. There are statutory provisions designed to protect against a bank suffering losses in transactions wPrinciple 11 for further information. During examinations, federal supervisors review transaction

its affiliates to determine compliance with such provisions. If there are transactions that pose safeconcerns for the bank, federal supervisors, as appropriate, can take actions, formal and informal, t

action is taken and that the bank is protected.

AC 1 Principle 5: Major acquisitions Criterion When a bank wishes to acquire a significant holding in a financial institution in another country, the super

consideration the quality of supervision in that country and its own ability to exercise supervision on a con

Legal Framework/ Practices and Procedures 

In practice, when a bank seeks to acquire a direct or indirect significant holding in a foreign financial instit

agencies consider the quality of host country supervision and its own ability to exercise supervision on a cof this evaluation, the federal banking agencies consider whether they will be able to obtain information (d

and from the bank or holding company) needed to determine and enforce compliance with U.S. banking laconsolidated supervision. Particularly for those jurisdictions in which U.S. banks and holding companies 

significant operations, the federal banking agencies confirm that the bank or holding company is aware of 

restrictions that may be imposed on its operations. In all instances, the federal banking agencies inquire in

country authorization, the policies and procedures to be applied at the foreign financial institution, and the holding company will put in place to oversee and monitor the operations of the foreign financial institution

5 http://www.occ.gov/corpbook/group2/public/pdf/opsubs.pdf 6 http://occnet.occ/examinerlibrary/manual/fba.pdf 
Principle 6: Capital adequacySupervisors must set prudent and appropriate minimum capital adequacy requirements for banks that reflect the risks that the define the components of capital, bearing in mind its ability to absorb losses. At least for internationally active banks, these reless than those established in the applicable Basel requirement. EC 1 Principle 6: Capital adequacy Criterion Laws or regulations require all banks to calculate and consistently maintain a minimum capital adequacy r

the supervisor define the components of capital, ensuring that emphasis is given to those elements of capit

losses. 

Legal Framework 

Federal statutes (1) authorize the federal banking agencies to establish minimum capital requirements for bfederal banking agencies to impose two types of capital adequacy standards on banks. See 12 USC § 1831

Federal banking agencies also have the authority to establish minimum capital requirements for certain affBHCs. See 12 USC § 3907, 3909(b). Under those authorities, the federal banking agencies have adopted banks and BHCs, which include both risk-based capital and leverage capital requirements. See 12 CFR 3.appendixes A, B, and C (national banks); 12 CFR 325.3, 12 CFR Part 325, appendices A, C, and D (state n

CFR Part 208, appendixes A, B, E, and F (state member banks); 12 CFR Part 225, appendixes A, B, D, E, companies); 12 CFR Part 567 (savings associations). The leverage capital requirement supplements the rirequirement and establishes a minimum ratio of a bank’s or BHC's tier 1 capital to total balance-sheet asselimits the extent to which a bank or BHC is able to fund itself with debt. The federal banking agencies have implemented bifurcated risk-based capital frameworks for banks and Bcapital framework (advanced approaches final rule), is mandatory for “core banking organizations” and avbasis to other banks and BHCs. This rule is consistent with the advanced approaches of the Basel II Capit

the Basel Committee on Banking Supervision. Core banking organizations include banks and BHCs that hof total consolidated assets or $10 billion or more of on-balance-sheet foreign exposure. All other U.S. ba

to the general risk-based capital framework that is consistent with the Basel I Capital Accord (general riskrisk-based capital rule for trading book activities is based on the market risk amendment to Basel I, adopteagencies in 1996 (market risk rule).2 The federal banking agencies have also issued a proposed rule that w

II standardized approach (standardized approach rule) with certain modifications to address U.S. markets, 

mortgages. The proposal would permit banks and BHCs (other than core banking organizations subject to 

1 As discussed in AC 4, the risk-based capital requirement differs for BHCs with consolidated assets of $500 million or less. 2 The OTS did not join the other federal banking agencies in adopting the market risk rule in 1996 as it was not applicable to the trading act

associations at that time. The OTS plans to join the other federal banking agencies in any future market risk amendment proposals due to inactivities. 
EC 1 Principle 6: Capital adequacy 

final rule) to choose to remain under the general risk-based capital rule or opt into the standardized approaproposal. However, a bank or BHC that chooses to opt in to the standardized approach rule must adopt alrule, including the operational risk capital charge and public disclosure requirements. Additionally, if one of a BHC decides to apply the proposed standardized approach rule, then all related banks and the parent B

comply with the rule unless the primary federal banking supervisor of a related bank or BHC approves a reto remain under the general risk-based capital rule. See 73 Fed. Reg. 43982 (July 29, 2008). The U.S. risk-based capital rules define the components of tier 1, tier 2, and tier 3 capital and focus on thoare available to absorb losses. Allowable capital for banks and BHCs conforms to the Basel Capital Accor

methodology for calculating tier 1 and tier 2 capital is detailed in the practices and procedures section of E

Practices and Procedures 

Banks and BHCs are subject to tier 1 and total risk-based capital ratio requirements on a consolidated basi

requirements for individual banks and BHCs are 4 percent tier 1 risk-based capital, 8 percent total risk-bastier 1 leverage capital (3 percent tier 1 leverage capital is the minimum requirement for banks and BHCs ratheir respective rating systems and for BHCs that have implemented the market risk rule). Most banks and capital levels well above these minimum requirements. For the purposes of calculating the risk-based capital ratios, a bank’s or BHC’s total capital consists of two capital (core capital elements) and tier 2 capital (supplementary capital elements). To qualify as tier 1 or tinstruments must be unsecured, and may not contain or be covered by any covenants, terms, or restrictions safe and sound banking practices. See section 3020 of the Federal Reserve’s Commercial Bank ExaminatiComptroller’s Corporate Manual on Capital and Dividends (November 2007), the FDIC’s Risk ManagemExamination Policies (Section 2.1 – Capital) and Section 0100 of the OTS Examination Handbook for a fudescription of tier 1 and tier 2 capital. See also 12 CFR Part 3, appendix A (OCC); 12 CFR Part 208, appeand 12 CFR Part 225, appendix A (Federal Reserve); 12 CFR 567.5 (OTS) and 12 CFR Part 325, appendix In addition to the components of tier 1 and tier 2 capital described above, tier 3 capital is used to protect agcapital is unsecured subordinated debt that has several other characteristics that are described in the markePart 3 appendix B; 12 CFR Part 208, appendix E; and 12 CFR Part 225, appendix E). Federal banking supand regulatory capital eligibility of more complex capital instruments. Capital elements for both banks an

case-by-case basis to determine their ability to absorb potential losses. In addition, the Federal Reserve issCFR part 225), amended in March 2009 (see http://www.federalreserve.gov/newsevents/press/bcreg/2009

3 The OTS maintains standardized capital requirements for all savings associations. The OTS does not apply a single standardized requirem

SLHCs are too diverse to develop a single, meaningful capital ratio requirement, since many of these companies are engaged in significant lbanking. The OTS takes a case-by-case approach that considers the overall risk profile of the entire conglomerate to ensure solvency and to on a consolidated basis. Generally, the OTS considers three capital measures in determining SLHC capital sufficiency: GAAP equity; tangsimilar to tier 1 core capital ratio for SLHCs that are primarily engaged in financial activities. 
EC 1 Principle 6: Capital adequacy 

the limits on the extent to which trust preferred securities can be included in BHC regulatory capital. The preferred securities in SLHC capital. For the OCC, see Interpretive Letter 894 (March 10, 2000).4

For more information regarding the qualifying components of tier 1 and tier 2 capital, review the risk-base

banks (12 CFR Part 3, appendices A, B, and C); and the “Capital Adequacy Guidelines for State Member BMeasure” (Capital Adequacy Guidelines; 12 CFR Part 208, appendices A and F), “Capital Adequacy GuidCompanies: Risk-Based Measure” (Capital Adequacy Guidelines; 12 CFR Part 225, appendices A and G), “Assessment of Capital Adequacy,” in the CBEM . For the OTS, see 12 CFR 567.5 and Examination Hanappendix A. For the FDIC, see 12 CFR Part 325, appendix A. In addition, all banks are required to report calculation of their risk-based capital ratios on schedule RC-R of the Consolidated Reports of Condition anForms FFIEC 031 and FFIEC 041, and TFR Schedule CCR). BHCs are required to report data quarterly orisk-based capital ratios on schedule HC-R of the Consolidated Financial Statements for Bank Holding Co

These materials apply to all of the criteria in Principle 6.

EC 2 Principle 6: Capital adequacy Criterion At least for internationally active banks, the definition of capital, the method of calculation and the ratio re

those established in the applicable Basel requirement. 

Legal Framework 

As indicated, all banks and most BHCs, 5 regardless of size, are subject to risk-based capital rules consiste

Basel Capital Accords. Large, internationally active banks are subject to the advanced approaches final rucalculate their risk-based capital ratios under that rule (72 Fed. Reg. 69288 (Dec. 7, 2007)). The U.S. risk-provide for definitions of capital, methods of calculation, and required ratios no lower than those imposed Capital Accord. 

Practices and Procedures 

The definition of capital, the method of calculation, and the minimum ratios required for U.S. banks and B

above) are based on the Basel I and Basel II Capital Accords (including the market risk amendment for cotime, the general risk-based capital rule applies to U.S. banks and BHCs on a consolidated basis (with the requirements for market risk, which, as discussed below, only apply to certain large, complex, commercial 

description of the general risk-based capital requirements, see 12 CFR Part 3, appendix A (national banks)

appendix A (state member banks); 12 CFR Part 225, appendix A (BHCs); 12 CFR Part 325, appendix A (s

and 12 CFR Part 567 (savings associations). Federal banking supervisors expect certain large, complex banks and BHCs to create internal processes t

4 www.occ.gov/interp/oct00/int894.pdf 5 See AC 4 regarding BHCs with consolidated assets of $500 million or less. 
EC 2 Principle 6: Capital adequacy 

(consistent with the 1996 market risk amendment). The market risk rule applies to any commercial bactivity (on a worldwide consolidated basis) equal to 10 percent or more of its total assets, or $1 billion o

basis, the federal banking agencies may require a bank or BHC that does not meet the applicability cmarket risk rule if deemed necessary for safety-and-soundness reasons (see AC 5), or may exclude a ba

applicability criteria if its recent or current exposure is not reflective of the level of its ongoing trading act

does not meet the applicability criteria may, subject to supervisory approval, comply voluntarily with the mIn addition to the general risk-based capital rule currently applied to U.S. commercial banks and BHCs, th

have adopted the advanced approaches final rule and are currently in the process of implementing this ruleapproaches final rule applies all three pillars of the advanced Basel II approaches on a mandatory basis to assets of at least $250 billion or consolidated on-balance-sheet foreign exposures of $10 billion or more. Bthe advanced approaches final rule also remain subject to the market risk rule, where applicable. Any othe

to the advanced approaches final rule, provided it meets all minimum qualifying criteria. While the advanc

went into effect on April 1, 2008, mandatory banks were expected to submit a bank- or BHC-specific impl

months, and generally must begin a parallel run of the advanced approaches final rule and the general risk-

than April 1, 2010. 72 Fed. Reg. 69288 (Dec. 7, 2007). As more fully described in EC 6, U.S. banks also are subject to the federal banking agencies’ prompt-correrequirements that establish a capital-based supervisory scheme that requires federal banking supervisors to stringent restrictions on banks as their regulatory capital levels decline. Because of these restrictions, mos

maintain capital levels at or above the “well capitalized” thresholds, which exceed the capital thresholds spCapital Accords. Specifically, to be “well capitalized,” a bank must have a total risk-based capital ratio of 

tier 1 risk-based capital ratio of 6 percent or greater; and a leverage ratio of 5 percent or greater. 

EC 3 Principle 6: Capital adequacy Criterion The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposureLegal Framework 

The risk-based capital rules require banks and BHCs to hold capital commensurate with the level and natu

they are exposed. The federal banking agencies have broad statutory authority to establish minimum capitBHC as an agency, at its discretion, deems necessary or appropriate in light of the particular circumstance3909. Under the risk-based capital rules, the federal banking agencies have authority to impose specific ca

more exposures if the applicable capital charge under the rules is not appropriate for the exposures. See 12 CFR Parts 208 and 225, appendix A, § IV, 12 CFR Part 208, appendix F, section 1(c), 12 CFR Part 225, ap(Federal Reserve); 12 CFR 567.11 (OTS). 
EC 3 Principle 6: Capital adequacy Practices and Procedures 

 Under the federal banking agencies’ Uniform Financial Institutions Rating System (known as CAMELS)6

supervisors assess a bank’s capital adequacy during every full-scope examination. This assessment is reflecomponent of the CAMELS rating and is an important component of the overall CAMELS composite ratinthe PCA requirements for banks that are not adequately capitalized (see EC 6). In assessing capital adequaagencies take into account, among other things, the level and severity of problem and classified assets; expdeclines in capital as a result of interest rate, liquidity, funding, and market risks; the quality and level of eportfolio, and other concentrations of credit; certain risks arising from nontraditional activities; the quality 

the effectiveness of loan and investment policies; and management's overall ability to monitor and control 

risks, including the risks presented by concentrations of credit and nontraditional activities. See, e.g,. OCC

Community Bank Supervision and Large Bank Supervision booklets of the Comptroller’s Handbook series

and 12 CFR Part 208, appendix A; FDIC’s Risk Management Manual of Examination Policies (section 2.1 

Examination Handbook section 120 and 12 CFR 567.3. As such, an assessment of a bank’s capital adequafrom conclusions that might be drawn solely from the level of its risk-based capital ratios. The federal banbanks and BHCs to increase overall capital to be able to support the risks to which they are exposed. The RFI/C(D) rating system measures the overall performance and condition of BHCs. The “F” componerepresents the financial condition of the BHC, which is supported by four subcomponents, one of which is adequacy of the BHC’s capital which takes into account the same factors described above for banks. See s

BHCSM for a full description of the “F” component under the RFI/C(D) ratings methodology. Similarly, 

system measures the overall performance and condition of SLHCs. See OTS CEO Memorandum 266, ChCompany Rating System and Examination Components, attachment (72 Fed. Reg. 72442 (Dec. 20, 2007)) 

the SLHC rating system. 

EC 4 Principle 6: Capital adequacy Criterion The required capital ratio reflects the risk profile of individual banks. Both on-balance sheet and off-balanLegal Framework 

Consistent with the Basel Capital Accords, U.S. risk-based capital rules for banks and BHCs reflect the risbanks and BHCs and capture both on-balance-sheet and off-balance-sheet risks. For a comprehensive list o

weight classes, as well as procedures for calculating the risks associated with off-balance-sheet items, see 

6 For rating definitions, see appendix A of OCC’s Bank Supervision Handbook: www.occ.gov/handbook/banksup.pdf 7 www.occ.gov/handbook/banksup.pdf; www.occ.gov/handbook/cbsh2003intro.pdf; www.occ.gov/handbook/cbsh2003appendixes.pdf; 

http://www.occ.gov/handbook/lbs.pdf 

8 www.fdic.gov/regulations/safety/manual. 
EC 4 Principle 6: Capital adequacy 

A and B; 12 CFR Part 208, appendix A (state member banks); appendix A of 12 CFR part 325 (FDIC); an

appendix A (BHCs). 

Practices and Procedures 

The general risk-based capital rule described in EC 2 addresses the on-balance-sheet and off-balance-sheet 

by weighting assets and off-balance-sheet exposures according to their broad inherent risk levels. 

The advanced approaches final rule produces risk-based capital requirements for on- and off-balance-shee

sensitive than those produced under the federal banking agencies’ general risk-based capital rule. The adv

rule provides a detailed discussion regarding the calculation of capital requirements for particular exposure

EC 5 Principle 6: Capital adequacy Criterion Capital adequacy requirements take into account the conditions under which the banking system operates. 

regulations in a particular jurisdiction may set higher capital adequacy standards than the applicable Basel 

Legal Framework 

The U.S. risk-based capital rules, like the Basel Capital Accords they implement, do not explicitly address banks and BHCs may face, particularly in the most sophisticated and competitive financial markets. The g

rule has built in “buffers” against these additional risks. Both the general risk-based capital rule and the ad

rule acknowledge that risk profiles are dynamic and, accordingly, the federal banking agencies expect banforward-looking capital plans. They also express the supervisory expectation that banks and BHCs will oplevels commensurate with the risks to which they are exposed, including those not explicitly addressed by 

federal banking supervisor can impose higher capital levels if, in the supervisor’s judgment, existing levels with the risks faced. 12 CFR 3.10 (OCC); see also the discussion in EC 3. 

In addition to the risk-based capital requirements, the federal banking agencies also review a bank’s or BH

(tier 1 capital divided by average total consolidated assets) when assessing its capital adequacy. The princmeasure (which is used as a supplement to the risk-based capital measure) is to place a constraint on the mbank or BHC can leverage its equity capital base. Federal banking supervisors generally expect and require banks and BHCs to operate at capital levels well 

minimums (12 CFR Part 3, appendix A (OCC); 12 CFR Parts 208 and 225, appendix A (Federal Reserve) appendix A (FDIC)). Finally, as described above, while the minimum regulatory capital ratios are set forth in EC 1 above, the Uestablished PCA requirements, including the tier 1 leverage ratio, which generally result in higher de facto requirements because there are disincentives for banks to fall below the “well capitalized” category. In adGramm-Leach-Bliley Act, Pub. L. 106-102, BHCs that have elected to be financial holding companies (FHensure their bank subsidiaries or affiliates remain well-capitalized so they can retain their FHC status in or
EC 5 Principle 6: Capital adequacy 

certain non-banking financial subsidiaries and merchant banking investments. PCA requirements are discu

in EC 6.

Practices and Procedures 

See Legal Framework. 

EC 6 Principle 6: Capital adequacy Criterion Laws or regulations clearly give the supervisor authority to take measures should a bank fall below the minLegal Framework 

The federal banking agencies have clear statutory authority to take a number of remedial measures in the ecompliance with applicable capital adequacy requirements. Under the PCA statute, 12 USC § 1831o, the pagency for a bank may take a range of mandatory and discretionary actions if that institution’s capital falls 

minimum level for any relevant capital measure. The severity of the supervisory action depends on the sevshortfall. Well-capitalized banks are not subject to any specific regulatory restrictions. However, a bank m

distributions or pay management fees if either would leave the bank undercapitalized. If a bank does not mcapitalized” it can be classified into one of four capital categories: adequately capitalized, undercapitalizedundercapitalized, and critically undercapitalized. See 12 CFR 6.4 (OCC); 12 CFR 208.43 (Federal Reserv325.103 (FDIC); 12 CFR 565.4 (OTS). An adequately capitalized bank may not pay a rate of interest on deposits that is more than 75 basis points that type of deposit in the market in which the deposit is offered. An adequately capitalized bank must alswaiver from the FDIC before it can accept, renew, or rollover brokered deposits. See 12 USC § 1831f (a). 

adequately capitalized banks, federal banking supervisors may take discretionary actions enumerated for uSee 12 USC § 1831o(g). If a bank is “undercapitalized,” it must, by a certain deadline, submit a capital restoration plan for the primsupervisor’s approval. A holding company that controls the bank must guarantee that the bank will complamount up to 5 percent of the bank’s total assets at the time the institution became undercapitalized. 12 UUntil such time as the primary federal banking supervisor approves the plan, the bank’s asset growth and ngenerally are restricted. The federal banking supervisor may also take other discretionary actions (e.g., reqdirect improvements in management; and restrict transactions with affiliates, interest rates offered, asset gr

12 USC § 1831o(e). If a bank is “significantly undercapitalized,” or is undercapitalized but fails to submit or implement an accplan, some of the discretionary actions discussed above become mandatory. In addition, the federal bankinthe bank to dismiss officers or directors, divest itself of a risky subsidiary, or be divested by a BHC under 

Also, the federal banking supervisor must approve certain compensation before it can be paid to senior exe
EC 6 Principle 6: Capital adequacy 

bank. See 12 USC § 1831o(f). If a bank is “critically undercapitalized,” the FDIC generally will restrict the activities of the bank and, at a receive the FDIC’s approval to engage in certain material transactions. The primary federal banking agencappoint a receiver or conservator. 12 USC § 1831o(h). A comprehensive list of provisions for adequately capitalized, undercapitalized, significantly undercapitaliundercapitalized banks is available in section 4133.1 of the CBEM and OCC Banking Circular 2689. The 

have the same PCA requirements as required under the Federal Deposit Insurance Corporation Improvemeand section 38 of the Federal Deposit Insurance Act (12 USC 1831o). See 12 CFR Part 6 (OCC); 12 CFR 

and 12 CFR 565.4, 565.5 (OTS) 

In addition to being subject to PCA requirements, a bank that fails to meet required capital minimums may capital directive under 12 USC § 3907(b)(2). Directives are enforceable in the same manner and to the sam

and outstanding cease and desist order that has become final under 12 USC § 1818(k). Violation of a direcassessment of civil money penalties in accordance with 12 USC § 3909(d). A directive can be issued in adother action permitted under law. Other possible remedial measures include an enforcement action, assesspenalties, and/or denial, conditioning, or revocation of corporate applications. A failure to achieve or mainlevels also can be the basis for termination of FDIC insurance. See 12 USC § 1818(a)(8), 12 CFR 325.412While not subject to PCA requirements, BHCs that do not meet the minimum risk-based requirement, or thconsidered to be inadequately capitalized, are expected to develop and implement plans acceptable to the Fachieving adequate levels of capital within a reasonable period of time (see 12 CFR 225, Appendix A). In 

Reserve’s authority to issue capital directives for failing to maintain sufficient capital also extends to BHC3909. 

Practices and Procedures 

The PCA requirements provide the federal banking supervisors a framework to take necessary measures shthan-well capitalized. As noted above, the risk-based and leverage requirements to be “well capitalized” abanking agencies’ regulatory minimums and those established by the Basel Capital Accords. A bank’s totrisk-based capital, AND leverage ratios must be at or above the regulatory minimum requirements (e.g., 12 considered adequately capitalized. Should any ratio fall below the minimum requirement, the bank would adequately capitalized. In practice, banks typically have a strong preference to remain well capitalized, as 

threshold results in certain restrictions on activities (e.g., inability to accept or roll over brokered deposits)requirements for each level of capitalization under the PCA requirements may be found in 12 CFR 6.4 (OC(Federal Reserve); and 12 CFR 565.5 (OTS). 

9 www.occ.gov/ftp/bc/bc-268.doc 
EC 6 Principle 6: Capital adequacy 

Examples of prompt corrective actions, capital directives, and other formal enforcement actions that includ

available for review on each agency’s website. An example includes the OCC’s 2009 determination that a maintain higher capital minimums (e.g. 9 percent leverage and 12 percent tier 1 risk-based capital) and mu

for the maintenance of adequate capital. 

EC 7 Principle 6: Capital adequacy Criterion Where the supervisor permits banks to use internal assessments of risk as inputs to the calculation of regul

assessments must adhere to rigorous qualifying standards and be subject to the approval of the supervisor. to meet these qualifying standards on an ongoing basis, the supervisor may revoke its approval of the inter

Legal Framework 

Under the advanced Basel II-based capital framework, subject banks and BHCs will be required to use inte

assessments of credit and operational risk as the basis for their regulatory capital requirements. Banks and Basel II advanced approaches must meet rigorous qualifying standards – on an initial and ongoing basis – assessments of risk as inputs to capital calculations. See 12 CFR Part 3, appendix C, part III (OCC); 12 CF

part III and 12 CFR Part 225, appendix G, part III (FRB); 12 CFR part 325, appendix D, part III (FDIC); 1

C (OTS). The U.S. Basel II advanced capital rule specifically requires banks and BHCs to meet qualifying 

basis. See12 CFR 3, appendix C, section 23 (OCC); 12 CFR 208, appendix F, part III, § 23; 12 CFR 225, 12 CFR 325, appendix D, section 23 (FDIC); 12 CFR 567 appendix C part 23 (OTS). Should the bank or standards on an ongoing basis, the supervisor will require the bank or BHC to improve all deficient model

practices. A bank and holding company is required to notify its primary federal banking supervisor when it makes ansystem that would result in a material change to the risk-weighted amount of an exposure type, or when thcompany makes any significant change to its modeling assumptions. The federal banking supervisor will 

company in writing of any failure to comply. The bank or holding company must develop and submit a plcompliance. Use of the advanced approaches framework is subject to rigorous qualifying criteria that must be met on an If the federal banking supervisor determines that a bank or BHC’s risk-based capital requirements are not 

market, operational, or other risks, the supervisor may require the bank or BHC to calculate its risk-based advanced approaches final rule with any modifications established by the supervisor or under the general r

In addition, a bank or BHC applying the market risk rule (discussed above in EC 2) must have its internal management procedures evaluated by its primary federal banking supervisor to ensure compliance with the qualifying standards. These rigorous standards are discussed in section 3020 of the CBEM. National bank
EC 7 Principle 6: Capital adequacy 

with OCC Bulletin 2000-16, Model Validation Standards.10

While the general risk-based capital rule does not, by and large, allow use of bank or BHC internal estimatallowing a bank or BHC to use an internal risk-rating approach for certain exposures to asset-backed commEven so, there are strict requirements for use of such estimates. See 12 CFR Part 3, appendix A, section 4

Parts 208 and 225, appendix A, § III.B.3. (Federal Reserve); and 12 CFR 567.6(a)(3) (OTS).

Practices and Procedures 

See Legal Framework. 

AC 1 Principle 6: Capital adequacy Criterion For non-internationally active banks, the definition of capital, the method of calculation and the capital req

consistent with the principles of applicable Basel requirements relevant to internationally active banks. 

Legal Framework 

All banks and BHCs are subject to one of the two risk-based capital frameworks adopted by the federal badiscussed above, these respectively implement (and are broadly consistent with) Basel I and the advanced all material respects. The definition of capital in both the general risk-based capital rule and the advanced approaches final rule with Basel II requirements. As noted above, as a general matter, large, internationally active banks and BHthe advanced approaches framework, while other banks and BHCs have the option to use the advanced appor the general risk-based capital framework. The market risk rule is mandatory for commercial banks and significant trading activities as described in EC 2. (See 12 CFR Part 3, Appendix A, § 2 (national banks); Appendix A, § II (state member banks); 12 CFR Part 225, Appendix A, § II (bank holding companies); 12 A, § I (state nonmember banks); and 12 CFR 567.5 (savings associations). 

Practices and Procedures 

See Legal Framework. 

AC 2 Principle 6: Capital adequacy Criterion For non-internationally active banks and their holding companies, capital adequacy ratios are calculated an

generally consistent with the applicable Basel requirement, as set forth in the footnote to the Principle. 

Legal For banks and their holding companies, capital is assessed on a fully consolidated basis. Bank and BHC c

10 www.occ.gov/ftp/bulletin/2000-16.doc 
AC 2 Principle 6: Capital adequacy Framework and applied in a manner consistent with Basel Capital Accord requirements and are consolidated for the ba

By using consolidated group accounts, measuring group capital excludes intra-group holdings, multiple geleveraging. 

Practices and Procedures 

See Legal Framework. 

AC 3 Principle 6: Capital adequacy Criterion The supervisor has the power to require banks to adopt a forward-looking approach to capital management 

anticipation of possible events or changes in market conditions that could have an adverse effect. 

Legal Framework 

The federal banking agencies have the power to require corrective action if, in their judgment, a bank’s cuplan is inadequate and causes it to be in an unsafe or unsound condition. See, for example, 12 CFR 3.10 ancapital plans under PCA, 12 CFR 6.5. 

Practices and Procedures 

The federal banking agencies expect banks and holding companies to assess their current capital adequacy 

a systematic and comprehensive manner in light of their risk profiles and business plans. This requires a f

to capital management in which capital levels are set in anticipation of possible changes in events or changthat could have an adverse effect. Federal banking supervisors evaluate the adequacy of bank and BHC st

Federal banking supervisors evaluate internal capital management processes to assess whether they meaninidentification, monitoring, and evaluation of risk to the determination of the bank or holding company’s caof the bank or BHC’s risk-based regulatory capital requirements). Banks and holding companies must coninternal processes to address risk factors that affect the capital condition, such as overall credit risk exposuliquidity, funding, and market risks; earnings; investment or loan portfolio concentrations; the effectivenespolicies; the quality of assets; and management’s ability to monitor and control financial and operational ri

1372 (January 11, 2007) (Interagency Statement on Sound Practices Concerning Elevated Risk Complex SActivities) (OCC); SR letter 99-18, Assessing Capital Adequacy in Relation to Risk at Large Banking Org

Complex Risk Profiles; OCC’s Community Bank Supervision and Large Bank Supervision booklets of the 

series; FDIC’s Risk Manual Management Manual of Examination Policies (Section 2.1 – Capital) and the 

Handbook and Holding Companies Handbook.11 In addition, the federal banking agencies have developed 

addresses concentrations in high-risk exposure areas such as subprime lending and commercial real estate. 

Reserve’s SR letter 07-12 and SR letter 07-01; 71 Fed. Reg. 74580 (December 12, 2006), and the OCC, Fe

11 www.occ.gov/handbook/cbsh2003intro.pdf; www.occ.gov/handbook/cbsh2003appendixes.pdf; www.occ.gov/handbook/lbs.pdf 
AC 3 Principle 6: Capital adequacy 

FDIC’s Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices and OCC 

2006-4612. 

In their implementation of the Basel II framework, the federal banking agencies have continued their longPillar 2, on the need for banks and holding companies to conduct an internal assessment of capital adequacminimum regulatory capital requirements. Beyond the requirement in the advanced approaches final rule, agencies have issued guidance for Pillar 2 containing standards for bank and BHC internal capital adequac73 Fed. Reg. 44620 (July 31, 2008).

AC 4 Principle 6: Capital adequacy Criterion The supervisor requires adequate distribution of capital within different entities of a banking group accord

risks. 

Legal Framework 

If a federal banking supervisor believes a bank or BHC is operating in an unsafe or unsound manner, after affiliate capital adequacy, the supervisor can require it to hold more capital. 

Practices and Procedures 

The capital adequacy of BHCs is assessed on a top-tier, fully consolidated basis. Capital ratios also are asbasis at the subsidiary bank level. The federal banking agencies expect the distribution of capital among e

group to reflect the risks presented by those entities. In addition, each functionally regulated subsidiary is regulator’s capital requirements, and those requirements take into account sector-specific risks. (For examis incorporated into the insurance risk-based capital regime.) Other subsidiaries also are expected to maintcapital that are, if applicable, consistent with the expectations of federal banking supervisors with oversigh

BHCs in which there is a significant nonbank presence, capital adequacy is analyzed with particular emph

current or potential issues present to any affiliated bank. 

• While differing slightly, capital guidelines apply to both banks and BHCs on a consolidated basis 

Basel Capital Accord requirements. The risk-based capital rules apply to any BHC with consolida

or more. The risk-based capital rules also apply on a consolidated basis to any BHC with consolid$500 million if the BHC meets additional criteria outlined in section 4060.3 of the Bank Holding C

Manual. BHCs with consolidated assets of less than $500 million are generally exempt from the c

risk-based capital ratios on a consolidated holding company basis, subject to certain terms and rest

Federal Reserve may apply the risk-based capital rules at its discretion to any BHC, regardless of warranted for supervisory purposes. 

12 www.occ.gov/ftp/bulletin/2007-26.html; www.occ.gov/fr/fedregister/72fr37569.pdf; www.occ.gov/ftp/bulletin/2006-46.html; 

www.occ.gov/fr/fedregister/71fr74580.pdf 
AC 4 Principle 6: Capital adequacy 

• SLHC capital is closely reviewed on a case-by-case basis through the CORE holding company exa

ongoing monitoring by OTS supervision staff. The adequacy of a SLHC’s capital is determined in organizational structure and risk profile. SLHCs are not subject to an explicit uniform minimum rrequirement. The OTS approach to evaluating capital of SLHCs is outlined in section 300 of the HHandbook.

AC 5 Principle 6: Capital adequacy Criterion The supervisor may require an individual bank or banking group to maintain capital above the minimum to 

banks or banking groups are operating with the appropriate level of capital. 

Legal Framework 

The federal banking agencies have the statutory authority to establish and enforce minimum capital levels 

BHCs, and SLHCs as determined, at the federal banking agencies’ discretion, to be necessary or appropriaor SLHCs in light of their particular circumstances. 12 USC §§ 3907(a)(2), 3909. These levels generally regulatory capital requirements. In addition, as described above, the federal banking agencies’ PCA requirements present strong incentives 

capital levels in excess of regulatory minimums and sets forth supervisory actions that the federal banking bank’s capital level falls below those minimums. 

Practices and Procedures 

Banks and holding companies that are exposed to high or unusual levels of risk are expected to maintain suminimum ratios. For example, banks and BHCs that are undertaking significant expansion are expected to 

levels substantially above the minimum ratios. In all cases, banks and BHCs should hold capital commens

nature of the risks to which they are exposed. Banks and BHCs that do not meet the minimum risk-based otherwise considered to be inadequately capitalized, are expected to develop and implement plans acceptab

federal banking agency for achieving adequate levels of capital within a reasonable period of time. See 12 

(OCC); the Federal Reserve’s Regulation H (12 CFR Part 208) and Regulation Y (12 CFR Part 225), as 

BHCSM for more information; 12 CFR 567.3 and 567.4; Examination Handbook sections 120 and 080 (O

(FDIC) and Holding Company Handbook section 300 (OTS). Examples where the primary federal banking supervisor has required banks and holding companies to incrabove the regulatory minimums can be found on the federal banking agencies’ websites. 
Principle 7: Risk Management Process Supervisors must be satisfied that banks and banking groups have in place a comprehensive risk management process (inmanagement oversight) to identify, evaluate, monitor and control or mitigate all material risks and to assess their overall captheir risk profile. These processes should be commensurate with the size and complexity of the institution. (Reference document: Enhancing corporate governance for banking organisations, February 2006)Overview Taking and managing risks are fundamental to the business of banking. Accordingly, the agencies place significant supervisoadequacy of an institution’s management of risk, including its system of internal controls. The agencies expect holding compplace comprehensive risk management policies and processes for identifying, evaluating, monitoring and controlling or mitigaFor banks, this expectation ultimately derives from the statutory responsibility of the agencies for the safety and soundness of 

jurisdiction. See, e.g., 12 U.S.C. § 1831p-1; 12 U.S.C. § 1818(b). Authority also derives from the agencies’ ability to impose 

on individual banks and BHCs as necessary and appropriate under the circumstances. See 12 U.S.C. §§ 39071, 3909. These r

in implementing safety and soundness guidelines, see 12 CFR Parts 30 (OCC), 208 (Federal Reserve), 364 (FDIC), and 570 (O

adequacy guidelines, see 12 CFR Parts 3 (OCC), 208 and 225 (Federal Reserve), 325 (FDIC), and 567 (OTS). 

Since rules and regulations cannot reasonably prescribe the specific practices each individual institution should utilize in man

have issued prudential policy and guidance documents that expand upon the requirements set forth in U.S. laws and regulation

expectations for sound practices. The agencies rely extensively on these policy and guidance documents in conducting their sExpectations regarding risk management programs (active board and senior management oversight; adequate policies, procedrisk measurement, monitoring, and management information systems; and comprehensive internal controls) are detailed in sup

examination manuals issued by the agencies and discussed in further detail below. These resources emphasize that individual appropriate to the size and activities of consolidated organizations and individual institutions and that risk management activitindependent of the business lines. Institutions are expected to conduct regular evaluations of their risk management systems tare adjusted, as appropriate, in light of new products, changing risk profiles and external market developments. As outlined in the introduction, the Federal Reserve is responsible for the supervision of BHCs and the OTS is responsible for 

SLHCs. Guidance for rating the risk management processes of domestic BHCs is provided in SR Letter 04-18, Bank Holding 

Among other things, this guidance was implemented to emphasize the importance of risk management as the more forward-losystem. The main components of the rating system are: Risk Management (R); Financial Condition (F); and potential Impact 

and non-depository subsidiaries on the subsidiary depository institutions (RFI rating). Guidance for rating the risk managemeprovided in the Savings and Loan Holding Company Rating System. The SLHC rating system is an internal rating system usecondition of all SLHCs in a systematic manner. The main components of the SLHC rating system are: Capital Adequacy (C)

1 The HOLA requires that safety and soundness regulations and policies that apply to savings associations must be at least as stringent as th

banks. See 12 U.S.C. § 1463(c). Although 12 U.S.C. § 3907 does not apply to savings associations, the HOLA requires the application of ssavings associations as to banks. 
Principle 7: Risk Management Process (O); Risk Management (R); and Earnings (E) (CORE rating). The RFI and CORE rating systems define composite and comp

assigned based on a 1 to 5 numeric scale. A 1 indicates the highest rating, strongest performance and practices, and least degrwhereas a 5 indicates the lowest rating, weakest performance, and highest degree of supervisory concern. The agencies are responsible for the supervision of individual banks depending on charter types. Each of the agencies, howevadheres to, uniform guidance for rating the risk management processes of domestically chartered banks (nationally-chartered member banks, state-chartered nonmember banks, and savings associations) through the FFIEC’s Uniform Financial Institutio

(UFIRS).

2 This rating system considers both qualitative and quantitative elements, and explicitly references the quality of risk 

in the management component and the identification of risk elements within the composite and component rating descriptionsthe rating system are: Capital Adequacy (C), Asset Quality (A), Management (M), Earnings (E), Liquidity (L), and Sensitivit(CAMELS rating). In addition to the CAMELS rating system, the agencies utilize the Uniform Interagency Consumer Compliance Rating System

scheme for measuring the compliance of banks with consumer protection and civil rights laws. Agency guidance for rating trthe Uniform Interagency Trust Rating System, which emphasizes the quality of risk management in assessing trust activities.3 

Rating System for Information Technology provides agency guidance for rating information technology for financial institutio

providers. This guidance also emphasizes the quality of risk management processes in each of the rating components.4 Each 

and adheres to, uniform guidance for rating the risk management processes of foreign banking organizations and their offices 

the U.S.5 The main components of the rating system for U.S. offices of foreign banks are: Risk Management (R), Operationa

Compliance (C), and Asset Quality (A) (ROCA rating). As with the holding company rating systems, the CAMELS and ROCA rating systems define composite and component rating

based on a 1 to 5 numeric scale. A 1 indicates the highest rating, strongest performance and practices, and least degree of sup

a 5 indicates the lowest rating, weakest performance, and highest degree of supervisory concern. In assessing a consolidated organization’s risk management processes, the Federal Reserve and OTS rely on the work of the fextent possible. The assessment of the consolidated organization takes into consideration the potential impact of the holding c

subsidiaries on the subsidiary bank. Agencies also take into consideration how the risks associated with functionally-regulate

consolidated entity and its bank affiliates. The assessment involves determining the material risks posed to the bank by functiand the systems in place for monitoring and controlling risks posed by those affiliates.6

2 See Federal Reserve SR Letter 96-38; OTS Examination Handbook, Section 071; OCC Bank Supervision Process booklet, 3 See Federal Reserve 98-37; OTS Transmittal No. 215; OCC Bank Supervision Process booklet; 4 See Federal Reserve 99-8; OTS CEO Memorandum 105; OCC Bank Supervision Process booklet 5 See Federal Reserve 00-14, Enhancements to the Interagency Program for Supervising the U.S. Operations of Foreign Banking Organizat

Branches and Agencies Supervision and Bank Supervision Process Handbooks. 6 See: OCC Bank Supervision Process and Related Organizations booklets of the Comptroller’s Handbook series; See Footnotes 1 through 
Principle 7: Risk Management Process Largely Compliant: Recent events have highlighted structural impediments that have resulted in too little attention to the risk

company, including risks created by the affiliates principally involved in trading and other capital market activities. Consolidplacing greater focus on assessing risk exposures and associated risk management practices across the entire organization to b

potential impact of correlated risk exposures that may reside in different legal entities or distinct business lines. For example, Federal Reserve released detailed guidance on consolidated supervision which addresses risk management on a consolidated bfor more details. Similarly in December 2007, the OTS issued its revised SLHC Rating System to better emphasize risk mana

More generally, recent market events have highlighted the need for banks and holding companies to have enhanced corporate improved identification of material risks and transfer mechanisms, and better firm-wide risk management practices. The U.S. are actively involved in various efforts underway by the Basel Committee, the Joint Forum, the Financial Stability Board, and 

Group (SSG) to identify and implement actions to strengthen supervisory practices and policies for risk management processethe agencies developed a template that is being used by the SSG to assess and benchmark globally active financial firms again

risk management identified in various lessons learned reports. Where the federal banking agencies find deficiencies in U.S. b

direct bank management to take corrective action. 

EC 1 Principle 7: Risk Management Process Criterion Individual banks and banking groups are required to have in place comprehensive risk management policie

identify, evaluate, monitor and control or mitigate material risks. The supervisor determines that these prosize and nature of the activities of the bank and banking group and are periodically adjusted in the light of 

of the bank or banking group and external market developments. If the supervisor determines that the risk 

are inadequate, it has the power to require a bank or banking group to strengthen them. 

Legal Framework 

Banks and holding companies are required to have in place comprehensive risk management policies and pevaluate, monitor and control or mitigate material risks. Interagency safety and soundness guidelines require institutions to establish internal controls and informat

appropriate to the size of the institution and the nature, scope and risk of its activities. High level requiremportions of the interagency safety and soundness guidelines addressing operational and managerial standar

208, Appendix D-1, part II; 12 CFR Part 30, Appendix A, part II; the interagency guidelines implementing Amendment to Basel I (12 CFR Part 3, Appendix B, section (4)(b) (national banks), 12 CFR Part 208, Appbanks), 12 CFR 225, Appendix E, section 4(b) (BHCs), 12 CFR 325, Appendix C, section 4(b) (state nonm

operational risk management provisions in the interagency guidelines on the advanced Basel II approaches

Appendix C, section 22 (h) and (j) (national banks), 12 CFR Part 208, Appendix F, section 22(h) and (j) (s

CFR 225, Appendix G, section 22(h) and (j) (BHCs), 12 CFR 325, Appendix D, section 22(h) and (j) (stat

7 72 FR No. 244 (December 20, 2007). 
EC 1 Principle 7: Risk Management Process 

the agencies’ Supervisory Guidance on the Supervisory Review Process of Capital Adequacy (Pillar 2) ReImplementation of the Basel II Advanced Capital Accord.8 Assessments of the quality of risk managemen

the evaluation of the overall organization. A banking organization’s failure to establish a management structure that adequately identifies, measures, 

risks involved in its various products and lines of business is considered unsafe and unsound conduct. If a

bank fails to meet any standard established by the agency or by interagency guidelines, the agency may reqsubmit an acceptable plan to achieve compliance. See 12 U.S.C. § 1831p-1(e). The agency also has the fl

courses of action, including enforcement actions or less formal actions, given the specific circumstances aninstitution's noncompliance with one or more standards. In the event that an institution fails to submit an a

time allowed by the agency or fails in any material respect to implement an accepted plan, the agency musinstitution to correct the deficiency. The agency may, and in some cases must, take other supervisory and/ountil the deficiency has been corrected. 

Practices and Procedures 

U.S. federal banking agencies are required to assess the management of all institutions under their jurisdic

size, and to assign a rating reflecting the assessment. In assessing management, risk-focused supervision p

the quality of risk management. Examiners consider findings relating to the following elements of a sound 

active board and senior management oversight; adequate policies, procedures, and limits; adequate risk meand management information systems; and comprehensive internal controls. An institution's policies, proc

expected to provide for the adequate identification, measurement, monitoring, and control of the risks pose

Policies and procedures are also expected to reflect the changing risk profile of the institution by providing activities new to the institution to ensure that the infrastructures necessary to identify, monitor, and control 

activity are in place before the activity is initiated. Principles of sound risk management are expected to apof risks facing a consolidated organization as well as individual institutions. U.S. federal banking examiners utilize a risk-focused approach to supervision, and apply flexibility when aappropriateness of a banking organization’s risk management processes to address the organization's circu

scope, and complexity of its operations. Large complex banks and holding companies are expected to havand formal risk management systems in order to address their broader and typically more complex range o

provide the board and senior management with the information needed to monitor and direct day-to-day acmanagement systems require frequent monitoring and testing by independent control areas and internal, as to ensure the integrity of the information used in overseeing compliance with policies and limits. Large co

companies should have risk management systems or units that are sufficiently independent of the business adequate separation of duties and the avoidance of conflicts of interest. For smaller banks engaged predombanking activities and whose senior managers and directors are actively involved in the details of day-to-d

management systems may be less sophisticated. 

8 73 Fed. Reg. 44620 (July 31, 2008). 
EC 1 Principle 7: Risk Management Process 

The agencies maintain teams of examiners on-site at the large complex banks, and these banks are subject focused supervision program. These teams include examiners with specialized expertise in areas such as ccommercial lending, operations, and information technology, and they conduct ongoing risk-focused super

guidance (see, e.g., FRB: SR Letter 97-24, Risk-Focused Framework for Supervision of Large Complex In

SR Letter 99-15, Risk Focused Supervision of Large Complex Banking Organizations; OCC: Large Bank 

Comptroller’s Handbook and various topical handbooks on specific risk areas and controls, including Risk 

Derivatives; Retail Lending, Liquidity Risk, Internal Controls, Leveraged Lending, Rating Credit Risk, and Specific risks such as BSA/AML are addressed under their specific Principle. The agencies’ supervisory 

need to maintain a current assessment of the organization’s risk profile which reflects external market deve

environmental factors which have the potential for swift and dramatic changes in the risk profiles of large holding companies. The agencies use similar risk-based supervision for smaller (community) banks. Assessments of these firmthrough both periodic on-site examinations that are supplemented with off-site monitoring. See, for examp

Focused Framework for the Supervision of Community Banks and the OCC’s Community Bank Supervisio

supervisory programs for large institutions, the agencies’ supervisory programs for smaller organizations aability to identify, measure, monitor and control risks.The risk management processes of BHCs are assessed in accordance with the guidance set forth in SR Lett

Adequacy of Risk Management Processes and Internal Controls at State Member Banks and Bank Holding 

Holding Company Supervision Manual (BHCSM), the Commercial Bank Examination Manual (CBEM), tMarkets Activities Manual (Trading Manual), and various other guidance documents. The risk manageme

assessed in accordance with the OTS Holding Companies Handbook, Sections 400 and 500. The risk man

foreign banking organizations (FBOs) are assessed in accordance with guidance set forth in SR Letter 00-1

Interagency Program for Supervising the U.S. Operations of Foreign Banking Organizations (Federal ResFederal Branches and Agencies Supervision Handbook. This program emphasizes coordination and coop

host country regulators, an assessment of the strength of support provided by the FBO, and a risk-focused As described in BCP 24, the Federal Reserve conducts consolidated supervision based upon the guidance o08-9/CA Letter 08-12, Consolidated Supervision of Bank Holding Companies and the Combined U.S. Ope

Banking Organizations. This guidance specifies principal areas of focus for consolidated supervision activ

consistent supervisory practices and assessments across organizations with similar activities and risks. The OTS completes a risk matrix for its most complex SLHCs, which are subject to continuous supervisioprimary activities for which the level and direction (increasing or decreasing) of each type of risk is assesswide assessment of the SLHC’s inherent risk and risk mitigation practices. See Section 200, Appendix B, 

Companies Handbook. 

Similar to the FRB and OTS, the OCC uses a risk assessment system (RAS) to consistently evaluate the ri
EC 1 Principle 7: Risk Management Process 

chartered banks across nine categories of risks. These assessments consider the bank’s quantity of risk, quand direction of the bank’s risk exposures. See OCC’s Bank Supervision Process Handbook. 

A bank’s or holding company's failure to establish a management structure that adequately identifies, meacontrols the risks involved in its various products and lines of business is considered unsafe and unsound cfederal banking agencies may initiate formal or informal supervisory action requiring the immediate imple

corrective measures, as explained in the enforcement actions section of the banking agencies’ web sites an

EC 2 Principle 7: Risk Management Process Criterion The supervisor confirms that banks and banking groups have appropriate risk management strategies that h

Board. The supervisor also confirms that the Board ensures that policies and processes for risk-taking are d

limits are established, and senior management takes the steps necessary to monitor and control all material approved strategies. 

Legal Framework 

See Overview and response to EC1. 

Practices and Procedures 

In assessing the adequacy of risk management processes, agencies ensure that banks and holding companimanagement strategies that have been approved by the relevant board. Examiners also verify that the boar

processes for risk-taking, establishes appropriate limits, and that senior management takes the steps necessall material risks consistent with the approved strategies. The agencies assess, and ratings reflect, the board’s fulfillment of its responsibilities primarily in accordanoutlined in EC 1 above.9 Under the agencies’ policies and guidelines, boards have ultimate responsibility 

by their organizations. Accordingly, they should approve the overall business strategies and significant poorganizations, including those related to managing and taking risk. Directors are also expected to provide 

the level of exposures acceptable to their organizations and that they have the responsibility to ensure that implements the procedures and controls necessary to comply with adopted policies. Compliance with these standards is conducted as part of the supervisory examination process. See Overvi

details on how the agencies confirm risk management practices at institutions.

9 Federal Reserve: SR Letter 95-51, CA Letter 06-8, the BHCSM, and the CBEM; OTS: set forth in the description of the SLHC rating syst

Memorandum No. 266, and in the OTS Holding Companies Handbook. See also OCC’s Bank Supervision Process Handbook and OCC’s T

of the National Bank Director,.and FDIC’s Risk Management Manual of Examination Policies (Section 4.1 – Management). 
EC 3 Principle 7: Risk Management Process Criterion The supervisor determines that risk management strategies, policies, processes and limits are properly doc

updated, communicated within the bank and banking group, and adhered to in practice. The supervisor detestablished policies, processes and limits receive the prompt attention of and authorization by the appropriand the Board where necessary. 

Legal Framework 

See Overview and response to EC1. 

Practices and Procedures 

In assessing the adequacy of risk management processes, agencies ensure that risk management strategies, 

limits are properly documented, reviewed and updated, and communicated within the bank and banking grexaminers determine that exceptions to established policies, processes and limits receive the prompt attentthe appropriate level of management and the board where necessary. The agencies generally conduct examdocumentation supporting the risk management process and adherence to internal policies, processes, and 

targeted examinations of specific business activities. As noted above, the agencies assess, and ratings reflect, documentation supporting the risk management prupdating, and communication of such documentation, and the monitoring of compliance with policies, proprimarily in accordance with the guidance noted in EC 2. Agencies’ policies state that boards should apprcommunicate policies throughout the institution, and modify them when necessary to respond to significan

holding company’s activities or business conditions.10 They also emphasize the importance of an indepen

control structure, and that large organizations require more frequent monitoring and testing by independeninternal, as well as external auditors, to ensure the integrity of the information used by senior officials in opolicies and limits. Agencies’ policies and examiner guidance provides that exceptions to policies/limits aappropriate level of management or board. See, e.g., 12 CFR 34.62 and Appendix A to 12 CFR Part 34; “IConcentrations in Commercial Real Estate Lending, Sound Risk Management Practices”11; “Interagency G

Nontraditional Mortgage Products”12; “Interagency Guidance on Credit Risk Management for Home Equi

“Interagency Policy Statement on Interest Rate Risk.”14

10 See, e.g., Federal Reserve SR Letter 95-51 and CA Letter 06-8; Interagency Policy Statement on the Allowance for Loan and Lease Losse

OCC Banking Circular 277, “Risk Management of Financial Derivatives,” OCC’s The Director’s Book – The Role of the National Bank DirManagement Manual of Examination Policies (Section 4.1 – Management), and the OTS Examination Handbook, Section 212; and OTS CE

“Interagency Guidance on Nontraditional Mortgage Product Risks.” 

11 71 FR 74580. 12 71 FR 58609. 13 OCC Bulletin 2005-22. 14 OCC Interest Rate Risk booklet of Comptroller’s Handbook, FR, OTS TB-13a Management of Interest Rate Risk, Investment Securities a
EC 4 Principle 7: Risk Management Process Criterion The supervisor determines that senior management and the Board understand the nature and level of risk b

how this risk relates to adequate capital levels. The supervisor also determines that senior management ensmanagement policies and processes are appropriate in the light of the bank’s risk profile and business plan implemented effectively. This includes a requirement that senior management regularly reviews and under(and limitations) of the risk management information that it receives. The same requirement applies to the management information presented to it in a format suitable for Board oversight. 

Legal Framework 

See Overview and response to EC1. 

Practices and Procedures 

Federal banking agency examiners review whether senior management and the board understand the naturtaken by the institution and how this risk relates to adequate capital levels. Examiners also determine that 

ensures that the risk management policies and processes are appropriate in the light of the institution’s risk and that they are implemented effectively. Senior management is expected to regularly review and unders

limitations) of the risk management information that it receives. The same requirement applies to the boar

management information presented to it in a format suitable for board oversight. The agencies assess, and ratings reflect, whether senior management and the board of directors understand 

risk being taken by the organization primarily in accordance with guidance outlined in EC 1. See Federal 

Assessing Capital Adequacy in Relation to Risk at Large Banking Organizations and Others with Complex Community Bank Supervision and Large Bank Supervision Handbooks, The Director’s Book – The Role of 

Director, and Detecting Red Flags in Board Reports – A Guide for Directors, and FDIC’s Risk ManagemePolicies (Section 4.1 – Management). As previously noted, federal banking agency guidance states that dir

understanding the nature of the risks significant to their organizations, and for ensuring that management inecessary to identify, measure, monitor, and control these risks. Directors are also responsible for understrelates to adequate capital levels. Boards of directors are expected to periodically review and approve the target level and composition of caprocess for setting and monitoring such targets. Banks and holding companies are expected to maintain ca

the nature and extent of risks taken and the ability of management to identify, measure, monitor, and contr

and quantity of risk inherent in a bank’s or holding company’s activities will determine the extent to which maintain capital levels above required regulatory minimums to properly reflect the potentially adverse con

may have on the organization’s capital. Recent events have revealed weaknesses in some banks’ and holding companies’ ability to identify and ag

firm and to conduct effective stress testing. For example, some firms relied too heavily on historical corre

heavily on specific lines of businesses when conducting stress scenarios and thus failed to capture the breinterconnected risk exposures fully. As noted in the overview, the agencies are actively involved in effortwide risk management and stress testing practices for large financial organizations. 
EC 4 Principle 7: Risk Management Process EC 5 Principle 7: Risk Management Process Criterion The supervisor determines that banks have an internal process for assessing their overall capital adequacy 

profile, and reviews and evaluates banks’ internal capital adequacy assessments and strategies. The nature methodology used for this assessment will depend on the size, complexity and business strategy of a bank. opt for a more qualitative approach to capital planning. 

Legal Framework 

See Overview and response to EC1. 

Practices and Procedures 

Federal banking agencies expect banks and bank holding companies to develop capital and strategic plans 

regulatory capital requirements to ensure that the capital they are holding and forecast to need is adequate 

Regulatory capital requirements have limitations in their ability to reflect an organization’s full risk profile

on regulatory capital standards, refer to CP 6, EC 1, EC 2, AC 1, and AC 2.) Accordingly, all organizationunderstand their underlying risks and hold capital commensurate with those risks – at levels above regulatcapital adequacy. The agencies require some organizations to use more sophisticated internal risk measure

assessment processes because of their size, complexity, and the corresponding limitations of regulatory capadequately capture their risk profile. Ratings reflect the results of this assessment.15 Evaluations of the str

adequacy assessments of consolidated organizations and individual institutions are generally conducted as examinations. Recent events have highlighted weaknesses in both the Basel II capital standards and firms’ own capital plagencies are actively involved in the Basel Committee’s recent proposals to enhance the Basel II framewocertain liquidity facilities, and improved value-at-risk models and stress testing. In addition, the agencies rcomprehensive, forward-looking assessment of the financial condition of the nation's 19 largest bank holdidetermine what capital buffers would be sufficient for these BHCs to withstand losses and sustain lending downturn is more severe than is currently anticipated. The agencies are actively working with those BHCs 

appropriate steps to obtain any additional capital needed. As part of this process, holding companies are replans that, among other things, identify steps to address weaknesses, where appropriate, in the BHC's inter

capital needs and engaging in effective capital planning. In addition, institutions subject to the advanced approaches of Basel II-based capital adequacy guidelines a

15 See FRB SR Letter 99-18 and AD Letter 08-11, which provides examiner guidance for conducting reviews of compliance with these stan

Supervision and Community Bank Supervision booklets of the Comptroller’s Handbook.
EC 5 Principle 7: Risk Management Process 

rigorous process for assessing capital adequacy in relation to their risk profiles. Interagency guidance that review process of capital adequacy (also known as Pillar 2) was issued on July 15, 2008.

EC 6 Principle 7: Risk Management Process Criterion Where banks and banking groups use models to measure components of risk, the supervisor determines th

and independent validation and testing of the models and systems. 

Legal Framework 

Under the interagency guidelines implementing the advanced Basel II approaches, banks and BHCs are reqadvanced systems on an ongoing basis in accordance with specified requirements. See, e.g., 12 CFR Part 

section 22(j) (national banks); 12 CFR Part 208, Appendix F, section 22(j) (state member banks); 12 CFR section 22(j) (BHCs), 12 CFR 325, Appendix D, section 22(j) (state nonmember banks) . In addition, they 

test the advanced approaches, also in accordance with stated specifications. See id. Internal models adopt

adhering to the 1996 Market Risk Amendment also must be stress tested. 12 CFR Part 3, Appendix B, secParts 208 and 225, Appendix E, section 4(b) (Federal Reserve), 12 CFR 325, Appendix C, section 4(b) (FD

Practices and Procedures 

In utilizing models and systems to measure risk, banks and BHCs are expected to ensure that risk managemare independently validated and tested with an appropriate frequency. The federal banking agencies offer courses on various aspects of risk modeling and have staff with specialized econometrics and modeling exexaminers in evaluating sophisticated models. The federal banking agencies’ supervisory guidance directs that key assumptions, data sources, and procedand monitoring risk be appropriate and adequately documented and tested for reliability on an ongoing basindependently validated and tested by risk management staff or by internal or outside auditors. The frequeorganizations should re-evaluate their models and assumptions depends, in part, on the specific risk exposu

trading activities, the pace and nature of market changes, and the pace of innovation with respect to measuGuidance which more specifically addresses model requirements for various types of models is found in th

agencies’ manuals. For example, the OCC assesses, and ratings reflect, risk measurement model validatiobanks in accordance with the guidance set forth in OCC Bulletin 2000-16, Risk Modeling, Model ValidatioReserve assesses, and ratings reflect risk measurement model validation and testing processes of consolida

accordance with the guidance set forth in SR letter 95-51. To address supervisory expectations more comp

explicitly, the Federal Reserve plans to issue enhanced guidance covering supervisory expectations for the 

risk management models and systems in the near future. Organizations implementing the advanced Basel II approaches are required to validate their advanced systaccordance with specified requirements. For those larger organizations subject to the 1996 Market Risk Am
EC 6 Principle 7: Risk Management Process 

requirements include that these organizations must have an internal model that is fully integrated into its dconduct independent reviews of its risk management and measurement systems at least annually, and must 

procedures for conducting appropriate stress tests and back tests, and for responding to the results of those Appendix B, section 4(b) (OCC); 12 CFR Parts 208 and 225, Appendix E, section 4(b) (Federal Reserve), section 4(b) (FDIC). Agencies generally conduct separate targeted examinations of an institution’s risk mto risk measurement models and systems, as well as of specific risk measurement models.

EC 7 Principle 7: Risk Management Process Criterion The supervisor determines that banks and banking groups have adequate information systems for measurin

on the size, composition and quality of exposures. It is satisfied that these reports are provided on a timely 

senior management and reflect the bank’s risk profile and capital needs. 

Legal Framework 

The agencies’ safety and soundness guidelines require banks and BHCs to have information systems that aof the institutions and the nature, scope and risks of their activities and that provide access to timely and acoperational, and regulatory reports. See, e.g., 12 CFR Part 30, Appendix A, part II(A) (OCC); 12 CFR Par

II(A) (Federal Reserve); 12 CFR 364, Appendix A, section II.A.(FDIC); 12 CFR Part 570 (OTS). 

Practices and Procedures 

Agency examiners review management information systems to ensure its adequacy in measuring, assessinsize, composition, and quality of exposures. Examiners also ensure that these reports appropriately reflect 

company’s risk profile and capital needs, and that they are provided to the board or senior management on 

generally conduct reviews of management information in conjunction with the targeted examinations of sp

and, at larger organizations, during the process of conducting ongoing supervision. The federal banking agencies assess, and their supervisory ratings reflect, the adequacy of risk managemenholding company and institution level. Risk monitoring activities must be supported by information syste

managers and directors with timely reports clearly indicating positions and risk exposures, as well as with detailed reports for line managers engaged in the day-to-day management of the organization’s activities.1

reports flowing to executive management, board committees, and the board of directors for clarity, consist

and coverage of crucial areas of the organization. Examiners ascertain that reporting is sufficiently comprdecision making, and that reports relate risks relative to the bank’s earnings and capital. Furthermore, guid

supervisory ratings emphasize the need for banks and BHCs s to identify and measure all material risks. 

16 See, e.g., FRB’s SR 99-18 and CA 06-8; OCC’s Risk Assessment System factors for determining quality of risk management in its “Com

“Large Bank Supervision” booklets, and FDIC’s Risk Management Manual of Examination Policies (Section 4.1 – Management). 
EC 8 Principle 7: Risk Management Process Criterion The supervisor determines that banks have policies and processes in place to ensure that new products and 

initiatives are approved by the Board or a specific committee of the Board. 

Legal Framework 

See Overview and response to EC 1. 

Practices and Procedures 

Agency examiners verify that banks and BHCs have policies and processes in place to ensure that managereviews all risks associated with new activities or products, and that the infrastructure and internal controls 

related risks are in place.17 Furthermore, agencies consider as a sound practice, having a new product app

review and approval by all operational areas affected by such transactions, and is evidenced by an audit tra

new product is introduced.18

The agencies expect the risk management process to reflect the size and the complexity of the product or s

the board may delegate performance of managerial duties to others, it has the ultimate responsibility for enholding company is run in a safe and sound manner. In fulfilling its responsibilities, the board or its designnew, expanded, or modified bank product or service is consistent with the strategic goals.19

Although the comprehensiveness and specificity of supervisory guidance relating to the approval of new pmanagement initiatives varies among the agencies, examiners generally employ similar procedures in condassessments. The federal banking agencies assess a bank’s new activity/product approval process at both tcompany levels. As noted, agency guidance states that before embarking on new activities or introducing organization, management should identify and review all risks associated with the activity or product and einfrastructure and internal controls necessary to manage the related risks are in place.20 When a new produ

explicit agency approval, such conditions are often imposed as part of the approval process and are enforcU.S.C. § 1818.21 The agencies expect that management identifies the risks associated with new activities o

launched and ensures that the appropriate infrastructure and internal controls are established. Furthermore

a sound practice, having a new product approval policy that requires review and approval by all operationatransactions, and is evidenced by an audit trail of approvals before a new product is introduced. 

17 See FRB’s SR Letter 95-51, OCC Bulletin 2004-20, Risk Management of New, Expanded, or Modified Bank Products and Services, and F

Manual of Examination Policies (Sections 4.1 and 4.2- Management & Internal Routine and Controls); and. OTS TB-13a Management of InSecurities, and Derviative Activities, 

18 See FRB’s TCMM (Section 2000.10, Overview of Risk Management in Trading Activities), Bulletin 2004-20; see also OCC Banking Circ

Financial Derivatives . 

19 See, e.g., FRB’s 95-51, 04-18, and CA 06-8; OCC Bulletin 2004-20, “Risk Management of New, Expanded, or Modified Bank Products a20 Id. 21 See, e.g., OCC Interpretive Letter 1101 (July 7, 2008); OCC Interpretive Letter 1065 (July 24, 2006); OCC Interpretive Letter 1039 (Sept
EC 8 Principle 7: Risk Management Process 

In the wake of recent events, the Federal Reserve is re-evaluating its existing guidance to incorporate more 

regarding new products and major initiatives, with emphasis on the need for board approval of new produc

Agency examiners generally conduct separate targeted examinations of the new activity/product approval approvals of specific activities and/or products during targeted examinations of specific business activities

EC 9 Principle 7: Risk Management Process Criterion The supervisor determines that banks and banking groups have risk evaluation, monitoring, and control or 

duties clearly segregated from risk-taking functions in the bank, and which report on risk exposures directland the Board. 

Legal Framework 

The interagency guidelines implementing the 1996 Market Risk Amendment require an independent risk cdirectly to senior management and is independent from business trading units. See, e.g., 12 CFR Part 3, A

4(b)(1)(national banks); 12 CFR Part 208, Appendix E, section 4(b)(1) (state member banks), 12 CFR Part 4(b)(1) (BHCs). Institutions adhering to the advanced approaches to Basel II rules must have control, ovemechanisms that maintain the integrity, reliability, and accuracy of those systems. The bank’s validation p

independent of the advanced systems’ development, implementation, and operation, or the validation must independent review of its adequacy and effectiveness. The bank’s senior management must ensure that all advanced systems function effectively and the bank’s board of directors (or a designated committee) must the effectiveness of, and approve, the bank’s advanced systems. See e.g., 12 CFR Part 3, Appendix C, Sec

(national banks); 12 CFR Part 208, Appendix F, section 22(h) (state member banks); 12 CFR Part 225, Ap

(BHCs). 

Practices and Procedures 

The federal banking agencies require BHCs and individual banks to have risk evaluation, monitoring, and 

functions with duties clearly segregated from risk-taking functions and which report on risk exposures dire

and the board or board committee. Federal banking agencies expect large banks and BHCs to have risk management systems or units that are 

of the business lines in order to ensure an adequate separation of duties and the avoidance of conflicts of inorganizations are generally given flexibility in how they accomplish this objective, most large, complex baestablished dedicated units to manage risk at the group level. 

22 Current Federal Reserve guidance (SR Letters 95-51, 04-18, and CA Letter 06-8) does not explicitly require that new products be approve

committee of the board; however, examiners expect the board or its designee to ensure the institution operates in a safe and sound manner, a

product or activity is consistent with the institution’s strategic goals. 
EC 9 Principle 7: Risk Management Process 

As noted above, organizations subject to the 1996 Market Risk Amendment and to the advanced approachmore rigorous requirements for independent risk control units.

EC 10 Principle 7: Risk Management Process Criterion The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, interest rate 

and operational risk. 

Legal Framework 

The agencies expect BHCs and banks to have in place comprehensive risk management policies and proceevaluating, monitoring and controlling or mitigating all material risks, including, but not limited to, credit, rate, and operational risk. The agencies have issued supervisory guidance related to each of these risk typstatutory and regulatory provisions, including those governing safety and soundness (see 12 U.S.C. § 1831

Appendix A (OCC); and 12 CFR Part 208, Appendix D-1 (Federal Reserve); 12 CFR 364, Appendix A (F(see, e.g., 12 USC §§ 3907(a), 3909; 12 CFR Part 3, Appendices A,B, and C (national banks); 12 CFR Par

and F; 12 CFR Part 225, Appendices A, E, and G (BHCs)). 12 CFR 570, Appendix A; OTS’s Holding Com

sections 400, 500, and 900. 

Practices and Procedures 

U.S. federal banking agencies have issued standards related to credit, market, liquidity, interest rate risk in operational risk in the form of supervisory guidance and through the issuance of examination procedures a

reflect the results of the assessment of compliance with expectations appearing in these documents. Guidance addressing specific aspects of risk management is discussed in further detail in the sections coveprinciples. 

AC 1 Principle 7: Risk Management Process Criterion The supervisor requires larger and more complex banks to have a dedicated unit(s) responsible for risk eva

control or mitigation for material risk areas. The supervisor confirms that this unit (these units) is (are) subthe internal audit function. 

Legal Framework 

Banking institutions subject to the interagency capital guidelines on market risk or the advanced Basel II ahave dedicated risk management units. See, e.g., 12 CFR Part 3, Appendix B, section 4(b) and 12 CFR Par

section 22(h) (OCC); 12 CFR Parts 208 and 225, appendix E, section 4(b), 12 CFR Part 208, Appendix F, Part 225, Appendix G, section 22(h) (Federal Reserve). 

Practices and Procedures 

The agencies generally expect larger, more complex banks and holding companies to have a dedicated unievaluation, monitoring, and control or mitigation for material risk areas. Agency examiners confirm that t

(are) subject to periodic review by the internal audit function. Given the unique characteristics of each org
AC 1 Principle 7: Risk Management Process 

agencies have historically held the view that there is no single risk management structure that is appropriatinstitutions. For example, some companies have chosen to have a single consolidated enterprise risk overshave more functionally organized risk management functions that are independent of risk-taking units and within the organization to elevate concerns to senior management and the board. With this said, most largBHCs have established dedicated units to manage risk at the corporate level. As noted above, organizations subject to the 1996 Market Risk Amendment and to the advanced approachmore rigorous requirements for independent risk control units.

AC 2 Principle 7: Risk Management Process Criterion The supervisor requires banks to conduct rigorous, forward-looking stress testing that identifies possible e

conditions that could adversely impact the bank. 

Legal Framework 

Institutions subject to the advanced Basel II approaches are required to conduct rigorous, forward looking circumstances that could adversely impact the bank. See, e.g., 12 CFR Part 3, Appendix C, section 22(j) (

Appendix F, section 22(j), and 12 CFR Part 225, Appendix G, section 22(j) (Federal Reserve). 

Practices and Procedures 

The agencies require large, complex banks to conduct rigorous, forward-looking stress testing that identifichanges in market conditions that could adversely impact the bank.23 Examinations of stress tests conduct

conducted as separate targeted examinations. An example of this is the Supervisory Capital Assessment P

conducted by the agencies24 in May of this year. The SCAP is a forward-looking capital assessment of the 

holding companies under different stress scenarios. See www.federalreserve.gov/newsevents/press/bcreg/

White Paper that explains the SCAP process. As previously noted, the agencies are working both domestiregulators to evaluate methods for improving supervisory processes to enhance the identification of systemand coordination between systemic risk and the supervision of banks and holding companies. As noted above, institutions implementing the advanced approaches under Basel II are required to stress teUnder the agencies’ guidance on Pillar 2, they must also conduct broader stress tests to assess the overall a

23 See, e.g., FRB’s SR Letter 99-18, which states that, in measuring risks, large banking organizations and others with complex risk profiles 

comprehensive and rigorous stress tests to identify possible events or changes in markets that could have serious adverse effects in the futur

testing expectations appears in the TCMM (Section 3020 – Market Risk, Section 3010.10 – Interest Rate Risk, Section 3000.10 – Securities

Securitization).; OCC Handbooks: Large Bank Supervision, Liquidity, Risk Management of Financial Derivatives . 

24 The agencies that participated in the SCAP are the Board of Governors of the Federal Reserve System, the Federal Reserve Banks, the Fe

Corporation, and the Office of the Comptroller of the Currency. 

25 See, e.g., “Supervisory Guidance: Supervisory Review Process of Capital Adequacy (Pillar 2) Related to the Implementation of the Base

Framework” 73 Fed. Reg. 44620 (July 31, 2008); “Stress Tests Used in Assessment of Capital Adequacy”; and SR Letter 99-18.
AC 2 Principle 7: Risk Management Process 

Likewise, institutions with significant portfolio concentrations are also expected to conduct stress tests or squantify the potential impact on the bank’s earnings and capital.26

Routine stress testing is not required for smaller, less complex institutions, however, such institutions are e

assess how changes in economic and borrower conditions may affect their earnings and capital; to manage to measure and control the exposure to earnings and capital of changing interest rates; and to develop and 

funding plans that consider the bank’s potential liquidity needs over a range of adverse scenarios. For further detail, refer to Principle 13, EC 4; Principle 14, EC4 and AC1; and Principle 16, EC 3 and AC3

AC 3 Principle 7: Risk Management Process Criterion The supervisor requires banks and banking groups to have in place appropriate policies and processes for a

risks not directly addressed in the subsequent CPs, such as reputational and strategic risks. 

Legal Framework 

The authority to impose risk management standards stems primarily from the agencies’ statutory authority 

and soundness of banks. 12 U.S.C. § 1831p-1. While existing safety and soundness guidelines and minimdo not specifically capture all risks to which banks and holding companies may be exposed, the agencies h

those guidelines to impose risk management requirements related to risk types not otherwise addressed. T

supervisory guidance and related materials. In addition, the agencies’ capital adequacy guidelines provide minimum capital ratios of an individual bank in view of its circumstances. 12 CFR 3.10 (OCC); 12 CFR P

A, § IV, 12 CFR Part 208, appendix F, section 1(c), 12 CFR Part 225, appendix G, section 1(c) (Federal RAppendix A, section II.A.3 and Appendix D, section 1(c) (state nonmember banks) 12 CFR 567.11 (OTSthe advanced approaches of Basel II-based capital adequacy guidelines are required to have a rigorous inteassessment process that captures all material risks, including those not directly addressed in minimum regurequirements (which may include liquidity, reputational and strategic risks, among others). Supervisory gusupervisory review process of capital adequacy (also known as Pillar 2) was published in the Federal Regi

Practices and Although the agencies differ as to whether or not they consider reputational and strategic risks as separatel

26 See, e.g., “Interagency Guidance: Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices”. 71 Fed. Reg27 See supra, n.26. 
AC 3 Principle 7: Risk Management Process Procedures agency requires its organizations and institutions to have in place appropriate policies and processes for as

including those not directly addressed in the subsequent Principles, such as reputational and strategic risk.

consistently expect reputational risk to be factored into the formulation of business strategy, and a part of tnew activities and products. Agencies also hold the board of directors responsible for ensuring that strateg

in a safe and sound manner. The agencies issue specific guidance when necessary to address unique reputrisks associated with a particular activity for which existing guidance may not adequately address supervisexample of interagency guidance issued to address a specific activity which poses heightened reputational 

Interagency Statement on Sound Practices Concerning Elevated Risk Complex Structured Finance Activitiguidance addresses the risk principles that assist organizations in identifying, evaluating, and managing the reputational risks that may arise from their involvement in complex structured finance transactions. For those institutions subject to the advanced approaches of Basel II-based capital adequacy guidelines, thsupervisory guidance related to the supervisory review process of capital adequacy, which addresses the neall material risks in their internal assessments of capital adequacy, including, reputational and strategic risk

28 The Federal Reserve and OTS define and specifically include reputational risk as a risk type for which the principles of sound manageme

SLHC Rating System applies; see also, SR Letter 99-18, Assessing Capital Adequacy in Relation to Risk at Large Banking Organizations a

Profiles. The OCC’s Risk Assessment System specifically includes both reputation and strategic risks (see OCC Handbook Bank Supervisi

29 See supra, n.26. 
Principle 8: Credit riskSupervisors must be satisfied that banks have a credit risk management process that takes into account the risk profile of thpolicies and processes to identify, measure, monitor and control credit risk (including counterparty risk). This would includmaking of investments, the evaluation of the quality of such loans and investments, and the ongoing management of the loan aOverview Banks and holding companies are subject to credit-risk management requirements pursuant to U.S. federal banking regulationReserve [12 CFR 208, appendix D-1, part II(C) & (D) (addressing loan documentation and credit underwriting); 12 CFR 225, 

adequacy guidelines); 12 CFR 208, subpart E (addressing real estate lending standards and setting requirements for lending po30, appendix A, part II (C) & (D) (addressing loan documentation and credit underwriting); 12 CFR 3, appendix C (capital adCFR 34, subpart D (addressing real estate lending standards and setting requirements for lending policies)]; and OTS [12 CFR are further developed in extensive supervisory guidance and related materials. Refer to U. S. federal banking agencies’ manu

Supervisory Guidance on Internal Ratings Based Systems for Credit Risk,” 72 Fed. Reg. 9084, 9088 (Feb. 28, 2007). Togethethat banks and holding companies establish, review, update (as appropriate), and implement credit-risk management strategiesfor identifying, measuring, controlling and reporting on credit risk (including counterparty risk). Also, the U. S. federal banki

BCBS’s releases of Principles for the management of credit risk, September 2000, and Sound credit risk assessment and valuAs noted in Principle 7, the U. S. federal banking agencies adhere to the UFIRS and evaluate every bank against UFIRS guide

examinations2. UFIRS has a specific component to rate Asset Quality (A), which directly couples supervisory assessments of 

the credit-risk management of those assets. These assessments incorporate quantitative measurements of the levels of delinquclassified assets and qualitative evaluations of the adequacy of board and senior management oversight, credit policies, procedmanagement practices, internal control mechanisms, and management information systems. The relative importance of the qudepends on the risk characteristics and circumstances particular to the bank. Further, peer practice comparisons and data analof the evaluation process and, when available and relevant, may be used in assigning a rating.

EC 1 Principle 8: Credit risk Criterion The supervisor determines, and periodically confirms, that a bank’s Board approves, and periodically revie

1 For the Federal Reserve see the Commercial Bank Examination and Bank Holding Company Inspection Manuals; for the OCC see the Com

Loan Portfolio Management, Rating Credit Risk, Commercial Real Estate and Construction Lending, Leveraged Lending, Retail Lending, A

Inventory Financing, Credit Card Lending, Agricultural Lending, Mortgage Banking, Securitization, and others (e.g., installment loans, floo

FDIC see the Risk Management Manual of Examination Policies as well as the Credit Card Activities and Credit Card Securitization Manu

and Holding Companies Handbooks. 

2 Bank holding companies and savings and loan holding companies are evaluated using the RFI and CORE rating systems respectively. Bra

banks are evaluated against the ROCA guidelines. See Principle 7 for further details. 
EC 1 Principle 8: Credit risk 

management strategy and significant policies and processes for assuming, identifying, measuring, controllrisk (including counterparty risk). The supervisor also determines, and periodically confirms, that senior m

the credit risk strategy approved by the Board and develops the aforementioned policies and processes. 

Legal Framework 

The authorities cited above provide for active board of directors (board) involvement in the approval, periooversight of senior management’s implementation of a bank’s and holding company’s overall business strapolicies — especially those related to originating and managing credit risk. A board also must ensure that 

fully capable of managing the lending and other credit-extension activities that the bank or holding compa

responsible for understanding the level and nature of credit risk to the bank and holding company, setting t

and ensuring that management implements appropriate risk-management practices to identify measure, morisks. 

Practices and Procedures 

U.S. federal banking supervisors assess whether the board understands (1) the credit risk involved in the ac

risk appetite to its management; and (3) delegates the development of comprehensive policies, proceduresreview the quality of aggregated management information provided to the board to test whether these repotimely and accurately reflect the level and nature of credit risk. To assess board involvement in credit-risk 

will review minutes of board meetings and meetings of board committees, management committees, and oFurthermore, supervisors determine whether the board approves and regularly reviews the adequacy of sig

procedures for credit underwriting and for identifying, measuring, monitoring, and controlling credit-risk adescription of how U. S. federal banking agencies evaluate counterparty credit risk. U.S. federal banking supervisors will review compliance with supervisory guidance on credit-risk managecompliance with internal credit-risk management strategies and risk-management policies by conducting in

internal policies and procedures, and performing transaction testing.

EC 2 Principle 8: Credit risk Criterion The supervisor requires, and periodically confirms, that such policies and processes establish an appropri

credit risk environment, including: ● a well documented strategy and sound policies and processes for assuming credit risk; ● well defined criteria and policies and processes for approving new exposures as well as renewing and reexposures, identifying the appropriate approval authority for the size and complexity of the exposures; ● effective credit administration policies and processes, including continued analysis of a borrower’s abili

repay under the terms of the debt, monitoring of documentation, legal covenants, contractual requirements 

classification system that is consistent with the nature, size and complexity of the bank’s activities or, at thgrading system prescribed by the supervisor; ● comprehensive policies and processes for reporting exposures on an ongoing basis; ● comprehensive policies and processes for identifying problem assets; and 
EC 2 Principle 8: Credit risk 

● prudent lending controls and limits, including policies and processes for monitoring exposures in relati

exceptions to limits.

Legal Framework 

Pursuant to the authorities cited at the outset of this Principle, the U.S. federal banking agencies generally 

holding company’s policies and processes for managing credit risk will establish an appropriate and propeenvironment. U.S. federal banking agencies’ expectations in this regard are enumerated in supervisory guinclude the features listed in this EC. 

Practices and Procedures 

The U.S. federal banking agencies have issued supervisory guidance on sound risk-management practices portfolio management. The agencies have published examination manuals that are supplemented by speciarticulated in Federal Reserve SR letters, FDIC Financial Institution letters (FIL) and Statements of Policy 

and OTS Thrift Bulletins. During the course of examinations, U.S. federal banking supervisors review bancompanies’ compliance with the guidance including evaluating whether banks and holding companies hav

management systems for identifying, measuring, monitoring, and controlling credit risk in their banking acthe adequacy and effectiveness of credit-risk management practices, supervisors generally consider, as app

complexity, and risk profile of the bank or holding company, whether 

o Credit-risk policies are comprehensive and well documented and accurately reflect existing credit-

objectives. Policies and procedures must provide for adequate identification, measurement, monitcredit risks posed by the lending, investing, trading, trust, fiduciary, and other significant activities

o Proposed and current credit activities are consistent with the overall business strategy, stated goals 

established risk tolerances, as well as the overall financial strength. 

o Policies and procedures requiring the review and approval by key risk and control personnel of all 

Policies ensure that the bank or holding company establishes the necessary risk and control infrast

monitor, and control the varied risks associated with new credit activities before these activities ar

o Credit administration practices include initial and ongoing borrower and counterparty analyses, co

documentation, credit covenant and collateral documentation, transaction due diligence, credit-unddecision tools, borrower and portfolio limit and concentration monitoring, payment and collectionrestructuring processes, and loan loss reserving. 

o Banks and holding companies must maintain documentation supporting their analysis of the custo

willingness to repay a loan or other exposure at the time it is extended, renewed, or restructured; arelating to and/or analyzing the borrower’s financial condition, collateral and its valuation, and othsuch as guarantor information, loan agreements, proof of security interest in collateral, and adhere

o Employs a risk rating/grading system that accurately assesses the absolute and relative credit risk a

portfolios. The risk-rating system accurately defines and delineates borrower/counterparty credit qmeasurement of credit migration, and drives management decision-making.

o Stress testing processes are effective in identifying the impact of portfolio-level stress events on as

capital; the impact of business-level stress on credit concentrations; and the impact of downside sc

credit exposures. 
EC 2 Principle 8: Credit risk 

o Has effective management information systems for reporting, managing, and monitoring portfolio

credit risk exposures. 

o Management information systems are structured to monitor current and potential exposure

limits and strategic goals and objectives. 

o Reports to management are timely and contain sufficient information for decision makers 

trend of credit risk faced by the bank and holding company, including reports that make threadily available and routinely reviewable: total credit exposure, including loans and comm

of existing credit limits; new extensions of credit, credit renewals, and restructured creditsand/or nonaccrual loans; credits adversely graded or requiring special attention; credits to interests; credits not in compliance with internal policies, laws, or regulations; and specifi“outsized” credit exposures, and analyses of the bank’s credit exposure by type, geograph

o Has policies and procedures governing problem loan management including delinquency and char

Supervisors will determine whether policies, procedures and processes are in place for the timely iloans; criteria for providing a full awareness of the risk position, informing management and directaking steps to mitigate risk, and properly assessing the adequacy of the allowance for credit losse

o Loan review process discharges its duties appropriately. These may include verifying loan gradin

portfolio-management processes, evaluating credit-risk management, and confirming credit admindepending on the size and risk. 

o Management promptly and accurately identifies loans or portfolios with potential or well-defined 

ensures the development and implementation of an appropriate action plan, including restructuring to minimize credit losses. 

o Policies and procedures for the Allowance for Loan and Lease Losses comply with both accountin

guidance. 

o Has implemented a system that clearly identifies portfolio business, risks, and transaction and port

processes to confirm compliance with these limits, to require review and approval of limits, and to exceptions to limits. Supervisors determine if risk limits are established to address borrower/coungeographic concentration risks as well as unique risk factors, such as commodity-reliant industries securitizations. If an exception to a limit is made, supervisors validate that the bank’s process ensuoversight and approval procedures are required. 

o Has adequate risk-management practices for approving, monitoring, and controlling third party (i.

Supervisors determine whether banks and holding companies perform comprehensive due diligencoriginators prior to entering a relationship. In addition, supervisors determine whether adequate aucontrols are verified that third parties are not generating credit exposure outside of the established Supervisors determine whether third-party audit procedures include monitoring the quality of loanand enable management to identify such problems as early payment defaults and incomplete packa

action, as needed. 

o Has comprehensive, formal strategies for managing risks in secondary market activities. Supervis

contingency planning includes how the bank and holding company will respond to reduced deman
EC 2 Principle 8: Credit risk 

References: “Interagency Questions and Answers on Capital Treatment of Recourse, Direct Credit Interests in Asset Securitizations” (May 23, 2002) - OCC [OCC Bulletin 2002-22]; Federal ReservFDIC [FIL-54-2002]; and OTS [CEO letter 163]. 

As noted above, the agencies’ expectations for each of the above components will vary, based on size and 

complex banks and holding companies will generally not require every element in the above list but are repolicies and procedures to identify, measure, monitor, and control their credit-risk exposures. The agencies regularly review and update their supervisory guidance and examination processes to addresrisks. Quite often, interagency working groups are assembled to revise existing guidance to address a curr

EC 3 Principle 8: Credit risk Criterion The supervisor requires, and periodically confirms, that banks make credit decisions free of conflicts of int

length basis. 

Legal Framework 

The statutes on transactions with related parties, discussed under Principle 11, require credit decisions to binterest and on an arm’s length basis. In certain situations, credit decisions are required to be made by the participation of the interested party. Terms must be in accordance with those offered to members of the geis reviewed as part of the normal supervisory process. Reference: Regulation O or 12 CFR 215 addresses Principle 11 for more information on the statutes. 

Practices and Procedures 

U.S. federal banking agencies require banks and holding companies to develop policies that (1) define and conflicts of interest; (2) acknowledge that these credit decisions are to be given independent and complete 

in certain situations, require board approval. The agencies require banks and holding companies to establiindependent credit-approval function to maintain consistency with credit-origination criteria, review the cradherence to credit limits. U.S. federal banking agencies also expect that the risk-management function anmeasuring, monitoring, and controlling risks are sufficiently independent from those individuals who have 

transactions. These actual practices will vary, depending on the size and complexity of the supervised ban

U.S. federal banking supervisors will determine whether banks and holding companies have developed pomanagement practices to prevent conflicts of interest from influencing credit-underwriting decisions. Sup

approval policies, credit analysis and approval procedures, credit files and approval records, credit commit

review, and internal audit procedures to ensure that conflicts of interest are appropriately identified and proDuring the course of examinations, supervisors perform transaction testing to ensure loans are underwrittearm’s length basis. Supervisors may review extensions of credit issued to employees, officers, and directoor to the related interests of such persons. Such loans are reviewed to determine whether they were made 
EC 3 Principle 8: Credit risk 

terms as those prevailing at the time for comparable transactions with other persons; whether they involve 

repayment; or whether they have other unfavorable features, such as not being supported by adequate credviolation of lending limitations. Regulation O specifically addresses procedures for extensions of credit to 

directors, principal shareholders and their related interests. Further, supervisors review approved credit decisions to ensure that policies and procedures, and actual ac

including a borrower’s ability to repay the credit, were followed. Similar procedures apply to wholesale antrading, investment, and available for sale approvals, all of which are reviewed by credit review and intern

EC 4 Principle 8: Credit risk Criterion The supervisor has full access to information in the credit and investment portfolios and to the bank office

managing, controlling and reporting on credit risk. 

Legal Framework 

Under the U.S. federal banking agencies’ statutory examination authority, supervisors may review all book

by a bank (and its affiliates) subject to the agencies’ supervision. References: 12 U.S.C. §§ 161, 325-26, 4and (v), 1467(h), 1467a(b), 1817(a), 1817(a)(2), 1817(a)(3), 1820(b), 1844(c), 1867, 3102(b), 3105(c). T

employees involved in a matter under review and bank service companies and independent servicers that aService Company Act. The agencies also evaluate significant third-party service providers (the OCC may under 12 U.S.C. § 1867(c) to examine a third-party service provider). The agencies require banks and hol

contracts with third-party service providers, to include agency access to the books, records, and operations Information Technology Examination Handbook). Supervisory guidance specifies the information that is expected to be maintained by banks and holding comcredit management, including details on credit and investment portfolios. Supervisors are allowed and gen

this information, and to all employees involved in assuming, managing, controlling and reporting on credit 

examinations. Also, section 5 of the Bank Holding Company Act of 1956, which authorizes the Federal Reserve to examnonbank subsidiary thereof; section 7 of the International Banking Act of 1978, which authorizes the Fede

each branch or agency of a foreign bank; and Section 25(a) of the Federal Reserve Act and Section 211.7 oauthorize the Federal Reserve to examine Edge and agreement corporations. The OTS has authority under Act to examine each SLHC and its savings associations and other subsidiaries, except banks. See 12 U.S.C

Practices and Procedures 

The U.S. federal banking agencies may issue regulations or guidance to further supplement or clarify the a

regarding access to books, records and personnel of the bank and holding company. References: Federal R

which summarizes the Federal Reserve’s examination authority; OCC [PPM 5310-10, which provides guidsecuring access to a bank’s books and records]; and OTS [12 CFR §§ 562.1, 563.17] and section 10 of the 
EC 4 Principle 8: Credit risk 

During the course of examinations, management is to provide supervisors with full access to all records anand holding company. This includes access to internal and external audit reports and other material (such minutes and reports). Banks and holding companies that do not supply requested information or access to may be subject to supervisory sanctions and prosecution. 

AC 1 Principle 8: Credit risk Criterion The supervisor requires that the credit policy prescribes that major credit risk exposures exceeding a certai

the bank’s capital are to be decided by the bank’s senior management. The same applies to credit risk exprisky or otherwise not in line with the mainstream of the bank’s activities. 

Practices and Procedures 

U.S. federal banking supervisors review policies and procedures to ensure that banks establish limits on th

that limits and approval authorities are clearly defined. Supervisors ensure that credit policies describe the 

exposures will be approved and ultimately reported to the board. Supervisors review the approved credit athe levels of authority are granted to appropriate, experienced staff. Supervisors ensure that policies requirinvolve excessive or undue risks receive close scrutiny by the bank and holding company, and may test crethat credit approvals comply with policy requirements. For example, the agencies’ “Joint Guidance on CoCommercial Real Estate Lending, Sound Risk Management Practices,” directs banks and holding companievaluate the degree of correlation between related real estate sectors, establish internal lending guidelines and maintain adequate capital for those exposures. The board, or a committee thereof, is to periodically re

risk-exposure limits. The guidance also sets forth exposure thresholds, expressed as a percentage of a ban

capital that may signify potential significant exposures that may warrant increased supervisory scrutiny. 3

U.S. federal banking supervisors also review policies and procedures controls to ensure they address adhermandated limits. For example, the OCC establishes limits for nationally chartered banks on credit allowed 

State-chartered banks have limits imposed by each state regulator, but such limits are generally consistent the OCC. Similarly, the agencies’ Real Estate Lending Standards Regulation [12 CFR 34, subpart D (OCC) establisvalue limits for categories of real estate loans and capital limitations on the aggregate amount of loans that aggregate amount of those exceptions must also be reported at least quarterly to the board. Supervisors alsregulatory restrictions on granting credit for the purpose of purchasing stock or other securities as defined and X. 

3 See Federal Reserve SR letter 07-01, OCC Bulletin 2006-46, FDIC FIL-104-2006, OTS 72 Fed. Reg. 1372 (Jan. 11, 2007). 
AC 1 Principle 8: Credit risk 

The U.S. federal banking agencies have issued guidance on risk-management practices for specific producpractices during on-site examinations to ensure application. For example, the “Interagency Statement on S

Concerning Elevated Risk Complex Structured Finance Activities”4 specifies that transactions and exposu

elevated level of risk are subject to heightened review. The policies and procedures should be designed to control the risks in those transactions. The agencies require that the risk dimensions of these transactions bmonitored, and controlled by management. Also see “Interagency Credit Risk Management Guidance for 

“Interagency Guidance on Nontraditional Mortgage Product Risks,”6, and “Interagency Guidance on Leve

Risk Management Practices.”7

AC 2 Principle 8: Credit risk Criterion The supervisor determines that banks have in place policies and processes to identify, measure, monitor an

credit risk exposure, including potential future exposure sufficient to capture the material risks inherent in transactions. These processes should be commensurate with the size or complexity of the individual bank

Legal Framework 

Under the general authorities cited at the outset of this Principle, banks and holding companies are expecteand processes to identify, measure, monitor, and control counterparty credit-risk exposure, including potensufficient to capture the material risks inherent in individual products or transactions. The expectations foprocesses are described in supervisory guidance. References: Federal Reserve [SR letter 99-3 (SUP)], OCand Risk Management of Financial Derivatives booklet of OCC’s handbook series], FDIC [FIL-96-066 (SCredit Derivatives)], and OTS [Regulatory Bulletin 32-30]. The processes are expected to be commensuracomplexity of the individual bank’s and holding company’s trading activities. Under the agencies’ risk-ba

banks and holding companies must hold capital for the current credit exposure and potential future capital 

sheet counterparty exposures. Banks and BHCs operating under the interagency guidelines implementing approaches must have highly sophisticated policies and processes in place to identify, measure, monitor, acredit-risk exposure. 

Practices and Procedures 

The U.S. federal banking agencies have issued supervisory guidance for banks and holding companies on practices for counterparty credit risk. During the course of examinations, supervisors review compliance w

including evaluating whether banks and holding companies have established an adequate risk-managemen

to effectively identify, measure, and monitor counterparty credit-risk exposure. In conducting this evaluat

policies and reports to review whether the board and senior management have identified and understood th

4 See Federal Reserve SR letter 07-5, OCC Bulletin 2007-1, FDIC FIL-3-2007, and OTS CEO Memorandum 252. 5 See Federal Reserve SR letter 05-11; OCC Bulletin 2005-22 and 2006-43, FDIC FIL-58-2008, and OTS CEO Memorandum 256. 6 See Federal Reserve SR letter 06-15; OCC Bulletin 2006-41; FDIC FIL 89-2006; and OTS CEO Memorandum 244. 7 See Federal Reserve SR letter 01-9, OCC Bulletin 2001-18; and OTS Press Release 01-27 
AC 2 Principle 8: Credit risk 

credit risk inherent in the activities and whether appropriate policies were reviewed and approved to limit associated with those activities. In evaluating the adequacy of the counterparty risk-management process, size and complexity of an individual bank and holding company. Supervisors evaluate the following key eholding company’s counterparty risk-management process: 

o The assessment of counterparty creditworthiness, both initially and on an ongoing basis, a

counterparty's capital strength, leverage, on- and off-balance-sheet risk factors and contingoperating results, reputation, and ability to understand and manage the risks inherent in thbusiness, as well as the risks involved in the particular products and transactions that definrelationship. 

o The standards, methodologies, and techniques used in measuring counterparty credit-risk 

instrument, counterparty, and portfolio basis. 

o The use and management of credit enhancements for mitigating counterparty credit risks, 

arrangements and collateral management systems, contractual downgrade or material chancontractual "option to terminate" or closeout provisions. 

o The risk limit and monitoring systems that entail the setting of meaningful limits on count

monitoring exposures against these limits, and initiating meaningful risk assessments and the event that exposures exceed limits. 

Additionally, supervisory guidance generally specifies that supervisors determine whether banks and holdi

o Devote sufficient resources and adequate attention to the management of the risks involve

profitable or potentially high-risk activities and product lines. 

o Have internal audit and independent risk-management functions that adequately focus on 

risk criteria in targeting their reviews. 

o Achieve an appropriate balance among all elements of credit-risk management, including 

quantitative assessments of counterparty creditworthiness; measurement and evaluation of sheet exposures, including potential future exposure; adequate stress testing; reliance on cenhancements; and the monitoring of exposures against meaningful limits. 

o Employ policies that are sufficiently calibrated to the risk profiles of particular types of co

instruments to ensure adequate credit-risk assessment, exposure measurement, limit settinenhancements. 

o Ensure that actual business practices conform with stated policies and their intent. o Are moving in a timely fashion to enhance their measurement of counterparty credit-risk e

refinement of potential future exposure measures and the establishment of stress testing mincorporate the interaction of market and credit risks. 

To adequately evaluate these factors, supervisors conduct sufficient and targeted transaction testing on act
AC 2 Principle 8: Credit risk 

products experiencing significant growth, above normal profitability or large potential future exposures. As part of transaction testing, supervisors review potential future exposure calculations to determine whethmeasures of exposure in both normal and stressed markets and whether banks and holding companies need methodologies. Supervisors also determine whether methodologies employed to measure exposures are apand whether appropriate management information systems are in place for counterparty credit-risk limits a

AC 3 Principle 8: Credit risk Criterion The supervisor determines that banks have policies and processes to monitor the total indebtedness of entit

credit. 

Legal Framework 

As discussed under Principles 10 and 11, banks and holding companies also are subject to limits on exposugroups of borrowers. In addition, the interagency guidelines on safety and soundness require banks and hoconnection with credit-underwriting activity, to take adequate account of concentrations of credit risk. Re

Appendix D-1, part II(D)(5). Supervisory guidance elaborates further on expectations regarding monitorin

Together, these sources require banks and holding companies to have policies and processes in place to moindebtedness of entities to which they extend credit. 

Practices and Procedures 

U.S. federal banking supervisors review credit policies to determine that they address permissible amounts 

the bank and holding company may provide and compliance with regulatory limits and supervisory guidanconcentrations of risk. Supervisors review policies, procedures, and controls to determine that the bank anhas established effective systems for measuring and monitoring credit exposures, ensuring compliance witlimits, and ensuring that any new and existing asset concentrations are reported to the board or other appro
Principle 9: Problem assets, provisions, and reservesSupervisors must be satisfied that banks establish and adhere to adequate policies and processes for managing problem adequacy of provisions and reserves. (Reference documents: Principles for the management of credit risk, September 2000 and Sound credit risk assessment and v2006.) EC 1 Principle 9: Problem assets, provisions, and reserves Criterion Laws, regulations or the supervisor require banks to formulate specific policies and processes for identifyi

assets. In addition, laws, regulations or the supervisor require periodic review by banks of their problem asor at a portfolio level for credits with homogenous characteristics) and asset classification, provisioning an

Legal Framework 

The safety-and-soundness provision of the FDI Act, 12 U.S.C. § 1831p-1(b) requires the U.S. federal bank

standards related to asset quality. The interagency safety-and-soundness guidelines implementing this proestablish and maintain a system to identify problem assets and prevent deterioration in those assets. The scommensurate with the bank’s size and the nature and scope of its operations. In addition, the bank is exp

periodic asset quality reviews to identify problem assets; (b) estimate the inherent losses in those assets anallowances/reserves that are sufficient to absorb estimated losses; (c) compare problem asset totals to capit

corrective action to resolve problem assets; (e) consider the size and potential risks of material asset conceperiodic asset reports with adequate information for management and the board of directors to assess the leCFR 30, appendix A, § II(G); 12 CFR 208, appendix D-1, § II(G); 12 CFR 570, appendix A and 12 CFR 3U.S. federal law provides that the accounting principles applicable to reports or statements required to be f

agencies generally must be uniform and consistent with U.S. generally accepted accounting principles (U.S

§ 1831n(a)(2)(A); see also id. § 1463(b). In certain situations, the U.S. federal banking agencies can presc

principles, provided the alternate principles are “no less stringent” than U.S. GAAP. See 12 U.S.C. § 1831

1463(b)(3). U.S. GAAP includes guidance on accounting for impairment in a loan portfolio and other credStatement of Financial Accounting Standards No. 5, Accounting for Contingencies (FAS 5), and StatemenStandards No. 114, Accounting by Creditors for Impairment of a Loan (FAS 114). The U.S. federal bankiand, as warranted, periodically updated interagency policy statements on the Allowance for Loan and Leasaddressing the supervisory expectations about supervised banks’ application of and documentation supporbank credit portfolios. These policy statements elaborate on the asset quality obligations, noted above, set 

safety-and-soundness guidelines. The ALLL represents one of the most significant estimates in financial statements and regulatory reports. policy statement discusses important aspects of loan loss allowance practices and is designed to assist bankprocess for determining an appropriate ALLL and documenting that process in accordance with U.S. GAA
EC 1 Principle 9: Problem assets, provisions, and reserves 

Policy Statement on the Allowance for Loan and Lease Losses1” (December 13, 2006). These include, am

responsibilities of boards of directors, management, and supervisors of banks regarding the ALLL; (b) facestimation of the ALLL; and (c) and the objectives and elements of an effective loan review system, includsystem. The statement emphasizes that each bank is responsible for developing, maintaining, and documesystematic, and consistently applied process for determining the amounts of the ALLL and the provision foTo fulfill this responsibility, each bank is expected to ensure that controls are in place to consistently deteraccordance with U.S. GAAP, stated policies and procedures, management’s best judgment, and relevant su

This Interagency Statement on the ALLL identifies losses that are to be estimated in accordance with FAS in off-balance-sheet credit exposures, resulting from commitments and explicit and implicit recourse. Sepaddresses the appropriate accounting and reporting treatment for certain loans that are sold directly from thtransferred to a held-for-sale account. See “Interagency Guidance on Certain Loans Held for Sale” (March FAS 114 provide guidance on how to estimate the inherent loss on individual and groups of loans for finanbut this guidance does not affect the U.S. federal banking agencies’ processes or decisions related to asset offs, which are addressed in separate interagency guidance. See “Revised Uniform Agreement on the ClasAppraisal of Securities Held by Banks and Thrifts” (June 15, 2004); “Revised Uniform Retail Credit ClassManagement Policy” (June 12, 2000). Supervisors monitor adherence with this guidance and with the othdiscussed above, during on-site examinations. Both the Federal Reserve and the OTS expect holding companies to follow the Interagency Statement noteduring examinations of holding companies. 

Practices and Procedures 

U.S. federal banking agencies require each bank to establish and maintain a system that is commensurate w

and scope of its operations to identify problem assets and prevent deterioration in those assets. U.S. federaconfirm that the bank 1. Conducts periodic credit reviews to identify problem assets; 2. Estimates the incurred losses in those assets and establishes reserves that are sufficient to absorb these lo

3. Compares problem asset aggregates to capital; 4. Takes appropriate corrective action to resolve problem assets; 5. Considers the size and potential risks of material asset concentrations; and 6. Provides periodic asset reports with adequate information for management and the board of directors to risk. (12 CFR 30 appendix A, § II(G); 12 CFR 208 appendix D-1; 12 CFR 364 appendix A; and 12 CFR 5The Interagency Statement on the ALLL requires banks to adopt and adhere to written policies and procedits size and the nature, scope, and risk of its lending activities. At a minimum, supervisors confirm that the

1The “Interagency Policy Statement on the Allowance for Loan and Lease Losses” will be referred to as the Interagency Statement on ALLL 

For the Federal Reserve, it is part of SR letter 06-17; for the OCC, it is in Bulletin 2006-47; for the FDIC, it is FIL-105-2006; for the OTS it 
EC 1 Principle 9: Problem assets, provisions, and reserves 

ensure that the bank has an effective loan review system and controls (including an effective loan classificsystem) that identify, monitor, and address asset quality problems in an accurate and timely manner. To be effective, the bank’s loan review system and controls must be responsive to changes in internal and the level of credit risk in the portfolio. Regardless of the structure of the loan review system, supervisors e

loan review system should have, at a minimum, the following objectives:  • To confirm that management promptly identifies loans with potential or demonstrated credit weaknessemanagement does not accurately and timely identify such loans, loan review has the responsibility and autdeterminations.  • As necessary, to appropriately grade or adversely classify loans, especially those with well-defined credjeopardize repayment, so that timely action can be taken and credit losses can be minimized.  • To determine or require that management identifies relevant trends that affect the collectability of the po

segments of the portfolio that are potential problem areas.  • To assess the adequacy of, and adherence to, internal credit policies and loan administration procedures compliance with relevant laws and regulations.  • To evaluate the activities of lending personnel including their compliance with lending policies and, as 

loan approval, monitoring, and risk assessment.  • To provide senior management and the board of directors with an objective and timely assessment of th

loan portfolio.  • To provide management with accurate and timely credit-quality information for financial and regulatory including the determination of an accurate internal problem loan identification process that is necessary to 

appropriate ALLL. As a bank’s or holding company’s risk profile changes whether due to new products, increased volumes oconcentrations, the quality of its portfolio, or the overall economic environment, supervisors confirm that trisk-management practices and measures. In general, in measuring these risks, U.S. federal banking agencholding companies to perform reasonable stress tests to identify possible events or changes in markets that adverse effects in the future. The agencies expect banks and holding companies to consider the impact of 

arising from loan commitments, securitization programs, and other transactions. For two examples of formal agreements directing banks to review the adequacy of the ALLL and setup an http://www.occ.treas.gov/FTP/EAs/ea2008-040.pdf

http://www.federalreserve.gov/newsevents/press/enforcement/enf20090622a1.pdf 

EC 2 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor confirms the adequacy of the classification and provisioning policies and processes of a ba
EC 2 Principle 9: Problem assets, provisions, and reserves 

implementation; the reviews supporting this opinion may be conducted by external experts. 

Practices and Procedures 

U.S. federal banking supervisors confirm the adequacy of a bank’s loan classification, loss provisioning pr

adequacy during each supervisory cycle. Under the agencies’ Uniform Financial Institutions Rating system assess and assign a composite rating based on an evaluation and rating of six essential components of a baand operations. One of these component factors addresses the quality of assets In assigning this componeconsider the adequacy of the bank’s ALLL and other asset valuation reserves as well as the adequacy of thpractices. Supervisors review the policies, procedures, and internal controls for classification of, and prov

well as compliance with laws and regulations. To support this assessment, supervisors generally conduct tassess the effectiveness of these internal control processes. Supervisors also review the internal and externmanagement reports, models, and model validation processes to determine that classifications and provisio

directors and senior management an accurate and timely picture of the bank’s or holding company’s credit respective examination manuals contain detailed procedures that supervisors follow in conducting their rev

For example, supervisors evaluate and test each bank’s credit-risk-rating policy and procedures. In additioInteragency Statement on the ALLL, supervisors review and adjust the classification or grading of the ban

the credit quality of a its loan portfolio; and check the appropriateness of its ALLL methodology, documen

amount. (See Interagency Statement on the ALLL p. 13 and beyond). The “Interagency Policy Statement 

Classification of Commercial Real Estate Loans”3 instructs supervisors to evaluate commercial real estate 

supervisory classification and requires supervisors to evaluate the methodology and process that managemestimate the ALLL to ensure that all of the relevant factors affecting the collectability of the portfolio have 

considered. The “Interagency Uniform Retail Credit Classification and Account Management Policy” (June 12, 2000) supervisors on classifying retail portfolios, or segments thereof, where underwriting standards are weak ancredit risk, and on criticizing account management practices that are deficient. It also instructs supervisors 

ALLL provides adequate coverage for probable losses inherent in the portfolio. (See FFIEC Uniform RetaAccount Management Policy (p. 8)). The “Interagency Uniform Agreement on The Classification of Assets and Appraisal of Securities Held by instructs supervisors to use the published ratings provided by nationally recognized statistical ratings organsupervisory classification definitions but allows supervisors to assign a more or less severe classification f

depending upon a review of applicable facts and circumstances and the adequacy of internal credit-grading Reserve SR letter 04-9, p. 1; OCC Bulletin 2004-25; FDIC FIL-70-2004; OTS CEO Memorandum 200, Ju

2 See, e.g.: OCC’s Community Bank Supervision, Large Bank Supervision, Loan Portfolio Management, Rating Credit Risk and Retail Lend

Handbook series or the Federal Reserve’s Commercial Bank Examination Manual, Section 2040.3, Loan Portfolio Management Examinatio

3 See Federal Reserve SR letter 91-24; OCC, the Commercial Real Estate and Construction Lending booklet of the Comptroller’s Handbook 
EC 2 Principle 9: Problem assets, provisions, and reserves 

The guidance on the ALLL contained in these interagency policies is consistent with U.S. GAAP. Through the agencies’ Shared National Credit Program, teams of supervisors from the agencies conduct an classification of large syndicated loans held by multiple banks and holding companies. These reviews are agent/lead banks and holding companies with assigned classifications applicable to all participating institu

covered 8,750 credit facilities with commitments totaling $2.8 trillion. An example of a relevant enforcement action is a Cease and Desist order issued requiring a bank’s ALLL the relevant interagency guidance. www.occ.treas.gov/FTP/EAs/ea2008-126.pdf

EC 3 Principle 9: Problem assets, provisions, and reserves Criterion The system for classification and provisioning takes into account off-balance sheet exposures Legal Framework 

Pursuant to the FDI Act, 12 U.S.C. § 1831n(a)(3)(C), all assets and liabilities, including contingent assets 

and holding companies must be reported in, or otherwise taken into account in the preparation of, any bala

statement, report of condition, or other report required to be filed with a federal banking agency. Implemeguidance makes clear that systems for classification and provisioning should take into account off-balance

Practices and Procedures 

Agency guidelines state that the risk ratings used by banks and holding companies should be applied to off

such as letters of credit and unfunded commitments that the bank or holding company is obligated to fund Portfolio Management Handbook or Federal Reserve’s Commercial Bank Examination Manual). 

The Interagency Statement on the ALLL requires the recognition of credit losses in off-balance-sheet expocommitments, standby letters of credit, guarantees, and recourse liabilities on loan transfers. U.S. federal b

the structure of off-balance-sheet instruments to understand the explicit and implicit credit risk to the banksecuritizations, underwritings of exposures requiring distribution in capital markets, structured securities, a

federal banking agencies expect banks and holding companies to estimate credit exposures in accordance wGAAP requires any allowance for credit losses on off-balance-sheet exposures to be reported on the balancLiability,” and not as part of the ALLL. See Interagency Statement on the ALLL, p. 3. 

EC 4 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor determines that banks have appropriate policies and processes to ensure that provisions and 

repayment and recovery expectations. 
EC 4 Principle 9: Problem assets, provisions, and reserves Legal Framework 

Under the interagency safety-and-soundness guidelines, a bank should establish and maintain a system thaidentifies and resolves problem assets. See 12 CFR 208, appendix D, § II(G); and 12 CFR 30, appendix Asupervisory guidance, banks and holding companies are expected to establish appropriate policies and procprovisions and write-offs reflect realistic repayment and recovery expectations. 

Practices and Procedures 

In accordance with long standing supervisory guidance as recently clarified in the Interagency Statement o

banking supervisors confirm that banks and holding companies evaluate the ALLL reported on the balance each quarter, or more frequently if warranted, and charge or credit the provision to bring the ALLL to an aevaluation date. The determination of the ALLL and the necessary provision are to be based on the bank’s 

the credit quality of the loan portfolio, and should consider all known relevant internal and external factors collectability as of the evaluation date. Nevertheless, the ALLL estimates do reflect rigorous quantitative considerable amounts of management judgment. U.S. federal banking supervisors review bank policies, processes, and practices to ensure that they prompt

portions of loans, where available information confirms the exposure to be uncollectible. Using the InteraCredit” definitions, supervisors can direct banks and holding companies to recognize loan losses or change 

Also, if the supervisor concludes that the reported ALLL level is not appropriate or determines that the ALbased on the results of an unreliable loan review system or is otherwise deficient, supervisors are empower

holding company to correct these deficiencies as dictated in the Interagency Policy Statement on the ALLL

EC 5 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor determines that banks have appropriate policies and processes, and organizational resource

identification of deteriorating assets, for ongoing oversight of problem assets, and for collecting on past-du

Legal Framework 

Under supervisory guidance implementing the interagency safety-and-soundness guidelines on identifying assets, banks and holding companies are expected to have appropriate policies and processes, and organizaearly identification of deteriorating assets, for ongoing oversight of problem assets, and for collecting on p

Practices and Procedures 

To facilitate early identification of deteriorating assets, U.S. federal banking agencies require banks and ho

effective loan administration and loan review systems that make use of a risk-rating system that rates or grassets. The agencies require banks and holding companies to initiate additional or heightened oversight as exposure deteriorates and to initiate appropriate corrective action, including potential escalation into the recollection processes. Based on a combination of on-site examinations and off-site monitoring, U.S. federa

assess the quality and timeliness of the bank’s or holding company’s rating system, classification process, 

processes to determine if they are appropriate. Supervisors also assess the trend in credit ratings migration 

holding company to re-grade any credit where the rating does not reflect the credit’s actual condition. In t

classification or grading of assets, supervisors consider all significant factors that affect the collectability o
EC 5 Principle 9: Problem assets, provisions, and reserves 

the value of any collateral. See Interagency Statement on the ALLL, pp. 6 – 8 and Attachment 1. For retail transactions, supervisors evaluate a bank’s account management, collection and foreclosure procwhether institutional intervention is appropriately mitigating or reducing potential losses. 

EC 6 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor is informed on a periodic basis, and in relevant detail, or has access to information concern

credits and assets and provisioning. 

Legal Framework 

Under the U.S. federal banking agencies’ statutory examination authority, supervisors may review all book

by a bank or holding company (and its affiliates) subject to the agencies’ supervision. See12 U.S.C. §§ 32625, 1464(d), 1467a(b), 1820(b), 1844(c), 3105(c). This includes access to the bank’s or holding companinvolved in a matter under review. Supervisory guidance specifies the information that is expected to be mholding companies with respect to credit management, including details on credit and investment portfolio

access to this information, and to all employees involved in assuming, managing, controlling and reporting 

examinations. Further, banks and holding companies are required to submit quarterly regulatory financial condition to supervisors (referred to as Call Reports or Thrift Financial Reports). This information include

of credits and assets, delinquencies, and provisioning. Supervisors have full and complete access to this inexaminations and may request additional details, as appropriate. 

Practices and Procedures 

During the course of examinations, U. S. supervisors are provided with full access to all records and emploholding company. This includes access to individual loan files, risk-management reports, internal and exteother material (such as board or committee minutes and reports). Banks and holding companies that do noinformation or access to premises and personnel are subject to supervisory sanctions and prosecution. The agencies utilize the quarterly regulatory financial reports, as well as regular reports from the bank’s manag

assess the condition of banks and holding companies and to identify trends in loan and asset performance. assists supervisors in identifying potential areas for further supervisory review. Supervisors use the report

necessary to make evaluations of the bank’s or holding company’s internal processes and management comAs clarified in the Interagency Statement on the ALLL, the U.S. federal banking agencies require banks to board of directors that summarizes the results of the loan review process, the loan loss allowance calculatievaluation of the appropriateness of the current ALLL level at least quarterly. The policy indicates that the 

be informed more frequently than quarterly when material adverse trends are noted. As the size and comp

supervisors use more granular reports to make their assessments and to find potential areas of weakness. In addition to reporting current credit quality findings, the board of directors should receive reports on com

identify significant changes or trends in the overall quality of the portfolio. Findings should also address t
EC 6 Principle 9: Problem assets, provisions, and reserves 

adherence to, internal policies and procedures, as well as compliance with laws and regulations, in order to correction of any noted deficiencies. Reports submitted to a bank’s or holding company’s board of directo

supervisors. The regulatory reports submitted by banks and holding companies, generally on a quarterly breconciliation of the ALLL, charge-offs, provisions, and past-due and nonaccrual information (See InteragALLL, Attachment 1; Call Reports, TFRs, Y-9 reports). 

EC 7 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor has the power to require a bank to increase its levels of provisions and reserves and/or over

deems the level of problem assets to be of concern. 

Legal Framework 

If provisions are deemed to be inadequate, the federal banking agencies will require corrective measures. 

federal banking agencies have the authority to require additional provisions or to impose other remedial mU.S.C. § 1818(b). Also, banks and holding companies must file with the federal banking agencies quarterlU.S.C. §§ 161(a) and (c) and 1464(v)(savings associations)), and civil money or other penalties may be asfailures, such as an inaccurate ALLL. U.S. federal banking supervisors assess the credit quality of a bank’s loan portfolio, the appropriateness of and documentation, and the appropriateness of the reported ALLL in the bank’s regulatory reports. Identifloan review program, including in the level of problem assets, should be noted in examination reports. Ba

companies are expected to correct any noted deficiencies, including, if appropriate, by increasing their leve

reserves and/or overall financial strength. Additional supervisory action may be taken based on the magnishortcomings. See Interagency Statement on the ALLL (December 13, 2006). 

Practices and Procedures 

As most recently clarified in the Interagency Statement on the ALLL, if a U.S. federal banking supervisor 

ALLL level is not appropriate or determines that the ALLL evaluation process is based on the results of an system or is otherwise deficient, supervisors will require the bank or holding company to take corrective a

deficiencies. Supervisors will note serious concerns regarding the ALLL in their reports of examination. agencies may also take enforcement action against the bank or holding company, based on the magnitude oshortcomings in the ALLL process, including the materiality of any error in the reported amount of the ALholding company’s ALLL is inadequate, supervisors will require it to adjust its ALLL by an amount sufficreported on its regulatory reports to an appropriate level as of the evaluation date. This adjustment should 

period provision or through the restatement of prior period provisions, as appropriate for the circumstanceStatement on the ALLL, p. 15). The federal banking agencies can require the addition of capital or an adjustment of capital to reflect the inprovisions and ALLL. See 12 CFR 3, Subpart C – Establishment of Individual Minimum Capital Ratios fo

Evaluations of capital adequacy fully incorporate assessments of asset quality, allowance/reserve appropri
EC 7 Principle 9: Problem assets, provisions, and reserves 

strength. Material shortfalls in allowance/reserves or regulatory capital are immediately met with supervis

EC 8 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor assesses whether the classification of the credits and assets and the provisioning is adequat

If provisions are deemed to be inadequate, the supervisor has the power to require additional provisions or measures. 

Legal Framework 

If provisions are deemed to be inadequate, the federal banking agencies will require corrective measures. 

federal banking agencies have the authority to require additional provisions or to impose other remedial mU.S.C. §1818(b); and 12 U.S.C. §1831p-1(e). Also, banks and holding companies must file with the federquarterly financial reports (12 U.S.C. §§ 161(a) and (c) and 1464(v)(savings associations), and civil money 

assessed for significant failures, such as an inaccurate ALLL. See 12 U.S.C. § 1818(i). 

Practices and Procedures 

As most recently clarified in the Interagency Statement on the ALLL, the U.S. federal banking agencies re

effective loan review system and controls (including an effective loan classification or credit-grading syste

monitors, and manages asset quality problems in a prudent manner. Through periodic on-site and off-site sagencies assess whether classification and provisioning processes are adequate. If the U.S. federal banking 

the reported ALLL level is not appropriate or determines that the ALLL evaluation process is based on the 

loan review system or is otherwise deficient, supervisors will require the bank or holding company to adjuthe process deficiencies. Supervisors do not rely on management’s current estimate of credit losses when supervisors find a bank’s internal credit administration practices ineffective. When an examination identifies material credit adminis

significant volume of problem loans and the ALLL amount appears deficient in such cases, supervisors req

company’s management to expeditiously address the appropriateness of its ALLL estimate and to make praddress deficiencies identified through the supervisors’ review. Supervisory recommendations on an appr

are included in the federal banking agency’s report of examination, and supervisors may require a formal w

bank or holding company on the action to be taken. Supervisors monitor the bank’s or holding company’s ensure that deficiencies have been addressed. (Interagency Statement on the ALLL, pp. 6 and 15) As clarified in the Interagency Statement on the ALLL and the “Interagency Policy Statement on Allowan

Losses Methodologies and Documentation,” supervisors ensure that valuation approaches and techniques aGAAP. 

EC 9 Principle 9: Problem assets, provisions, and reserves 
EC 9 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor requires banks to have appropriate mechanisms in place for periodically assessing the valu

including guarantees and collateral. The valuation of collateral is required to reflect the net realizable valu

Legal Framework 

The interagency safety-and-soundness guidelines require banks to establish and maintain systems for ident

preventing deterioration of those assets which include guidelines for loan documentation. See 12 CFR 30, CFR 208, appendix D-1, § II(G); and 12 CFR 570, appendix A, § II(G) . As part of this system, the bank icredit administration function and conduct periodic asset quality reviews to identify problem assets. The U

agencies expect banks and holding companies to establish and implement appropriate policies and proceduassessing the value of risk mitigants, including guarantees and collateral, at net realizable value. For real eagencies have appraisal and real estate lending standards regulations that govern collateral valuation practistandards (e.g., loan-to-value limits), credit administration, and portfolio management expectations. (See CFR 208 subpart E; 12 CFR 225, subpart G; and12 CFR 564.) 

Practices and Procedures 

As clarified in the Interagency Statement on the ALLL and the “Interagency Policy Statement on Allowan

Losses Methodologies and Documentation,” supervisors ensure that valuation approaches and techniques aGAAP. For loans individually evaluated for impairment, supervisors confirm that estimates of credit lossall significant factors that affect the collectability of the loan as of the evaluation date, including risk mitigThere are three methods that are allowed to determine the impairment: fair value of collateral, observable mand a discounted cash flow method. For loans solely dependent on the liquidation of collateral, only the collateral valuation approach is allowe

approach allows a valuation “as-is” less transaction costs to determine the impairment -- a “fire sale” estim

real estate secured credits, supervisors assess compliance with appraisal regulations and accompanying gumarket value of real estate securing the credit. As part of the appraisal regulations, the U.S. federal bankin

appraisal standards as set forth in the U.S. Uniform Standards of Professional Appraisal Practice. For loans evaluated for impairment on a pool basis, estimates of credit losses should follow a systematic a

approach to select the most appropriate loss measurement methods with written documentation and supporrationales for the use and valuation of risk mitigants and collateral. For example, loans that are fully secureat the bank or would be evaluated for collectability with a thorough analysis of the borrowers’ ability to reof the deposit. (See Interagency Statement on the ALLL, pp. 6 and 15 and the July 2001 interagency “Poli

Allowance for Loan and Lease Losses Methodologies and Documentation for Banks and Savings Institutioletter 01-17, pp. 13 16; OCC Bulletin 2001-37 (July 20, 2001); and FDIC FIL-63-2001 (July 25, 2001).) 

EC 10 Principle 9: Problem assets, provisions, and reserves Criterion Laws, regulations or the supervisor establish criteria for assets to be identified as impaired, e.g. loans are i

there is reason to believe that all amounts due (including principal and interest) will not be collected in acc
EC 10 Principle 9: Problem assets, provisions, and reserves 

contractual terms of the loan agreement. 

Legal Framework 

Pursuant to the safety-and-soundness provision of the FDI Act, 12 U.S.C. § 1831p-1(b), the U.S. federal bestablished criteria for identifying an asset as “impaired.” See Interagency Statement on the ALLL (Decem

Practices and Procedures 

U.S. federal banking supervisors evaluate assets considered for impairment, the impairment evaluation proimpairment amounts taken under the ALLL review process. Deficiencies in the process are identified and expected. The accounting guidance defines impaired assets in several pronouncements – individual loans under FAS collectively (as part of a pool) under FAS 5. Fundamentally, an impaired loan is defined as a loan where mthat it will collect payment in full of contractual interest, fees, and principal payments. Banks and holding companies have the discretion to determine which individual loans are considered for eunder FAS 114 and define them in their internal accounting practice documents. Generally, loans exceedicriterion, nonaccrual assets, severely delinquent credits, and problem loan or “watch” lists generate the loa

which loans are “impaired. Once a loan is identified as impaired, an estimate of the amount of impairment 

The amount of impairment for a pool of loans is based on a bank’s or holding company’s ongoing loan revof loan performance. One method of estimating loan losses for groups of loans is through the application oaggregate loan balances. Such loss rates typically reflect the bank’s or holding company’s historical loan lgroup of loans, adjusted for relevant environmental factors (e.g., industry, geographical, economic, and po

conditions over a defined period of time. See July 2001 “Interagency Policy Statement on Allowance for L

Methodologies and Documentation for Banks and Savings Institutions”; Federal Reserve SR letter 01-17, 

2001-37 (July 20, 2001); and FDIC FIL-63-2001 (July 25, 2001). 

EC 11 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor determines that the Board receives timely and appropriate information on the condition of t

including classification of credits, the level of provisioning and major problem assets. 

Legal Framework 

Pursuant to the sources identified under EC 10 and the interagency guidelines on safety and soundness, bacompanies should have policies and procedures in place to ensure that the board of directors receives timeinformation on the condition of the bank’s or holding company’s asset portfolio, including classification oprovisioning, and major problem assets. See 12 CFR 30, appendix A § II(G); 12 CFR 208, appendix D-1, 

Practices and Procedures 

During the course of examinations, a bank’s or holding company’s management provides supervisors with 

and employees. This includes access to internal and external audit reports and other material, such as boar
EC 11 Principle 9: Problem assets, provisions, and reserves 

meeting minutes. Banks and holding companies that do not supply requested information or access to premsubject to supervisory sanctions and prosecution. U.S. federal banking agencies utilize the quarterly regulwell as reports from the bank’s or holding company’s management, to monitor and assess the condition of companies and to identify trends in loan and asset performance. This information also assists supervisors areas for further supervisory review. Agency supervisors determine whether bank management provides clear, concise, and timely information and its attendant risks to the board of directors. Supervisors determine that management has clearly commobjectives and risk limits to the board and that the board has approved them. Supervisors also ensure that rprovisioning levels, significant problem assets, policy exceptions, and compliance with laws and regulatio

to both senior management and the board. Supervisors determine whether the reports’ descriptions of loan sufficient to enable the board to exercise its supervisory responsibilities. The agencies expect that a unit independent of the lending function will periodically evaluate the accuracytimeliness of the information in these reports. This evaluation is normally part of loan review or audit activabout internal testing, supervisors conduct sufficient testing to reach an independent assessment. As most recently clarified in the Interagency Statement on the ALLL, the agencies require bank managemreports, at a minimum, to the board of directors, summarizing the results of the loan review process. The amanagement to make more frequent reports to the board of directors when material adverse trends are noteThe agencies expect management to provide the board of directors with comparative reports that identify s

level and trend of credit risk in the portfolio. Such reports should address the adequacy of, and adherence procedures, as well as compliance with laws and regulations, in order to facilitate timely correction. These also provided to supervisors. During on-site examinations, supervisors evaluate the effectiveness bank corincluding the type and quality of information provided to the board of directors. (See Interagency Statemenfor a brief synopsis of federal banking agencies examination handbook/manual sections on boards of direcresponsibilities.) 

EC 12 Principle 9: Problem assets, provisions, and reserves Criterion The supervisor requires that valuation, classification, and provisioning for large exposures be conducted on Legal Framework 

Pursuant to the Interagency Statement on the ALLL (December 13, 2006), banks are expected to value, claprovisions for large exposures on an individual item basis. 

Practices and U.S federal banking agencies expect management to focus attention on, and consider capital allocations fo
EC 12 Principle 9: Problem assets, provisions, and reserves Procedures including large individual exposures. As most recently clarified in the Interagency Statement on the ALLL

banks to review significant credits at least annually, upon renewal, or more frequently when internal or extpotential for deteriorating credit quality in a particular loan, loan product, or group of loans. Also, the ageholding companies to individually allocate provisions for large exposures. 

AC 1 Principle 9: Problem assets, provisions, and reserves Criterion Loans are required to be classified when payments are contractually a minimum number of days in arrears 

Refinancing of loans that would otherwise fall into arrears does not lead to improved classification for suc

Practices and Procedures 

Supervisors have issued specific supervisory classification for retail credits, see “Uniform Retail Credit ClManagement Policy”; 65 Fed. Reg. 36903 (June 12, 2000); Federal Reserve SR letter 00-8; OCC Bulletin 2000 (June 29, 2000); and OTS CEO Memorandum 128 (July 27, 2000). In the U. S., the agencies have gmost retail products, the quality of retail credit is best indicated by the repayment performance of individu

under these guidelines, banks and holding companies are expected to classify loans and recognize losses wcontractually a minimum number of days in arrears. Also, banks and holding companies are required to esthat control the use of extensions, deferrals, renewals, and rewrites. The policy does not preclude supervisindividual loans or entire portfolios regardless of delinquency status or criticizing account management primproperly managed. If underwriting standards, risk management, or account management standards are w

unreasonable credit risk, supervisors may deviate from the minimum classification guidelines outlined in t

Reserve’s CBEM, section 2060.1; OCC’s Retail Lending Examination Procedures Handbook and FDIC FCEO Memorandum 128 (July 27, 2000). For loans not covered by the policy on retail credit, above, the U.S. federal banking agencies consider credarrearage. Credits are required to be classified when well defined weaknesses that jeopardize liquidation oclassifying such credits, the agencies use the following asset designations – “Special Mention,” “Substand“Loss.” The Federal Reserve’s criteria are in Commercial Bank Examination Manual, section 2060.1; OC

Risk Handbook; and the FDIC’s FIL-40-2000 as well as chapter 3.2.of the RMMEP and the OTS’s is in OHandbook, Section 260, Classification of Assets. 
Principle 10: Large exposure limitsSupervisors must be satisfied that banks have policies and processes that enable management to identify and manage concentrand supervisors must set prudential limits to restrict bank exposures to single counterparties or groups of connected counterpa(Reference documents: Measuring and controlling large credit exposures, January 1991; and Principles for managing credit rOverview Banks, including branches and agencies of foreign banking organizations, are subject to limits on exposures to a single counteconnected counterparties. National banks are subject by statute to limits tied to express percentages of a bank’s unimpaired ca

U.S.C. § 84. These limits are further defined by regulation. See 12 CFR 32. Section 84 authorizes the OCC to establish lend

classes or categories of loans or extensions of credit" that are different from those expressly provided by the statute's terms. S

OCC has exercised this authority to add special lending limits for certain small business loans, small farm loans, and residentiSee 12 CFR 32.7. A bank’s total outstanding loans and extensions of credit to one borrower are typically limited to 15 percensurplus. A bank can extend an additional 10 percent of its capital and surplus to one borrower if the loan is fully secured by recollateral on which a perfected security interest has been obtained (i.e., there is an aggregate limit of 25 percent of a bank’s caOther limits apply in special situations. In addition to the 15 percent and 10 percent restrictions for loans to one borrower, a bthan 50 percent of its capital and surplus to corporate groups. See 12 CFR 32.5(d). The OCC’s lending limit regulation for national banks applies to other types of banks as well. By statute, the limits in section banks apply to all savings associations, with narrow exceptions. See 12 U.S.C. § 1464(u). The OTS has issued implementing 

560.93. In general, state chartered banks are subject under state banking laws to percentage limitations similar to those applicThe FDIC and the Federal Reserve have not promulgated separate regulations governing single borrower limits, although, as d

11, the national and state lending limits are incorporated by reference into the Federal Reserve’s regulations governing exposu

addition, all banks and holding companies are subject to the interagency guidelines on safety and soundness. See Federal Res

appendix D-1, which effectively requires diversification in the credit portfolio and prohibit undue concentrations of assets] anappendix A]. The limits imposed by regulation apply to all outstanding loans and extensions of credit to a single borrower. These lending linvestment securities limits of 12 U.S.C. § 24(Seventh) and 12 CFR 11 which impose separate and independent limits on expo

arising from securities held by banks for their own account. These limits restrict the amount of securities that a bank may deal or sell, based on the characteristics of the security’s obligor. 12 CFR 24 imposes similar investment limits on a national bank

community and economic development entities. Both sets of limits are expressed as a percentage of a bank’s capital. The ag

securities issued by one borrower and held by a bank may not exceed 10 percent of the bank’s capital and surplus for Type II 

issued by individual states or by certain international and multinational development bank); 10 percent of capital and surplus f

(e.g., certain corporate or municipal bonds); 25 percent of capital and surplus for Type IV securities (e.g., small business-relatthird or fourth highest rating categories by an NSRO); and 25 percent of capital and surplus for Type V securities (e.g., certain 

1 12 CFR 1 applies to banks but not savings associations 
Principle 10: Large exposure limitsmarketable securities). See 12 CFR 1.3. Those investment securities restrictions impose separate and independent limits on earising from securities held by banks for their own account. The single borrower limits also do not apply to transactions with 

subject to separate restrictions as discussed in the assessment of Principle 11. A federal savings association’s total investment corporate debt securities of any one issuer, or issued by any one person or entity affiliated with that issuer, together with other 

general lending limit. See 12 CFR 560.40(a)(3). Different statutory limits apply to the aggregate amounts of various types of loans and investments by a federal savings associ

are based on total capital or assets, apply to the aggregate amount of all loans or investments of the same type. See 12 U.S.C. 

560.30. For example, commercial loans may not exceed 20 percent of the total assets of the federal savings association, and apercent may only be for small business loans. See 12 U.S.C. § 1464(c)(2)(A). Nonresidential real property loans may not exc

12 U.S.C. § 1464(c)(2)(B). All consumer loans and all investments in commercial paper and corporate debt securities, when aexceed 35 percent of total assets. See 12 U.S.C. § 1464(c)(2)(D).Largely Compliant: Prior to the market turmoil, many banks' default models relied on historical correlations and, especially fmortgage related exposures, focused on geography and borrower characteristics, but not on the aggregate risk exposure of subincluding exposures from highly-rated senior CDOs and other structured securities. In addition, some off balance sheet structnot fully considered. In many cases the bank did not have any legal obligation to support those transactions but later chose to investor relationships, In retrospect, these omissions proved to be critical, and are being addressed in current supervisory activ

directing banks to improve their ability to aggregate risks across legal entities and product lines to identify potential risk conc

EC 1 Principle 10: Large exposure limits Criterion Laws or regulations explicitly define, or the supervisor has the power to define, a “group of connected cou

actual risk exposure. The supervisor may exercise discretion in applying this definition on a case-by-case b

Legal Framework 

Regulations define those individuals and entities whose interests will be attributed to the single borrower fthe lending limits. Under the regulations, the OCC and OTS generally have discretion to apply the attribut

reflects actual risk exposure. Regulations also define corporate groups for purposes of the lending limits. 

and 12 CFR 32.5. Although there are no statutory or regulatory concentration limits for holding companieconcentrations at holding companies are monitored and subject to limits through the supervisory process. 
EC 1 Principle 10: Large exposure limits Practices and Procedures 

The U.S. federal banking agencies expect banks to adhere to legal lending limits. U.S. federal banking supand holding company’s risk-management practices to define, identify, measure, monitor, and control large 

large exposure depends in part on “facts and circumstances,” specifically, credit exposure to related groupcollateralized by a single security or securities with common characteristics, credit exposure to borrowers characteristics within an industry, and loans with a single source of repayment. Supervisors review the pointernal controls a bank or holding company uses to monitor and manage its concentration risks. 

EC 2 Principle 10: Large exposure limits Criterion Laws, regulations or the supervisor set prudent limits on large exposures to a single counterparty or a grou

counterparties. “Exposures” include all claims and transactions, on-balance sheet as well as off-balance sh

confirms that senior management monitors these limits and that they are not exceeded on a solo or consoli

Legal Framework 

The sources cited in the overview establish limits on “loans and extensions of credit” to a single counterpaconnected counterparties. In general, on-balance-sheet as well as off-balance-sheet extensions of credit arthe limit. The legal lending limits, however, do not cover all claims and transactions that expose a banking 

risk of third parties. Counterparty credit risk from derivatives is not explicitly included. Unlike other cred

potential credit risk arising from a derivative transaction is more uncertain: for most transactions, the risk party of the contract having a current credit exposure to the other party at various points in time over the camount at risk is not a fixed amount but rather varies over time with movement in market rates. As a result can only estimate, how much the value of the derivative contract might be at various points of time in the f

exposures are not included in a bank’s legal lending limit, institutions are expected to establish internal lim

these limits are reviewed and monitored by examiners. In many cases, these exposures are collateralized b

Combination rules apply to determine whether extensions of credit to one borrower will be attributed to aneach person will be deemed a borrower. See 12 CFR 32.5. For example, under the combination rules, loa

another person when proceeds of a loan or extension of credit are to be used for the direct benefit of the otcommon enterprise is deemed to exist between the persons. Id. 

When the agencies identify overages to the legal lending limit, they may seek restitution and civil money pdirectors and agents of the bank See 12 U.S.C.§ 1818(b) and (c) and 12 U.S.C. § 93. 

While subject to the same lending limits as a bank, 12 CFR 560.93, a federal savings association’s total inpaper and corporate debt securities of any one issuer, or issued by any one person or entity affiliated with t

2 For Federal Reserve see section 2050 of CBEM; for OCC see the Comptroller’s Handbooks for Community Bank Supervision, Large Bank 

diversification management and concentration limits are assessed as part of OCC’s Risk Assessment System), Concentrations of Credit p. 1 Management; for FDIC see FIL-22-2008 and subsection G of RMMEP; for OTS see Examiner Handbook, section 211. 
EC 2 Principle 10: Large exposure limits 

other loans, may not exceed the general lending limit. See 12 CFR 560.40(a)(3).

Practices and Procedures 

The U.S. federal banking agencies confirm, as part of the normal supervisory process, that senior managemcredit and issuer limits and monitors the bank’s and holding company’s exposures and that it has adequate information systems to ensure that these limits are not exceeded on an individual legal entity or consolidat

expect management to define, identify, measure, monitor, and control borrower limits, which are defined aextensions of credit and contingent obligations (both on- and off-balance sheet). U.S. federal banking supervisors determine whether a bank’s or holding company’s lending policies and papplicable laws and regulations and initiate corrective action when policies, practices, procedures, or interor when violations of laws or regulations have been noted. The supervisor is charged with understanding aeffectiveness of the internal policies, systems, and controls that the bank or holding company uses to moniassociated with asset limitations. The supervisor is also responsible for verifying the accuracy of large bor

identified by the bank or holding company. See Banking Manuals noted in Principle 7 and footnote 1 of E

EC 3 Principle 10: Large exposure limits Criterion The supervisor determines that a bank’s management information systems identify and aggregate on a tim

individual counterparties and groups of connected counterparties. 

Legal Framework 

Banks and holding companies are expected, in adhering to the interagency safety-and-soundness standards

information systems (MIS) in place that adequately and timely identify and aggregate risk exposures, inclucounterparties and groups of connected counterparties. For holding companies, these systems must provid

legal entities. 

Practices and Procedures 

The U.S. federal banking agencies have directed banks and holding companies to maintain adequate record

identify large borrower relationships. See footnote 1 of EC 1. The degree of sophistication of a bank’s or reporting systems and records will vary depending on the size, complexity, and global footprint of the ban

new and existing large borrowers should be reported regularly to the board of directors or other appropriat

U.S. federal banking supervisors are responsible for reviewing, evaluating, and verifying these reports dur

Supervisors determine that management reporting is timely and in a format that clearly indicates absolute 

exposure to individual counterparties and groups of connected counterparties. In addition, supervisors ass

reporting includes a well-defined process through which management reviews and evaluates large borrowereports. Supervisors also evaluate if a bank or holding company should have a more advanced practice thathese exposures relative to internal and regulatory capital measures, not just notional exposures. 
EC 4 Principle 10: Large exposure limits Criterion The supervisor confirms that a bank’s risk management policies and processes establish thresholds for acc

credit and require that all material concentrations be reviewed and reported periodically to the Board. 

Legal Framework 

The legal authorities and supervisory guidance cited in the overview to Principle 8 provide for active board 

approval, periodic review, and oversight of senior management’s implementation of a bank’s and holding business strategies and significant policies —including strategies and policies related to taking and managi

supervisory guidance, banks and holding companies are expected to establish internal thresholds for accepcredit and to report all material concentrations to the board for review. 

Practices and Procedures 

The U.S. federal banking supervisors confirm that management identifies, defines, measures, monitors, an

Concentrations are generally defined by the agencies as direct or indirect extensions of credit and contingeand on-balance sheet) that, when aggregated, exceed 25 percent of the bank’s tier 1 capital plus the allowalosses. See footnote 2 in EC 1. The U.S. federal banking agencies expect that the bank and holding compestablish prudent concentration control processes in relation to the level and complexity of its lending activsophistication, and its capital levels. These processes should include escalation procedures and approval p

policy limits. Supervisors verify that new and existing concentrations are reported regularly to the board oappropriate management committees for review. Supervisors review policies, management reports, and au

aggregate exposures and concentrations to ensure that the policies and practices are sufficient to control co

reports are sufficiently detailed to provide appropriate information to the board of directors or other appropappropriate action. The U.S. federal banking agencies have established policies and guidance regarding concentration by induGuidance on Concentration in Commercial Real Estate”3, and concentration by product, such as “Interage

Nontraditional Mortgage Products Risks”4. The “Interagency Guidance on Concentrations in Commercial 

MIS should provide management with sufficient information to identify, measure, monitor, and control coincludes meaningful information on portfolio characteristics that is relevant to the bank’s or holding comp

underwriting standards, and risk tolerances. 

EC 5 Principle 10: Large exposure limits Criterion The supervisor regularly obtains information that enables concentrations within a bank’s portfolio, includi

3 For Federal Reserve, see SR letter 07-1; for OCC, see Bulletin 2006-46; for FDIC, see FIL-22-2008; for OTS, see CEO Memorandum 2524 For Federal Reserve, see SR letter 06-15; for OCC, see Bulletin 2006-41; for FDIC, see FIL-89-2006, for OTS, see CEO Memorandum 25
EC 5 Principle 10: Large exposure limits 

and currency exposures, to be reviewed. The supervisor has the power to require banks to take remedial acconcentrations appear to present significant risks. 

Legal Framework 

The U.S. federal banking agencies regularly obtain, through regulatory financial reports and on-site exami

enables review of concentrations within a bank’s and holding company’s portfolio, including sectoral, geoexposures. Supervisors may follow up on any areas of concern, requesting additional information or direcorganization to reduce concentrations that present significant risks. The agencies may take more formal ac

protect the safety and soundness of the bank and holding company. See 12 U.S.C. § 1818(b) & (c). 

Practices and Procedures 

As indicated in ECs 1-4 above, supervisors regularly obtain information from banks regarding credit concenumerous factors for determining concentrations within a loan portfolio, including by collateral support, gcharacteristics, industry or economic sector, product type, or by factors that link performance to similar ec

business developments. See manuals noted in footnote 1 of EC 1 and Uniform Bank Performance Report 

Concentrations of Credit. If a supervisor identifies weaknesses, the agencies have the authority to require 

company to take remedial actions in cases where concentrations present significant risks. Generally, these institutional evaluation of concentrations relative to risk-management prowess and capital levels. Supervisory recommendations on concentrations are included in the agency’s report of examination, and thformal written response on the action to be taken. See, e.g., OCC Bulletin 95-7. The agency monitors the 

ensure that deficiencies have been addressed. 

AC 1 Principle 10: Large exposure limits Criterion Banks are required to adhere to the following definitions: 

• Ten percent or more of a bank’s capital is defined as a large exposure; and • Twenty-five percent of a bank’s capital is the limit for an individual large exposure to a private se

counterparty or a group of connected counterparties. 

Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very 

banks. 

Legal Framework 

A bank’s total outstanding loans and extensions of credit to one borrower are typically limited to 15 percensurplus. A bank can extend an additional 10 percent of its capital and surplus to one borrower if the loan i

marketable collateral on which a perfected security interest has been obtained (i.e., there is an aggregate limbank’s capital). See 12 U.S.C. § 84. Other limits apply in special situations. In addition to the 15 percent for loans to one borrower, a bank may not loan more than 50 percent of its capital and surplus to corporate 32.5(d). In addition to the credit exposure limits discussed above, there are separate limits on the amount of securitobligor that can be held by one bank. The aggregate par value of securities issued by one borrower and he
AC 1 Principle 10: Large exposure limits 

exceed 10 percent of the bank ’s capital and surplus for Type II securities (e.g., obligations issued by indiv

international and multinational development banking organizations); 10 percent of capital and surplus for T

certain corporate or municipal bonds); 25 percent of capital and surplus for Type IV securities (e.g., small rated in the third or fourth highest rating categories by an NSRO); and 25 percent of capital and surplus focertain investment-grade rated, marketable securities). See 12 CFR 1.3. 

While subject to the same lending limits as a bank, 12 CFR 560.93, a federal savings association’s total in

paper and corporate debt securities of any one issuer, or issued by any one person or entity affiliated with tother loans, may not exceed the general lending limit. See 12 CFR 560.40(a)(3). 

Practices and Procedures 

Lending limits, investment limits, and requirements for internal operating limits effectively identify the mabe provided to one entity, and by so doing define “large exposure.” The U.S. federal banking agencies expect that all banks and holding companies define, identify, measure, concentrations. Compliance with all lending limits is monitored and reviewed by supervisors. Moreover, 

supervisors have broad authority to assess the risk posed by a credit risk concentration and consider the ad

to absorb the risk posed by the concentration. For additional details concerning OTS practices and proced

Memorandum 246.
Principle 11: Exposures to related partiesIn order to prevent abuses arising from exposures (both on-balance sheet and off-balance sheet) to related parties and to addresupervisors must have in place requirements that banks extend exposures to related companies and individuals on an arm’s lenare effectively monitored; appropriate steps are taken to control or mitigate the risks; and write-offs of such exposures are madpolicies and processes. (Reference document: Principles for the management of credit risk, September 2000.)Overview Two major sets of laws establish limits on transactions with “related parties” covered by the Overview to this principle. (The parties to include “the bank’s subsidiaries and affiliates, and any party that the bank exerts control over or that exerts control o

include the bank’s major shareholders, directors, senior management and key staff, their direct and related interests, and their 

well as corresponding persons in affiliated companies.”) Limits on Transactions with Affiliates. Sections 23A and 23B of the Federal Reserve Act (12 U.S.C. §§ 371c and 371c-1), an

regulation, Federal Reserve Regulation W (12 CFR 223), are designed to prevent the misuse of a bank’s resources through pre

with its affiliates and otherwise to limit the risks posed to the bank from transactions with affiliates. Section 23A (12 U.S.C. § member bank (state or national) from engaging in “covered transactions” with an “affiliate” unless the bank limits the aggrega

transactions with that particular affiliate to generally 10 percent of the bank’s capital and surplus. In addition, the aggregate a

transactions to all affiliates is limited to 20 percent of the bank’s capital and surplus. Moreover, any loan or extension of cred

(or guarantee or letter of credit issued by a bank on behalf of an affiliate) generally must be fully secured and purchases of “lo

generally prohibited. In general, “covered transactions” include loans and extensions of credit to an affiliate, investments in securities issued by an assets from an affiliate, and the issuance of a guarantee or letter of credit on behalf of an affiliate. Sections 23A and 23B and an attribution rule, which provides that a transaction between a bank and a third party where funds are transferred to—or used affiliate is considered a covered transaction with that affiliate. The term “affiliate” is defined broadly to include any entity that directly or indirectly controls, or is under common control wicompany is defined to include ownership of 25 percent or more of the voting securities of the other company or exercise of a cthe management or policies of the other company. The definition of affiliate also includes certain investment funds that are adan affiliate of the bank. Moreover, the definition of an affiliate in both the statute and Regulation W provides that an affiliate 

that the appropriate federal banking agency determines to have a relationship with the bank or any affiliate of the bank, such tby the bank with that company may be affected by the relationship to the detriment of the bank. The definition of affiliate gen

subsidiaries of the bank – subsidiaries of the bank are treated as part of the bank for purposes of sections 23A and 23B and ReSafety and soundness is an overriding principle of the U.S. transactions with affiliate regime. All covered transactions, includavailable exemptions, must be consistent with safe and sound banking practices. Even if transactions are structured in a mann
Principle 11: Exposures to related partieswith the requirements of the statute and regulation, supervisors can still criticize the transactions if they are abusive, involve ucircumvent the purpose of the regulation. Section 23B (12 U.S.C. § 371c-1) covers a wider range of activities than section 23A. It covers virtually any type of financial bank and an affiliate. Section 23B provides that transactions between a bank and its affiliates must be on terms and under circcredit standards, that are substantially the same or at least as favorable to the bank as those prevailing at the time for comparabinvolving nonaffiliated companies. Sections 23A and 23B also apply to all savings associations (12 U.S.C. § 1468(a)) and to state nonmember insured banks (12 

Limits on Transactions with Insiders. Sections 22(g) and (h) of the Federal Reserve Act (12 U.S.C. §§ 375a and 375b) imposon extensions of credit by a member bank to its insiders and to insiders of its affiliates. Insiders include bank or affiliate exec

principal shareholders, as well as companies controlled by such insiders. These restrictions also apply to savings associations CFR 563.41) and state nonmember insured banks (12 U.S.C. § 1828(j)). 12 CFR 215 (the Federal Reserve’s Regulation O) implements the restrictions imposed under sections 22(g) and (h) of the Fed

CFR 31.2(a) requires a national bank and its insiders to comply with the provisions contained in 12 CFR 215.1 12 CFR 563.4

association and its insiders to comply with the provisions contained in 12 CFR 215.2 In general, the regulation provides that e

bank to an insider must be made on the same terms and conditions as extensions of credit to non-insiders and must not represe

risk of repayment. See 12 CFR 215.4(a). In addition, the regulation imposes on extensions of credit to insiders the single borunder Principle 10. See 12 CFR 215.2(i) and 215.4(c). The regulation also places a quantitative limit on extensions of credit 

in the aggregate. Large extensions of credit to insiders must be reviewed and approved by the bank’s board of directors prior 

215.4(b). Extensions of credit by a bank to its executive officers are subject to an additional set of restrictions. Notably, otheresidential housing or educational purpose, a bank may not extend more than $100,000 in credit to an executive officer. Although the regulatory restrictions on transactions with insiders apply only to the bank subsidiaries of holding companies, thagencies encourage banks to adopt these policies corporate-wide to avoid disadvantageous transactions with affiliates or insid

transactions that do not involve a supervised bank may be legal, the agencies still may consider them “unsafe and unsound.” Iconsolidated supervisor, the Federal Reserve and the OTS monitor material intra-group transactions and exposures. They also companies have adequate risk-management processes in place for the bank as a whole pertaining to such transactions.

EC 1 Principle 11: Exposures to related parties 

1 Also see Comptroller’s Handbook, “Insider Activities.” 2 Also see OTS Examination Handbook, Section 380, Transactions with Affiliates and Insiders. 
EC 1 Principle 11: Exposures to related parties Criterion Laws or regulations explicitly provide, or the supervisor has the power to provide, a comprehensive defini

This should consider the parties identified in the footnote to the Principle. The supervisor may exercise disdefinition on a case by case basis. 

Legal Framework 

The statutes and regulations cited in the overview to this principle carefully define the individuals and enti

and insider transaction limits apply. The definitions are broad and provide discretion to the supervisor in i

determine whether a particular individual or entity is considered a related party subject to the restrictions. 

Practices and Procedures 

The U.S. federal banking agencies regularly review bank exposure to affiliates, insiders, and other related compliance with the statutes and regulations such as sections 22(g), 22(n), 23A and 23B of the Federal ReRegulation O and Regulation W. The agencies train their supervisors extensively to facilitate their undersgoverning these transactions, and supervisory guidance contains detailed information regarding the rules, iinspection procedures for reviewing transactions between a bank and its affiliates, insiders, and related par

EC 2 Principle 11: Exposures to related parties Criterion Laws, regulations or the supervisor require that exposures to related parties may not be granted on more fa

credit assessment, tenor, interest rates, amortization schedules, requirement for collateral) than correspond

related counterparties. 

Legal Framework 

Under the statutes and regulations cited in the overview to this principle, exposures to affiliates and insider

more favorable terms (i.e., for credit assessment, tenor, interest rates, amortization schedules, requirement corresponding exposures to non-affiliates or non-insiders. 

Practices and Procedures 

 Section 23A (12 CFR 371c) requires that all covered transactions between a bank and an affiliate be on teconsistent with safe and sound banking practices. Section 23B (12 CFR 371c-1) requires that financial traand an affiliate be on terms and under circumstances, including credit standards, that are at least as favorabprevailing at the time for comparable transactions with nonaffiliates. U.S. federal banking supervisors are 

affiliate transactions are on terms and conditions that are consistent with safe and sound banking practices conditions of affiliate transactions are the same as or more favorable than those that would be offered or ap

companies in comparable transactions. See: FRB [SR letter 03-2], OCC [Comptroller’s Handbook, “Relat

[Examination Handbook, Section 380, “Transactions with Affiliates and Insiders”]. Related training matesupervisor guidance to facilitate review and verification of compliance with the market terms requirement Regulation O requires that extensions of credit by a bank to an insider (1) be made on substantially the saminterest rates and collateral) as, and following credit underwriting procedures that are not less stringent tha

time for comparable transactions by the bank with non-insiders and (2) not involve more than the normal rRegulation O requires banks to maintain records to document compliance with its restrictions, including itrequirement. 
EC 2 Principle 11: Exposures to related parties 

Violations of Regulation O or section 23B can give rise to reimbursement and formal enforcement actions violation also can give rise to an enforcement action. For example, a Cease and Desist order was issued against a bank requiring approval from the supervisor p

inside or related parties. www.occ.treas.gov/FTP/EAs/ea2008-008.pdf

EC 3 Principle 11: Exposures to related parties Criterion The supervisor requires that transactions with related parties and the write-off of related-party exposures e

amounts or otherwise posing special risks are subject to prior approval by the bank’s Board. The superviso

members with conflicts of interest are excluded from the approval process. 

Legal Framework 

Regulation O requires that extensions of credit by the bank to an insider be reviewed and approved by the if the aggregate credit exposure of the bank to the insider would exceed $500,000 upon consummation of tlower review threshold applies to smaller banks. See 12 CFR 215.4(b). Extensions of credit to insiders abmust be pre-approved by a majority of the bank’s board of directors, and the insider who is obtaining the cparticipating either directly or indirectly in the vote. (Participation in the discussion or any attempt to influregarded as indirect participation.)The U.S. bank regulatory framework does not, however, require board pre-approval of transactions betwee

In addition, the U.S. bank regulatory framework does not impose a board approval requirement on write-o

transactions. 

Practices and Procedures 

 U.S. federal banking supervisors review a bank’s policies and procedures to ensure that the bank properly 

approvals of certain transactions with related parties and that the bank’s board of directors approves materrelated parties. For example, a bank or its subsidiary cannot knowingly purchase or acquire any security dunderwriting or selling syndicate for that security, if an affiliate of the bank is a principal underwriter in thto this would require that the purchase was approved by a majority of the bank’s directors before the secursale to the public, based upon a determination that it is a sound investment for the bank, irrespective of the principal underwriter of the securities. In general, under Federal regulations and supporting guidance, and as a matter of sound corporate governa

conflicts of interest must recuse themselves from consideration of any matter in which they have an interesdirected to identify and criticize any situation in which an interested director involves himself or herself in matter in which he/she has an interest. 
EC 3 Principle 11: Exposures to related parties 

Examples of enforcement actions taken by the agencies include An enforcement action taken against International City Bank which prohibits transactions with affiliates w

and documented board approval. www.occ.treas.gov/FTP/EAs/ea2009-011.pdf

An enforcement action taken against CIB Marine Bancshares, Inc., directed CIB to enhance and improve iand services provided to subsidiary banks. www.federalreserve.gov/boarddocs/press/enforcement/2004/20

EC 4 Principle 11: Exposures to related parties Criterion The supervisor requires that banks have policies and processes in place to prevent persons benefiting from 

persons related to such a person from being part of the process of granting and managing the exposure. 

Legal Framework 

The regulatory provision discussed under EC 3 prevents persons benefiting from the exposure and/or persoperson from being part of the process of granting and managing the exposure. Banks are expected to have 

place to ensure compliance with these restrictions. 

Practices and Procedures 

U.S. federal banking supervisors are directed to identify and criticize any situation in which an interested dherself in the consideration of a matter in which he/she has an interest. Supervisors review policies and pr

facilitate compliance with the laws and regulations governing affiliate transactions. Supervisors also revie

Regulation O for extensions of credit to insiders. As noted above, under Regulation O, the insider who is o

abstain from participating either directly or indirectly in any related votes. Violations of these regulations 

and procedures to ensure compliance with the regulations may subject the bank to formal enforcement acti

EC 5 Principle 11: Exposures to related parties Criterion Laws or regulations set, or the supervisor has the power to set on a general or case by case basis, limits for 

parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralisatWhen limits are set on aggregate exposures to related parties those are at least as strict as those for single c

connected counterparties. 

Legal Framework 

The sources cited in the overview to this principle establish quantitative limits on affiliate and insider trans

requirements on certain affiliate transactions. The aggregate limits on exposures to a group of affiliates or 

equivalent or stricter than those applicable to groups of connected counterparties that are not affiliates or inextension of credit, the supervisor can address problems identified with such exposures by requiring their dwhen assessing capital adequacy and, consistent with section 23A and Regulation W, requiring the posting 
EC 5 Principle 11: Exposures to related parties Practices and Procedures 

Each bank’s credit transaction with an affiliate must be fully collateralized as required by Regulation W (1Federal banking supervisors may request a list of transactions with affiliates, including the terms of any co

compliance with the regulation. Affiliate transactions in excess of regulatory limits are prohibited unless the Federal Reserve has exempted 

finding that such exemption would be in the public interest and consistent with the purposes of section 23Asubmission must be provided to the general counsel of the Federal Reserve in order for such a request to b

such requests is rare and, if granted, is subject to any conditions that the Federal Reserve might wish to appMoreover, investments by a bank in subsidiaries that are not consolidated for accounting or supervisory pu

case basis, investments in other designated subsidiaries or associated companies at the discretion of the Fededucted from total capital components (for more information see Principle 6). Investments by a bank in 

is, a subsidiary that is engaged in activities that are not permissible for the lead bank to conduct directly) g

total capital components as well.

EC 6 Principle 11: Exposures to related parties Criterion The supervisor requires banks to have policies and processes to identify individual exposures to related pa

amount of such exposures, and to monitor and report on them through an independent credit review proces

that exceptions to policies, processes and limits are reported to the appropriate level of senior management 

Board, for timely action. The supervisor also confirms that senior management monitors related party tranbasis, and that the Board also provides oversight of these transactions. 

Legal Framework 

Banks must identify, through an annual survey, all insiders of the bank and maintain records of all extensio

CFR 215.8(b)). 

Practices and Procedures 

Banks must establish policies and procedures for compliance with all applicable laws, rules, and regulation

and Regulation W. These policies, as well as individual transactions, are reviewed during the examination 

banking agencies require the banks to develop policies to help ensure that credit decisions are based on an 

credit evaluation. The agencies expect that a bank’s management information system identifies and quanti

parties and that these transactions are routinely reviewed by loan review and management. U.S. federal badetermine whether loans to insiders and affiliates exceed the imposed lending limits and that appropriate obtained if prior approval by the bank’s board was required for a loan to an insider. In addition, supervisoof the bank’s procedures used to ensure that loans to related parties are not made on conditions indicating As previously discussed, violations of these regulations or weaknesses in policies and procedures may subenforcement action. 
EC 7 Principle 11: Exposures to related parties Criterion The supervisor obtains and reviews information on aggregate exposures to related parties. Practices and Procedures 

All top-tier bank holding companies and foreign banking organizations that own a U.S. subsidiary bank m

Bank Holding Company Report of Insured Depository Institutions’ Section 23A Transactions with Affiliatequarterly report is used to enhance the Federal Reserve's ability to monitor the holding company’s exposur

ensure compliance with section 23A of the Federal Reserve Act. The FR Y-8 report contains multiple itemdisclose their aggregate exposures to affiliates – both transactions that are subject and transactions that are 23A’s collateral requirements. OTS requires similar reporting on aggregate transactions with affiliates on Supplemental Information Schedules of the Thrift Financial Report. The U.S. federal banking agencies also require reporting of insider lending transactions, and federal bankin

the amount of credit extended to an insider, both to a single insider borrower and in the aggregate to all insprovisions of Regulation O. As supervisors review individual transactions, as discussed in EC 5 above, thwith affiliated organizations and insiders that do not appear in the bank’s or holding company’s reports of 
Principle 12: Country and transfer risksSupervisors must be satisfied that banks have adequate policies and processes for identifying, measuring, monitoring and contransfer risk in their international lending and investment activities, and for maintaining adequate provisions and reserves agaOverview The U.S. federal banking agencies are required to evaluate banks’ and holding companies’ foreign country exposure and transexaminations and supervision. See 12 U.S.C. § 3903(a).1 The agencies also must ensure that these risks are taken into accou

or holding company’s capital adequacy. See id.§ 3903(b). Banks and holding companies meeting certain reporting criteria ba

exposure are required to identify and monitor these risks and to provide quarterly reports to supervisors on their foreign count

The quarterly reports detail each bank’s or holding company’s significant claims on foreign entities, specifying, among other and country in which the borrowers are located. Necessarily, banks and holding companies must have established policies anmonitoring the countries with which they are doing business and monitoring and evaluating their exposures to those countriesRepresentatives of three of the federal banking agencies (the Federal Reserve, OCC, and the FDIC) are part of an “InteragencReview Committee” (ICERC), which meets once a year (the committee reserves the option to meet at any other time during thcircumstances warrant attention) to review conditions in countries that have defaulted by not complying with their external seunable to service the existing loan according to its terms, as evidenced by failure to pay principal and interest timely and fullyrestructuring, or rollovers and where U.S. banks and holding companies have large exposures. Based on this review, the ICErating to the country and determines whether U.S. banks and holding companies must hold a reserve (an “Allocated Transfer “ATRR”) against exposures where the country of residence of the ultimate obligor is from the defaulting country. See 12 CFR Interagency Country Exposure Review Committee Process (November 2008).2 The agencies also support the Basel Commit

paper Management of banks’ international lending, March 1982.3

As required by statute, the agencies have issued regulations and guidance governing international lending. See 12 CFR 211, sprovisions of the International Lending Supervision Act, 12 U.S.C. §§ 3901-3911, do not apply to savings associations and SLOTS, which historically have not had large foreign country exposures and transfer risk. For purposes of Principle 12, therefornot include a savings association. OTS examines large and complex SLHCs for country risk, however, and would require a SATRR pursuant to the ICERC’s guidelines. Most of the discussion below includes any SLHC with foreign country exposure. 

1 The statute that imposes a requirement for banks and bank holding companies does not apply to savings associations and SLHCs, which ty

country exposures. However, the OTS’s examination procedures extend the requirement to complex SLHCs. See the OTS’s Holding Comp

2 www.occ.treas.gov/ftp/bulletin/2009-8b.pdf. 3 www.bis.org/publ/bcbsc122.pdf?noframes=1. 
EC 1 Principle 12: Country and transfer risks Criterion The supervisor determines that a bank’s policies and processes give due regard to the identification, measu

control of country risk and transfer risk. Exposures are identified and monitored on an individual country bend-borrower/end-counterparty basis). Banks are required to monitor and evaluate developments in countr

and apply appropriate countermeasures. 

Legal Framework 

Banks and holding companies are required to monitor and evaluate developments in country risk and in traappropriate, establish an ATRR or take other appropriate countermeasures. See 12 CFR 211.43; and 12 CFHolding Companies Handbook, section 940. 

Practices and Procedures 

Country risk and transfer risk are monitored and measured through two independent supervisory processesprocess and the work of the ICERC. ICERC was established to provide a forum for U.S. federal banking a

assessments of cross-border risk and to promote a consistent approach to the supervisory process. The ICEcommunicated to the banking industry by supervisors and provide the banking industry with a general expholding company’s sovereign risk-management practices. During examinations, supervisors assess the bank’s or holding company’s overall identification and managtransfer risk (See CBEM, section 7040.3; OCC’s Country Risk Management Handbook; FDIC’s Risk ManExamination Policies (Section 11.1 – International Banking)4, and FDIC’s: FIL 23-20025, and OTS’s Ho

Handbook, section 940). Banks and holding companies are expected to assess the level of their country-rithe effect of prevailing and future economic, political, and social conditions on a country’s ability to sustai

and reflect the impact of these conditions on the credit risk of individual counterparties located in the counbanks and holding companies to have a comprehensive risk-management system to identify their cross-borand by country, and to quantify exposure, including cross-border guarantees, derivatives, and reference assorder effectively to control country risk, supervisors expect that this risk-management system includes oveholding company’s board of directors, well-defined policies and procedures for managing country risk, an reporting system, an effective country analysis process, a country-risk rating system, established country eadequate internal controls. The agencies hold the banks’ or holding company’s management responsible for implementing sound, welprocedures for managing country risk that establish risk tolerance limits, specify authorized activities, and business. Supervisors confirm that banks and holding companies have appropriate risk-management systemrating scale and a regular cycle of reviews, to evaluate sovereign risk. Supervisors also review the systemindividual country’s economic, social, and other conditions and developments where the organization is exexpect that procedures are established for dealing with exposures in troubled countries, including contingerisk, and if necessary, exiting the country. In addition, the U.S. federal banking agencies send representatiinternational supervision to meet on a regular basis with ICERC, to evaluate sovereign risk for countries to 

4 FDIC: Risk Management Manual of Examination Policies 5 FDIC: FIL-23-2002 
EC 1 Principle 12: Country and transfer risks 

holding companies have exposure exceeding certain thresholds, and to establish reserve requirements, ATTexposures for countries that are currently in severe trouble or default. 

EC 2 Principle 12: Country and transfer risks Criterion The supervisor confirms that banks have information systems, risk management systems and internal contr

monitor and report country exposures and ensure adherence to established country exposure limits. 

Practices and Procedures 

U.S. federal banking supervisors assess a bank’s or holding company’s information and risk-management whether a bank or holding company has appropriate risk controls, information systems, and monitoring strborder exposures are managed consistently with the bank’s or holding company’s strategy and risk-managSupervisors evaluate whether banks and holding companies have comprehensive reporting systems to accurisk exposure, ensure adherence to the directives of the board, provide for at least an annual review of port

country, and establish a methodology for reporting exceptions. As part of the examination process, supervfrequency and size of exceptions to country limits imposed by banks and holding companies and, if approp

management if weaknesses are noted. Banks and BHCs are required to report their various asset exposures quarterly on the Country Exposure reagencies maintain an aggregated, publicly available database (FFIEC E16 report) that contains bank’s and 

sovereign exposure in detail by country. A restricted version of this database, which contains the same inf

is used by supervisors in their sovereign exposure monitoring process. In assessing the quality of a bank’s 

exposure management systems, supervisors verify the accuracy of data submitted on the FFIEC 009 report

and review country-risk reports provided to the board of directors to ensure completeness and accuracy of 

EC 3 Principle 12: Country and transfer risks Criterion There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk

international practices which are all acceptable as long as they lead to risk-based results. These include: 

The supervisor (or some other official authority) decides on appropriate minimum prov

percentages for exposures to each country. 

The supervisor (or some other official authority) sets percentage ranges for each country, and the 

these ranges, which provisioning to apply for the individual exposures. 

The bank itself (or some other body such as the national bankers’ association) sets percenta
EC 3 Principle 12: Country and transfer risks 

decides for each individual loan on the appropriate provisioning. The provisioning wexternal auditor and/or by the supervisor. 

Legal Framework 

The expectations of the U.S. federal banking agencies for banks’ and holding companies’ sovereign risk pr

the International Lending Supervision Act (ILSA) passed by the U.S. Congress in 1983. The ILSA includboth the international lending activities of U.S. banks and bank holding companies and the federal banking 

those activities. The ILSA requires banks and bank holding companies, in certain circumstances, to set up assets subject to severe transfer risk. The three federal banking agencies have published regulations implerequirement. The regulations require that each affected organization charge off or establish and maintain awith impaired value due to transfer risk. (See 12 CFR 28, subpart C; 12 CFR 211, subpart D; or 12 CFR 3Overview regarding savings associations and SLHCs. 

Practices and Procedures 

U.S. federal banking agencies set country and transfer risk provisions for only selected countries. These p

determined through the ICERC process which evaluates transfer risk for the U.S. banking system on an onmeeting, ICERC evaluates high-risk regions and countries and mandates specific credit reserves for countrexposure and by tenor. The minimum threshold for ICERC consideration for review of a country is an aggbillion or more for at least two consecutive quarters. In addition, countries to which aggregate exposure is $1 billion are reviewed by the ICERC if the exposure at five or more U.S. banks or bank holding companietier 1 capital plus the allowance for loan and lease losses. The agencies require banks and holding companies to establish an ATRR for each applicable international obligor resides in a defaulted country. However, the ATRR requirement does not apply to U.S. branches, lending company subsidiaries of foreign banking organizations. Nevertheless, each U.S. federal banking a

need, if any, for other special measures that may be warranted by conditions in the branch, including, for emonitoring of due-from/due-to head office accounts, asset maintenance requirements, and/or specific reserCross-border exposure monitoring is performed pursuant to the ILSA. This act codified the process for crmonitoring which was put in place by ICERC. At the time that ICERC was established, supervisors obserthat heightened the need for a better understanding of banks’ and bank holding companies’ sovereign risk Significant and growing level of country-risk exposure on the balance sheets of U.S. banks and bank holdiGrowing stress in sovereign credits, Limited sophistication in sovereign risk analysis at banks and bank holding companies and rating agenciesLimited availability of data on sovereign credits. Supervisors assess the aforementioned risks by using various procedures and measures, which include comholding company’s country-risk exposures as a percentage of its assets and capital and analyzing the stren

based on publicly available information. However, the agencies recognize also that the level of sophisticat

review of a bank’s or holding company’s sovereign credits varies. Therefore, ICERC devotes significant e
EC 3 Principle 12: Country and transfer risks 

of a set of standards for supervisors to follow in their assessment of banks’ and holding companies’ sovere

ICERC standards also provide the banking industry with general expectations for a bank’s or holding commanagement practices. In addition to the specific mandated reserves, the agencies expect banks and holding companies to evaluatsovereign credit profile of their foreign exposures (both cross-border and local), appropriately grade certaiobligor exposures, and establish limits that are consistent with the bank’s or holding company’s strategy, rSupervisors evaluate the establishment, appropriateness, and compliance with such limits during the exam

EC 4 Principle 12: Country and transfer risks Criterion The supervisor obtains and reviews sufficient information on a timely basis on the country risk and transfePractices and Procedures 

The federal banking agencies obtain the completed FFIEC 009 reports for individual banks and BHCs on a reports contain information for on- and off-balance-sheet exposure by type of obligor (government, bankin

analyze the quarterly reports for levels, significant variations and trends. Also, agency economists evaluatpolitical, economic, and social events for high impact countries. These analyses are supplemented by a mocountry-risk exposure during regular supervisory activities. The agencies expect banks and holding compasupervision to continue to monitor their cross-border exposure to all countries closely; to have robust counsystems; to have appropriate sovereign exposure limits in place for each sovereign entity; to perform finansovereign entities to which the bank or holding company is exposed; and generally to continue to apply so

their country exposures, not just to the countries rated by ICERC. 
Principle 13: Market riskSupervisors must be satisfied that banks have in place policies and processes that accurately identify, measure, monitor and cosupervisors should have powers to impose specific limits and/or a specific capital charge on market risk exposures, if warranteOverview As noted in the overview to Principle 7, the U.S. federal banking agencies expect all banks and holding companies, to have in management policies and processes for identifying, evaluating, monitoring, and controlling or mitigating all material risks, inc

authority to impose and enforce risk-management requirements stems from the safety and soundness and capital adequacy sta

for safety and soundness: 12 U.S.C. § 1831p-1 and 12 CFR 30, 208, 364, and 570; and for capital adequacy: 12 U.S.C. §§ 18

CFR 3, 208, 225, 325, and 567. Each agency supplements these regulatory requirements with examination procedures and prspecific supervisory guidance on risk-management expectations.1

As part of their supervisory programs, supervisors assess each bank’s or holding company’s exposure to, and management of, agencies UFIRS supervisory rating system (CAMELS), supervisors assess and assign each bank a supervisory rating for its SeThe market risk component reflects the degree to which changes in interest rates, foreign exchange rates, commodity prices, oadversely affect earnings or economic capital. For most U.S. banks and holding companies, interest-rate risk in their banking 

market-related risk exposure. Large banks and BHCs that have significant trading or foreign exchange exposures are subject to the agencies’ market- risk ca

the 1996 Market Risk Amendment to Basel I (See 12 CFR 3, appendix B)2. These rules require market risk to be calculated f

based primarily on a bank’s or bank holding company’s internal models. Compliance with these rules, as well as supplementabank or bank holding company to implement a comprehensive risk-management program, including adequate policies, procedboard and senior management oversight; adequate risk measurement, monitoring, and management information systems; and controls. Supervisory expectations regarding these programs are detailed in supervisory guidance and examination manuals i

banking agencies. These resources emphasize that individual programs should be appropriate to the size and activities of indicompanies. Regular risk-management evaluations ensure that the programs are adjusted, as appropriate, in light of changing r

developments. Failure to implement and enforce adequate market-risk management programs can trigger an enforcement actiremedial measures. 

1 See OCC’s Community Bank Supervision, Large Bank Supervision, and Risk Management of Financial Derivatives booklets of the Compt2 The OTS did not join the other federal banking agencies in adopting the market risk rules in 1996, as the rules were not applicable to the tr

savings associations at that time. The OTS plans to join the other agencies in any future market risk amendment proposals due to increased Although SLHCs also currently do not have the trading activities levels to be subject to the 1996 Market Risk Amendment, OTS examiners OTS’s Holding Companies Handbook, sections 400, 500, and 900. 
EC 1 Principle 13: Market risk Criterion The supervisor determines that a bank has suitable policies and processes that clearly articulate roles and r

the identification, measuring, monitoring and control of market risk. The supervisor is satisfied that policiadhered to in practice and are subject to appropriate Board and senior management oversight. 

Practices and Procedures 

U.S. federal banking agencies require banks and holding companies to implement sound risk-management and market-risk management is one element of overall sound risk management. Senior management is expthe risks involved in the bank’s and holding company’s activities, question business line management abouprompt and open discussions about any market-risk control problems or losses. This commitment to markexpected to be delineated in practice and codified in written policies and procedures approved by the board The agencies’ expectations are documented in exam manuals and published statements regarding the implecontrols including internal controls for market-risk management.3 Each of these identifies the crucial role 

management oversight, and the approval of policies and procedures for market-risk management by the bofederal banking supervisors confirm that adequate market-risk policies and procedures for conducting longactivities are in place, and this includes ensuring clear delineations of responsibility for managing risk, ademeasuring risk, appropriately structured limits on risk taking, effective internal controls, and a comprehens

U.S. federal banking supervisors also confirm that a bank’s or holding company’s market-risk managemen

risks; establishes policies, procedures, and risk limits; monitors and reports compliance with limits; delineportfolio management; develops guidelines for new products and includes new exposures within the curren

new measurement methods to existing products. 

The supervisory expectations as described in these written documents are implemented via monitoring of r

management at supervised banks and holding companies as well as examinations of the banks and holding monitoring and analysis by on-site teams at larger banks and holding companies entails ongoing analysis o

discussions with internal management. Supervisors confirm that these reports provide sufficient detail to drisk is appropriately measured, monitored and controlled. They also assess the adequacy of board and manExaminations are conducted to identify both deviations from policies and procedures as well as weaknesseprocedures followed by the firms. A key element of examinations is the review of new product policies an

that the risks of these products are adequately identified so that they may be incorporated into the risk mea

and control processes. Examinations emphasize the need to use multiple measures of market risk and avoisingle measure of risk. These should include a variety of stress tests, value-at-risk measures, position sens

3 See Federal Reserve’s Trading and Capital Markets Activities Manual (www.federalreserve.gov/boarddocs/supmanual/trading/200704/07

Assessment System as outlined in the Bank Supervision Process, Community Bank Supervision, and Large Bank Supervision booklets of the 

series and its Risk Management of Financial Derivatives booklet and Banking Circular 277; and SEC’s Joint Statement: Broker Dealer Risk Note: Under the OCC’s Risk Assessment System, market risk is evaluated as “price risk.” 
EC 1 Principle 13: Market risk 

measures which may form a set of limits. Internal controls are checked to assure that approvals, verificatio

conducted and documented so that market-risk management is effective in measuring risk and that market-

large risk positions to senior management. In cases where these internal controls are weak, supervisors maimproved, impose higher capital requirements, or restrict business activities. 

EC 2 Principle 13: Market risk Criterion The supervisor determines that the bank has set market risk limits that are commensurate with the institutio

and that reflect all material market risks. Limits should be approved by the Board or senior management. that any limits (either internal or imposed by the supervisor) are adhered to. 

Practices and Procedures 

As noted in EC 1, banks and holding companies are expected to establish market-risk limits that are command complexity and that reflect all material market-risk exposures. Supervisors confirm that banks and ho

appropriate limits in place that are developed under the direction of, and approved by, senior management Supervisors review risk-management reports and confirm that the reports highlight positions, limits, and excommensurate with trading activity, and are submitted to senior management for review. As part of their examinations, supervisors check the adherence to these limits and discuss with senior manprocedures for limit exceptions. These discussions allow supervisors to confirm that senior management ipositions and the proper approvals for excesses as described in the policies and procedures of the firm hav

need not be absolute under the regime of any U.S. supervisor; however, supervisors confirm that appropriatrading senior management takes place and is documented before limits are exceeded. Supervisors also coprocedures address the frequency of review of the limit structure, identify the authority to set and change l

limits are set by personnel independent of the trading activity. Supervisors check approvals for limit excesadhered to through transaction testing. In cases where limits are imposed by the agency, for example, limits on activities that can be undertaken b

(for example, 23A which limits transactions with affiliates of a bank), banks are expected to seek approval appropriate agency or agencies prior to consummating such a transaction, and receive the appropriate supe

entering into the transactions. In other cases, as part of its approval of a new transaction, activity, or corpo

may require or establish limits for the size or exposure of the activity. Such limits are enforceable under thpowers and can result in a variety of regulatory sanctions or actions if they are violated. U.S. federal banking agencies consider that a well constructed system of limits and policies on acceptable particularly important element of risk control in trading operations. Supervisors check to ensure that bank

establish limits for market risk that relate to their risk measures and are consistent with maximum exposursenior management and their board of directors. Examinations ensure that these limits are allocated to busor other appropriate organizational units and that these units, as well as the risk management or control fun
EC 2 Principle 13: Market risk 

limits. A variety of limits is expected to be used to control risk taking by the business unit or an individua

EC 3 Principle 13: Market risk Criterion The supervisor is satisfied that there are systems and controls in place to ensure that all transactions are ca

and that the banks’ marked-to-market positions are revalued frequently, using reliable and prudent market market prices, internal or industry-accepted models). The supervisor requires banks to establish and maintfor considering valuation adjustments/reserves for positions that otherwise cannot be prudently valued, incliquid, and stale positions. 

Practices and Procedures 

All public corporations in the U.S. are expected to disclose the value of their positions quarterly on their p

Trading assets and other assets valued on a mark-to-market basis are reported at fair value in accordance wspecifically FAS 157. For banks and holding companies required to file public reports, Sarbanes-Oxley le

critical controls relating to financial reports must be documented and tested, and that weaknesses in these c

in their quarterly public financial reports. Banks and holding companies are subject to these same standardfor control and frequency of valuation imposed by financial supervisors are higher for those banks and hol

significant trading operations. Implicitly, many of the requirements imposed on banks and holding compathat trading positions be revalued daily and verified by a unit independent of the business unit on a frequen

the standards for risk-management control or regulatory capital. This is explicit for broker/dealers who mucompliance with their regulatory capital requirement. For banks and bank holding companies, the agencieestablish qualitative and quantitative requirements for a bank’s or bank holding company’s value-at-risk (V

compute its regulatory market-risk capital requirements. Among these is that its VaR model is used to meAs discussed in Principle 22, U.S. federal banking supervisors confirm that FAS 157 is appropriately appliunder this statement, and that the bank’s or holding company’s process is documented and approved by its 

As documented in the Senior Supervisors Group report, Observations on Risk Management Practices durinTurbulence, released in March 2008, many banks and holding companies found that their valuation proced

change in market liquidity. Their valuation procedures had established a single method to value a particul

relied on suitable prices being observed in a liquid market. When the market for these assets became illiqucompanies found that they could not apply a method that relied on observed prices. These banks and holddevelop complex pricing models that met high control standards in an expedited timeframe. This experien

develop a “waterfall” of valuation procedures that provided the banks and holding companies with the abil

under a variety of market conditions.

EC 4 Principle 13: Market risk 
EC 4 Principle 13: Market risk Criterion The supervisor determines that banks perform scenario analysis, stress testing and contingency planning, a

validation or testing of the systems used to measure market risk. The supervisor confirms that the approacmanagement policies and processes, and results are taken into account in the bank’s risk-taking strategy. 

Legal Framework 

The agencies’ risk-based capital guidelines set forth qualitative and quantitative requirements for banks an

subject to market risk and advanced approaches capital rules. See 12 CFR 3, appendices B and C; 12 C.F.G.4. 

Practices and Procedures 

Scenario analysis, stress testing, and periodic validation of systems used to measure market risk are key corisk and advanced approaches capital adequacy guidelines. U.S. federal banking agencies expect all banks and holding companies to perform scenario analysis or stremanagement of market risk, and confirm this during on-site examinations. Stress testing is part of the quathe management of market risk contained in the market risk amendment (MRA) which have been adopted U.S., only banks and bank holding companies with trading assets and liabilities of over $1 billion or 10 pesubject to the MRA. However, stress testing is an important risk measurement tool and banks and holding to use this in measuring the risk from trading activities even if they are not subject to the market-risk amenSupervisors review the results of stress tests and discussions are held with the internal management. Supefor their use in risk management and compare established limits against stress test results. If supervisors dtesting is inadequate or insufficient, corrective actions would be required. Specialty staff from the agenciesupervisors in the evaluation of complex models. Supervisors also confirm that periodic validation of market-risk management systems is completed. Superindependent validation of the models during an exam, and an independent validation is required once a yeameasurement systems. For broker-dealer organizations, an external validation of the models is required on

and bank holding companies, the validation of market-risk models is an ongoing process that includes a nu

backtesting of VaR models; profit and loss attribution; pricing model validation and testing; as well as dire

front office, back office and risk-management personnel about how well the models reflect prices observed Supervisors review validation documents and interview personnel responsible for validation during exams ongoing validation activities affect planned model improvements.

AC 1 Principle 13: Market risk Criterion The supervisor requires that market data used to value trading book positions are verified by a function ind

4 See Response to Principle 6 for explanation of capital requirements for SLHCs and the OTS’s Holding Companies Handbook, sections 30
AC 1 Principle 13: Market risk 

business. To the extent that the bank relies on modelling for the purposes of valuation, the bank is requireis independently tested. 

Legal Framework 

Under the federal banking agencies’ market risk and advanced approaches capital adequacy guidelines (12 

C; 12 CFR 225, appendices E and G), banks and bank holding companies must have a risk control unit thamanagement and is independent from business units5. In addition, banks and bank holding companies mu

reviews of risk measurement and risk-management systems at least annually. 

Practices and Procedures 

Supervisors determine whether banks’ and holding companies’ valuation systems enable senior managemeperformance of the risk-taking activity justifies the risks taken. To ensure that financial results are approppresent an accurate description of the performance of the firm, supervisors confirm that the market values objective, independent framework. Supervisors are instructed to ensure that financial control units are “sufficiently” independent of the busineverify that the personnel responsible for independent valuation do not have their compensation determined report to senior management that is independent of the business unit. More granularly, supervisors check 

responsible for independent valuation have the appropriate authority to contest valuations and that this ulti

into policies and procedures. Independent valuation units must have adequate resources to determine valu

reliance on the business unit, and that they have sources of pricing information outside of the business unitSupervisors confirm that where pricing models are used, firms have comprehensive policies and procedurevalidating, revising and reviewing the pricing models used in the valuation process. Supervisors are direct

models are validated by individuals who are not directly involved in the development process before they 

includes ensuring that pricing model validation by the bank and holding company involves an evaluation o

to material sources of model risk. This validation not only applies to new models but also models that are 

be re-evaluated frequently. Supervisors also confirm that model validation is conducted and documented bsufficient technical expertise to conduct the evaluation. The federal banking agencies evaluate the internaThey offer specialized training courses on various aspects of risk modeling and have staff with specialized modeling expertise that can assist supervisors in evaluating sophisticated models of the bank and holding c

5 OTS similarly examines SLHCs for independence of risk control units from business units. See “Savings and Loan Holding Company Ra

72442, 72448 (Dec. 20, 2007) and OTS Holding Companies Handbook, Section 500 Risk Management. 
Principle 14: Liquidity riskSupervisors must be satisfied that banks have a liquidity management strategy that takes into account the risk profile of the inpolicies and processes to identify, measure, monitor and control liquidity risk, and to manage liquidity on a day to day basis. Sto have contingency plans for handling liquidity problems. Overview Liquidity risk has and continues to be a primary concern of the U.S. federal banking agencies, and, as recent market events ha

management is essential to ensuring the safety and soundness of banks and holding companies and has been an important comsupervisory efforts of U.S. federal banking agencies. The U.S. federal banking agencies expect banks and holding companie

implement liquidity management programs that (a) assess, on an ongoing basis, the current and expected future needs for funsufficient funds or access to funds exist to meet those needs at the appropriate time; (b) provide for an adequate cushion of liqunanticipated cash-flow needs that may arise from a continuum of potential contingent events that can range from high-probabthat occur in daily operations to low-probability/high severity events that occur less frequently but could significantly affect a company’s safety and soundness; and (c) strike an appropriate balance between the benefits of providing for adequate liquiditadverse events and the cost of that liquidity. The primary role of liquidity-risk management is to prospectively assess the nee

obligations and ensure the availability of cash or collateral to fulfill those needs at the appropriate time by coordinating the vaavailable to the bank and holding company. The safety and soundness and capital adequacy statutes and guidelines provide the legal basis for the imposition and enforcemmanagement requirements by the federal banking agencies. See for safety and soundness: 12 U.S.C. § 1831p-1 and 12 CFR 3for capital adequacy: 12 U.S.C. §§ 1831o(c) & 3907 and 12 CFR 3, 6, 208, 225, 325, & 567. Specific expectations are enumguidance listed below and related materials such as the Basel Committee’s Sound Practices for Managing Liquidity in Bankin

2000) as well as the Committee’s Principles for Sound Liquidity Risk Management and Supervision (September 2008). Failur

enforce adequate liquidity-risk management programs can trigger an enforcement action and/or an array of other remedial me

On June 30, 2009 the agencies released for public comment an interagency policy statement on liquidity-risk management to pinteragency expectations on sound practices for managing funding liquidity risk. The guidance summarizes the principles of smanagement that the agencies have issued in the past and are currently outstanding, and, where appropriate, brings these princ

with the international guidance recently issued by the Basel Committee on Bank Supervision titled Principles for Sound LiquiSupervision. Existing supervisory guidance can be found in the following publications: For national banks, see the Liquidity, 

Supervision and Large Bank Supervision booklets of the Comptroller’s Handbook series. For state member banks and bank hFederal Reserve’s Commercial Bank Examination Manual - section 4020.1; Bank Holding Company Supervision Manual - seand Capital Markets Activities Manual - section 3005.1 & appendixes (Trading Manual). For state non-member banks, see the Examination Guidance for Liquidity and Funds Management - Trans. No. 2002-01, Nov. 19, 2001. For savings associations a

Examination Handbook - section 430, Operations Analysis and Holding Company Handbook, Section 600. The Federal Rese

evaluate holding companies’ management of liquidity risk.

As noted in Principle 7, the U. S. federal banking agencies adhere to the UFIRS, and U.S. federal banking supervisors evaluat
Principle 14: Liquidity riskUFIRS guidelines. UFIRS has a component to rate Liquidity (L) in the CAMELS ratings. Liquidity is also evaluated in the fholding company ratings systems1. U.S. federal banking supervisors consider the current level and prospective sources of liq

funding needs, as well as to the adequacy of funds management practices relative to the bank’s and holding company's size, co

during each full scope examination. Liquidity is rated based upon, but not limited to, an assessment of the following evaluatio

• The adequacy of liquidity sources compared to present and future needs and the ability of the bank and holding comp

without adversely affecting its operations or condition. 

• The availability of assets readily convertible to cash without undue loss. • The ability to access money markets and other sources of funding. • The level of diversification of funding sources, both on- and off-balance sheet. • The degree of reliance on short-term, volatile sources of funds, including borrowings and brokered deposits, to fund l• The trend and stability of deposits. • The ability to securitize and sell certain pools of assets. • The capability of management to properly identify, measure, monitor, and control the bank’s and holding company's l

including the effectiveness of funds management strategies, liquidity policies, management information systems, and plans. 

Each federal banking agency evaluates a bank’s and holding company’s liquidity risk and risk-management systems as part of 

supervisory programs. Largely Compliant: Although established U.S. federal banking agency guidance is considered wholly compliant with internat

events during the current crisis have moved the agencies to fully assess the overall effectiveness of the implementation of the used in enforcing such guidance. Based on such assessments the agencies consider their current status as largely compliant wRecognizing the need for improvement in implementation of this principle, the agencies have enhanced the supervision of liqfollows: 1) issuing consistent supervisory expectations through an interagency statement on sound practices; 2) introducing 

guidance on consolidated supervision that stresses a focus on group-wide as well as legal entity liquidity management; 3) inc

liquidity risk profiles of banks and holding companies as well as monitoring systemically important institutions liquidity leveland 4) improving coordination among the supervisory agencies in assessing quantitative risk profiles as evidenced by the rece

Assessment Program exercise. 

1 See Federal Reserve SR 04-18, www.federalreserve.gov/boarddocs/press/bcreg/2004/20041201/attachment.pdf; OTS’s CEO Memorandum 

Reg. 72442)(Dec. 20, 2007)) (SLHCs), http://files.ots.treas.gov/73377.pdf. 
EC 1 Principle 14: Liquidity risk Criterion The supervisor sets liquidity guidelines for banks. These guidelines take into consideration undrawn comm

balance sheet liabilities, as well as existing on-balance sheet liabilities. 

Practices and Procedures 

The U.S. federal banking agencies’ approach with respect to liquidity is qualitative in nature – focusing on specific quantitative standards and tests. U.S. federal banking agencies also do not have a one-size-fits-all assessing liquidity. In general, U.S. federal banking supervisors confirm that regulated banks and holding in place for managing liquidity that is commensurate with the size and complexity of its operation and its onoted above, the agencies assess each bank’s and holding company’s liquidity as part of the UFIRS or hold

systems as noted above. The rating system directs that: 

“In general, funds management practices should ensure that an institution is able to maintain a lev

meet its financial obligations in a timely manner and to fulfill the legitimate banking needs of its c

should reflect the ability of the institution to manage unplanned changes in funding sources, as wemarket conditions that affect the ability to quickly liquidate assets with minimal loss. In addition, practices should ensure that liquidity is not maintained at a high cost, or through undue reliance on 

not be available in times of financial stress or adverse changes in market conditions.” 

As a result, the agencies expect a range of sound practices based on the business activities, objectives, and 

and holding company. Through the examination process, supervisors evaluate each bank’s and holding comanaging liquidity risk to ensure that it is appropriate for the nature and scale of the bank’s and holding coactivities and commensurate with the bank’s and holding company’s liquidity risk arising from both on anactivities. The agencies’ regulatory Call Reports and Thrift Financial Reports collect information on each bank’s and liability and deposit mix, including information on deposit maturities and repricing characteristics. These 

level of large deposits that may not be covered by FDIC deposit insurance, non-maturity deposits, non-depbe credit sensitive, and off-balance-sheet commitments. Each agency uses this and other market related daand monitoring tools to identify banks and holding companies that may have high potential liquidity-risk e

EC 2 Principle 14: Liquidity risk Criterion The supervisor confirms that banks have a liquidity management strategy, as well as policies and processe

risk, which have been approved by the Board. The supervisor also confirms that the Board has an oversighpolicies and processes for risk-taking are developed to monitor, control and limit liquidity risk, and that m

implements such policies and processes. 

Practices and Procedures 

U.S. federal banking supervisors confirm that banks and holding companies have documented strategies fo

and clear policies and procedures for limiting and controlling risk exposures. Strategies should identify pr
EC 2 Principle 14: Liquidity risk 

daily operating cash outflows as well as seasonal and cyclical cash flow fluctuations. In addition, the bankstrategies and policies and procedures should address alternative responses to various adverse business sce

and holding company’s methods for managing daily operating cash flows, providing for seasonal and cycl

and addressing various adverse liquidity scenarios. When necessary, policies, procedures, and limits shoulseparately for major currencies in which the bank and holding company conducts business. Supervisors also confirm that these policies and procedures are approved by the board of directors of the b

or an appropriate committee of the board, and reflect the objectives, risk tolerances and goals of the board While formal supervisory approval of a bank’s and holding company’s policies and procedures is not requ

procedures are reviewed through the supervisory process. Deficiencies and recommendations to rectify ththe report of examination (or similar communications) and discussed with senior management and, if necedirectors. See Supervisory Guidance publications noted in the overview. 

EC 3 Principle 14: Liquidity risk Criterion The supervisor determines that a bank’s senior management has defined (or established) appropriate polici

monitor, control and limit liquidity risk; implements effectively such policies and processes; and understanliquidity risk being taken by the bank. 

Practices and Procedures 

The U.S. federal banking agencies require banks and holding companies to have sound liquidity-risk manainvolve effective oversight of a comprehensive process to adequately identify, measure, monitor, and contconsistent with guidance issued by the Basel Committee noted in the overview. Supervisors determine thasound liquidity-risk management process are evident. These include adequate corporate governance, incluby the board of directors and senior management; appropriate strategies, policies, procedures, and limits forisk; adequate systems and processes for measuring, monitoring, and reporting liquidity risk; comprehensiplans for addressing potential adverse liquidity events and meeting emergency cash flow needs; and appro

all aspects of liquidity-risk management. Supervisors evaluate the customization of each of these element

for the sophistication, complexity, and business activities of the bank and holding company. As noted in the agencies’ manuals, supervisors assess the adequacy of board and senior management overs

are made by reviewing the bank’s and holding company’s policies and procedures and management reportdiscussions with the bank’s and holding company’s management. Supervisors’ reviews will also assess wmanagement: have identified lines of authority and responsibility; have articulated the bank’s and holding liquidity strategies and its approach to liquidity risk; understand the bank’s and holding company’s liquidi

plans; and periodically review the bank’s and holding company’s liquidity-risk profile. See Supervisory Gnoted in the overview.
EC 4 Principle 14: Liquidity risk Criterion The supervisor requires banks to establish policies and processes for the ongoing measurement and monito

requirements. The policies and processes include considering how other risks (e.g. credit, market and oper

the bank’s overall liquidity strategy, and require an analysis of funding requirements under alternative scenfunding sources, a review of concentration limits, stress testing, and a frequent review of underlying assum

they continue to be valid. 

Practices and Procedures 

The U.S. federal banking agencies require banks and holding companies to have policies and processes to liquidity needs appropriate to the bank’s and holding company’s risk profile; agencies do not mandate or cexplicit scenarios in their assessment of the liquidity position of a bank and holding company given the div

industry. Rather, the U.S. federal banking supervisors review the robustness of the scenario analyses and sbanks and holding companies based on the size, complexity, and risk profile. The resiliency of a bank’s anfunding liquidity to firm-specific and market-wide stress conditions is also assessed through the supervisoroff-site monitoring and target examinations. For the largest banks and holding companies, the agencies mteams that review and assess a variety of risk management and funding reports on an ongoing basis. As indicated in the agencies’ examination manuals, in evaluating the adequacy of a bank’s and holding com

supervisors consider the current level and prospective sources of liquidity compared with funding needs, afunds-management practices relative to the bank’s and holding company’s size, complexity, and risk proficonfirm that funds-management practices ensure that a bank and holding company is able to maintain a lev

meet its financial obligations in a timely manner and to fulfill the legitimate banking needs of its communireflect the ability of the bank and holding company to manage unplanned changes in funding sources, as w

market conditions that affect the ability to quickly liquidate assets with minimal loss. In addition, supervis

management practices limit a bank’s and holding company’s reliance on funding sources that may not be afinancial stress or adverse changes in market conditions. Supervisors review to ensure a bank and holding company conducts stress testing or scenario analysis of itSupervisors evaluate that the stress tests or scenario analyses include an assessment of the potential impact that are bank and holding company-specific and/or externally-driven events. Also, supervisors determine stressed under different levels of severity, funding needs are quantified, funding sources are identified, and reporting and external communication are addressed throughout a stress event. During the stress testing pr

managers ensure that they choose potential adverse liquidity scenarios that entail appropriate degrees of seappropriate level of diversified funding sources; and model cash flows consistent with each level of stress. 

Guidance publications noted in the overview.
EC 5 Principle 14: Liquidity risk Criterion The supervisor obtains sufficient information to identify those institutions carrying out significant foreign 

transformation. Where a bank or banking group’s foreign currency business, either directly, or indirectly thexchange to domestic borrowers, is significant, or where a particular currency in which the bank has materexperiencing problems, the supervisor requires the bank to undertake separate analysis of its strategy for eand, where appropriate, set and regularly review limits on the size of its cash flow mismatches for foreign and for each significant individual currency. 

Practices and Procedures 

U.S. federal banking agencies require banks and holding companies to have a system in place to measure, 

liquidity positions for each major currency in which business is conducted. The treatment of foreign currenholding company’s internal liquidity assessment is largely determined by the bank and holding company. reviewed during the examination process. Banks and holding companies are expected to be able to managtheir currency exposures. The assumptions regarding currency convertibility are left to each individual ban

determine. Supervisors review the reasonableness of these assumptions, under both normal and stressed c

documentation. Under the Interagency Country Exposure Review Committee (ICERC), agencies review cprovide an assessment of the degree of transfer risk that is inherent in the cross-border and cross-currency 

and, if applicable, determine minimum allocated transfer risk reserves (ATRR). Agencies also evaluate crSee Supervisory Guidance publications noted in the overview to Principle 14 as well as those noted in Prin

EC 6 Principle 14: Liquidity risk Criterion The supervisor determines that banks have contingency plans in place for handling liquidity problems, inc

supervisor. 

Practices and Procedures 

U.S. federal banking agencies expect banks and holding companies to have appropriate contingency fundin

Supervisors review and assess a bank’s and holding company’s CFP during examinations. These assessmeCFP includes policies, procedures, and action plans for responding to contingent liquidity events, includinmarkets or the bank’s and holding company’s market access (e.g., access to commercial paper markets) caspecific or market-wide events. Action plans are expected to include the bank’s and holding company’s pl

customers and large funds providers, the press, and the bank’s and holding company’s supervisors. Supervis commensurate with the complexity, risk profile, and scope of operations of the bank and holding compabusiness and risk-management objectives, strategies, and tactics. Supervisors confirm that senior managemthe CFP as well as the bank’s and holding company’s liquidity-risk management strategies, policies, and p

they remain appropriate and sound. Supervisors evaluate if management also coordinates the CFP with thcompany’s liquidity-risk management efforts for disaster, contingency, and strategic planning. As part of the consideration of potential firm-specific events, a bank and holding company is also expected potential declines in regulatory capital that would cause them to be less than “well capitalized” for purpose

Corrective Action (PCA) legislation (See 12 U.S.C. § 1831o). For example, a bank that relies upon broke
EC 6 Principle 14: Liquidity risk 

incorporate PCA related downgrade triggers into its CFPs since a change in PCA status could have a mateavailability of this funding source. As outlined in the Joint Agency Advisory on Brokered and Rate Sensit

are considered only “adequately capitalized” must receive a waiver from the FDIC before they can accept, brokered deposit. When a bank becomes undercapitalized under the PCA legislation, limits are placed on its asset growth aninterest in another bank. See 12 U.S.C. § 1831o(e ). Additional limitations are placed on the bank if it bec

critically undercapitalized or if it fails to carry out its approved capital restoration plan. See section 29 of undercapitalized banks generally may not borrow from the discount window. See 12 U.S.C. § 1831o, as w

AC 1 Principle 14: Liquidity risk Criterion The supervisor determines that, where a bank conducts its business in multiple currencies, foreign currenc

separately stress-tested, and the results of such tests are a factor in determining the appropriateness of mism

Practices and Procedures 

U.S. federal banking agencies stress the need for liquidity-risk management programs to take full account 

or holding company’s lending, investment, and other activities and should ensure that adequate liquidity is 

company and any of its bank and non-bank subsidiaries. These programs should fully incorporate real and 

the transfer of funds among subsidiaries and between affiliates and the parent company, including legal anU.S. federal banking agencies require banks and holding companies to have a system in place to measure, liquidity positions for each major currency in which business is conducted. Stress testing is another important element of risk management and involves identifying possible events or behavior that could have unfavorable effects on the bank and holding company. Stress-test analyses used holding company’s ability to withstand a stress event should also include contingency funding plans (CFP

actions in certain situations. Banks and holding companies may be required to utilize separate CFPs for th

the consolidated banks in a multibank holding company, for separate subsidiaries (when appropriate), or focurrency and global political entity, as necessary.

AC 2 Principle 14: Liquidity risk Criterion The supervisor confirms that banks periodically review their efforts to establish and maintain relationships 

maintain the diversification of liabilities, and aim to ensure their capacity to sell assets. 

2 See Federal Reserve SR letter 01-14; OCC Advisory Letter 2001-5 (May 11, 2001); FDIC PR-37-2001 (May 11, 2001); and OTS CEO Me

2001). 
AC 2 Principle 14: Liquidity risk Practices and Procedures 

U.S. federal banking supervisors, during the examination process, review and assess the adequacy of the lipolicies and procedures, and conduct periodic reviews of the reliability of liquidity sources. Because U.S. companies rely on different sources of funding (wholesale, retail, secured, and unsecured), federal bankin

banks and holding companies establish policies that set out their liquidity risk tolerances and guidelines apcomplexity and liquidity-risk profile of the bank and holding company. Supervisors evaluate if bancompanies employ both quantitative targets and qualitative guidelines that adjust as circumstances ctolerances, and guidelines may include funding concentrations that address diversification issues such aborrowed funds dependency, single funds providers, market segment funds providers, and types of brokerefunding. During both on-site examinations and off-site reviews, supervisors review and assess the bank’s and holdin

marketable assets as liquidity reserves in addition to assessing the bank’s and holding company's strategy tliquidity during stress situations from repos and sales of securities, asset securitization and sales activities, and access to the discount window. Because the bank’s and holding company’s business activities may haits liquidity needs, examiners also review and assess the nature of the bank’s and holding company’s activoperational risks associated with the bank’s and holding company’s business activities, risks inherent in th

external factors that may have an impact on the bank’s and holding company's liquidity including access to of liquidity. Some smaller banks and holding companies may engage in activities in stress situations (repo and/or sales securitization and/or sales, wholesale borrowings, and access to the discount window) that are similar to thand more complex ones. However, small banks and holding companies may have fewer funding options more reliant on maintaining an established liquidity warehouse, which is a portion of the investment accouto meet both normal and stress liquidity needs. Smaller banks may also rely more heavily on secured or unborrowings in the form of FHLB advances or brokered deposits. In light of this, supervisors review and asholding company's concentration of borrowed funds, their capacity to borrow from the FHLB, and the ava

funds providers. Supervisory guidance states that banks and holding companies should periodically test the operational elemensure that there are no unexpected impediments or complications in accessing standby sources of liquiditliquidity event. See Supervisory Guidance publications noted in the overview.
Principle 15: Operational risk

Supervisors must be satisfied that banks have in place risk management policies and processes to identify, assess, mooperational risk. These policies and processes should be commensurate with the size and complexity of the bank. Legal Framework Overview Many banks and holding companies view operational risk as comprising any risk not categorized as credit or market risk and 

significance only to credit risk. This view has become more widely held in the wake of recent, highly visible breakdowns in icorporate governance that have exposed banks and holding companies to large losses. These facts combined with several key use of automated technology, proliferation of new and highly complex products; growth of e-banking transactions and related large scale acquisitions, mergers, and consolidations; and greater use of outsourcing arrangements have contributed to increas

exposures at banks and holding companies. As a result, the U.S. federal banking agencies have increased their oversight of bacompanies’ management of operational risk, and have adopted/outlined proposed and final rules for the inclusion of an explic

requirement. The U.S. federal banking agencies issued new risk-based capital rules (72 Fed. Reg. 235 (December 7, 2007)), effective April parallels principles set forth in the BCBS’s June 2006 - Basel II: International Convergence of Capital Measurement and Capi“Risk-Based Capital Standards: Advanced Capital Adequacy Framework” adopts only the advanced approaches and is only re

by large and/or internationally active banks and holding companies. In addition to the credit and market risk requirements – tregulatory capital requirement for operational risk, as well as specific qualification requirements, including the development o

management processes, operational-risk data and assessment systems, and operational-risk quantification systems. These guidpursuant to the agencies’ statutory authority to impose capital adequacy requirements. See 12 U.S.C. §§ 1831o and 3907. As organizations met the criteria under the rule’s scope and are designated as “mandatory institutions.” The U.S. federal banking agencies also issued proposed risk-based capital rules (73 Fed. Reg. 146 (July 29, 2008)), which wo

to the advanced approaches for banks and holding companies not designated as “mandatory" under the final rule referred to abrule is referred to as the Standardized Framework, for operational risk, the proposed rule would require banks and holding comIndicator Approach. In addition, banks and holding companies are encouraged to manage operational risk consistent with the 

BCBS’s “Sound Practices for the Management and Supervision of Operational Risk.” In addition to the revised Advanced ApStandardized Approaches, and existing Basel I risk-based capital requirements, all U.S. banks and holding companies are subjrequirements. Although these leverage capital requirements do not explicitly address operational risk, they provide an importoperational and other risks. 
Principle 15: Operational risk

The U.S. federal banking agencies have also issued extensive supervisory guidance on various aspects of operational risk maninternal controls, information technology, outsourcing of financial services, payment systems, audit, business continuity plann

insurance, and fiduciary operations. In all cases, risk-management practices are expected to be commensurate with the size, c

of the entity. The safety-and-soundness statutes, rules and guidelines are the principal legal bases for the imposition and enfooperational-risk management standards. See 12 U.S.C. § 1831p-1 and 12 CFR 30, 208, 364, and 570. The federal banking agintegrated principles set forth in the Basel Committee on Banking Supervision’s Sound practices for the management and suprisk, February 2003; and Outsourcing in financial services, Joint Forum (February 2005) into its overall supervisory programs

The federal banking agencies also expect banks and holding companies to implement an appropriate risk-management program

the complexity of the bank and holding company’s structure and products, to ensure compliance with all consumer protection Additionally, the federal banking supervisors meet periodically to discuss operational risk issues through, for example, an integroup. 

EC 1 Principle 15: Operational risk Criterion The supervisor requires individual banks to have in place risk management policies and processes to identi

control/mitigate operational risk. These policies and processes are adequate for the size and complexity of the supervisor confirms that they are periodically adjusted in the light of the bank’s changing risk profile a

developments. 

Legal Framework 

See Overview above. 

Practices and Procedures 

The federal banking agencies expect banks and holding companies to implement an appropriate risk-manacorresponding to the complexity of the banking organization’s structure and products, and to ensure complprotection laws and regulations. The agencies have identified operational risk as one of the risk categories inherent in banks’ and holding cconfirm that banks and holding companies have risk-management policies and processes to identify, assesoperational risk. The agencies use ongoing supervision techniques, including on-site and off-site examina
EC 1 Principle 15: Operational risk 

surveillance processes, to evaluate the adequacy of banks’ and holding companies’ operational risk-manag

processes in the context of the size, nature, and complexity of operations and activities considering the ext

market factors in which banks and holding companies operate. The supervision process includes an identithe banks’ and holding companies’ critical and/or key operational risks and an evaluation of associated riskand processes, including banks’ and holding companies’ periodic re-evaluation of operational risk exposurtheir activities and risk profile and developments in external markets and the environment. Refer to Princibackground on U.S. supervisors’ expectations for the necessary elements of a sound risk-management proSupervisory assessment of a bank’s risk-management processes and practices are largely captured in the agFinancial Institutions Rating System] (UFIRS) that evaluates each bank’s capital, asset quality, manageme

sensitivity to market risk. The agencies have various internal risk-assessment systems that they use to eva

banking organization’s risk-management processes. For example, OCC supervisors use a Risk Assessmenquantity of risk, the quality of risk management, the level of supervisory concern (measured as aggregate rrisk across various categories of risk, including transaction/operational risk. See the Bank Supervision ProSupervision, and Large Bank Supervision booklets of the OCC Comptroller’s Handbook series. Similarly, the OTS assign a formal supervisory rating to the adequacy of risk-management processes, including inter

holding companies. See Federal Reserve SR letter 95-51 and OTS CEO Memorandum 266 and attachmenU.S. federal banking agencies adopted the new risk-based capital framework that is based on the advanced 

Basel Capital Accord in December 2007. As implemented, the advanced capital adequacy framework inclthe Advanced Measurements Approach (AMA) for operational risk. See Overview for additional informatformal enforcement authority to address risk-management deficiencies at banks and holding companies anauthority when identified deficiencies materially threaten an institution’s safe and sound operation. The fo

formal enforcement actions that serve as examples of U.S. supervisors’ authority to direct adequate manag

at banks and holding companies: North Valley Bank – Written Agreement dated March 15, 2007, requiring a written plan to strengthen and processes, including but limited to operational risk. www.federalreserve.gov/newsevents/press/enforcement/enf20070322a1.pdf

First Security NB – Cease and Desist Order that mandates controls over new products and services, accuraand improved MIS. www.occ.treas.gov/FTP/EAs/ea2008-150.pdf
EC 1 Principle 15: Operational risk 

Sunnyside Federal S & L Association of Irvington—Cease and Desist Order dated September 14, 2007, recommittee of outside directors of board to monitor creation of, and compliance with, business plan, complprogram, and other plans to ensure compliance with various laws. www.files.ots.treas.gov/enforcement/96199.pdf

Home Federal Savings Bank—Temporary cease and desist order dated October 9, 2007, requiring establisoutside directors of board to monitor creation and maintenance of accurate books and records. http://files.ots.treas.gov/enforcement/96304.pdf

EC 2 Principle 15: Operational risk Criterion The supervisor requires that banks’ strategies, policies and processes for the management of operational ri

are periodically reviewed by the Board. The supervisor also requires that the Board oversees management policies and processes are implemented effectively. 

Legal Framework 

See Overview above. 

Practices and Procedures 

U.S. federal banking agencies evaluate the risk-management processes and programs of banks and holding assessment of active board of directors’ and senior management oversight, a key element of such program

accountability for the level of risk taken by their banks and holding companies, and supervisors evaluate wunderstands the nature of operational risks and take steps necessary to identify, measure, control, and mon

specifically, U.S. federal banking agencies’ examination procedures require verification that a board perioapproves significant operational risk management-related strategies, policies, and processes, and are amonresponsibilities of the board in directing a bank’s and/or holding company’s activities. While the volume astrategies, policies, and processes varies at each bank or holding company according to size and the nature expectation for board review and approval of such policies and for a board’s active oversight of managemeexecution/implementation of them is universal. With respect to the banks and holding companies that are opt-in to, the advanced approach under Basel II, there is a requirement that the board must at least annually of and approve the organization’s advanced systems. Largely through on-site examinations, and secondarily through on- and off-site supervisory activities, supe
EC 2 Principle 15: Operational risk 

and/or holding company’s operational risk-related strategies, policies, and processes and verify that they aorganization’s actual operating characteristics, and have been formally approved by the board. Additional

the board oversight of management’s effectiveness in implementing operational risk-management policiesconducted in several ways: 1) Review of board and committee minutes; 2) Evaluation of the frequency, co

external and internal audit reports; and 3) Assessment of the frequency, nature, and integrity of applicable system that reflect effective policy/control implementation through reported residual risk levels (For more Principle 7, Principle 17, Principle 22, and EC 1 above). The consolidated supervision framework for large bank holding companies directs Federal Reserve particiaudit for a defined population of large bank holding companies and for combined U.S. operations of foreigsupplemented by annual reassessments. The following outstanding formal enforcement actions serve as an example of the authority to direct board 

review of operational risk-management policies and board oversight of effective implementation. 

Cache Valley Banking Company and Cache Valley Bank – Cease and Desist Order dated March 20, 2development of a plan to strengthen board oversight, including a process to ensure timely board appro

policies and to monitor management’s adherence to approved policies and procedures. 

www.federalreserve.gov/newsevents/press/enforcement/enf20070323a1.pdf

Beach First National Bank – Formal Agreement dated September 30, 2008, requiring a review of curresupervision, conduct of strategy planning, and improvements of IT and MIS programs. 

www.occ.treas.gov/FTP/EAs/ea2008-142.pdf

American Bank, Rockville, MD –Cease and Desist order dated September 4, 2008, requiring adoption 

improvements in board oversight. http://files.ots.treas.gov/enforcement/97010.pdf

EC 3 Principle 15: Operational risk 
EC 3 Principle 15: Operational risk 

Criterion The supervisor is satisfied that the approved strategy and significant policies and processes for operational 

effectively by management. 

Legal Framework 

See Overview above. 

Practices and Procedures 

U. S. federal banking supervisors review and evaluate the same information inputs available to the bank’s board. External and internal audit reports and selected management information system reports are review

that management has implemented the board approved operational risk-management strategies, policies anAdditionally, on a risk-focused basis and/or where warranted based on initial evaluation findings, on-site s

select transaction testing to validate conformance with, and effectiveness of, operational risk management 

processes. (For more information, also see Principle 7, Principle 17, and EC 1 and EC 2 above). The U.Salso established uniform review procedures for use in all Basel II mandatory and potential opt in institutioneven implementation and evaluation throughout the jurisdiction, and the information is collected, reviewed address systemic or industry concerns. Additionally U.S. regulators are participating in, and serving as the 

2008 LDCE (loss data collection exercise) sponsored by the Basel Committee. This effort, on a voluntary supervisors and institutions with a broad base of information to ensure consistent and even implementation 

regulatory expectations are met. The following outstanding formal enforcement actions serve as examples of the authority to direct manageimplementation of board approved policies and procedures. 

Bank of York – Cease and Desist Order dated August 14, 2006, requiring monitoring of effective policenhancements to the internal audit program. www.federalreserve.gov/newsevents/press/enforcement/enf20060822a1.pdf\

First National Bank of Kansas – Cease and Desist Order that required the bank to revise its automated management system, including operational risk. www.occ.treas.gov/FTP/EAs/ea2008-093.pdf

EC 4 Principle 15: Operational risk Criterion The supervisor reviews the quality and comprehensiveness of the bank’s business resumption and continge
EC 4 Principle 15: Operational risk 

that the bank is able to operate as a going concern and minimize losses, including those that may arise from 

and settlement systems, in the event of severe business disruption. 

Legal Framework 

See Overview above. 

Practices and Procedures 

U.S. federal banking agencies have adopted examination procedures and perform risk-focused reviews of bcompanies’ business resumption and contingency plans during on-site examinations, with the scope/breadtupon the risk profile of the organization. The risk profile is based on 1) the size and nature of the organiza

and activities, considering any significant changes since the previous regulatory review; 2) the scope/breadprevious regulatory reviews; and 3) any significant changes in the external or environmental factors that cabusiness continuity risk. Additionally, under certain circumstances, the business resumption and contingen

holding companies, individually by organization and/or horizontally across groups of banks and holding coof both on-site and off-site supervisory activities at the U.S. federal banking agencies. Various supervisory policies, standards, and/or guidance statements relevant to business resumption and co

been issued on an interagency basis. See March 2008 FFIEC Business Continuity Planning Booklet, as wfor responses to Hurricanes Katrina and Rita. Supervisory oversight of key financial firms and market utilities that support critical financial markets havteams to assess the adequacy of governance and risk management of critical business/service lines on an ogenerally provide core clearing and settlement services that are the backbone of the U.S. financial and intesystems. As such, U.S. federal supervisors have adopted guidelines that are outlined in the Interagency Pa

Strengthen the Resilience of the U.S. Financial System. These guidelines outline recovery and resumption and settlement activities that support critical financial markets with the specific goal of limiting systemic/d

financial system. Supervisory programs have integrated these guidelines into their continuous monitoring 

targeted control validation reviews, both of which leverage work already performed by, or conducted in cosupervisors and functional regulators. A related principle in the consolidated supervision framework is that large holding companies should provmeasures for the recovery and/or resumption of their most important business processes in the event of a b

Federal Reserve’s supervisory approach focuses on the areas of the greatest systemic risk, i.e., clearing and related to critical financial markets. The resulting supervision program establishes a mechanism to conduc

the adequacy of risk management over the resiliency and recovery of clearing and settlement activities relamarkets as originally contemplated under SR letter 03-09, the Interagency Paper on Sound Practices to St
EC 4 Principle 15: Operational risk 

the U.S. Financial System. The supervisory program combines an examination team’s continuous monitor

assessment of any material changes in a firm’s related activities or characteristics, and periodic targeted co

The OTS’s approach is similar in its role as a consolidated supervisor. Also, the OCC and the FDIC expecjurisdiction to also provide for sufficient resiliency measures. The following outstanding formal enforcement action serves as an example of the authority to direct develimplementation of a business continuity plan: 

Vineyard Bank, N.A. – Cease and Desist Order dated July 22, 2008 requiring development of an entercontinuity process. 

www.occ.treas.gov/FTP/EAs/ea2008-068.pdf

EC 5 Principle 15: Operational risk Criterion The supervisor determines that banks have established appropriate information technology policies and pro

such as information security and system development, and have made investments in information technolo

size and complexity of operations. 

Legal Framework 

See Overview above. Pursuant to statute 15 U.S.C. § 6801(b), the U.S. federal banking agencies published the Interagency Inforin May 2001. This requires that banks and holding companies develop and implement a comprehensive wprogram that includes administrative, technical, and physical safeguards to protect the security, confidentia

customer information. See 12 CFR 30, appendix B (OCC), 

Practices and Procedures 

U.S. federal banking agencies’ supervisory procedures determine if banks and holding companies have app

to address information security and system development through on-site examinations considering the risk holding company. The agencies have supervisors with specialized IT skill sets who can lead or assist in exholding companies that have complex IT or operating environments. Also, consumer compliance supervisholding companies’ compliance with statutory consumer privacy provisions to ensure that controls are in pcustomer information and that appropriate disclosures are made regarding banks’ and holding companies’ practices. 
EC 5 Principle 15: Operational risk 

Various supervisory policies, standards, and/or guidance statements relevant to risk management of IT acti

an interagency basis, many through the FFIEC’s IT Subcommittee (ITS), a standing subcommittee of the FSupervision to address security and development. See www.ffiec.gov/PDF/annrpt06.pdf ,p. 20, for a desc

responsibilities. The FFIEC’s Information Security booklet provides extensive guidance and examination procedures to eva

practices. The ITS develops and publishes IT-related risk-management policies and guidance statements btrends or developments in the broader IT environment. This includes the Information Security booklet of 

Examination Handbook, as well as other more targeted guidance such as Interagency Guidance on Authen

Banking Environment (October 2005), Guidance on the Use of Free and Open Source Software (Decembe“Phishing” Informational Brochure (October 2004), Uniform Rating System for Information Technology Interagency Supervisory Statement on Risk Management of Client/Server Systems (October 1996). The following outstanding formal enforcement actions serve as examples of the authority to direct adequatinformation technology activities and environment: 

Sella Holding Banca, S.p.A and Sella Holding Banca, S.p.A. d/b/a Banca Sella, S.p.A. Miami Agency dated April 12, 2006, requiring submission of an acceptable plan to improve management oversight of information technology function.

www.federalreserve.gov/newsevents/press/enforcement/enf20060424d1.pdf

Bank of America – Formal Agreement dated February 9, 2005 requiring controls over new products, schanges to existing customer relationships in the Wealth & Investment Management Group. 

www.occ.treas.gov/FTP/EAs/ea2005-10.pdf

EC 6 Principle 15: Operational risk Criterion The supervisor requires that appropriate reporting mechanisms are in place to keep the supervisor apprised 

operational risk at banks in their jurisdictions. 

Legal See Overview above. 
EC 6 Principle 15: Operational risk 

Framework Practices and Procedures 

U.S. federal banking agencies rely upon a combination of their supervisory activities and required regulato

and reporting by banks and holding companies (public requirements stem from accounting and audit-relateapplicable to publicly held firms) to keep apprised of developments affecting operational risk at their supeThe agencies also maintain on- and off-site supervisory monitoring and surveillance regimens; supervisory individual banks and holding companies monitor those firms’ current and planned activities. At larger bancompanies, this may include supervisors with specialized skills in IT or operational risk issues. On-site analso analyzes and reacts to developments regarding operational risk indicated by the firms’ regulatory and reporting (see discussion below). Furthermore, regulations requiring a bank and holding company to file a formal, written application or not

federal banking agency regarding proposed mergers, acquisitions, changes in control, and/or expansions inprovide each agency with indicators of events potentially affecting the organization’s inherent operational 

example, under the Bank Services Company Act, U.S. banks are required to provide regulatory notice upoparty contract outsourcing the performance of certain functions or services. Such notices indicate developand potentially in other categories of operational risk. Finally, the agencies maintain surveillance units tha

sheet, profit/loss, and supplemental information routinely submitted by all banks and holding companies thfinancial reports. Performance trends in various financial indicators can directly or indirectly point to deve

organization’s operational risk profile. Supervisory analysis of a banking organization’s operational risk a

draws upon public disclosures of financial and managerial information and audit-related internal controls a

publicly held banks and holding companies. The AMA to operational risk under the Basel II Capital directive (see EC 1 above) permits some flexibility tools for the quantification and management of operational risk. However, banks and holding companies a

both scenario analysis and business environment and internal control factor analysis methodologies. Outsiframework, the agencies and the banking industry understand that a number of tools exist for the managemincluding, among others, scenario analysis; risk and control self assessments; scorecards; key risk indicatoprocesses for information security risk under the Gramm-Leach-Bliley Act; and business continuity, interncontrol assessments under the Sarbanes-Oxley Act. The desired result sought by U.S. banking agencies is 

operational risk levels accompanied by appropriate risk-management controls or mitigants. How those resspecific tools used, are typically left to the banks and holding companies in order that they might match spcircumstances. For banks and holding companies not required to implement the AMA for operational risk
EC 6 Principle 15: Operational risk 

proposed an additional capital adequacy framework that would implement the U.S. version of the standard

risk and the Basic Indicator Approach (BIA) for operational risk contained in Basel II. This framework, aoptional for banks and holding companies not subject to the advanced approaches of Basel II. 

EC 7 Principle 15: Operational risk Criterion The supervisor confirms that legal risk is incorporated into the operational risk management processes of tLegal Framework 

See Overview above. 

Practices and Procedures 

Under the U.S. federal banking agencies’ operational and managerial safety and soundness standards (12 Cbanks’ an holing companies’ internal controls and information systems must ensure compliance with appliregulations. Supervisors assess a bank’s and/or holding companies’ compliance with applicable laws and 

supervision activities. 

EC 8 Principle 15: Operational risk Criterion The supervisor determines that banks have established appropriate policies and processes to assess, mana

activities. The outsourcing risk management program should cover: 

conducting appropriate due diligence for selecting potential service providers; 

structuring the outsourcing arrangement; managing and monitoring the risks associated with the outsourcing arrangement; ensuring an effective control environment; and establishing viable contingency planning. 

Outsourcing policies and processes should require the institution to have comprehensive contracts and/or swith a clear allocation of responsibilities between the outsourcing provider and the bank. 

Legal Framework 

See Overview above. 
EC 8 Principle 15: Operational risk 

Practices and Procedures 

U.S. federal banking agencies strictly maintain that although banks and holding companies may outsource other business processes to outside parties, the banks’ and holding companies’ directorate and managemenaccountable for the safe and sound performance and legitimacy/legality of the outsourced activity, includin

Safety and soundness considerations include the security, integrity, and availability of any sensitive data othe service provider. U.S. federal banking agencies’ examination procedures ensure supervisors evaluate, through on-site exam

companies establish appropriate policies and processes to assess, manage, and monitor outsourced activthat each firms’ program includes conducting due diligence on potential service providers, structuring the 

assessing, managing, and monitoring of applicable risk, ensuring effective controls, and establishing 

Interagency guidance on this topic has been issued through the FFIEC. While both Guidance on Outsourced Technology Services (November 2000) and the Outsourcing Technology Services Booklet (Jun

risk-management expectations largely from the perspective of IT-related outsourcing, the same risk-applied in practice to any material outsourcing arrangement at banks and holding companies, whether techrelated. The Interagency Information Security Standards (May 2001) are applicable to customer informand holding companies themselves or maintained on their behalf by outsourced service providers. OTS Tadditional guidance on third-party arrangements. U.S. federal banking agencies are active in additional aspects of the banking industry’s use of service provand jurisdiction from the Bank Services Company Act, the agencies pool supervisory resources to perform management evaluations/examinations of data processing service providers with significant client bases cobanks and holding companies. For large service providers whose performance is identified as having systeevaluations are performed under the Multi-regional Data Processing Servicers (MDPS) Program administeSubcommittee. Other data processing service providers with less significance, yet multiple client banks anidentified and evaluated under the Regional Technology Service Provider (Regional TSP) program adminiregional or local offices.

AC 1 Principle 15: Operational risk Criterion The supervisor determines that the risk management policies and processes address the major aspects of op

an appropriate operational risk framework that is applied on a group-wide basis. The policies and processeadditional risks prevalent in certain operationally intensive businesses, such as custody and correspondent periods when operational risk could increase. 
AC 1 Principle 15: Operational risk 

Legal Framework 

See Overview above. 

Practices and Procedures 

As discussed in the above responses to the ECs, U.S. federal banking agencies routinely ensure the existenadequacy, of risk-management policies and processes across the major categories of operational risk applicholding companies. Additionally, on a risk-focused basis, an assessment of operational risk-management p

significant or critical business lines can be scoped into planned supervisory activities. Further, as indicato

risk surface at a specific bank, holding company, or more generally across the banking industry, the agencplanned supervisory activities are adjusted accordingly. Regarding the existence and adequacy of an enterprise-wide risk-management framework overlaying all ca

risk across all of a supervised firm’s business operations and activities, regulatory expectations are dependand complexity of a bank’s or holding company’s activities/operations. The requirements of the AMA for adequacy under Basel II apply an enterprise-wide approach or framework to overall operational risk. The individual banks and holding companies in the United States, although limited, will serve to reinforce the p

wide operational risk governance and management in the largest, most complex, and internationally active companies.
Principle 16: Interest rate risk in the banking bookSupervisors must be satisfied that banks have effective systems in place to identify, measure, monitor and control interest rate including a well defined strategy that has been approved by the Board and implemented by senior management; these should band complexity of such risk. Overview The U.S. federal banking agencies have emphasized that banks and holding companies should carefully assess the risk to earn

value of their capital from adverse changes in interest rates. The “Joint Policy Statement on Interest Rate Risk1” provides gui

guidance stresses the importance of assessing interest rate risk to the economic value of a bank’s or holding company’s capitapractice in selecting appropriate interest rate scenarios to be applied for capital adequacy purposes. Banks and holding compaestablish limits on their interest rate risk exposures that are appropriate to the size, complexity and capital adequacy and that aimpact of changing interest rates on both reported earnings and economic value of equity. The agencies also refer to the BCBfor the management and supervision of interest rate risk, July 2004” for guidance. The safety-and-soundness statute explicitly requires the U.S. federal banking agencies to prescribe standards for banks and hoto interest rate exposure. See 12 U.S.C. § 1831p-1(a)(1)(D). The interagency safety-and-soundness guidelines specify that a b

interest rate risk in a manner appropriate to the size and complexity of its assets and liabilities and (b) provide for periodic repthe board of directors regarding interest rate risk with adequate information for management and the board of directors to asseCFR 208, appendix D-1, § II(E); 12 CFR 30, appendix B, § II(E) (FRB) and 12 CFR 30, appendix A § II(E) (OCC). Interest ris integral to ensuring compliance with regulatory capital standards imposed under 12 U.S.C. §§ 1831o and 3970 and the intersee 12 CFR 208, appendixes A, E, and F (FRB); and 12 CFR 3.10 and 12 CFR 3, appendix A (OCC). As noted in Principle 7, the agencies adhere to the UFIRS and evaluate every bank against UFIRS guidelines during on-site ex

component to rate Sensitivity to market risk in the CAMELS ratings (S) that requires supervisors to evaluate the bank’s exposof, the interest rate risk in its banking book. Specifically, this component reflects the degree to which changes in interest ratescommodity prices, or equity prices can adversely affect a bank’s earnings or economic capital. For most U.S. banks and holdprimary source of market risk is the interest rate risk that arises from non-trading positions in their banking book. In some lar

companies, foreign operations can be a significant source of market risk. For some banks and holding companies, trading acti

of market risk. The Sensitivity to market risk evaluation is based upon, but not limited to, an assessment of the following evaluation factors:

• The sensitivity of the bank’s earnings or the economic value of its capital to adverse changes in interest rates, foreign 

commodity prices, or equity prices. 

1 See Federal Reserve SR letter 96-13; OCC Comptroller’s Handbook, Interest Rate Risk; FDIC: FIL-52-96; Due to the high concentrations 

loans within the thrift industry, the OTS had, prior to the inception of the Interagency Statement, developed a separate policy and process foof interest rate risk, as partially described in Federal Register, 58 Fed. Reg, No. 167 (August 31, 1993). A more detailed discussion of OTSinterest rate risk in the banking book can be found in Thrift Bulletin (TB) 13a, section 650 of the OTS Examination Handbook, Interest Rat
Principle 16: Interest rate risk in the banking book

• The ability of management to identify, measure, monitor, and control exposure to market risk given the size, complex

• The nature and complexity of interest rate risk exposure arising from non-trading positions. 

• Where appropriate, the nature and complexity of market risk exposure arising from trading and foreign operations. 

Interest rate risk is the current or prospective risk to both earnings and capital arising from adverse interest rate movements th

holding company’s banking book. The main sources of interest rate risk in the banking book are repricing risk, yield curve risoption features embedded in many financial instruments. As noted in EC 1 below, each agency has examination manuals and programs that supervisors use to assess the level and manrisk exposure.

EC 1 Principle 16: Interest rate risk in the banking book Criterion The supervisor determines that a bank’s board approves, and periodically reviews, the interest rate risk stra

processes for the identification, measuring, monitoring and control of interest rate risk. The supervisor alsmanagement ensures that the interest rate risk strategy, policies and processes are developed and implemen

Legal Framework 

Compliance with the interest rate exposure provisions of the interagency safety-and-soundness guidelines development and adoption by the board of a strategy and policies and processes for identifying, measuringcontrolling interest rate risk. 

Practices and Procedures 

As stated in the Joint Agency Policy Statement on Interest Rate Risk, the board is responsible for setting th

company’s “tolerance for interest rate risk, including approving relevant risk limits and other key policies, 

authority and responsibility for managing risk, and ensuring adequate resources are devoted to interest rate 

as monitoring “the bank's overall interest rate risk profile and ensuring that the level of interest rate risk is 

levels.” The policy statement also indicates that senior management is responsible for ensuring that intereappropriately. In this regard, senior management should develop and implement policies and procedures; 

approved responsibilities for measuring, managing, and reporting interest rate risk exposures; oversee the imaintenance of management information and other systems that identify, measure, monitor, and control thcompany’s interest rate risk; and establish internal controls over the interest rate risk management process

supervisors confirm a bank’s or holding company’s compliance with this statement during on-site examinaDue to the high concentrations of mortgage loans and securities that savings associations hold in their port

savings associations are particularly vulnerable to adverse movements in interest rates. Consequently, OTto interest rate risk in the banking book is somewhat different than that taken by the other U.S. federal banto its guidance to senior management and boards of directors on interest rate risk management, OTS also u

(NPV) Model to monitor the interest rate risk exposures of individual savings associations, as well as the i
EC 1 Principle 16: Interest rate risk in the banking book 

quarterly basis. The NPV Model is a comprehensive, off-site, supervisory interest rate risk model, which w1991, upgraded in 1993, and extensively modified in 2006 and 2007. As such, the NPV Model is a type oat-risk model, where the value-at-risk is the net economic value of a savings association’s portfolio of asse

balance-sheet (OBS) contracts. OTS evaluates savings associations’ interest rate risk by estimating the sen

to changes in market interest rates. In essence, OTS marks-to-market each savings association’s balance sdifferent interest rate scenarios to determine how the NPV of the savings association changes in response tOTS defines NPV as the present value of expected net cash flows from existing assets, less the present valfrom existing liabilities, plus the present value of net expected cash flows from existing OBS contracts. Thproduce Interest Rate Risk Exposure Reports quarterly for OTS-regulated savings associations. Frequentlya management tool by small savings associations that do not have their own internal interest rate risk mode

quarter, savings associations report the outstanding balances of assets, liabilities, and OBS contracts they hOTS. These data, along with the maturities, coupon rates, and repricing frequencies for the various instrum

Schedule CMR of the Thrift Financial Report. The NPV Model uses these data as input. In assessing the strategy, policies, procedures and processes for the identification, measurement, monitorinrate risk, U.S. federal banking supervisors perform off-site risk assessments and on-site examinations. Wh

banking agency utilizes their own examination procedures and guidance for their supervised banks and ho

guidance remains consistent across the agencies. For example, the agencies’ procedures direct supervisors to obtain, review, and evaluate the interest rate ripolicies and procedures (written or unwritten); board and asset liability committee and other management strategic plan; and internal risk-management reports during the on-site examination. Examination procedusupervisors to assess board and senior management oversight; evaluate the quality of interest rate risk maninternal controls and internal audit function; and evaluate the exposure to interest rate risk from an earning

perspective3.

EC 2 Principle 16: Interest rate risk in the banking book 

2See the Federal Reserve’s CBEM - section 4090 and the Trading and Capital Markets Activities Manual - section 3010; see OCC’s Interes

Supervision, and Large Bank Supervision booklets of the Comptroller’s Handbook series; see the FDIC’s Risk Management Manual of Exa

7.1; see the OTS Examination Handbook -section 600, “Sensitivity to Market Risk”) 

3 Interagency guidance, including the OTS’s TB 13a, notes that limits and measurements of interest rate risk should address the potential im

interest rates on both a bank’s and holding company’s reported earnings and economic value of equity (EVE). From an earnings perspectivshould explore limits on net income as well as net interest income. A bank’s and holding company’s EVE limits should reflect the size and 

positions. For non-complex banks and holding companies, simple limits on permissible holdings or allowable repricing mismatches in interinstruments may be adequate. At more complex banks and holding companies, more extensive limit structures may be necessary. 
EC 2 Principle 16: Interest rate risk in the banking book Criterion The supervisor determines that banks have in place comprehensive and appropriate interest rate risk measu

any models and assumptions are validated on a regular basis. It confirms that banks’ limits reflect the risk 

and are understood by and regularly communicated to relevant staff. The supervisor also confirms that exc

policies, processes and limits should receive the prompt attention of senior management, and the Board wh

Practices and Procedures 

The interest rate exposure provisions of the interagency safety-and-soundness guidelines require banks and 

establish policies and procedures for assessing the level of interest rate risk and for reporting on interest ra

the board of directors and management. Banks and holding companies, as appropriate to their size and levoperations, are required to establish comprehensive interest rate risk measurement systems and regularly vassumptions4. 

U.S. federal banking supervisors confirm that the board and senior management ensure that the level of inteffectively managed and that appropriate policies and practices are established to control and limit risks. A

policies to ensure they include the delineations of clear lines of responsibility and authority for identifying risk arising from existing or new products or activities; establishing and maintaining an interest rate risk mformulating and executing strategies to manage interest rate risk exposures; and authorizing policy excepticonfirm that the specific procedures and approvals are necessary for exceptions to policies, limits, and authinterest rate risk policies are defined, periodically reviewed and revised as needed. In addition, U.S. federal banking agency guidance outlines the need for banks and holding companies to hidentifying and measuring interest rate risk; a system for monitoring and controlling interest rate risk expointernal controls, reviews, and audits to ensure the integrity of the overall risk-management process. The JStatement on Interest Rate Risk also requires an independent review of an interest rate model by a person(smodel function and savings associations are encouraged to have their risk-measurement systems reviewed 

parties. In order to evaluate the bank’s or holding company’s risk-measurement systems and interest rate risk expo

examination procedures which are incorporated in the respective agencies guidance. The procedures direcand assess the data inputs and data integrity; to review and assess the model assumptions and methodology

are appropriate controls and if the assumptions are regularly reviewed. The procedures also call for superv

4 TB 13a provides guidelines for interest rate risk measurement systems at OTS-regulated institutions. According to these guidelines, unles

OTS Regional Director, institutions below $1 billion in assets may usually rely on the quarterly NPV estimates produced by OTS and distrib

Exposure Report. If such an institution owns complex securities (see Glossary in TB 13a) whose recorded investment exceeds 5 percent of 

should be able to measure, or have access to measures of, the economic value of those securities for hypothetical interest rate scenarios of p300 basis points from the actual term structure observed at quarter-end. In contrast, those institutions with more than $1 billion in assets shoand its interest rate sensitivity. These institutions are encouraged to have NPV measurement systems that produce financial instrument valuor indirectly on observed market prices, where feasible. See TB 13a for a detailed discussion of other desirable methodological features of N

that OTS examiners use in evaluating the quality of institutions’ internal interest rate risk models. 
EC 2 Principle 16: Interest rate risk in the banking book 

model’s structure and capabilities to determine if the model is adequate to accurately assess the risk exposorganization; to support the bank’s and holding company’s risk-management process; and serve as a basis authorizations. The agencies also provide guidance to supervisors and bankers on key principles for model validation (see and have staffs with specialized skills in model development and validation that can assist supervisors at laand holding companies. The OTS Thrift Bulletin 13a discusses desirable features of interest rate risk measurement systems. These that financial instrument valuations should, where feasible, be based directly or indirectly on observed marascribed only to financial instruments currently in existence or for which contracts currently exist (i.e., futu

included in NPV); values are based on granular information; zero-coupon (spot) rates of the appropriate mdiscount cash flows; implied forward interest rates are used to model adjustable-rate product cash flows; creasonable non-interest costs that the savings association an SLHC will incur in servicing both assets and laccount of embedded options; and valuation of deposits is based on savings association an SLHC-specific rates of existing accounts and the rates offered by the savings association on its deposits. Guidance also coand market risk monitoring and reporting, with a requirement for savings associations to reconcile and exptheir internal model results and those of the OTS NPV Model.5

EC 3 Principle 16: Interest rate risk in the banking book Criterion The supervisor requires that banks periodically perform appropriate stress tests to measure their vulnerabil

interest rate movements. 

Practices and Procedures 

U.S. federal banking agencies agree that the bank’s or holding company’s management should ensure that measured over a probable range of potential interest-rate changes, including meaningful stress situations. the scenarios used should be large enough to expose all of the meaningful sources of interest rate risk asso

holding company’s holdings. In developing appropriate scenarios, the agencies require that the bank’s or hmanagement consider the current level and term structure of rates and possible changes to that environmen

expected future volatility of market rates. At a minimum, the agencies have stated that scenarios should inplus or minus 200 basis point parallel shift in market rates for a one year time horizon. The OCC encouragimpact of both immediate and gradual changes in market rates as well as changes in the shape of the yield their risk exposure. 

5 See section 650 of OTS Examination Handbook and TB 13a, appendix B, sections C, D, and E. 
EC 3 Principle 16: Interest rate risk in the banking book 

The OTS requires savings associations to consider hypothetical interest rate scenarios of plus and minus 1points from the actual term structure observed at quarter-end. In addition, OTS encourages its savings asswith assets greater than $1 billion and/or using internal models, to conduct scenario analysis that considers the yield curve. OTS also suggests that stress tests should include “worst-case” scenarios in addition to mscenarios. Possible stress scenarios recommended by OTS include abrupt changes in the general level of ishifts in the yield curve); changes in the relationships among rates (i.e., basis risks); change in the slope of 

changes in the liquidity of key financial markets or changes in the volatility of market rates. For instrumenmay be difficult to liquidate or offset during stressful situations, OTS requires that the board and senior mareview the design and results of stress testing and that the savings association conducts appropriate conting

AC 1 Principle 16: Interest rate risk in the banking book Criterion The supervisor has the power to obtain from banks the results of their internal interest rate risk measureme

terms of the threat to economic value, including using a standardised interest rate shock on the banking bo

Practices and Procedures 

With the exception of the OTS, none of the U.S. federal banking agencies has a standard measure for inter

utilize the bank’s or holding company’s internal measures of risk, require sound risk-management practicescreens to identify those banks and holding companies that appear to be taking excessive risk. The agenciinclude maturity and repricing information on each bank’s investment, loan and deposit portfolios. Banks must also report the current fair value of their investment portfolios. At the largest banks and holding com

maintain on-site examination staffs who receive more detailed information on those banks’ and holding corisk exposures. During on-site examinations, supervisors review the bank’s or holding company’s internal 

reports and also evaluate whether the interest rate risk measurement system, structure and capabilities are a

assess the risk exposure, support the risk management process, and serve as a basis for internal limits and 

supervisory authority to review banks’ internal interest rate risk measurement systems is included in sectioDeposit Insurance Corporation Improvement Act of 1991 (FDICIA) which addresses risk-based capital starisk. Interest rate risk exposure estimates, whether linked to earnings or economic value, use some form of fore

possible changes in market interest rates. In conducting this analysis, supervisors confirm that a bank’s or 

interest rate risk measurement systems assess all material IRR associated with its assets, liabilities, and off

over an appropriate range of interest rate scenarios; use generally accepted financial concepts and risk-meahave well documented assumptions and parameters. As noted previously, OTS has an off-site regulatory model that helps to assess the level of IRR in the induassociations that appear to have excessive levels of risk. To help supervisory staff interpret results from th

developed a two-dimensional matrix that is used to quantify the level of IRR for each savings association. 

account a savings association’s pre-shock net portfolio value (i.e., pre-shock capital or net worth) and the d
AC 1 Principle 16: Interest rate risk in the banking book 

portfolio value is affected by an instantaneous, parallel shift in the yield curve of +/-200 bps. The matrix ithat a savings association with a higher level of pre-shock capital can afford to take on a higher level of int

with a lower level of pre-shock capital. The matrix has four interest-rate-risk categories: “Minimal”, “Mod

“High.” Supervisors are given the flexibility to use the results from the OTS NPV Model, or those from a 

internal model if such a model is deemed more appropriate. 

AC 2 Principle 16: Interest rate risk in the banking book Criterion The supervisor assesses whether the internal capital measurement systems of banks adequately capture the 

banking book. 

Practices and Procedures 

The Interagency Policy Statement on Interest Rate Risk states that the adequacy and effectiveness of a ban

interest rate risk management process and the level of its interest rate exposure are critical factors in an age

bank’s and holding company’s capital adequacy. A bank or holding company with material weaknesses in process or high levels of exposure relative to its capital will be directed by the appropriate agency to take cDepending on the facts and circumstances, such actions could include recommendations or directives to ra

strengthen management expertise, improve management information and measurement systems, reduce lev

combination thereof. See EC 1 for a further description of how the U.S. federal banking agencies evaluate compliance. 

AC 3 Principle 16: Interest rate risk in the banking book Criterion The supervisor requires stress tests to be based on reasonable worst case scenarios and to capture all mater

including a breakdown of critical assumptions. Senior management is required to consider these results wreviewing a bank’s policies, processes and limits for interest rate risk. 

Practices and Procedures 

U.S. federal banking agencies view stress testing as an important tool for banks and holding companies to monitor, and control their interest rate risk exposure and assess a bank’s or holding company’s stress test mexaminations. While the formality of a bank’s or holding company’s stress testing regime will vary, based complexity, U.S. federal banking supervisors evaluate that the stress scenarios used should be large enoug

sources of IRR associated with a bank’s or holding company’s holdings. Supervisors also confirm that in scenarios, banks and holding companies consider a number of factors including the level and shape of the incorporate sufficiently wide changes in market interest rates and/or yield curve shifts. In addition, banks should employ assumptions about customer behavior and new business activity that are reasonable and conscenario that is evaluated. In particular, banks and holding companies should measure how the maturity, rinstruments with embedded options may change under the various stress scenarios. Supervisors confirm th
AC 3 Principle 16: Interest rate risk in the banking book 

include loans that can be prepaid without penalty prior to maturity or have limits on the coupon adjustmenunspecified maturities or rights of early withdrawal. Stress tests should be designed to identify particular vand holding company under certain conditions. Supervisors confirm that senior management and the board periodically review stress test results in order t

the implications of various stress scenarios including the reasonableness and sensitivity to key assumptionreview that the stress test results be used as a mechanism to facilitate the review of the bank’s or holding c

and limits and provide the basis needed to implement strategies to mitigate the identified risk exposure and tolerances. 

AC 4 Principle 16: Interest rate risk in the banking book Criterion The supervisor requires banks to assign responsibility for interest rate risk management to individuals inde

reporting lines separate from those responsible for trading and/or other risk-taking activities. In the absencmanagement function that covers interest rate risk, the supervisor requires the bank to ensure that there is a 

mitigate a possible conflict of interest for managers with both risk management and risk-taking responsibil

Practices and Procedures 

U.S. federal banking agencies believe that effective oversight by senior management and the board is critic

process and evaluate this oversight during on-site examinations. U.S. federal banking supervisors confirm and the board establish clear lines of authority, responsibilities, and risk limits, and ensure that adequate re

support the risk monitoring, audit, and control functions. For example, supervisors confirm that the personrisk monitoring and control functions are independent from the persons or units that create the risk exposumay be part of a more general operations, audit, compliance, risk management, or treasury unit. If the risk 

functions are part of a treasury unit that also has the responsibility and authority to execute investment or h

manage the bank’s or holding company’s risk exposure, supervisors confirm that the bank or holding comp

audit and control function and sufficient safeguards in place. 
Principle 17: Internal control and audit

Supervisors must be satisfied that banks have in place internal controls that are adequate for the size and complexity of their binclude clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and approaudit and compliance functions to test adherence to these controls as well as applicable laws and regulations. Overview The effectiveness of internal controls, information systems, and audits is essential to a bank’s and holding company’s ability tand other legal requirements. The safety-and-soundness provision of the FDI Act explicitly requires the U.S. federal banking 

standards relating to internal controls, information systems, and audits. Refer to section 39 of the FDI Act, codified as 12 U.S

Furthermore, section 112 of the FDIC Improvement Act (FDICIA) added section 36 of the FDI Act to provide greater specificsection 39, and these must conform with statutory requirements concerning (a) the submission of annual reports; (b) the subm

statements with appropriate attestations by management regarding the effectiveness of internal controls and legal compliance, an evaluation and attestation regarding the effectiveness of internal controls by an independent public accountant meeting certstandards; (d) an annual independent audit of the bank’s and holding company’s financial statements, prepared by an independmeeting certain qualification standards, in accordance with generally accepted accounting and auditing principles; (e) the esta

independence of, and reporting to, an internal audit committee by larger banks and holding companies; and (f) the sharing of iauditors and supervisors. See 12 U.S.C. § 1831m. In general, smaller banks and holding companies s (i.e., those with total asless) are exempt from these specific requirements but still must adhere to the general requirements of the safety-and-soundnesestablishment of internal controls, information systems, and audits. With respect to audited financial statements, section 36 orequires audited financial statements for banks and holding companies with $500 million or more in assets. In addition, at tho

billion in assets management must sign off on the adequacy of internal controls over financial reporting. The interagency safety-and-soundness guidelines implement the foregoing requirements. See12 CFR 208, appendix D-1, § IIappendix A, § II(A) and (B). They specify that a bank and holding company should have internal controls and information syto the size of the bank and holding company and the nature, scope, and risk of its activities and that provide for (a) an organizestablishes clear lines of authority and responsibility for monitoring adherence to established policies; (b) effective risk assessaccurate financial, operational and regulatory reports; (d) adequate procedures to safeguard and manage assets; and (e) compli

and regulations. A bank and holding company also should have an internal audit system that is appropriate to the size of the b

and the nature and scope of its activities and that provides for (a) adequate monitoring of the system of internal controls throu

function (or, in the case of smaller or noncomplex banks and holding companies, a system of independent reviews of key inte

independence and objectivity; (c) qualified persons; (d) adequate testing and review of information systems; (e) adequate docu
Principle 17: Internal control and audit

findings and any corrective actions; (f) verification and review of management actions to address material weaknesses; and (gholding company’s audit committee or board of directors of the effectiveness of the internal audit systems. The agencies have 

guidance elaborating on these requirements. See “Interagency Policy Statement on the Internal Audit Function and its Outsou

These policies align with BCBS‘s documents Framework for internal control systems in banking organisations, September 19

banks and the supervisor’s relationship with auditors, August 2001; and Compliance and the compliance function in banks, AThe OTS requires an independent audit for safety and soundness purposes of any SLHC that controls a savings association suconsolidated assets of $500 million or more2 and of any savings association with a composite CAMELS rating of 3, 4, or 5. S

safety and soundness purposes, OTS may also require, at any time, an independent audit of the financial statements of, or the agreed upon by the OTS to a savings association, SLHC, or affiliate. See 12 CFR 562.4(a). Additional audit requirements are set forth for national banks and federal savings associations acting in a fiduciary capacity. S

banks); 12 CFR 550.440-480 (federal savings associations). As discussed under Principle 3, ECs 3 and 9, the effectiveness of internal controls, information systems, and audits is evaluategrantings of banks and holding companies and as part of the supervisory process3. If an agency determines that a bank or hol

any safety or soundness standard established under the interagency guidelines, the agency may require the bank and holding cacceptable plan to achieve compliance. In the event that a bank or holding company fails to submit an acceptable plan within in any material respect to implement an accepted plan, the agency must order the bank or holding company to correct the defi

and in some cases must, take other supervisory actions until the deficiency is corrected. See 12 U.S.C. § 1831p-1(e). 

Since the enactment in 2002 of the Sarbanes-Oxley Act (the Act),4 the federal securities laws have established internal contro

for internal controls over financial reporting for companies, including banks, savings associations, and their holding companieregistered under the Securities Exchange Act of 1934, 15 U.S.C. §§ 78c et seq., (“public companies”).5 Section 301 of the Ac

requires that all members of the audit committee of a public company must be independent and also subjects them to other reqcommittee must establish procedures to handle complaints regarding accounting matters that are received by the public compa

1 See Federal Reserve SR letter 03-5; OCC Bulletin 2003-12; FDIC FIL-21-2003; and OTS Thrift Bulletin 81. 2 SLHC report H-(b)(11) requires audited financial statements. 3 Each agency’s examination manual includes procedures to evaluate internal controls and audit. See, for example, OCC Comptroller’s 

FFIEC IT Handbook. 

4 Pub. L. No. 107-204, 116 Stat. 745 (2002). 5 As a general matter, the U.S. federal banking supervisors apply the SEC’s regulations implementing the Sarbanes-Oxley Act to banks 

and enforce the Act with respect to banks. See 15 U.S.C. § 78l(i). (The SEC has enforcement authority with respect to holding compan
Principle 17: Internal control and audit

employees, or the company’s securities may be delisted from securities exchanges. Id. Section 302 of the Act, 15 U.S.C. § 72principal executive and financial officers of a public company to make certain representations about the veracity and accuracy reports. Section 404 of the Sarbanes-Oxley Act, 15 U.S.C. § 7262(b), requires an auditor of a public company annually to reneffectiveness of the company’s internal controls over financial reporting. Pursuant to section 406 of the Act, 15 U.S.C. § 7264

disclose in its periodic reports if it has adopted a code of ethics for senior financial officers and, if not, why not. In addition to creating a new registration requirement for auditors of public companies, the Act established requirements desig

independence of auditors from the public companies that they audit. A registered auditor cannot perform certain specific non

company. Also, a registered auditor cannot provide services for a public company if the lead audit partner has performed such 

last five years. In addition, the registered auditor must report certain information to the audit committee concerning the comp

and practices. Finally, a registered auditor cannot perform audit services for a public company if the auditor employed certain 

management during the previous year. 15 U.S.C. § 78j-1. Through FDIC guidelines, these independence requirements may be applied to an independent public accountant who audits a under the banking laws to have an annual independent audit, or to the auditor of its holding company if the bank satisfies the r

independent audit at the holding company level. See 12 CFR Part 363, appendix A, ¶ 14. The “Interagency Policy Statement on the Internal Audit Function and Its Outsourcing” (March 17, 2003) encouraged banks a

are neither subject to Section 36 of the FDI Act nor the Sarbanes-Oxley Act auditor independence requirements not to use theperform internal audit services.6

EC 1 Principle 17: Internal control and audit Criterion Laws, regulations or the supervisor establish the responsibilities of the Board and senior management with 

governance to ensure that there is effective control over a bank’s entire business. 

Legal Framework 

Together, the authorities cited in the overview to this principle and under risk management and risk-specif16) provide for the establishment of a general corporate governance framework for banks and holding com

6 See Federal Reserve SR letter 03-5; OCC Bulletin 2003-12; FDIC FIL-21-2003; and OTS Thrift Bulletin 81. 
EC 1 Principle 17: Internal control and audit 

specifics of implementation largely are left to the individual organizations to decide, at a minimum, the fraand holding companies to have clearly established responsibilities for board members and senior managemcorporate governance to ensure that there is effective control over a bank’s and holding company’s entire b

Practices and Procedures 

U.S. federal banking agencies establish expectations of boards of directors and senior management through 

through various interagency statements, including those referred to below. The level of technical knowledmay vary depending on the size and complexity of the bank and holding company. Specifically, boards of banks and holding companies are obligated to discharge the duties owed to their bank and holding compan

and creditors of their organizations, and to comply with federal and state statutes, rules and regulations. T

duties of loyalty and care. Directors have ultimate responsibility for the level of risk taken by their bank omeans that directors are responsible for selecting, monitoring, and evaluating competent management; estastrategies and policies; monitoring and assessing the progress of business operations; establishing and mon

policies; and for making business decisions on the basis of fully informed and meaningful deliberation. Dmanagement oversight of the enterprise-wide compliance program, including approval of risk-managemenof internal processes, is essential. See “Interagency Statement on Application of Recent Corporate GovernPublic Banking Organizations” (May 2003)7, “Amended Interagency Guidance on the Internal Audit Func

(April 2003)8, “Interagency Statement on Sound Practices Concerning Elevated Risk Complex Structured 

(January 2007)9, FDIC “Statement of Policy Concerning the Responsibilities of Bank Directors and Office

There are also separate requirements for boards of directors and audit committees of banks under the FDI Aimplementing regulation and guidance. FDIC insured banks with assets of $1 billion or more, as of the beare required to opine on their Internal Controls Over Financial Reporting (ICOFR) and have an audit commoutside directors who are independent of management of the bank. The audit committee of banks with assbillion, measured as of the beginning of each fiscal year, must include members with banking or related finexpertise, have access to its own outside counsel, and not include any large customers of the bank. If a lara holding company and relies on the audit committee of the holding company to comply with this rule, the committee shall not include any members who are large customers of the subsidiary bank.10 In addition, s

documentation that banks and holding companies produce for internal control reviews under section 404 odetermine whether there are any material weaknesses or significant deficiencies that should be followed up 

7 See Federal Reserve SR letter 03-8; OCC Bulletin 2003-21; FDIC FIL-17-2003; and OTS CEO Memorandum 174. 8 See Federal Reserve SR letter 03-5; OCC Bulletin 2003-12; FDIC FIL-21-2003; and OTS Thrift Bulletin 81. 9 See Federal Reserve SR letter 07-5; OCC Bulletin 2007-1; FDIC p. 5369 “Pocket Guide Directors” (1988) 10 See FDIC FIL-119-2005 
EC 1 Principle 17: Internal control and audit 

examination work. The following formal enforcement actions serve as examples of the banking agencies’ authority to direct, w

governance, effective control over a bank’s and holding company’s entire business. 

• Southern Bank of Commerce – Written Agreement dated December 21, 2007, requiring a written b

improve the bank’s condition and maintain effective control over, and supervision of, the bank’s semajor operations and activities. /www.federalreserve.gov/newsevents/press/enforcement/20080108a.htm

• Commerce Bank/Harrisbury, N.A. – Formal Agreement dated January 29, 2007, requiring an indep

board supervisory study focusing in risk management, internal audit, consumer and BSA complianhttp://www.occ.treas.gov/FTP/EAs/ea2007-008.pdf

EC 2 Principle 17: Internal control and audit Criterion The supervisor determines that banks have in place internal controls that are adequate for the nature a

These controls are the responsibility of the Board and/or senior management and deal with organizatipolicies and processes, checks and balances, and the safeguarding of assets and investments. More saddress: 

• Organizational structure: definitions of duties and responsibilities, including clear delegation of au

loan approval limits), decision-making policies and processes, separation of critical functionorigination, payments, reconciliation, risk management, accounting, audit and compliance). 

• Accounting policies and processes: reconciliation of accounts, control lists, information for manag• Checks and balances (or “four eyes principle”): segregation of duties, cross-checking, dual 

signatures. 

• Safeguarding assets and investments: including physical control.
EC 2 Principle 17: Internal control and audit 

Legal Framework 

As noted in the overview to this principle in EC 1 above, the U.S. federal banking agencies assess adequaccompany’s corporate governance framework at granting charters and as part of the supervisory process. 

Practices and Procedures 

U.S. federal banking agencies evaluate the adequacy of bank’s and holding company’s internal controls du

on- and off-site periodic monitoring and supervisory activities, and through various surveillance activities. 

activities, supervisors determine that banks and holding companies have in place internal controls that are and scale of their business. When evaluating the adequacy of a bank’s and holding company’s internal conprocedures, supervisors consider whether 

• The system of internal controls is appropriate to the type and level of risks posed by the nature and 

holding company’s activities. 

• The organizational structure of the bank and holding company establishes clear lines of authority a

monitoring adherence to policies, procedures, and limits. 

• Reporting lines for the control areas are independent from the business lines, and there is adequate 

throughout—such as duties relating to accounting, trading, custodial, and back-office activities. 

• Official organizational structures reflect actual operating practices. • Financial, operational, and regulatory reports are reliable, accurate, and timely, and, when applicab

and promptly investigated. 

• Adequate procedures exist for ensuring compliance with applicable laws and regulations. • Internal audit or other control-review practices provide for independence and objectivity. • Internal controls and information systems are adequately tested and reviewed. The coverage of, p

and responses to audits and review tests are adequately documented. Identified material weaknessand timely high-level attention, and management’s actions to address material weaknesses are timverified and reviewed. 

• The bank’s and holding company’s audit committee or the board of directors reviews the effective

other control-review activities. 

Supervisors will also assess the risks inherent in the bank and/or holding company, and the risk mitigants 

ongoing examination processes. See Amended “Interagency Guidance on the Internal Audit Function and its Outsourcing,” pp. 2 - 3; Fede

section 1010, and SR letter 95-51; OCC Internal Control, Internal and External Audit, and Bank Supervisi

OCC’s Handbook series; FDIC Risk Management Manual of Examination Policies, section 4.2; and OTS E

U.S. federal banking agencies assess a bank’s and holding company’s compliance with the Interagency PoInternal Audit Function and Its Outsourcing (see EC 1). Also, supervisors determine the quality and reliab
EC 2 Principle 17: Internal control and audit 

holding company’s policies, procedures, and processes with respect to internal control functions and reach 

the internal control system. During targeted examinations of specific product areas within the bank and ho

of an annual review, supervisors evaluate the adequacy of internal control. When supervisors determine thinternal audit is effective, they will leverage off that work to evaluate the effectiveness of internal control. 

Section 404 (b) of the Sarbanes-Oxley Act, 15 U.S.C. § 7262(b), requires auditors of public companies to on the effectiveness of the entity’s internal controls over financial reporting. Under section 36 of the FDI 

& (c), management of nonpublic banks with $1 billion or more in total assets must annually assess the effecontrol over financial reporting as of year-end and have the bank’s and holding company’s independent aumanagement’s assertion concerning internal control. See 12 CFR 363.2(b), 363.3(b), & appendix A (FDICregulation). Supervisors review these reports as well as the list of weaknesses or deficiencies from auditorSarbanes-Oxley to determine where control weaknesses exist and whether management is addressing these manner. The following formal enforcement actions serve as examples of the agencies’ authority to direct the impleminternal controls: 

• The Bank of New York, Written Agreement dated April 21, 2006, requiring an assessment of the e

control infrastructure, governance, organizational structure, and business line accountability. www.federalreserve.gov/newsevents/press/enforcement/20060424a.htm

• Asian Financial Corporation and Asian Bank, Cease and Desist Order dated March 3, 2006, requir

policies and procedures designed to strengthen and maintain the bank’s internal controls.

www.federalreserve.gov/newsevents/press/enforcement/20060308a.htm

• Commerce Bank, N.A., Cease and Desist Order dated June 28, 2007, requiring a plan to address d

and board structure. www.occ.treas.gov/FTP/EAs/ea2007-065.pdf

EC 3 Principle 17: Internal control and audit Criterion Laws, regulations or the supervisor place the responsibility for the control environment on the Board and s

bank. The supervisor requires that the Board and senior management understand the underlying risks in thcommitted to a strong control environment. 

Legal Several statutory and regulatory provisions, including those governing safety and soundness, external audi
EC 3 Principle 17: Internal control and audit 

Framework certification of financial statements, capital adequacy, and remedial powers of the agencies, make clear tha

and management ultimately are responsible for the control environment of the bank and/or holding compaand supervisory standards require that board and senior management understand the underlying risks in thecommitted to a strong control environment. 

Practices and Procedures 

U.S. federal banking agencies also place responsibility for the control environment through supervisory gu

indicates that the effective functioning of the internal control process, including the control environment, ractivities, information and communication, and monitoring activities is the responsibility of the bank’s or hof directors, management, and other personnel. Supervisory guidance also indicates that an effective contr

commitment by the board of directors and senior management to strong controls, and that the board of dire

responsible for establishing and maintaining effective internal control that meets statutory and regulatory rto changes in the organization’s environment and conditions. See FDIC Risk Management Manual of Exa

4.2; OCC Internal Control, and Duties and Responsibilities of Directors booklets of the Comptroller's Han

Soundness series) and “The Director’s Book – The Role of a National Bank Director” (at www.occ.gov/diReserve CBEM, section 1010, and CA letter 06-8; and OTS Examination Handbook, section 310. 

EC 4 Principle 17: Internal control and audit Criterion The supervisor has the power to require changes in the composition of the Board and senior management t

concerns related to the satisfaction of these criteria. 

Legal Framework 

As part of their remedial powers, U.S. federal banking agencies may limit the powers of institution-affiliatdirectors and management) when an unsafe or unsound violation or practice exists. See 12 U.S.C. § 1818(have the power, under certain well-defined circumstances, to prohibit an IAP from participating in the affacompany. See 12 U.S.C. § 1818(e). In some instances, this prohibition may extend industry-wide. Id. § 1

supervisors try to address deficiencies in the composition of the board or management by less formal mean

effort to resolve prudential concerns. 
EC 5 Principle 17: Internal control and audit 

Criterion The supervisor determines that there is an appropriate balance in the skills and resources of the back office 

relative to the front office/business origination. 

Legal Framework 

As noted in the overview to this principle, the U.S. federal banking agencies assess the adequacy of a bankcorporate governance framework, including the competence and qualifications of its employees, at licensinsupervisory process. 

Practices and Procedures 

As part of on-site examinations, on- and off-site periodic monitoring and supervisory activities, and variou

supervisors evaluate a bank’s and holding company’s internal control functions when assessing the control of the bank and holding company as a whole and for specific activities and operations. Supervisors coordicontrol with the reviews of other areas of the bank and holding company (e.g., credit, capital markets, com

systems) as a cross-check of the bank’s and holding company’s compliance and process integrity. Supervi

reviews of control monitoring functions such as internal audit. If internal audit is effective, supervisors lev

risk-focused examinations. Supervisors regularly conduct targeted reviews of high risk areas such as tradi

effective controls, including segregation of duties, are in place. Supervisory guidance cautions supervisors 

that adverse circumstances may exist (such as inappropriate balance of skills and resources between opera

functions) when reviewing internal controls. Supervisors evaluate the competency and skills of personnel 

control functions and the adequacy of resources the bank and holding company has available to effectively 

objectives. See OCC Comptroller’s Handbook series; Federal Reserve CBEM, section 1010; FDIC Risk M

Examination Policies, sections 4.2.; and OTS Examination Handbook, section 340. 

EC 6 Principle 17: Internal control and audit Criterion The supervisor determines that banks have a permanent compliance function that assists senior manageme

the compliance risks faced by the bank. The compliance function must be independent of the business acti

supervisor determines that the Board exercises oversight of the management of the compliance function. 

Legal Framework 

As noted in the overview to this principle in EC 1 above, the interagency safety-and-soundness guidelines with applicable laws and regulations, including the agencies’ authority to assess the adequacy of a bank’s 

compliance function. In addition to these general guidelines, under the agencies’ Bank Secrecy Act (BSA) regulations, every ba

compliance program. (See 12 CFR 21.21) 

Practices and Procedures 

U.S. federal banking agencies’ guidance and examination procedures direct supervisors to determine whet

company have an effective compliance function. Supervisors confirm that the compliance function is inde
EC 6 Principle 17: Internal control and audit 

holding company’s business activities and has controls commensurate with the bank’s and holding compan

The guidance also indicates that the bank’s and holding company’s board of directors is ultimately responsadministering a compliance management system that ensures compliance with laws and regulations. Supeboard of directors and management establish and maintain an effective compliance management system in• demonstrating clear and unequivocal expectations about compliance; • adopting clear policy statements; • appointing a compliance officer with authority and accountability; • allocating resources to compliance functions commensurate with the level and complexity of the bank’s a

operations (e.g., sufficient to address compliance in specialty areas such as leverage leasing, insurance and • conducting periodic compliance audits; 

• ensuring that business lines have appropriate personnel with compliance expertise; and 

• providing for recurrent reports by the compliance officer. See FDIC [Compliance Handbook and Risk Management Manual of Examination Policies, section 4.2]; Fe

Compliance Handbook, CBEM sections 1000 and 2115.1, and CA letter 06-8]; OCC [Compliance Managethe Comptroller’s Compliance Handbook series and Internal Control booklet]; and OTS [Examination Ha

The following serve as an example of the agencies’ authority to direct the implementation of an adequate c

• The Bank of New York – Written Agreement dated April 21, 2006, requiring an assessment of the 

training of the bank’s senior management responsible for implementing and overseeing the compliwww.federalreserve.gov/newsevents/press/enforcement/20060424a.htm

• Old National Bank – Civil Money Penalty issued for flood insurance related violations. 

www.occ.treas.gov/FTP/EAs/ea2008-111.pdf

EC 7 Principle 17: Internal control and audit Criterion The supervisor determines that banks have an independent, permanent and effective internal audit function 

that policies and processes are complied with and (ii) reviewing whether the existing policies, processes ansufficient and appropriate for the bank’s business. 
EC 7 Principle 17: Internal control and audit 

Legal Framework 

As noted in the overview to this principle in EC 1 above, the interagency safety-and-soundness guidelines

contemplate that most banks and holding companies will establish a permanent internal audit unit responsicompliance with policies and procedures and (b) assessing the continued adequacy of the policies and proc

Practices and Procedures 

As noted in the “Interagency Guidance on Internal Audit and its Outsourcing,” each bank’s and holding co

and management must consider the type of internal audit oversight that is necessary to ensure that internal 

While the benefits of a full-time audit function will largely outweigh the costs at a large bank or holding coutweigh the benefits at smaller ones. Small banks and holding companies should still have a comprehens

internal controls by an independent party. Supervisors determine the adequacy of the internal audit function through their ongoing supervisory activisuggests annual evaluation of changes to Internal Audit through periodic monitoring and a full scope reviethree years, particularly at large complex banks and holding companies. Supervisors assess the quality and 

holding company’s internal audit function, regardless of whether it is performed by the bank’s and holding 

by an outsourcing vendor. Specifically, supervisors consider whether 

• The internal audit function’s control risk assessment, audit plans, and audit programs are appropriate fo

company’s activities; 

• The internal audit activities have been adjusted for significant changes in the bank’s and holding compa

structure, activities, risk exposures, or systems; 

• The internal audit activities are consistent with the long-range goals and strategic direction of the bank 

are responsive to its internal control needs; 

• The internal audit manager’s impartiality and independence is promoted by having him or her directly r

audit committee; 

• The internal audit manager is placed in the management structure in such a way that the independence 

impaired; 

• The bank and holding company have promptly responded to significant identified internal control weak

• The internal audit function is adequately managed to ensure that audit plans are met, programs are carri

audits are promptly communicated to senior management and members of the audit committee and boa

• Workpapers adequately document the internal audit work performed and support the audit reports; • Management and the board of directors use reasonable standards, such as the Institute of Internal Audit

the Professional Practice of Internal Auditing, when assessing the performance of internal audit; and 

• The audit function provides high-quality advice and counsel to management and the board of directors 

in risk management, internal control, and regulatory compliance. 
EC 7 Principle 17: Internal control and audit 

Supervisors also assess the competence of the bank’s and holding company’s internal audit staff and manaeducation, professional background, and experience of the principal internal auditors. See Federal Reserve 

section 1010 of the CBEM; and section 2060 of the BHC Supervision Manual]; OCC [Internal Audit and 

the Comptroller’s Handbook – Safety & Soundness, Objective 6]; FDIC [Risk Management Manual of Exa

4.2]; and OTS [Examination Handbook, section 355]. The following outstanding formal enforcement actions serve as examples of the agencies’ authority to dire

an adequate internal function. 

• Bank of New York – Cease and Desist Order dated August 14, 2006, requiring submission of an a

audit program. 

• Asian Financial Corporation and Asian Bank – Cease and Desist Order dated March 3, 2006, requ

acceptable written internal audit policies and procedures.www.federalreserve.gov/newsevents/press/enforcement/20060308a.htm

EC 8 Principle 17: Internal control and audit Criterion The supervisor determines that the internal audit function: 

• has sufficient resources, and staff that are suitably trained and have relevant experience to un

business they are auditing; 

• has appropriate independence, including reporting lines to the Board and status within the b

management reacts to and acts upon its recommendations; 

• has full access to and communication with any member of staff as well as full access to records, f

its affiliates, whenever relevant to the performance of its duties; 

• employs a methodology that identifies the material risks run by the bank; • prepares an audit plan based on its own risk assessment and allocates its resources accordingly; an• has the authority to assess any outsourced functions.

Legal Framework 

As noted in the overview to this principle in EC 1 above, the supervisory assessment of the adequacy of a company’s internal audit function, including the competence and qualifications of its employees, is encom

safety-and-soundness guidelines and is determined as part of the supervisory process. 
EC 8 Principle 17: Internal control and audit 

Practices and Procedures 

In addition to supervisory guidance, U.S. federal banking supervisors also use industry standards (e.g., tho

Internal Auditors (IIA)) to assess the adequacy of their work against these standards. The scope of periodiindependence and competency, the role of the Board and Audit Committee, the identification of the audit uand risk assessment methodology, audit’s plans, audit work including work papers and sampling methodolratings, follow-up of audit issues, and audit’s interaction with management. 

See response to EC 7. In addition, the “Interagency Policy Statement on the Internal Audit Function and I

instructs supervisors to perform additional steps when reviewing outsourcing arrangements. Supervisors awhether: 

• The arrangement maintains or improves the quality of the internal audit function and the bank’s and h

control; • Key employees of the bank and holding company and the outsourcing vendor clearly understand the 

and how any internal control problems or other matters noted by the outsourcing vendor are to be addr• The scope of the outsourced work is revised appropriately when the bank’s and holding company’s eactivities, risk exposures, or systems change significantly; • The directors have ensured that the outsourced internal audit activities are effectively managed by the company; • The arrangement with the outsourcing vendor satisfies the independence standards described in this p

thereby preserves the independence of the internal audit function, whether or not the vendor is also th

company’s independent public accountant; and 

• The bank and holding company has performed sufficient due diligence to satisfy itself of the vendor’

entering into the outsourcing arrangement and has adequate procedures for ensuring that the vendor expertise to perform effectively throughout the arrangement.

AC 1 Principle 17: Internal control and audit Criterion In those countries with a unicameral Board structure (as opposed to a bicameral structure with a Superviso

Management Board), the supervisor requires the Board to include a number of experienced non-executive 

Legal Framework 

For banks and holding companies with total assets of $1 billion or more, the audit committee must be com

non-executive directors. For banks and holding companies with total assets of $500 million or more but le

majority of audit committee members must be outside, non-executive directors, subject to case-by-case exsupervisors. See 12 U.S.C. § 1831m(g); and 12 CFR 363.5. For banks and holding companies with total a
AC 1 Principle 17: Internal control and audit 

billion, the audit committee members must (a) have banking or related financial management expertise; (b

committee’s own outside counsel; and (c) not be a large customer of the bank or holding company. Id. Fo

Sarbanes-Oxley Act requires each member of the audit committee to be independent of the issuer. See 15 Sarbanes-Oxley Act also requires public companies to disclose in their periodic reports whether there is at on the audit committee and, if not, why not. See 15 U.S.C. § 7265. 

Practices and Procedures 

For public companies, the Sarbanes-Oxley Act requires each member of the audit committee to be indepen

and holding companies subject to section 36 of the FDI Act and part 363 of the FDIC’s regulations are reqindependent audit committees. This committee is to be established consisting of outside directors who are 

management. The independent audit committee’s duties include reviewing with management and the inde

the basis for the all financial reports issued. The U.S. federal banking agencies may, by order or regulationaudit committee of a bank and a holding company to be made up of less than all, but no less than a majoritFurther, SEC rules require each member of the audit committee to be financially literate; as such qualificat

bank’s and holding company’s board of directors in its business judgment. FDIC rules require audit commbank and holding company that has total assets of more than $3 billion, measured as of the beginning of ea

members with banking or related financial management expertise.

AC 2 Principle 17: Internal control and audit Criterion The supervisor requires the internal audit function to report to an audit committee, or an equivalent structuLegal Framework 

For public companies, Sarbanes-Oxley Act of 2002 defines the scope of the audit committee’s duties to inaccounting and financial reporting processes of the issuer and audits of the financial statements of the issu

includes internal audit). See 15 U.S.C. §7201. 

Practices and Procedures 

U.S. federal banking agencies assess compliance against “The Interagency Policy Statement on the Interna

Outsourcing” which requires the internal audit function to be positioned so that the board has confidence tfunction will perform its duties with impartiality and not be unduly influenced by managers of day-to-day 

committee, using objective criteria it has established, is required to oversee the internal audit function and 

(See Federal Reserve SR letter 03-5, p. 3; OCC Bulletin 2003-12; FDIC FIL-21-2003; and OTS Examinati355.) In addition, supervisors evaluate internal audit functions against IIA standards which recommend a 

Committee. Supervisors confirm the internal audit function reporting line during on-site examinations by chart as well as review of audit committee meeting minutes and through discussions with the internal audi
AC 3 Principle 17: Internal control and audit 

Criterion In those countries with a unicameral Board structure, the supervisor requires the audit committee to includ

executive directors. 

Legal Framework 

For banks and holding companies with total assets of $1 billion or more, the audit committee must be com

non-executive directors. For banks and holding companies with total assets of $500 million or more but le

majority of audit committee members must be outside, non-executive directors, subject to case-by-case exsupervisors. See 12 U.S.C. § 1831m(g); 12 CFR 363.5. For banks and holding companies with total asset

the audit committee members must (a) have banking or related financial management expertise; (b) have a

own outside counsel; and (c) not be a large customer of the bank or holding company. Id. For public comp

Act requires each member of the audit committee to be independent of the issuer, subject to case-by-case eSEC. See 15 U.S.C. § 78j-1. The Sarbanes-Oxley Act also requires public companies to disclose in their p

there is at least one financial expert on the audit committee and, if not, why not. See 15 U.S.C. § 7265. 

Practices and Procedures 

For public companies, the Sarbanes-Oxley Act requires each member of the audit committee to be indepen

to case-by-case exemptions granted by the SEC. The Sarbanes-Oxley Act also requires public companies 

periodic reports whether there is at least one financial expert on the audit committee and, if not, why not. 

Banks subject to section 36 of the FDI Act and part 363 of the FDIC’s regulations are required to maintain committees. For banks and holding companies with total assets of $1 billion or more, this committee is to 

entirely of outside directors who are independent of management. For those with total assets of $500 milli

$1 billion, the majority of audit committee members must be outside directors who are independent of manby-case exceptions granted by supervisors. The independent audit committee’s duties include reviewing windependent public accountant the basis for the all financial reports issued by the bank or holding companyAC 1 for additional requirements. 

AC 4 Principle 17: Internal control and audit Criterion Laws or regulations provide, or the supervisor ensures, that banks must notify the supervisor as soon as the

material information which may negatively affect the fitness and propriety of a Board member or a membe

Legal Framework 

Certain laws and regulations require the bank and holding company to notify the supervisor when they bec

information that may indicate that a board member or member of senior management is unfit for service. Factivity reports are required to be filed for any instances of known or suspected illegal or suspicious activitboard members and senior management. [See 31 U.S.C. § 5318(g); 12 CFR 208.62, 12 CFR 211.24(f), an

(Federal Reserve); 12 CFR 353 (FDIC); 12 CFR 21.11 (OCC); and 12 CFR 563.180 (OTS)]. 

Practices and Procedures 

U.S. federal banking agencies expect that notification would be given of any circumstance involving a boamember that has the potential to impact the safety or soundness of the bank or holding company. 

Principle 18: Abuse of financial servicesSupervisors must be satisfied that banks have adequate policies and processes in place, including strict “know-your-customer” ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionallOverview Various statutes and regulations require the U.S. federal banking agencies to issue regulations and conduct periodic examinati

compliance by banks and holding companies with anti-money-laundering (AML) and suspicious activity reporting laws and r

agencies have authority to take enforcement actions, including cease and desist orders and civil money penalties. The agencieinstitutions they supervise have adequate policies and procedures in place and comply with applicable laws and regulations to 

and holding companies for criminal purposes, including fraud, money laundering, and terrorist financing. For example, under 

agencies are required to and have prescribed regulations requiring banks that they supervise to establish and maintain proceduassure and monitor an institution’s compliance with the requirements of the Bank Secrecy Act (BSA), 31 U.S.C. §5311 et seq

§1951 – 1959, an AML and counter terrorist financing (CFT) statute. The agencies and the Department of the Treasury (TreaFinancial Crimes Enforcement Network (FinCEN), have also issued regulations requiring financial institutions to establish anprocedures for verifying the identity of each customer. See 12 CFR 21.21(b)(2) (OCC); 208.63(b)(2), 211.5(m)(2), 211.24(j)(326.8(b)(2) (FDIC); 563.177(b)(2) (OTS) 31 CFR 103.121 (FinCEN). Each of the agencies has issued regulations that set forbanks under its supervision to establish and maintain procedures to ensure and monitor their compliance with the BSA (the “B

Program”). See 12 CFR 208.63, 211.24(j)(1), 211.5(m)(1) (Federal Reserve); 326.8 (FDIC); 21.21 (OCC); and 563.177 (OT

strong BSA/AML Compliance Program is the adoption and implementation of comprehensive customer due diligence (know-procedures, and processes for all customers. Under statutory and regulatory authority and using an interagency BSA/AML ex

interagency statement on enforcement, the agencies examine banks and holding companies for BSA/AML compliance and tak

address non-compliance. See 12 U.S.C. § 1818(s)(2); Federal Financial Institutions Examination Council (FFIEC) Bank SecLaundering Examination Manual; and “Interagency Statement on Enforcement of Bank Secrecy Act/Anti-Money Laundering 

2007). The agencies have traditionally supported the Basel Committee’s efforts to provide guidance through the issuance of dPrevention of criminal use of the banking system for the purpose of money-laundering, December 1988; Customer due diligen

2001; Shell banks and booking offices, January 2003; Consolidated KYC risk management, October 2004; FATF 40 + IX, 200

Methodology, 2004, as updated; and Due diligence and transparency regarding cover payment messages related to cross-bord2009. 

The agencies and Treasury have also issued regulations requiring banks and holding companies to file suspicious activity repoknown or suspected criminal violations or suspicious transactions with the agencies, federal law enforcement authorities, and 21.11 (OCC); 208.62, 211.5(k), 211.24(f), 225.4(f) (Federal Reserve); 353 (FDIC); 563.180(d) (OTS); 31 CFR 103.18 (FinCE90-22.47). BHCs (12 CFR 225.4(f)) and certain SLHCs and their nondepository subsidiaries are required to file SARs pursua

(e.g., insurance companies, 31 CFR 103.16, and broker/dealers, 31 CFR 103.19). In addition, SLHCs, if not required, are stroSARs in appropriate circumstances. Effective customer due diligence policies, procedures, and processes provide the critical 

banks and holding companies to comply with regulatory requirements and to report suspicious activity. The agencies and Treasury may take enforcement actions against banks and holding companies to address significant failures 
Principle 18: Abuse of financial servicesactivity reporting and other recordkeeping and reporting requirements, and in cases where noncompliance indicates possible c

may be referred to the U.S. Department of Justice (DOJ). The agencies also supervise to ensure compliance with U.S. economic and trade sanctions, administered by the Treasury DepaAssets Control (OFAC). See 31 CFR 500 et seq. OFAC has civil monetary penalty authority, and OFAC violations may resu

imposed by the DOJ. Other agencies have enforcement authority with respect to certain conduct that results in abuse of financial services. For examCommission (FTC) may take action against non-depository organizations involved in fraud that harms consumers. The Commadministers and enforces certain export restrictions and violations of such restrictions may result in penalties. Finally, any conorganization that rises to the level of a criminal offense (i.e., actual participation in fraud, money laundering, or other miscondprosecution. 

EC 1 Principle 18: Abuse of financial services Criterion Laws or regulations clarify the duties, responsibilities and powers of the banking supervisor and other com

related to the supervision of banks’ internal controls and enforcement of the relevant laws and regulations 

activities. 

Legal Framework 

The agencies must review each supervised bank’s BSA/AML Compliance Program at each examination

1818(s)(2)(A). The agencies have authority to enforce all banking rules and regulations, including complicertain enforcement obligations apply with respect to BSA/AML Compliance Program violations. See 12 banking supervisors also have enforcement authority for state-chartered banking institutions. The federal supervisors may require banks to undertake remedial actions and may assess civil money penalties and issuFinCEN and the DOJ have authority to assess civil and criminal penalties, respectively, for BSA violation

Practices and Procedures 

The agencies have clear statutory authority to regulate banks and holding companies, examine them for coregulations relating to the prevention of criminal misuse, and enforce those requirements through civil enf12 U.S.C. §§ 1818(s)(2) and (s)(3); 1818(i). These provisions are vigorously enforced by the federal bankyears a number of banks and holding companies have been assessed significant penalties for BSA/AML co

e.g. OCC EA 2008-29 (United Bank for Africa $15 million penalty); OCC EA 2007-110 (Union Bank of Cpenalty); OCC EA 2004-44 (Riggs Bank, N.A $25 million penalty); OTS ATL 2006-01 (BankAtlantic, Fo

million penalty); FRB 05-035-CMP-FB (ABN AMRO Bank N.V. and ABN AMRO Bank N.V. New York $40 million penalty). In addition to the agencies, certain other federal and state government agencies play 

1 Besides banks, other types of holding company subsidiaries may be “financial institutions,” which are subject to BSA laws. See 31 U.S.C

have implemented examination procedures for enterprise-wide compliance programs, which they encourage more complex holding compan

at 149-64. 
EC 1 Principle 18: Abuse of financial services 

safeguarding the U.S. financial sector from criminal activities as noted in the overview. 

EC 2 Principle 18: Abuse of financial services Criterion The supervisor must be satisfied that banks have in place adequate policies and processes that promote hig

standards and prevent the bank from being used, intentionally or unintentionally, for criminal activities. Tand detection of criminal activity, and reporting of such suspected activities to the appropriate authorities. 

Legal Framework 

The agencies and Treasury have issued regulations requiring banks to establish and maintain BSA/AML Cat a minimum, include the following elements: internal controls to assure BSA compliance; independent te

individual responsible for coordinating and monitoring day-to-day compliance; and training for appropriatU.S.C. § 5318(h)(1) (statutory requirement); 12 CFR 21.21 (OCC); 208.63, 211.5, 211.24 (Federal Reserv563.177 (OTS). The agencies and Treasury have issued separate regulations requiring banks to establish a program (CIP). [See 31 U.S.C. §5318(l) (statutory requirement); 12 CFR 208.63(b)(2) (Federal Reserve); 

(FDIC); ); 12 CFR 21.21(b)(2)(OCC); 12 CFR 563.177(b)(2) (OTS), as well as cites in the overview; and (Treasury/FinCEN).] The agencies and Treasury have issued regulations requiring banks and holding com

activity report with FinCEN within 30 days of the initial detection of certain facts (within 60 days if attemSee 31 CFR 103.18(b) (Treasury/FinCEN); 12 CFR 21.11(d) (OCC); id. at 208.62(d) (Federal Reserve); i

id. at 563.180(d)(5) (OTS); see also 31 U.S.C. § 5318(g) (statutory requirement). The Bank Protection Act, 12 U.S.C. § 1882, requires the agencies to promulgate rules applicable to banks installation, maintenance, and operation of security devices and procedures to discourage robberies, burglaassist in the identification and apprehension of persons who commit such acts. See e.g. 12 CFR 21, subpar

Devices and Procedures (OCC); 12 CFR 326 (FDIC); 12 CFR 208.61 (Federal Reserve); and 12 CFR 568 The Interagency Guidelines Establishing Information Security Standards 12 CFR 30, appendix B (OCC); 

(FDIC); and 12 CFR appendix D-2 (Federal Reserve) and 12 CFR 225, appendix F (Federal Reserve); and (OTS)set standards for banks to develop and implement safeguards for the security, confidentiality, and ininformation, including protecting against unauthorized access, and advise banks to perform background chresponsibilities for, or access to, customer information. 

Practices and Procedures 

Examinations of banks and holding companies are conducted by federal and state supervisors using a consset forth in the FFIEC BSA/AML Examination Manual (Manual). The agencies released the Manual publi

of examination criteria and disseminate uniform guidance on supervisory expectations. The agencies desig

training for the banking industry to introduce and reinforce regulations and procedures contained in the Missued a policy statement clarifying the practice for taking enforcement actions relating to BSA/AML comstatement can be found in Appendix R of the Manual. The federal and state supervisors also assess more b

and holding company hve adequate policies and processes in place to promote high ethical and professionabank from being used, intentionally or unintentionally, for criminal activities. 
EC 2 Principle 18: Abuse of financial services 

As part of the examination of the BSA/AML Compliance Program, U.S. federal banking supervisors evaluappropriate policies, procedures, and processes in place to monitor, identify, and report unusual activity, cproducts, services, customers and geographic locations. Supervisors also confirm that an institution’s boar

mandate of formally approving the written BSA/AML program. See, e.g., 12 U.S.C. § 1818(s); 12 CFR 2326.8 (FDIC); 12 CFR 208.63 (Federal Reserve); and 12 CFR 563.177 (OTS)..

EC 3 Principle 18: Abuse of financial services Criterion In addition to reporting to the financial intelligence unit or other designated authorities, banks report to the 

suspicious activities and incidents of fraud when they are material to the safety, soundness or reputation of 

Legal Framework 

The agencies and Treasury have issued regulations requiring banks and holding companies to file a SAR wdays of the initial detection of certain facts (within 60 days if attempting to identify a subject). See 31 CFR 

(Treasury/FinCEN); 12 CFR 21.11(d) (OCC); id. at 208.62(d) (Federal Reserve); id. at 353.3(b)(1) (FDIC

(OTS); see also 31 U.S.C. § 5318(g) (statutory requirement). Specifically, a bank, bank holding companynon-bank subsidiary, and certain SLHCs and non-bank subsidiaries of SLHCs are under an obligation to fidetects any known or suspected federal criminal violation, or pattern of criminal violations, committed or 

or involving a transaction or transactions conducted through the bank, where the filer believes that it was evictim of a criminal violation, or series of criminal violations, or that the filer was used to facilitate a crimiinsider was involved; or (2) over $5,000 was involved, and the filer can identify a suspect; or (3) over $25

bank cannot identify a suspect; or alternatively, that the transaction involves $5,000 or more and involves 

laundering or violations of the Bank Secrecy Act. See 12 CFR 21.11(c) (OCC); id. at 208.62(c) (Federal R

(FDIC); and id. at 563.180(d)(3) (OTS). 

In cases involving violations requiring immediate attention, such as when a reportable transaction is ongoi

whether a bank or holding company, must immediately notify law enforcement and the agency in addition CFR 21.11(d) (OCC); id. at 208.62(d) (Federal Reserve); id. at 353.3(b)(2) (FDIC); id. at 563.180(d)(5) (O

bank files a SAR it must promptly notify the board of directors or board committee. See 12 CFR 21.11(h) 

(Federal Reserve); id. at 353.3(f) (FDIC); and id. at 563.180(d)(9) (OTS). 

Banks and holding companies are required at all times to conduct their business and exercise their powers and soundness. See, e.g., 12 CFR 208.3(d)(1) (addressing conditions of membership in the Federal Reserv

soundness standards for national banks) ) and 12 CFR 353.3(b)(2) for FDIC. As part of this obligation, threport directly to them any suspicious activities and incidents of fraud which might be material to the safet

of the institution. The Bank Protection Act, 12 U.S.C. § 1882, requires the agencies to promulgate rules applicable to banks 
EC 3 Principle 18: Abuse of financial services 

installation, maintenance, and operation of security devices and procedures to discourage robberies, burglaassist in the identification and apprehension of persons who commit such acts. See, e.g., 12 CFR 21, subp

Devices and Procedures) (OCC); 12 CFR 326 (FDIC); 12 CFR 208.61 (Federal Reserve); and 12 CFR 568 

Practices and Procedures 

All SARs filed pursuant to the agencies’ and Treasury’s rules are centrally filed with FinCEN and the agen

access to such reports . As part of the supervision process, the agencies assess the procedures and control

organization to identify, monitor, and report violations and suspicious activities. The agencies and law enfguidance, notices, and alerts to the banking industry on criminal activity and terrorist finance trends. See, Financial Institution Letters and Special Alerts and FinCEN’s Secure Information Sharing System. SARs, 

exemptions can be downloaded from or obtained directly online from a controlled BSA-reporting database 

by FinCEN. Each agency has staff authorized to obtain this data from the BSA-reporting database that supscope and plan their examination activities. FinCEN also publishes the “SAR Activity Review, Trends, Tiyear to provide information and guidance to SAR filers. They also issue the “SAR Activity Review, By thto provide numerical data and information concerning the number and types of SAR filings. In general, msafety, soundness, or reputation of a supervised institution, whether or not reflected on a SAR, are monitorbanking supervisory staff. As a part of its examination scoping responsibilities, the agencies review BSA data (including SARs) to idfraud risks and document the examination plan based upon these risks and other risks to the institution. Thincludes determining the examination staffing needs and technical expertise, and selecting examination proSee Manual p. 11. Additionally, the agencies review SARs that report known or suspected criminal activities by current and femployees, and other institution-affiliated parties (IAPs) to ensure that appropriate enforcement actions are See, Federal Reserve SR letter 03-20, “Suspicious Activity Reports and Enforcement Actions against Indiv

OCC’s Fast Track Enforcement Program is designed to ensure that bank insiders who have engaged in crimwho are not being criminally prosecuted, are prohibited from working in the banking industry. SAR data i

IAPs that have engaged in suspicious or illegal conduct. See OCC PPM 5310-8 (Rev). The OTS reviews Sengaged in suspicious or illegal conduct and has details on enforcement actions in section 080 of the Exam

FDIC describes among other SAR review process, its internal review procedure of IAP SARs in the WinteInsights Journal. 

EC 4 Principle 18: Abuse of financial services Criterion The supervisor is satisfied that banks establish “know-your-customer” (KYC) policies and processes whic

communicated to all relevant staff. Such policies and processes must also be integrated into the bank’s ove
EC 4 Principle 18: Abuse of financial services 

KYC management program, on a group-wide basis, has as its essential elements: 

• a customer acceptance policy that identifies business relationships that the bank will not • a customer identification, verification and due diligence program; this encompasses verif

ownership and includes risk-based reviews to ensure that records are updated and relevan

• policies and processes to monitor and recognize unusual or potentially suspicious transac

risk accounts; 

• escalation to the senior management level of decisions on entering into business relation

accounts, such as those for politically exposed persons, or maintaining such relationships relationship becomes high-risk; and 

• clear rules on what records must be kept on consumer identification and individual transa

period. Such records should have at least a five year retention period.

Legal Framework 

Pursuant to statute, 31 U.S.C. 5318(l), the agencies and Treasury have issued regulations requiring various opening procedures, including verifying the identity of any person seeking to open an account, to the exten

and practicable and maintaining records of the information used to verify the person’s identity, including nand other identifying information. The Customer Identification Program (CIP) also must include procedurresponding to circumstances in which the bank cannot form a reasonable belief that it knows the true identcustomer; this provision is implemented by regulation 31 CFR 103.121. In addition, for certain non-U.S. atransactions, banks must identify beneficial owners (see section 312 of the USA Patriot Act, 31 U.S.C. 531CFR 103.178). The BSA regulations generally require that the banks properly safeguard and maintain copand reports for a period of five years following the completion of the transaction. See 31 CFR 103, subpar

Practices and Procedures 

Banking supervisors determine whether the internal controls in a bank’s BSA/AML Compliance Program opening procedures and ongoing monitoring systems, including a customer acceptance policy identifying bank will not accept, if any. Supervisors evaluate whether the bank’s CIP enables the bank to form a reascustomer’s true identity at account opening and whether the bank has measures in place to ensure account 

that monitoring can be risk-based. Where appropriate, supervisors also review accounts to determine whe

individuals that are politically exposed persons (PEPs) and whether management is involved in decisions maintain existing accounts whose holders are determined to be PEPs, and to ensure the bank conducts ongmonitoring of PEP accounts. See the Manual, see also, 31 U.S.C. § 5318(i)(3)(b) and 31 CFR 103.178(c). 

agencies and FinCEN have issued detailed “frequently asked questions” (FAQs) relating to CIP requireme

FinCEN’s website. See “Interagency Interpretive Guidance on Customer Identification Program Requiremof the USA Patriot Act (April 28, 2005). All banks are required to have a BSA compliance program (31 U.S.C. § 5318(h)) and maintain bank recorprograms (31 U.S.C. § 5318(k)). The cornerstone of a strong BSA/AML program is the adoption of compdiligence (CDD) policies, procedures, and processes for all customers, particularly those that present a higlaundering and terrorist financing. Effective CDD policies and procedures provide the critical framework comply with regulatory requirements and to report suspicious activity. See Manual p. 56. The agencies h
EC 4 Principle 18: Abuse of financial services 

guidance that directs banks to establish CDD policies, procedures and processes, which are integrated into management strategy. The agencies have identified failures of such during examinations evidenced by recactions. Details of the enforcement actions may be found on each agency’s website. Below are some exa

OCC Cease and Desist Order and Civil Money Penalty, Eastern National Bank (EA 2008-129 and www.occ.treas.gov/FTP/EAs/ea2008-152.pdf

Federal Reserve Cease and Desist Order and Civil Money Penalty, FRB 07-17-B-EC, American E

(2007). FDIC Cease and Desist Order, First Regional Bank (2008). www.fdic.gov/bank/individual/enforce

OTS Cease and Desist Order, First Federal Savings of Middletown, NY (2008) 

http://files.ots.treas.gov/enforcement/97023.pdf

EC 5 Principle 18: Abuse of financial services Criterion The supervisor is satisfied that banks have enhanced due diligence policies and processes regarding co

policies and processes encompass: 

• gathering sufficient information about their respondent banks to understand fully the n

customer base, and how they are supervised; and 

• not establishing or continuing correspondent relationships with foreign banks that do n

against criminal activities or that are not effectively supervised by the relevant authoritieare considered to be shell banks. 

Legal Framework 

31 U.S.C. § 5318(i) and its implementing regulation at 31 CFR 103.176, require banks to establish risk-ba

and procedures reasonably designed to detect and report money laundering through correspondent account

administered, or managed in the United States for a foreign financial institution. In addition, banks must perform enhanced due diligence for foreign correspondent banks operating under clicenses. Enhanced due diligence includes obtaining ownership information about certain correspondents, scrutiny of the transactions routed through these accounts, and ascertaining whether the foreign correspondcorrespondent accounts to other foreign banks. 
EC 5 Principle 18: Abuse of financial services 

31 U.S.C. § 5318(j) and its implementing regulation at 31 CFR 103.177 prohibit U.S. banks from providin

to foreign shell banks and require U.S. banks to take reasonable steps to ensure that correspondent accountbanks are not being used to indirectly provide financial services to foreign shell banks. U.S. banks are reqcertifications to that effect from their foreign bank customers and to periodically obtain re-certification. 

Practices and Procedures 

U.S. federal and state banking agencies generally view BSA/AML risks in domestic correspondent bankinother types of financial services, but U.S. federal and state banking supervisors nevertheless evaluate, for U

correspondent bank services to domestic respondent banks, the policies, procedures, and processes to maninvolved in these correspondent relationships and to detect and report suspicious activities. (See the Manu

The agencies supervise banks to ensure compliance with foreign correspondent banking requirements, in aprocedures and expectations set forth in the Manual. The agencies confirm that banks are meeting their le

procedures for a periodic review of each correspondent account to determine consistency with the informa

type, purpose, and anticipated activity of the account as required under 31 U.S.C. § 5318(i). Supervisors afactors that may be used to help identify potential risk characteristics of a foreign correspondent customer 

agencies enforce requirements that banks establish due diligence and enhanced due diligence policies and correspondent banking. The agencies have cited failures of such rules as a cause of concern during examinrecent public enforcement actions, found on each agency’s website, some of which are described below. OCC Cease and Desist Order, Union Bank of California, www.occ.treas.gov/FTP/EAs/ea2007-110.pdf

Federal Reserve Written Agreement, FRB 06-030-WA/RB-FB, FRB 06-030-WA/RB-FBR, Intesa Sanpao

Sanpaolo S.p.A. New York Branch (2007). 

FDIC Order to Case and Desist and Order to Pay, Israel Discount Bank of New York (2005) and Israel Dis

(Civil Money Penalties 2006) OTS Cease and Desist Order, Downey Sav. & L. Association (2007) http://files.ots.treas.gov/enforcement/96186.pdf

EC 6 Principle 18: Abuse of financial services Criterion The supervisor periodically confirms that banks have sufficient controls and systems in place for preventin

reporting potential abuses of financial services, including money laundering. 

Legal Under 12 U.S.C. § 1818(s), each examination by a federal banking agency is required to include an examin
EC 6 Principle 18: Abuse of financial services Framework BSA Compliance Program. Under 12 U.S.C. § 248 (Federal Reserve); 481 (OCC); 1464(d) (OTS); 1820 (

supervisors have complete access to a supervised bank’s books and records during an examination (see alsexaminer guidance (OCC)). In some circumstances, supervisors may also review the books and records of subsidiaries. In addition, supervisors have access to the books and records of bank service companies, and of independent servicers that pertain to the services that are subject to the Bank Service Company Act, 12 federal and state banking agencies’ supervision process includes both on-site examinations and off-site sur

In general, on-site examinations must occur once every 12 to 18 months (e.g., 12 CFR 208.64 (Federal Re(OCC)) 12 CFR 337.12 (FDIC)). Institutions that the agencies believe possess significant compliance riskfrequently. For larger more complex banking organizations, the agencies maintain resident on-site supervicontinuous monitoring to assess any deterioration in the control infrastructure and annually assess the orgarisk assessment. The agencies are responsible for examining banks and holding companies within their re

safety and soundness and compliance with applicable laws. In addition, federal law requires that each agebank includes a review of the BSA Compliance Program and that its reports of examination describe any pCompliance Program. See 12 U.S.C. § 1818(s). 

Practices and Procedures 

A key component of the BSA/AML on-site examination is to ensure that the bank maintains an effective BProgram for its business activities. Prior to the examination, banking supervisors routinely conduct an offdatabases of bank SARs and CTRs to determine if a bank that is about to be examined has filed such reporcomplete and timely, and for areas of examination interest. The agencies assess a bank’s compliance with obligations using the core examination procedures detailed in the Manual during each examination. 

The agencies also alert the industry of fraud schemes through bulletins and industry conferences. 

EC 7 Principle 18: Abuse of financial services Criterion The supervisor has adequate enforcement powers (regulatory and/or criminal prosecution) to take action ag

comply with its obligations related to criminal activities. 

Legal Framework 

In appropriate circumstances, an agency may take formal or informal enforcement actions to address violarequirements (including those related to BSA Compliance Programs and SAR and CTR regulatory obligatand unsafe and unsound practices or breaches of fiduciary duty involving failure to comply with obligationactivity. In certain circumstances, 12 U.S.C. § 1818(s)(3), requires an agency to issue a cease aaddress a violation of the BSA Compliance Program requirement for banks. See 12 U.S.C. § be taken to enforce compliance with the requirements of the Bank Protection Act. 12 U.S.C. § 18authority to assess penalties against banks and holding companies for violations of the BSA. See 31 U.S.C103.57. The DOJ has the authority to bring criminal cases against banks and holding companies for violatincluding certain provisions of the BSA. 31 U.S.C. § 5322; 18 U.S.C. §§ 1956 and 1957. Any bank convicriminal money laundering statutes must undergo a hearing to have its deposit insurance revoked, and for 
EC 7 Principle 18: Abuse of financial services 

statutes a hearing may be conducted. See 12 U.S.C. § 1818(w). 

Practices and Procedures 

In general, BSA/AML deficiencies that give rise to supervisory enforcement actions relate to compliance wBSA/AML Compliance Program rule, CIP rule, and with SAR filing requirements. In the event that BSA/significant, repeated, unresolved by the bank’s management, or otherwise of serious concern, the appropri

enforcement authority by taking a formal action against a bank subject to its supervision. Depending on thnoncompliance, an agency can issue written orders that impose remedial actions; impose civil money penaindividuals or bar them from employment within the industry; restrict or suspend the specific activities of the license of the organization; or refer the matter to the DOJ for possible criminal penalties. The provisioaction are tailored to address the particular violations and weaknesses identified by the supervisors. In ordapproach for enforcement of BSA/AML Compliance Program requirements and to make those standards mindustry, the agencies issued an interagency statement in August 2007 to clarify the circumstances in whic

cease and desist order to address noncompliance with certain BSA/AML requirements. This statement can of the Manual. 

The agencies are authorized to take formal administrative action against an IAP of any banking organizatio

informal actions with respect to less serious deficiencies or more technical violations of the BSA/AML req

§ 1813(u) and 1818, see also, Principle 23, EC 3 and EC 6.

EC 8 Principle 18: Abuse of financial services Criterion The supervisor must be satisfied that banks have: 

• requirements for internal audit and/or external experts to independently evaluate the 

policies, processes and controls. The supervisor must have access to their reports; 

• established policies and processes to designate compliance officers at the manageme

relevant dedicated officer to whom potential abuses of the bank’s financial servitransactions) shall be reported; 

• adequate screening policies and processes to ensure high ethical and professional standar• ongoing training programs for their staff on KYC and methods to detect criminal and sus

Legal Framework 

Banks must have adequate BSA/AML Compliance Programs in place that include independent testing of tdesignation of an individual responsible for coordinating and monitoring day-to-day compliance; and ongo

U.S.C. § 1818(s), see also the response to Principle 18, EC 2. The agencies have issued “Interagency Guidelines Establishing Standards for Safeguarding Customer Infobanks to perform background checks for employees with responsibilities for, or access to, customer inform

appendix D-2 and 12 CFR 225, appendix F (Federal Reserve); 12 CFR 364, appendix B (FDIC); 12 CFR 3

e) (OCC); and 12 CFR 570, appendix B (OTS). 
EC 8 Principle 18: Abuse of financial services Practices and Procedures 

The expectations of, and examination procedures utilized by, banking supervisors regarding the BSA/AML 

requirements are covered extensively in the Manual. Supervisors assess the adequacy of the bank’s BSA/Aand determine whether the bank has developed, administered, and maintained an effective program includithe designation of an individual responsible for coordinating and monitoring day-to-day compliance; and o

for staff on customer due diligence and methods to detect suspicious activities. If one or more of the components of the BSA/AML Compliance Program are considered inadequate, the aor formal supervisory actions to require the bank to correct the deficiencies to strengthen the bank’s complresponse to Principle 18, EC 7). 

The agencies strongly encourage banks to use reasonable employment screening processes to minimize the embezzlement, money laundering, and other crimes. The agencies consider that a reasonable policy might 

references, performing credit and/or background checks, Internet searches, and performing criminal backg

FBI fingerprint check, for prospective employees. (See the response to Principle 23, EC 6 for a description against individuals). Further, the FDIC issued a FIL -46-2005, “Pre-employment Background Screening”, such a policy. See also, FFIEC Information Technology Examination Handbook, Operations, Personnel Cissue guidance to the industry concerning best practices in this area. See e.g., Comptroller’s Handbook for Conflicts of Interest; FFIEC, The Detection, Investigation and Prevention of Insider Loan Fraud: A White 

The Directors Book – The Role of a National Bank Director, March 1997. 

EC 9 Principle 18: Abuse of financial services Criterion The supervisor determines that banks have clear policies and processes for staff to report any problems rel

banks’ financial services to either local management or the relevant dedicated officer or to both. The super

banks have adequate management information systems to provide managers and the dedicated officers witsuch activities. 

Legal Framework 

In addition to the SAR requirements, the audit committees of publicly held banks and holding companies t

301 of Sarbanes-Oxley must establish procedures for the confidential, anonymous submission by employeconcerns regarding questionable accounting or auditing matters. 15 U.S.C. § 78j-1(m)(4). The Bank Protection Act, 12 U.S.C. § 1882, requires the agencies to promulgate rules applicable to banks installation, maintenance, and operation of security devices and procedures to discourage robberies, burglaassist in the identification and apprehension of persons who commit such acts. See e.g. 12 CFR 21, subparDevices and Procedures) (OCC); 12 CFR 326 (FDIC); and 12 CFR 568 (OTS). Also, whenever a bank files a SAR, it must promptly notify the board of directors or board committee. 12 

at 208.62(h) (Federal Reserve); id. at 353.3(f) (FDIC); and id. at 563.180(d)(9) (OTS).
EC 9 Principle 18: Abuse of financial services Practices and Procedures 

The agencies assess a bank’s and holding company’s policies, procedures, and processes, including internasupervision, for monitoring and identifying unusual activity and for referring unusual activity from all busor department responsible for evaluating unusual activity. Banking supervisors evaluate the effectiveness by considering the bank’s overall risk profile, the volume of transactions, and the adequacy of staffing assiresearch, and reporting of suspicious activities. Additionally, the agencies evaluate the escalation process detection to disposition of the investigation to determine whether management’s documented decisions to 

reasonable and whether SARs are filed in a timely manner. Finally, the agencies review management infothat they inform the board (or board committee) and senior management of suspicious activities, compliancorrective action. (See Manual). 

EC 10 Principle 18: Abuse of financial services Criterion Laws and regulations ensure that a member of a bank’s staff who reports suspicious activity in good faith e

to the relevant authority cannot be held liable. 

Legal Framework 

The BSA and the agencies’ SAR regulations provide protection to financial institutions and their employeefiling a SAR or for making disclosures in a SAR. The agencies and FinCEN have issued an interagency adthis “safe harbor,” as judicially interpreted on May 24, 2004. See SR letter 04-8 (May 24, 2004); OCC Bu

FIL-67-2004. U.S. federal law (31 U.S.C. § 5318(g)(3)) provides protection from civil liability for all reports of suspicioappropriate authorities, including supporting documentation, regardless of whether such reports are filed pinstructions. Specifically, the law provides that a bank and holding company and its directors, officers, emmake a disclosure of any possible violation of law or regulation, including a disclosure in connection with “shall not be liable to any person under any law or regulation of the U.S., any constitution, law, or regulatisubdivision of any state, or under any contract or other legally enforceable agreement (including any arbitrdisclosure or for any failure to provide notice of such disclosure to the person who is the subject of such diperson identified in the disclosure.” Section 351 of the USA Patriot Act, amended 31 U.S.C. § 5318(g)(3) charges of breach of contract and included directors, officers, employees, and agents of the bank or holdinin preparing and reporting of SARs under safe harbor protections. The safe harbor applies to SARs filed w

reporting thresholds as well as to SARs filed voluntarily on any activity below the threshold. Each agency which specifically include a safe harbor provision for banking in the filing of SARs. See 12 CFR 353.3(h) 

(OCC); 12 CFR 563.180(d)(13) (OTS); and 12 CFR 208.62(k) (Federal Reserve). Finally, section 355 of the USA Patriot Act specifically authorizes banks and holding companies to includ

activity in written employment references. See 12 U.S.C. § 1828(w). 

Practices and The agencies review the procedures and practices of a bank’s or holding company’s suspicious activity rep
EC 10 Principle 18: Abuse of financial services Procedures ensure that appropriate procedures are being conducted. EC 11 Principle 18: Abuse of financial services Criterion The supervisor is able to inform the financial intelligence unit and, if applicable, other designated authority 

transactions. In addition, it is able, directly or indirectly, to share with relevant judicial authorities informa

actual criminal activities. 

Legal Framework 

In accordance with procedures applicable to the sharing of confidential supervisory information, the agencinform relevant authorities, including Treasury and FinCEN, of suspicious transactions. See generally 12 

CFR 4; 12 CFR 309.6; and 12 CFR 503.2. Also within these prescribed procedures, the agencies have the indirectly, to share with judicial authorities information related to suspected or actual criminal activities. 

Practices and Procedures 

U.S. federal and state banking agencies have the ability, and consider it their supervisory responsibility, to authorities of suspicious activity and share information with relevant judicial authorities. If a bank or hold

a SAR but federal or state supervisory agency staff determines that it should, agency staff may file a SAR holding company, and the form will be available to authorities with database access. The Manual provides situations when the agency should file a SAR. SARs and any information that would disclose the existence of a SAR are confidential. See 31 U.S.C. § 5

underlying documents and information pertaining to the suspicious transactions may be shared by banking 

judicial authorities with certain limitations. The agencies have procedural restrictions on the disclosure of 

information (that is, information obtained through the examination process), but have established processenecessary review and approval to provide information. See 12 CFR 4 and 12 CFR 309. Information aboualso subject to restrictions on disclosure by government agencies under the Right to Financial Privacy Act (RFPA). In general, RFPA provides all necessary exceptions with respect to disclosures for law enforcem

EC 12 Principle 18: Abuse of financial services Criterion The supervisor is able, directly or indirectly, to cooperate with the relevant domestic and foreign financial 

authorities or share with them information related to suspected or actual criminal activities where this infopurposes. 

Legal Framework 

As discussed under Principle 1(6), the U.S. federal banking agencies are authorized, directly or indirectly, relevant domestic and foreign financial sector supervisory authorities or share with them information relatecriminal activities where this information is for supervisory purposes. 
EC 12 Principle 18: Abuse of financial services 

Section 8(v) of the Federal Deposit Insurance Act (12 U.S.C. § 1818(v)) permits the agencies to provide a

banking authorities, if the foreign authority is conducting an investigation to determine whether there is a v

regulation dealing with banking matters or currency transactions that are administered or enforced by the f15 of the International Banking Act (12 U.S.C. § 3109) authorizes sharing information with foreign bank rauthorities, if such disclosure does not prejudice the interests of the United States, and the foreign authorit

confidentiality of the information to the extent possible under applicable law. 12 CFR 4.37 permits the Comptroller of the Currency to share non-public OCC information with certain oof foreign governments (not just foreign bank regulators or supervisors), subject to appropriate confidentia309 gives the Federal Deposit Insurance Corporation discretion in the sharing of confidential information wsafeguards. 12 CFR 261.20 and 261.21 permit the Federal Reserve to share confidential supervisory inforunder certain circumstances and subject to confidentiality safeguards. . The OTS has a similar regulation. 

Practices and Procedures 

The agencies have broad authority to share relevant supervisory information with domestic banking superv

also share information with other supervisory and enforcement agencies, subject to confidentiality restricti

11). 

Under the relevant statutes and regulations, the agencies may share with foreign bank supervisors, spontanThey also have authority to exchange information with foreign bodies other than banking supervisors, incl

enforcement agencies. 12 CFR 4.37(c); 12 U.S.C. § 326; 12 U.S.C. § 1817(a)(2)(C). All of the agencies hprocedures under which requests for information are processed. The agencies are party (either separately osupervisory information sharing arrangements with foreign bank supervisors. 

AC 1 Principle 18: Abuse of financial services Criterion If not done by another authority, the supervisor has in-house resources with specialist expertise for addressLegal Framework Practices and Procedures 

The agencies employ highly skilled personnel for a number of specialties, including compliance and AML 

offences. These specialists are highly skilled, receive annual continuing education training, and are deplo

complex and high-risk institutions, and are well prepared to identify unusual or potentially criminal activitexpertise. In addition to subject matter experts, the agencies have fraud experts on staff to handle fraud casenforcement such as the US Department of Justice and the Federal Bureau of Investigations. The FDIC’s Office of Inspector General-Office of Investigations carries out a comprehensive nationwide p
AC 1 Principle 18: Abuse of financial services 

detection, and investigation of criminal or otherwise prohibited activity affecting the FDIC and its program

Investigations coordinates with DOJ, the Federal Bureau of Investigation, the Secret Service, the Internal ROffice of Inspector Generals, and state and local law enforcement authorities regarding the prosecution of including money laundering and terrorist financing offences. 
Principle 19: Supervisory approachAn effective banking supervisory system requires that supervisors develop and maintain a thorough understanding of the operand banking groups, and also of the banking system as a whole, focusing on safety and soundness, and the stability of the banOverview Banking laws vest the U.S. federal banking agencies with broad authority to regulate and supervise banks and holding companjurisdiction. This authority includes the power to examine banks and holding companies and their affiliates and to obtain a br

from both, including financial data and information on their activities, operations, structure, corporate governance, risk manag

details necessary to determine and enforce compliance with applicable laws and ensure the safety and soundness of the bank o12 U.S.C. §§ 93a, 161(a) and (c), 324-26, 481, 483, 602, 625, 1464(d) and (v), 1467(h) and 1467a(b)(2), 1817(a), 1817(a)(2), 

1844(c), 3105(c), and 3108. Banks and holding companies must provide supervisors with full and complete access to their bodo so can result in the imposition of administrative sanctions. Under the agencies’ statutory examination authority, supervisorand records maintained by a banking organization subject to the agencies’ supervision. This includes access to the bank’s and employees involved in a matter under review. These duties extend to the foreign operations of banks; however, it should be n

foreign host countries may restrict U.S. banks and holding companies operating in such countries from sharing certain inform

banking agencies. U.S. federal banking supervisors utilize this authority to develop and maintain a thorough understanding of the operations of i

holding companies, to evaluate and ensure their safety and soundness and compliance with applicable laws and regulations, an

of the banking and financial system.Largely compliant: The recent market turmoil has highlighted areas where regulatory oversight and coordination need to be many of the problems in the subprime mortgage market originated with mortgage brokers and lenders who were not affiliatchartered depository institutions and thus were subject to limited supervision. In other cases, there were not sufficient mresolve systemically important nonbank firms. The U.S. Treasury Department’s financial reform package addresses these 

Summary of Recent Events and Implications within the Introduction for more detailed discussion on initiatives that are und

EC 1 Principle 19: Supervisory approach Criterion The supervisor has policies and processes in place to develop and maintain a thorough understanding of th

banks and banking groups. 

Legal Framework 

See Overview section above. 
EC 1 Principle 19: Supervisory approach Practices and Procedures 

U.S. federal banking agencies use their authority to conduct on-site reviews and off-site analyses to develounderstanding of the risk profile of banks and holding companies. Under U.S. law, the agencies conduct fexaminations of banks at least once every year (for banks that have assets of at least $500 million or that amanaged or well-capitalized) or 18 months (for banks that have assets of less than $500 million and that armanaged and well-capitalized). Bank holding company (BHC) inspections are mandated on an annual or tupon size, complexity, and rating, with smaller (less than $1 billion in assets) banks subject to off-site revi

Reserve’s BHC Inspection Program). SLHC examinations are conducted concurrently with the OTS examsavings associations. The agencies also conduct regular Consumer Compliance examinations and Commuevaluations of banks to confirm that the organization is appropriately managing its compliance risk and co

consumer protection laws and regulations. A full-scope examination addresses all key areas of a bank’s operations, including capital adequacy, asset strength and quality of oversight from the bank’s board of directors, compliance with laws and regulations

of earnings, adequacy of liquidity sources to support ongoing cash needs, and sensitivity of a banking orgacapital position to market risk. For many larger banks and holding companies, full scope examinations/insof targeted reviews during the examination cycle which culminate in a roll-up process where ratings are as

results of these targets and the continuous monitoring activities. The requirements and mandates for these 

found in the individual agencies’ examination manuals noted in the overview section of Principle 7. Additlargest banks and holding companies, one or more of the banking agencies maintains a full-time, on-site exthe activities. During the period of time in between full-scope, on-site examinations, the agencies maintain a thorough unand holding company’s risk profiles. This is accomplished through the analysis of quarterly financial staterelevant agency and the review of regulatory reports that banks must file to notify the agencies of changes structure. Further, supervisors may request and review key management information reports including, bu

audit information, and, in the case of publicly traded banks and holding companies, the consideration of mprovide insight into the market’s assessment of the risk profile. These sources may be supplemented by diorganization’s management, meetings with its internal and external auditors, and, where no full-time on-si

maintained, on-site visits to maintain an up-to-date understanding of the financial condition. In addition, t

various analytical tools that can help identify emerging risks or changes in the risk profile that may require For additional information on the agencies’ off-site surveillance procedures and analytical tools, see Feder

and 95-43; and OCC Community Bank Supervision and Large Bank Supervision Handbooks, and PPM 500OCC uses a variety of monitoring tools, including the Canary Early Warning System; monitoring of foreig

under different macroeconomic and financial market scenarios; quarterly reports obtained from large bank

loan level detail on various loan portfolios such as residential mortgages; and annual underwriting surveys

several monitoring systems such as Large Institution Risk Review, Real Estate Stress Test, and Growth M
EC 1 Principle 19: Supervisory approach 

OTS issued an internal New Directions Bulletin to supervision staff providing national guidance on off-sit

EC 2 Principle 19: Supervisory approach Criterion The supervisor monitors and assesses trends, developments and risks for the banking system as a whole. T

into account developments in non-bank financial institutions through frequent contact with their regulators

Practices and Procedures 

On a quarterly basis, U. S. federal banking agencies monitor and assess banks and holding companies thro

that each is required to file. These financial statements consist of a balance sheet, income statement, and s

schedules. Using aggregations of these data, the banking agencies complete analyses addressing overall cobanking industry. These analyses highlight earnings performance, industry capitalization levels, lending c

other fundamental and specialized areas of the bank’s or holding company’s operations, and are used to as

and risks for the banking system as a whole. The agencies also make use of higher level risk committees, 

officials, to evaluate and assess the risks facing the financial system. In addition, the results of formal off-swhich utilize the submitted financial data to identify emerging problems in supervised banks and holding cmonitor banking industry trends. See Principle 21 for details on Supervisory Reporting requirements. The agencies also maintain contacts with a variety of market and industry analysts to obtain insights on emaffect the banking system and financial markets as a whole. For example, the OCC has a Financial Markededicated to monitoring and analyzing market developments and trends, and maintaining contact with margroup conducts periodic meetings with various market analysts, hedge fund managers, and other key playeemerging risks. The U.S. President’s Working Group on Financial Markets facilitates coordination among market regulators on issues and risks that cut across the financial sector. The agencies also consult regular

major non-bank organizations in the United States, including the Securities and Exchange Commission (SEdealers and the state insurance authorities in the case of insurance companies, to help to evaluate the impac

activities on the condition of holding companies.

EC 3 Principle 19: Supervisory approach Criterion The supervisor uses a methodology for determining and assessing on an ongoing basis the nature, importan

to which individual banks or banking groups are exposed. The methodology should cover, inter alia, the bu

profile and the internal control environment, and should permit relevant comparisons between banks. Supebased on the results of these assessments. 
EC 3 Principle 19: Supervisory approach Practices and Procedures 

During each supervisory cycle, the U.S. federal banking agencies formally assess the risk profile of each bin order to determine the supervisory strategy to be followed by examination staff and prioritization of ageassessments are updated on a regular basis through off-site monitoring programs and on-site examinationsuse a common framework that promote and facilitate comparisons across banking organizations. The U.S

maintain continuous off-site monitoring programs to determine and assess on an ongoing basis the nature, risks to which banks and holding companies are exposed. These programs draw on financial data, prior suregulatory reports specifying changes in activities, and other internal and publicly available sources of info

and holding companies requiring a heightened supervisory focus. Banks and holding companies showing deterioration or making significant changes in their business focus may be subject to immediate on-site or under policies and procedures maintained by the banking agencies. The adequacy of internal controls is ev

targeted examinations and is also taken into consideration when determining the need for additional supervthe banking agencies collect information on the scope of each bank’s and holding company’s external audi

quality of internal controls, and require audited financial statements and additional reporting on the quality banks and holding companies of significant size. The agencies’ Uniform Bank Performance Report or Uniform Thrift Performance Report allows supervisocompare financial trends across groups of peer banks to identify outlier or high risk banks. The agencies aknown as CAMELS, that provides a consistent methodology and terminology for assessing and assigning 

Similar uniform rating systems are used to assess holding companies, information technology, trust, and cosystems. The ROCA rating system is used for foreign banking organizations (see BCP 7). Each agency hasystems, such as horizontal examinations of a group of banks that it uses to supplement these interagency tSee EC 1 above for additional information on quarterly monitoring practices. Also see 12 U.S.C. § 1831mthe annual management attestation of internal controls framework.

EC 4 Principle 19: Supervisory approach Criterion The supervisor confirms banks’ and banking groups’ compliance with prudential regulations and other legLegal Framework 

See Overview. 

Practices and Procedures 

During regular on-site examinations, the U.S. federal banking agencies complete a series of testing procedagencies’ examination manuals, to confirm banks’ and holding companies’ compliance with prudential reg

requirements. In addition, compliance with some rules is monitored on an ongoing basis through the collefinancial and structure reports that must be filed. U.S. federal banking supervisors confirm that banks and 

maintain policies and procedures designed to ensure their compliance with applicable laws and regulationscompliance programs are evaluated by the banking agencies during on-site examinations. U.S. federal ban
EC 4 Principle 19: Supervisory approach 

developed and maintain extensive supervisory guidance to evaluate compliance programs and specific areacontrols, audit, consumer protection, fair credit reporting, home mortgage disclosure, real estate settlement 

money-laundering, among others. A complete listing of the guidance is available through each agency. 

EC 5 Principle 19: Supervisory approach Criterion The supervisor requires banks to notify it of any substantive changes in their activities, structure and overa

they become aware of any material adverse developments, including breach of legal or prudential requirem

Legal Framework 

See Principle 4 regarding transfer of significant ownership and Principle 5 for major acquisitions. For add

requirements for BHCs, see the applicable sections of the Bank Holding Company Act of 1956. For nationregulatory requirements to notify the OCC of changes include 12 CFR 5.30 - national banks must submit aapproval from the OCC to establish or relocate a branch, and 12 CFR 5.32 (12 USC § 215a-2) - for reorganational bank becomes a subsidiary of a bank holding company. See FDI Act sections 4 through 6 for varirequirements associated with required applications to FDIC. An insured savings association must provide FDIC before it establishes or acquires a subsidiary or engages in any new activity through an existing subs1828(m). A SLHC must obtain approval of the OTS for certain acquisitions of more than 5 percent of a noassociation or SLHC. 12 CFR 584.4. 

Practices and Procedures 

The U.S. federal banking agencies generally expect banks and holding companies to notify them of any su

activities, structure and overall condition, or as soon as they become aware of any material adverse develoof legal or prudential requirements. In addition, U.S. federal banking supervisors use formal off-site moni

required regulatory reports on structure to identify banks and holding companies exhibiting deteriorating tr

legal or prudential requirements, or substantively changing their activities. In the case of new banks and hbanking agencies routinely include a condition in their approval orders that requires prior notice of any chaorganization’s business plan during the first three years of operation. After this period, changes in the acti

state and federal law, would be subject to review during periodic safety-and-soundness examinations. Fur

agencies may impose notification requirements formally or informally as determined by supervisors. 

EC 6 Principle 19: Supervisory approach Criterion The supervisor has an adequate information system which facilitates the processing, monitoring and analy

information. The system aids the identification of areas requiring follow-up action. 

Practices and Procedures 

The U.S. federal banking agencies maintain a comprehensive set of databases containing examination, finafacilitate the processing, monitoring, and analysis of prudential information. These data sources are used t

agency-specific surveillance tools to support ongoing off-site analysis of, and follow-up action on, banking 

and holding companies and within the industry as a whole. For example, agency exam databases can iden
EC 6 Principle 19: Supervisory approach 

companies matters requiring the bank’s, holding company’s or their respective board’s attention for agencSpecific to financial data, each bank is required to file complete financial data to the Central Data Repositobasis. The format utilized for this process is known as the Call Report. The data contained within the repo

CDR by the Federal Financial Institutions Examination Council (FFIEC) and is then utilized in a multitude 

across each of the regulatory agencies, and even by the general public. The resulting data provides the age

produce high level reports of the condition of the banking system in various formats. Common examples o

both the Uniform Bank Performance Report (UBPR) and the Uniform Bank Holding Company Performanboth of which provide detailed analysis of a given bank’s or holding company’s financial condition. See FFwww.ffiec.gov/secreport.htm, for further review.

AC 1 Principle 19: Supervisory approach Criterion The supervisor employs a well defined methodology designed to establish a forward-looking view on the r

positioning the supervisor better to address proactively any serious threat to the stability of the banking sy

emerging risks. 

Practices and Procedures 

Each of the U.S. federal banking agencies employs well defined off-site surveillance procedures for measu

risk profiles of individual banks and holding companies and the banking environment as a whole for possib

surveillance systems focus heavily on identifying banks and holding companies that are exhibiting problemexamination resources can be directed to troubled organizations. They also flag banks and holding compancomplex activities. These programs use a mix of predictive econometric models, expert systems based on screens, and market-based financial measures to identify banks and holding companies warranting a height

For example, the agencies have adopted a standardized request for electronic loan files that supervisors can 

and report on the contents of a loan trial balance. Other examples include the Federal Reserve’s SR-SABR 

Canary Early Warning System and Global Outlook scenarios, and the FDIC’s Large Insured Depository Inthe details of which are available through each agency. Through their ongoing risk assessment processes, risks that may be increasing or risk-management systems that may need improvements. For example, the Oassessment systems evaluate whether the direction of a bank’s risk profile is increasing, decreasing, or stab

The agencies also conduct annually a joint review of the largest, complex credits that are shared by three o

review provides an opportunity for the agencies to identify trends in underwriting and credit classification overall commercial credit conditions, across the banking system. The 2008 review included 8,746 credits extended to 5,742 borrowers. 

See EC 1 for more information. 
Principle 20: Supervisory techniquesAn effective banking supervisory system should consist of on-site and off-site supervision and regular contacts with bank manOverview Pursuant to the authorities cited in the overview to Principle 19, the U.S. federal banking agencies complement regulatory stanthe safe and sound operation of banks and holding companies with a risk-focused supervisory approach. Supervision is accomcombination of on-site examinations and off-site reviews. In general, the primary federal banking supervisor conducts annualthe banks within its jurisdiction. See 12 U.S.C. § 1820(d). Smaller banks that satisfy certain qualifying criteria, including hav

in total assets, may be examined on an 18-month cycle. See 12 U.S.C. § 481; 12 CFR 4.6(OCC); 12 U.S.C. §§ 1463(a)(1) and 

563.170 and 584.1(g)(OTS). However, the OCC, FDIC, and OTS retain authority to examine a bank as frequently as they dee

example, the FDIC would conduct annual examination of problem institutions less than $500 million, and depending on the n

conduct more frequent visitations. See id. Examination areas for all banks include any cross-border operations. In addition t

banks and their affiliates, the OCC examines federal branches and federal agencies of foreign banks and bank service companalternates with state regulators in examining state licensed branches and agencies of foreign banks. See 12 U.S.C. §§ 1867 an

In their role as holding company supervisors, the Federal Reserve and the OTS also conduct inspections and make risk assessm

company’s operations. See 12 U.S.C. § 1842 a and 12 U.S.C. § 1467a(b)(4). All of the U.S. federal banking agencies examicompanies. See 12 U.S.C. § 1867. Examination areas for all banks and holding companies include any cross-border operatioOff-site supervision involves periodic surveillance and assessment of information from a variety of sources, including the supcompany. The information includes standard regulatory reports, which capture a host of commercial and financial informatio

The number and the type of report forms that must be filed depend on the size of a bank or holding company and the scope of 

surveillance also includes a review of reports of recent examinations and inspections, internal management and internal and ex(when requested by supervisors), reports filed by public companies (e.g., 10-Qs and 10-Ks), application materials, and publicl

information published in the financial press and elsewhere). In addition, it includes information obtained from regular discussinternal and external auditors, and other supervisors, both foreign and domestic. 

In on-site examinations and through continuous supervision, supervisory staff generally: (1) evaluate the soundness of the banassets and the effectiveness of its internal controls, policies, and management; (2) analyze key financial factors such as the ban

company’s capital, earnings, liquidity, and sensitivity to interest rate risk; (3) assess the bank’s or holding company’s exposur

risks; (4) check for compliance with banking laws and regulations; and (5) determine the bank’s or holding company’s overal

In addition to these specific areas, supervisors also evaluate transactions between a bank or holding company and its affiliates the transactions on the bank’s or holding company’s condition and to ascertain whether the transactions are consistent with thsections 23A and 23B of the Federal Reserve Act. 

The primary federal banking supervisor makes risk assessments with respect to the bank’s operations. For larger banks and hfederal banking agency maintains resident on-site supervisors who provide continuous supervision of the banking organizatio
Principle 20: Supervisory techniquesupdates on the bank’s and holding company’s condition and risk. Each agency has the authority to take an enforcement action 

opinion, the bank, holding company or any institution-affiliated party (IAP) is engaging or has engaged, or the agency has reathat the bank, holding company or any IAP is about to engage in an unsafe or unsound practice, or is violating or has violated

reasonable cause to believe that the bank,, holding company or any IAP is about to violate a law, rule, or regulation, or any coby the agency in connection with the granting of any application or other request by the bank or holding company or any writt

with the agency. See 12 U.S.C. §§ 1813(q) and (u), and 1818. 

The primary federal banking agencies generally have the authority to examine affiliates of the bank under their supervision. S(examinations of affiliates of state member banks); 481 (examinations of affiliates of national banks); 1464(d)(1)(B) (examina

savings associations); 1820(b)(4) (examinations of affiliates of state nonmember banks)); 1467a(b)(4)(subsidiaries of SLHCs)of BHC s). The OCC’s procedures regarding a functionally regulated affiliate of a national bank are described in the Comptro

Supervision Process (Sept. 2007), pages 20-22. The Federal Reserve has the authority to examine bank subsidiaries of BHCsReserve must rely to the fullest extent possible on the bank examinations conducted by the primary federal banking superviso

federal supervisor of both SLHCs and their state and federal savings association subsidiaries and thus need not rely upon exam

supervisor except when state savings banks regulated by the FDIC elect to be treated as a savings association for purposes of hsupervision. In addition, all of the federal banking agencies must rely to the fullest extent possible on the functional supervisoinsurance subsidiaries and any other subsidiary that is subject to comprehensive supervision by a federal or state authority for minimize duplication and unnecessary regulatory burden on regulated entities. See 12 U.S.C. §§ 1831v and 1844(c)(2)(E). Tbanking agency can conduct an examination of a functionally regulated subsidiary only if the agency has reasonable cause to 

engaging in activities that pose a material risk to the bank or is not in compliance with any Federal law that it has specific juri

such subsidiary, or for other prudential reasons and the information cannot be obtained from the functional supervisor. See 12 The U.S. federal banking agencies routinely share supervisory information with each other and with the functional supervisorthe U.S. Attorney General, Secretary of the Treasury, and the head of other federal agencies are required, unless prohibited by appropriate federal banking agency any information they believe raises significant concerns regarding the safety or soundness company. See 12 U.S.C. § 1831m-1. 

In certain cases, there is overlapping examination authority among the federal supervisors. For example, 12 U.S.C. § 1820(b)Federal Reserve the authority to examine any bank, and, if necessary, to independently determine the condition of that bank fo

insurance purposes. 

EC 1 Principle 20: Supervisory techniques Criterion The supervisor employs an appropriate mix of on-site and off-site supervision to evaluate the condition of 

and the corrective measures necessary to address supervisory concerns. The specific mix may be determinconditions and circumstances of the country. The supervisor has policies and processes in place to assess tand integration of on-site and off-site functions, and to address any weaknesses that are identified. 
EC 1 Principle 20: Supervisory techniques Legal Framework 

See Overview. 

Practices and Procedures 

The U.S. federal banking agencies apply a risk-based supervisory approach that focuses on evaluating riskemerging problems, and ensuring that these banks and holding companies take corrective action before prosafety and soundness. The agencies accomplish this through a mix of both on- and off-site supervisory actUnder U.S. law, the agencies conduct full-scope on-site examinations of banks at least once every year (foat least $500 million or that are not considered well-managed or well-capitalized) or 18 months (for banks than $500 million and that are considered well-managed and well-capitalized) to evaluate the condition of 

and the corrective measures necessary to address supervisory concerns. The agencies also conduct regular examinations and Community Reinvestment Act evaluations of banks to confirm that the organization is acompliance risk and complying with U.S. consumer protection laws and regulations. At the conclusion of 

board of directors receives a Report of Examination (ROE) that conveys the overall condition and risk proon the assigned supervisory ratings, discusses significant deficiencies, violations, and excessive risks, and 

which the board or management has committed. In their role as holding company supervisors, the Federal 

conduct inspections and make risk assessments of holding companies’ operations. See 12 U.S.C. § 1844(cU.S.C. § 1467a(b)(4)(OTS). While most banks and holding companies agree to promptly address criticismarise through the examination process, the agencies also have a variety of informal and formal enforcemeneffect corrective actions. See Principle 23 for information on enforcement powers and tools of supervisorsDuring the time period in between on-site examinations, the agencies conduct ongoing off-site surveillancand holding company and may follow up with additional on-site work and testing. Generally, the balance 

supervisory activities is dictated by the condition and size of the subject bank or holding company, with mwork being conducted at larger or more problematic banks and holding companies. At the largest and mosbanks and holding companies, the agencies’ Central Point of Contact (CPC) or Examiner-in-Charge (EIC) ongoing, on-site presence and continuous monitoring program. For other banks and holding companies, passigned responsibility for developing and executing examination strategies. The agencies monitor the success of their on- and off-site supervisory efforts in promptly identifying and abanks and holding companies on a continuous basis and make adjustments to off-site surveillance programapproaches as needed to improve their effectiveness. See Federal Reserve SR letters 06-2 and 97-24; OCC Process Handbook and PPM 5000-34 (REV), “Canary Early Warning System” (Aug. 7, 2001). Also see rPrinciple 19 for a summary of FDIC and OTS off-site monitoring systems.
EC 2 Principle 20: Supervisory techniques Criterion The supervisor has in place a coherent process for planning and executing on-site and off-site activities. Th

processes in place to ensure that such activities are conducted on a thorough and consistent basis with cleaobjectives and outputs, and that there is effective coordination and information sharing between the on-site 

Practices and Procedures 

Each of the U.S. federal banking agencies maintains written guidance for planning and executing on-site aGenerally, agencies annually develop on- and off-site examination strategies and goals based on the risk pholding company. Guidance can be found in each of the agencies’ examination manuals, updated regularl

the objectives and expected actions and outputs for these activities, and also details basic procedures for coand implementing off-site surveillance programs. Coordination and information sharing between on- and 

functions is facilitated by formal off-site monitoring programs that trigger follow-up by the on-site functiocompanies meet various screening thresholds. In addition, supervisory policies require the consideration oresults when supervisors are determining the scope and procedures of on-site reviews. See Federal ReservBank Supervision Process Handbook; FDIC RMMEP section 1.1; and OTS Holding Companies Handboodetails. Also see Principle 7 for a listing of federal banking manuals. 

EC 3 Principle 20: Supervisory techniques Criterion On-site work, conducted either by the supervisor’s own staff or through the work of external experts, is us

provide independent verification that adequate corporate governance (including risk managesystems) exists at individual banks; determine that information provided by banks is reliable; 

obtain additional information on the bank and its related companies needed for the assessment of 

the evaluation of material risks, and the identification of necessary remedial actions and supe

enhanced off-site monitoring; and monitor the bank’s follow-up on supervisory concerns.

Practices and Procedures 

On-site examinations address all key areas of a bank’s and holding company’s operations, including capita

management strength and quality of oversight from the board of directors, compliance with laws and regulsustainability of earnings, the adequacy of liquidity sources to support ongoing cash needs, and sensitivity position to market risk. These reviews incorporate independent verification of the effectiveness of risk macontrols, management reporting, and overall corporate governance. In addition, examination procedures mvalidating the reliability and accuracy of financial data reported to the agencies. Also, at each examination

follow-up to supervisory concerns raised at prior examinations or as a result of off-site monitoring. 
EC 3 Principle 20: Supervisory techniques 

During on-site examinations, U.S. federal banking supervisors review the most recent external auditor’s asholding company’s financials and the work of the loan review function and internal audit. Typically, supetesting of financial and Call Report reconcilements and accuracy. For banks over $1 billion, section 112 oInsurance Corporation Improvement Act (FDICIA) (see 12 U.S.C. § 1831m) requires a formal attestation f

management on the quality of the internal control structure. External auditors are required to attest to, and 

assertions of the bank’s management regarding internal controls. Section 404 of the Sarbanes-Oxley Act, 

requires an external auditor of a bank or holding company that is a public company annually to render an oeffectiveness of the company’s internal controls over financial reporting and make a management assessm

for a further discussion. As part of their Report of Examination, supervisors will specify matters requiring These are practices that deviate from sound governance, internal control, and risk management principles, impact earnings or the capital, risk profile, or reputation if not addressed, or that result in substantial noncoregulations, internal processes, or supervisory guidelines. Supervisors evaluate management plans for corrwhether they are likely to be effective. In cases of severe problems or where management has been unable 

deficiencies, either formal or informal actions are typically issued against the bank and holding company. 

require the bank or holding company to correct the most serious of examination findings and communicate corrections to the responsible agency, commonly on a quarterly basis. The U.S. federal banking agency th

judgment on management’s progress and can in turn structure the ongoing supervisory plan accordingly. Son corrective and remedial powers of the agencies.

EC 4 Principle 20: Supervisory techniques Criterion Off-site work is used as a tool to: 

regularly review and analyze the financial condition of individual banks using prudential reports, appropriate information, including publicly available information; follow up on matters requiring further attention, evaluate developing risks; and help identify tfurther work; and help determine the priorities and scope of on-site work. 

Practices and Procedures 

As part of formal, off-site monitoring programs, the U.S. federal banking agencies use automated screeninreports, standardized financial reports detailing key financial ratios and measures, and public sources of fin

monitor the performance and condition of supervised banks and holding companies and promptly identify supervisory attention. Supervisors periodically (e.g., quarterly) communicate with the bank’s or holding cdiscuss emerging issues or concerns. See EC 2 for a more detailed description of the off-site review proceagencies as well as various examination manuals by the agencies. 
EC 4 Principle 20: Supervisory techniques 

Examination staffs also use off-site surveillance tools and reports to plan the scope of, and determine prior

examination work, as well as to monitor the progress in responding to matters requiring further attention. further details. 

EC 5 Principle 20: Supervisory techniques Criterion Based on the risk profile of individual banks, the supervisor maintains sufficiently frequent contacts as app

Board, non-executive directors, Audit Committee and senior and middle management (including heads of and control functions) to develop an understanding of and assess such matters as strategy, group structure, 

performance, capital adequacy, liquidity, asset quality and risk management systems. 

Practices and Procedures 

During the course of regularly scheduled on-site examinations, the U.S. federal banking agencies commun

bank’s and holding company’s board, non-executive directors, audit committee, and senior and middle ma

of individual business units and control functions). This communication facilitates the development of an 

assessment of such matters as strategy, group structure, corporate governance, performance, capital adequaquality, and risk-management systems. It also provides an opportunity for the banking agencies to deliver corrective actions as needed and follow a bank’s and holding company’s progress in addressing earlier recconclusion of each exam, the supervisor will meet with the bank’s or holding company’s management and 

discuss findings and any significant issues found and to obtain management’s commitment to correct any w

the exam. The agency also provides the bank’s or holding company’s board of directors a written ROE fo

and senior officers. The ROE conveys the overall condition and risk profile of the bank and provides concsupervisory CAMELS ratings (those ratings assess the bank’s Capital adequacy, Asset quality, Managemeand Sensitivity to market risk); identifies any violations of law; assesses compliance with the Bank Secreccompliance to consumer laws and regulations and the Community Reinvestment Act. The ROE also discudeficiencies, violations, and excessive risks, and details corrective action to which the board or managemeFor large banks and holding companies and those exhibiting a higher degree of risk, the amount of commuwith all levels of a bank’s and holding company’s corporate governance structure is expanded, with the fre

contact determined based on the size or risk profile of the bank or holding company. This contact may incpresence to enable monitoring by CPC and EIC teams. Each agency has guidelines on communication expReserve SR letter 08-1/CA letter 08-1; OCC Bank Supervision Process Handbook; and OTS Examination 

and Holding Companies Handbook, section 200) 

EC 6 Principle 20: Supervisory techniques Criterion On an ongoing basis during on-site and off-site supervisory activities, the supervisor considers the quality 
EC 6 Principle 20: Supervisory techniques 

management. 

Practices and Procedures 

The U.S. federal banking agencies consider the capability of the board of directors and management, in theidentify, measure, monitor, and control the risks of a bank’s or holding company’s activities and to ensure 

company’s safe, sound, and efficient operation in compliance with applicable laws and regulations in all a

supervisory activities. The evaluation of the quality of management and the adequacy of board of directorholding company’s activities is central to the regular full scope on-site examinations required by U.S. law. management or the board of directors exhibit deficiencies, banks and holding companies are subject to heimonitoring and more in-depth testing as part of on-site work. As described in the overview to Principle 7, supervisors evaluate Management during the regular on-site eConclusions about management are often assigned as a result of assessments of each of other areas, under financial condition of the bank or holding company as well as related internal controls, risk-management p

adherence to the bank’s or holding company’s policies and regulations is a representation of board and ma

EC 7 Principle 20: Supervisory techniques Criterion The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to wh

the internal auditors’ work to identify areas of potential risk. 

Practices and Procedures 

The U.S. federal banking agencies assess the quality and scope of every bank’s and holding company’s intwhether or not audits are performed by the bank’s or holding company’s own staff or an outside vendor. Tconsideration of the independence of the function, the appropriateness of the risk assessment program for aand risks of the bank or holding company, the size and quality of staffing, and the effectiveness and complperformed. The results of this assessment are used in determining how reliable the resulting internal audit 

whether it may be relied upon in developing a supervisory assessment of a bank’s or holding company’s so

internal controls. Examination manuals maintained by the various agencies provide details of procedures u

and holding company’s audit function. See Principle 17 for additional details on how the banking agencie

audit function. 

EC 8 Principle 20: Supervisory techniques Criterion The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses by mean

through discussions or meetings with management. 

Practices and Procedures 

Findings of supervisory activities are written in report format and delivered to and discussed with the bankmanagement and the board of directors each examination cycle. See EC 5 for more details. The superviso

bank and holding company as a result of supervisory activities are also provided to the subject’s board of d
EC 8 Principle 20: Supervisory techniques 

management within the written examination reports. In cases where supervisory activity results in an asseholding company that is less than satisfactory, the bank’s or holding company’s board of directors and senaware of resulting regulatory restrictions where appropriate. Examples of these restrictions are constraints made to IAPs, requirements regarding the appointment of new directors or senior executive officers, restripayments while the bank or holding company is in a problem condition, and prohibition of new branches. agencies coordinate communication of examination activities and findings varies depending on the specifiholding company, structure, and in the case of state counterparts, geographic location. See EC 23 for spec

agencies may take. 

AC 1 Principle 20: Supervisory techniques Criterion The supervisor meets periodically with senior management and the Board to discuss the results of supervis

external audit. The supervisor should also meet separately with the independent Board members, as neces

Practices and Procedures 

At the conclusion of regularly scheduled on-site examinations, federal banking supervisors meet with seniboard of directors to discuss findings of the examinations and communicate supervisory ratings assigned. supervisors may also meet separately with independent board members. This communication focuses primsupervisory reviews and testing conducted by the banking agencies and any recommended follow-up actioencompass a discussion of any significant findings of the external audit. In addition, communication is gefrequent for larger banks and holding companies, and those exhibiting a higher risk profile or deteriorating 

and frequency of discussions determined by the overall risk profile. See EC 5 for more details. 
Principle 21: Supervisory reportingSupervisors must have a means of collecting, reviewing and analysing prudential reports and statistical returns from banks on consolidated basis, and a means of independent verification of these reports, through either on-site examinations or use of exteOverview As noted in the overview to Principle 20, off-site surveillance is a key component of the U.S. federal banking agencies’ risk-fapproach. A major part of this surveillance consists of the collection, review, and analysis of regulatory reports required to be on a periodic basis. These reports capture an array of data, including financial, operational, prudential, activities, and structurpreviously noted, the agencies’ authority to require the submission of information is broad, extending to affiliates of a bank or 

including information on a bank’s and holding company’s domestic and foreign activities and operations. It includes the auth

require the submission of reports necessary for the effective supervision of the particular bank or holding company or groups similar operations and/or risks. In addition, as discussed in detail under Principle 22, banks exceeding a certain asset threshold are required to be audited at le

independent public accountant meeting certain qualifying criteria. The external audit reports are required to be provided to thbanking agency.

EC 1 Principle 21: Supervisory reporting Criterion The supervisor has the powerto require banks to submit information, on both a solo and a consolidated bas

condition, performance, and risks, at regular intervals. These reports provide information on such matters a

sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, asset concentrationsector, geography and currency), asset quality, loan loss provisioning, related party transactions, interest ra

Legal Framework 

Under the authorities cited in the overview to Principle 20, the U.S. federal banking agencies have the pow

holding companies to submit information, on both a solo and a consolidated basis, on their financial condirisks, at regular intervals. Required reports provide information on balance sheet assets and liabilities, off-profit and loss, capital adequacy, asset quality, loan loss provisioning, affiliate and insider transactions. Th

information allowing for an assessment of liquidity, large exposures, asset concentrations (including by ecand currency), foreign exposures, interest rate risk, and market risk. 

Practices and Procedures 

The U.S. federal banking agencies have a robust regulatory reporting framework and have the power to req

for supervisory purposes at regular intervals. Banks and holding companies are subject to reporting requirements that include financial and other inform

must submit reports on an entity-specific basis, while BHCs with assets of $500 million or more and SLHC

financial and supervisory information on a consolidated basis. Banks owned by a BHC must submit finaninformation to the appropriate federal banking agency, and each bank must submit reports on an entity-spe
EC 1 Principle 21: Supervisory reporting 

reporting includes information about balance sheet items, off-balance-sheet exposures, profit and loss, capquality, loan loss provisioning as well as some information on interest rate risk sensitivity and market riskregulatory reports is used to create performance measures for analysis, including funding and liquidity, capquality and concentrations, earnings, and sensitivity to changes in market prices. The parent BHC must sufinancial statements on a “stand-alone” basis and also include information on related party transactions. M

for BHCs and Thrift Financial Report Schedule SI for SLHCs) must be submitted regarding certain related between the holding company and affiliates. In addition, all other subsidiaries are subject to reporting requirements that include financial and supervisoentities exceed certain thresholds. Many performance measures are derived from information reported by companies, and are included in the Uniform Bank Performance Report (UBPR), the Uniform Thrift Perforthrift institutions and the Bank Holding Company Performance Report (BHCPR). U.S. federal banking aginteragency basis to maintain regulatory reports under the Federal Financial Institutions Examination Counmaintained on an interagency basis by the FFIEC can be found at the following website: www.ffiec.gov/f

subset of these reports include: FFIEC 030 – Foreign Branch Report of Condition – reported quarterly or annually, depending on size and 

FFIEC 031 - Consolidated Reports of Condition and Income for a Bank with Domestic and Foreign OfficeFFIEC 041 - Consolidated Reports of Condition and Income for a Bank with Domestic Offices Only – repFFIEC 002 – Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks – reported FFIEC 009 – Country Exposure Report – reported quarterly The information included in these reports is used to derive various performance measures and ratios that aUBPRs. The Federal Reserve also maintains many regulatory reports submitted by banks and holding companies. at the following website: www.federalreserve.gov/reportforms. A subset of these reports, which reflect th

reports at the consolidated and individual levels, include: FR Y-9C – Consolidated Financial Statements for Bank Holding Companies – reported quarterly FR Y-9LP – Parent Company Only Financial Statements for Large Bank Holding Companies – reported qFR Y-9SP – Parent Company Only Financial Statements for Small Bank Holding Companies – reported se
EC 1 Principle 21: Supervisory reporting 

FR Y-11 – Financial Statements of U.S. Nonbank Subsidiaries of U.S. Bank Holding Companies – reportedepending on the size and nature of the subsidiary FR 2314 – Financial Statements of Foreign Subsidiaries of U.S. Banking Organizations – reported quarter

on size and nature of subsidiary FR Y-6 - Annual Report of Bank Holding Companies – reported annually FR Y-7 – Annual Report of Foreign Banking Organizations – reported annually FR Y-7N – Financial Statements of U.S. Nonbank Subsidiaries Held by Foreign Banking Organizations – 

FR Y-8 - The Bank Holding Company Report of Insured Depository Institutions' Section 23A Transactionquarterly FR 2886b – Consolidated Report of Condition and Income for Edge and Agreement Corporations – report

In addition to filing either FFIEC 031 or 041, each national bank is required to file with the OCC an AnnuSubsidiaries containing a variety of information including the lines of business in which the operating subs

directly with consumers. See 12 CFR 5.34(e)(6). The OCC and OTS also collect performance data on firs

mortgages from a group of national banks and savings associations with the largest mortgage servicing por

data in OCC and OTS Mortgage Metrics Report. The OTS is responsible for maintaining the regulatory reports submitted quarterly by savings associations reports can be found at the following website: http://www.ots.treas.gov/?p=ReportFormsBulletins. SLHC

Annual/Current Report. Among other items, this report requires consolidated and unconsolidated financia

can be found at the following website: files.ots.treas.gov/78171.pdf. These regulatory reports are used to 

monitoring and on-site examinations.Further, banks are required to report public loan data for the Home Mortgage Disclosure Act (HMDA) whdetermining whether banks are serving the housing needs in their markets; in distributing public-sector invinvestment where needed; and in identifying possible discriminatory lending patterns. Additionally, those 

Community Reinvestment Act’s (CRA) Large Bank Evaluations must report data associated with small buloans. 
EC 2 Principle 21: Supervisory reporting Criterion The supervisor provides report instructions that clearly describe the accounting standards to be used in pre

Such standards are based on accounting principles and rules that are widely accepted internationally. 

Legal Framework 

By statute, banks and holding companies are required to apply accounting principles that are no less stringaccepted accounting principles (U.S. GAAP) in preparing and submitting financial reports or statements reU.S. federal banking agencies and annual financial statements must be prepared in accordance with U.S. G1831n(a)(2) and 1831m(b)(1). The FFIEC has generally adopted U.S. GAAP for the Consolidated ReportIncome. This requirement is reiterated in the general instructions to relevant regulatory reports. See “InstrConsolidated Reports of Condition and Income (FFIEC 031 and 041),” at p. 8, available at www.ffiec.gov/PDF/FFIEC_forms/FFIEC031_041_200806_i.pdf; and “Instructions for Preparation of Co

Statements for Bank Holding Companies (Reporting Form FR Y–9C),” at p. GEN-3, available at www.federalreserve.gov/reportforms/forms/FR_Y-9C20080630_i.pdf. The “Thrift Financial Report (OTS 

Manual – General Instructions” p. 103, available at files.ots.treas.gov/4210048.pdf. See also the reporting 

(b)11 Annual/Current Report for SLHCs at the following website: files.ots.treas.gov/78171.pdf.

Practices and Procedures 

The U.S. federal banking agencies provide instructions for each report that must be submitted by banks anreporting instructions describe the accounting standards required in the preparation of regulatory reports. Mrequire the use of U.S. GAAP, which have been widely accepted over the years internationally, while othe7 report, and, in certain instances, the FR 2314 report, allow the option of U.S. GAAP, International Accoulocal accounting standards, depending on the nature of the report being filed and the domicile of the reportfinancial regulatory reporting by banks on forms FFIEC 031 and 041 (referred to as the Call Report) and T

required by statute to be no less stringent than U.S. GAAP, and the FFIEC has generally adopted U.S. GA

The Financial Accounting Standards Board (FASB) and the International Accounting Standards Board (IAconvergence of their accounting standards. The Securities Exchange Commission (SEC) approved the use private issuers in 2007 and currently is evaluating the possibility of allowing U.S. companies, including bacompanies, to adopt IFRS for financial reporting purposes. The U.S. federal banking agencies are closely wdevelopments.

EC 3 Principle 21: Supervisory reporting Criterion The supervisor requires banks to utilise valuation rules that are consistent, realistic and prudent, taking acc

where relevant. 

Practices and Procedures 

As described in EC 2, the U.S. federal banking agencies generally require banks and holding companies to apply various valuations rules to different categories of assets and liabilities. The accounting rules allow fliabilities to be reported on a historical cost, or amortized cost basis, while the application of lower of cost 

value accounting is required under certain circumstances. For example, loans held for investment are acco

cost, loans held for sale are valued at the lower of cost or fair value, and trading assets and liabilities are va
EC 3 Principle 21: Supervisory reporting 

FASB Statement No. 157, Fair Value Measurements (FAS 157), issued in September 2006, defines fair va

framework for measuring the fair value of assets and liabilities based on a three-level hierarchy, and expan

value measurements. The FASB’s three-level fair value hierarchy gives the highest priority to quoted pricidentical assets or liabilities (Level 1 inputs) and the lowest priority to unobservable inputs (Level 3 inputsquoted prices in active markets for identical assets or liabilities that the reporting entity has the ability to adate (e.g., the reporting date). Level 2 inputs are inputs other than quoted prices included in Level 1 that aror liability, either directly or indirectly. Level 3 inputs are unobservable inputs for the asset or liability. According to FAS 157, observable inputs are inputs that reflect the assumptions market participants would liability based on market data obtained from sources independent of the reporting entity. In contrast, unobthat reflect the reporting entity’s own assumptions about the assumptions market participants would use in 

liability based on the best information available under the circumstances. FAS 157 is effective for fiscal yNovember 15, 2007, and, with certain exceptions, is to be applied prospectively. However, on February 1FASB Staff Position No. FAS 157-2, which delays the effective date of FAS 157 for all nonfinancial assetliabilities to fiscal years beginning after November 15, 2008 and interim periods within those fiscal years, 

are recognized or disclosed at fair value on a recurring basis, i.e., at least annually, in the financial stateme

apply to entities that have issued interim or annual financial statements or Call Reports that include the appmeasurement and disclosure provisions of FAS 157. Banks and holding companies must adopt FAS 157 faccordance with the standard’s effective date, including the delayed effective date for eligible nonfinancia

liabilities. Thus, a bank or holding company with a calendar year fiscal year must adopt FAS 157 as of Janany fair value measurements subject to the delay mentioned above. This standard did not significantly chavalue, but rather, compiled the fair valuation guidance from other areas of U.S. GAAP and established the one standard. FASB Statement No. 159, The Fair Value Option for Financial Assets and Financial Liabilities (FAS 159

allows banks and holding companies to report certain financial assets and liabilities at fair value with the c

included in earnings. In general, a bank or holding company may elect the fair value option for an eligible when it first recognizes the instrument on its balance sheet or enters into an eligible firm commitment. A bmay also elect the fair value option for eligible items that exist on the effective date of FAS 159. The decioption for an eligible item is irrevocable. A bank or holding company that elects the fair value option is ex

management and control practices to the assets and liabilities that will be accounted for at fair value under FAS 159 is effective as of the beginning of a bank’s or holding company’s first fiscal year that begins afte

should not be applied retrospectively to prior fiscal years, except as permitted in the standard’s early adoptThe definition of fair value in U.S. GAAP is similar to the definition of fair value in IFRS. However, the a

“day one” gains for certain financial instruments is different under IFRS and U.S. GAAP. A fair value opt
EC 3 Principle 21: Supervisory reporting 

IFRS, with certain eligibility requirements that differ from those in U.S. GAAP. The current use of the faiand U.S. GAAP is generally limited to larger, more complex banks and holding companies.

EC 4 Principle 21: Supervisory reporting Criterion The supervisor collects and analyses information from banks at a frequency (e.g., monthly, quarterly and a

with the nature of the information requested, and the size, activities and risk profile of the individual bank. 

Practices and Procedures 

The U.S. federal banking agencies collect and analyze information quarterly from all banks, bank holding consolidated assets of $500 million or more, and SHLCs of all sizes. If the BHC is below the $500 million 

a parent-only report on a semiannual basis. In addition, reports from other subsidiaries, such as nonbank sare required to be submitted either quarterly or annually, depending of the size and nature of the subsidiaryreports and reporting frequency. At large banks or holding companies where the agencies have on-site examination teams, supervisors recemanagement reports that allow them to monitor the bank’s or holding company’s condition and trends in k

segments. Similarly, the agencies may direct individual banks and holding companies to provide informatbasis, depending on their risk profile. For example, monthly reports on key risk areas may be required frocompanies that are identified as posing special supervisory concerns or that are subject to certain enforcemsituations, daily reports may be received on key funding or liquidity issues. 

EC 5 Principle 21: Supervisory reporting Criterion In order to make meaningful comparisons between banks and banking groups, the supervisor collects data 

relevant entities covered by consolidated supervision on a comparable basis and related to the same dates ((flow data). 

Practices and Procedures 

The U.S. federal banking agencies collect reports on the same dates for all entities in the consolidated hold

frequency may differ given the size and nature of the entity, the reporting dates are as of the calendar quar

holding companies are required to complete reports using a standard set of reporting instructions, thereby e

reported items between banks and holding companies. The agencies meet during the year to determine what revisions, if any, need to be made to regulatory repor

supervisors, changes in risk profiles, changes in accounting rules, or other factors. Revisions are usually mcalendar quarter of the following year. For example, revisions to the 2008 reporting requirements were de

implemented as of the first calendar quarter end for 2008 (i.e., March 31, 2008). However, changes to regsometimes implemented later in the year. For example, some reporting requirements changes will be impl
EC 5 Principle 21: Supervisory reporting 

calendar quarter end for 2009 (i.e., June 30, 2009), and others will become effective as of the end of the fo(i.e., December 31, 2009). Implementation of reporting requirements is sometimes staggered to lessen the and holding companies. The agencies also work together to ensure, to the extent possible, that the information reported at the subsito information that is collected at the consolidated holding company level. In addition, revisions to supplementities (for example, a nonbank subsidiary report) are driven by changes made to the bank report and the company report which helps ensure that comparable information is reported across the holding company. reports. 

EC 6 Principle 21: Supervisory reporting Criterion The supervisor has the power to request and receive any relevant information from banks, as well as any o

irrespective of their activities, where the supervisor believes that it is material to the financial situation of tor to the assessment of the risks of the bank or banking group. This includes internal management informa

Legal Framework 

As noted in the overview to Principle 19, the U.S. federal banking agencies have broad statutory authority information from supervised banks and holding companies, including financial data and information on thstructure, corporate governance, risk management, and any other details necessary to determine and enforcapplicable laws and ensure the safety and soundness of banks and holding companies. See 12 U.S.C. §§ 9

481, 483, 602, 625, 1464(d) and(v), 1467 (d) and (h), 1467a(b)(2) and (4), 1467a(g), 1817(a), 1817(a)(2), 1844(c), 3105(c), and 3108. Banks and holding companies must provide supervisors with full and comple

records, and employees; failure to do so can result in the imposition of administrative sanctions. These reqforeign operations of banks and holding companies; however, it should be noted that the laws of foreign ho

U.S. banks and holding companies operating in such countries from sharing certain information with the UUnder these statutory authorities, U.S. federal banking agencies have the power to request and receive any 

banks and holding companies, irrespective of their activities, where the supervisor believes that it is materisituation, or to the assessment of the risks of the bank or holding company. This includes internal managenational banks, see 12 U.S.C. § 161(a) and (c)). However, as discussed in greater detail in the overview to authority is limited by the requirement that the federal banking agencies must rely to the fullest extent possupervisors of the securities and insurance subsidiaries and any other subsidiary that is subject to functiona

or state authority. See 12 U.S.C. §§ 1831v and 1844(c)(2)(E).Further, as noted under EC 4, the agencies have the authority to request more frequent and supplemental re

Practices and Procedures 

 U.S. federal banking agencies have the power and authorization to request any relevant information from companies that is deemed necessary for supervisory purposes. Even affiliates of banks and holding comp
EC 6 Principle 21: Supervisory reporting 

be exempt from reporting certain information can be required to do so by their U.S. federal banking agencsupervisors can request and obtain internal management information. In addition, an agency may request ifunctional supervisor for entities it does not supervise (for example, an insurance underwriting subsidiary tregulated by an insurance supervisor). See Principle 20 Overview for a more detailed discussion of functio

EC 7 Principle 21: Supervisory reporting Criterion The supervisor has the power of full access to all bank records for the furtherance of supervisory work. Th

similar access to the bank’s Board, management and staff, when required. 

Legal Framework 

Under the authorities cited in EC 6, the U.S. federal banking agencies have the power of full access to all brecords for the furtherance of supervisory work. The agencies also have similar access to the bank’s or ho

management, and staff, when required. 

Practices and Procedures 

U.S. federal banking agencies have the authority to review all books and records of a bank or holding comnecessary for supervisory purposes. The agencies have access to the bank’s or holding company’s board, when required to discuss supervisory matters. Furthermore, the agencies have the authority to require a ba

submit any information if there is a supervisory need, even when a particular bank or holding company worequired to submit such information. 

EC 8 Principle 21: Supervisory reporting Criterion The supervisor has a means of enforcing compliance with the requirement that the information be submitte

basis. The supervisor determines that the appropriate level of senior management is responsible for the accreturns, can impose penalties for misreporting and persistent errors, and can require that inaccurate inform

Legal Framework 

As discussed under EC 6, banks and holding companies are required by statute to comply with reporting reinformation disclosure requests of federal banking agencies. A failure to comply (including by submitting 

misreporting or persistent errors) can provide the basis for informal or formal enforcement measures, inclu(C&D) proceedings and the imposition of civil monetary penalties (CMP), against a bank or holding compaffiliated parties (IAPs). Under certain circumstances, a culpable IAP also may be subject to suspension aU.S.C. §§ 1817(a) and 1818(b) and (i). The remedial provisions are structured to be appropriate to the sev

These measures help ensure compliance with the requirement that information be submitted on a timely an
EC 8 Principle 21: Supervisory reporting 

As described more fully in Principle 22, public companies, including banks and holding companies that arwith the SEC, are required by the Sarbanes-Oxley Act of 20021 to obtain an annual audit of the financial s

controls over financial reporting. Public company officers must acknowledge in writing that they have evainternal financial controls and the Chief Executive Officer (CEO) and Chief Financial Officer (CFO) are r

that they have reported to the independent auditors and to the audit committee all information regarding siinternal controls that could adversely affect the company's ability to provide accurate financial reports. Se

As described more fully in EC 10 and 11, for banks with assets of $1 billion or more, the agencies require management's responsibilities for preparing the bank’s annual financial statements, for establishing and m

internal control structure and procedures for financial reporting, and for complying with laws and regulatiosoundness; (2) an assessment by management of the bank’s compliance with such laws and regulations du

(3) an assessment by management of the effectiveness of such internal control structure and procedures as year. See 12 CFR 363.2. 

Practices and Procedures 

U.S. federal banking agencies can impose CMPs, negotiate memoranda of understanding (MOU) and issue 

holding companies if information is not reported on a timely basis or on an accurate basis. The agencies c

and holding companies to amend previously filed reports when material errors have occurred. The consoli

for banks and holding companies must be signed by the CFO (or the individual performing the equivalent representative must attest that the report has been prepared in conformance with the instructions and the in

therein is true and correct to the best of their knowledge and belief. The bank level report must also be sigequivalent) as well as three members of the bank’s board of directors and all attest that the report has been with the instruction and the information contained therein is believed to be true and correct. 

EC 9 Principle 21: Supervisory reporting Criterion The supervisor utilises policies and processes to confirm the validity and integrity of supervisory informat

program for the periodic verification of supervisory returns by means either of the supervisor’s own staff o

Practices and Procedures 

U.S. federal banking supervisors review and verify regulatory reports during the course of on-site examinacompanies. For example, an area of significant regulatory interest and scrutiny is the accuracy of the repoand lease losses (ALLL). Comprehensive examination procedures are used to evaluate the ALLL. In addition, the U.S. federal banking agencies utilize extensive off-site automated programs that provide v(“edits”) against the regulatory reports submitted by banks and holding companies. Some edits check the m

certain areas of the regulatory reports (so-called “validity edits”) while other edits review relationships bet

1Pub. L. 107-204 (July 30, 2002), 116 Stat. 745. 
EC 9 Principle 21: Supervisory reporting 

the reports and certain qualitative measures (called “quality edits”). All edit exceptions must either be cor

edit explanation provided by the reporting bank or holding company is found to be unacceptable by the fedadditional investigative work is performed with the reporting bank or holding company until the edit excep

(sometimes resulting in amended reports). There cannot be any validity edits exceptions on the regulatory 

exceptions must be considered reasonable by the federal banking agency before the report is accepted by tAll edit explanations are documented and reviewed during the reports submission process. The agencies cholding companies to submit amended reports when supervisors identify material errors in information sub

For consumer compliance examinations, supervisors verify the accuracy of the HMDA and CRA data submcorrections if necessary. 

EC 10 Principle 21: Supervisory reporting Criterion The supervisor clearly defines and documents the roles and responsibilities of external experts, including th

when they are appointed to conduct supervisory tasks and monitors the quality of the work. External exper

routine validation or to examine specific aspects of banks’ operations. 

Practices and Procedures 

The banking agencies generally do not utilize external experts to perform supervisory tasks. However, on 

during periods where staffing needs to be augmented, the agencies may use external experts to perform specommercial credit reviews. Tasks and deliverables are outlined in a formal contract with a defined timelintypically filled with former supervisors or subject matter experts who are supervised by agency personnel. 

EC 11 Principle 21: Supervisory reporting Criterion The supervisor requires that external experts bring to its attention promptly any material shortcomings iden

any work undertaken by them for supervisory purposes. 

Practices and Procedures 

When banking agencies engage consultants or external experts (see EC 10), such experts and consultants asupervision of on-site agency personnel, and as a result, their findings are reported to the agencies. 
Principle 22: Accounting and disclosureSupervisors must be satisfied that each bank maintains adequate records drawn up in accordance with accounting policies anaccepted internationally, and publishes, on a regular basis, information that fairly reflects its financial condition and profitabil(Reference document: Enhancing bank transparency, September 1998.)Overview Section 36 of the FDI Act, 12 U.S.C. § 1831m, requires, each bank exceeding a minimum asset threshold to submit an annual U.S. federal and state banking agencies containing a report signed by the chief executive officer and the chief accounting or fiwhich includes a statement of management’s responsibilities for preparing financial statements, establishing and maintaining control structure and procedures for financial reporting; and complying with safety-and-soundness laws and regulations. See and 12 CFR 363.2(b). The report must include an assessment, as of the end of the bank’s most recent fiscal year, of (a) the efinternal control structure and procedures; and (b) the bank’s compliance with applicable safety-and-soundness laws and regul§ 1831m(b)(2)(A) and (B). An independent public accountant must attest to and report separately on management’s assertion

The banks exceeding the minimum asset threshold are required to prepare annual financial statements in accordance with U.Saccounting principles (U.S. GAAP). See 12 U.S.C. § 1831m(b)(1) and section 37 of FDI Act, 12 U.S.C. § 1831n. However, banking agency may determine that the application of any U.S. GAAP principle to any bank is inconsistent with the objectiveAct, and may, with respect to reports or statements required to be filed with such agency, prescribe an accounting principle wh

banks and holding companies which is no less stringent than U.S. GAAP. These financial statements must be audited by an inaccountant in accordance with U.S. GAAP. Id. § 1831m(d)(1). The accountant is required to determine and report whether th

presented fairly under U.S. GAAP. See 1831m(d)(2). Publicly traded institutions registered with the SECs are required to un

of their financial statements by an independent public accountant, who must report findings to the bank’s audit committee. Th

must provide the accountant’s report to any appropriate federal or state banking agency. Id. § 1831m(g)(2). 

Independent public accountants providing these services to banks must meet certain statutory qualifying criteria. See 12 U.S.C

FDIC or an appropriate U.S. federal banking agency may remove, suspend, or bar an independent public accountant, upon a s

from performing the audit services described above. Id. § 1831m(g)(4) and, for national banks, 12 CFR 19.243. In addition, 

institution-affiliated party (IAP), may be subject to enforcement actions such as section 8 actions under the FDI Act, C&D pro

of CMP, and/or suspension or industry-wide debarment in connection with services provided to a bank. See 12 U.S.C. §§ 181

regulations elaborate on the duties of the independent public accountants. See 12 CFR 363. 

Statutes and regulations address the applicability of the foregoing requirements to banks that are part of a holding company. I

audit requirements applicable under 12 U.S.C. § 1831m may be satisfied at the holding company level. In addition, the federaissued an interagency policy statement addressing external auditing programs. See “Interagency Policy Statement on Externa
Principle 22: Accounting and disclosureBanks and Savings Associations,” 64 Fed. Reg. 52319 (Sept. 28, 1999). The agencies apply this statement to all banks and ho

Federal Reserve SR letter 99-33 (SUP) and OCC Bulletin 99-37, “Interagency Policy Statement on External Auditing Program

agencies apply this statement to encourage all banking organizations not subject to other audit requirements to adopt an externthey also support BCBS’s report “Enhancing Bank Transparency,” September 1998, available at www.bis.org/publ/bcbs41.pd

requires an independent audit by a qualified independent public accountant of a savings association with a composite rating of 

controls savings association subsidiaries with aggregate consolidated assets of $500 million or more. See 12 CFR 562.4(b)-(d

EC 1 Principle 22: Accounting and disclosure Criterion The supervisor has the power to hold bank management and the bank’s Board responsible for ensuring tha

systems and the data they produce are reliable. 

Legal Framework 

The information required to be provided by banks and holding companies is required to be accurate. (For U.S.C. § 161). To ensure accuracy and reliability, banks and holding companies must establish and maintrecord-keeping systems. See 12 U.S.C. § 1831m. As indicated in the overview to this principle, the federabroad remedial authority to take enforcement actions against a bank and its IAPs, including board memberprovide misleading or false information. 

Practices and Procedures 

The U.S federal banking agencies have the supervisory power and responsibility to evaluate management’associated policies and procedures to ensure that entities are operating in a safe and sound manner and havsupport the level of risk. The board of directors and senior managers of a bank or holding company are rethe bank operates in a safe and sound manner. To meet the safety and soundness guidelines of section 39 o

U.S.C. § 1831p-1), the bank should maintain effective systems and internal controls to produce reliable anreports. For national banks, see generally 12 CFR 30. 

Banks and holding companies are required to submit quarterly regulatory financial reports such as the ConCondition and Income (Call Report) for banks, the Consolidated Financial Statements for Bank Holding CBHCs, and the Thrift Financial Reports (TFRs) for OTS regulated savings associations and TFR Schedule Annual/current Report for SLHCs. These reports require the CFO (or equivalent) to attest to the accuracy preparation in accordance with regulatory reporting instructions. Such instructions require the reports to bwith U.S. GAAP. Furthermore, Call Reports and TFRs require the bank’s director (trustee) to certify the aprepared in accordance with regulatory reporting instructions which are based on U.S.GAAP. These reporPrinciple 21. Federal banking agency staff regularly review the accuracy of accounting data submitted to supervisors conduct periodic reviews of Call Report or TFRs and other data to determine whether the bank procedures in place to accurately report such data. 

1 The OCC encourages all national banks to have independent external audits of their operations and financial records. See OCC Bulletin. 9

Handbook, Internal and External Audits (Apr. 2003). 
EC 1 Principle 22: Accounting and disclosure 

Banks that exceed a prescribed threshold are required by section 112 of the Federal Deposit Insurance Cor

of 1991 (FDICIA 112) (see 12 U.S.C. § 1831m) and its implementing rules in 12 CFR 363 to obtain an indits annual financial statements that are prepared in accordance with U.S. GAAP. The reporting threshold ibanks with total assets of $500 million or more. In addition, at banks with total assets of $1 billion or morto provide an assessment of the effectiveness of the internal control structure and procedures and also to obpublic accountant’s assessment on the bank’s internal control structure and procedures for financial reporti

Public companies, including banks and holding companies that are publicly registered must comply with Sincluding the Sarbanes-Oxley Act of 20022 to obtain an annual audit of the financial statements and the in

financial reporting. Public company officers must acknowledge in writing that they have evaluated the cocontrols and the CEO and CFO are required to sign and certify that they have reported to the independent committee all information regarding significant deficiencies in internal controls that could adversely affect provide accurate financial reports. See 15 U.S.C. § 7241. Furthermore, it is unlawful for any officer or dircompany, or any other person acting under their direction, to fraudulently influence, coerce, manipulate, opublic or certified accountant performing an audit of the financial statements of that issuer for the purpose 

financial statements materially misleading. See id. § 7242. 

U. S. federal banking agencies review of safety and soundness includes review of risk management and ac

controls. If the U. S. supervisor determines management’s risk management or control process to be defic

number of available responses to address such deficiencies, including requiring increased regulatory capitameasures. Further discussion of the available supervisory measures is included in other principles, includi

EC 2 Principle 22: Accounting and disclosure Criterion The supervisor has the power to hold bank management and the bank’s Board responsible for ensuring tha

issued annually to the public receive proper external verification and bear an external auditor’s opinion. 

Legal Framework 

The broad remedial authority cited in the overview to this principle and referenced under EC 1 provides a bank’s or holding company’s board members and management responsible for ensuring that the financial sto the public are reviewed and properly verified by an independent, appropriately credentialed public acco

holding companies that have external audit requirements as described in this principle. 

Practices and Procedures 

U. S. federal banking agencies, through regulation and guidance, strongly endorse sound corporate governand practices for all banks. Supervisory regulation and guidance require banking organizations, including 

2 Pub. L. 107-204 (July 30, 2002), 116 Stat. 745. 
EC 2 Principle 22: Accounting and disclosure 

board, to have in place adequate governance and controls related to financial reporting. U. S. federal banking agencies require independent external audits on annual financial statements and relat

on prescribed thresholds, regardless of whether the bank is public or non-public. Banks and holding comp

registered also must comply with SEC requirements, including the Sarbanes-Oxley Act to obtain an annuastatements and the internal controls over financial reporting and are subject to the SEC’s reporting requiremreporting of quarterly and annual financial reporting. The audited annual financial statements, as well as qstatements, of public companies are made publicly available by the SEC and by the OTS for certain publicassociations that are subject to CEO and CFO certification. U. S. supervisors require banks and holding companies to file applicable financial reports that include finareports of condition that reflect the capital to be accurate. These reports, for both public and non-public ba

companies, are made public by the federal banking agencies with the exception of certain information deem

certain data related to Fiduciary and Related Services). As described in EC 3 for this principle, such finan

required to be certified by the bank’s or holding company’s CFO and a specified number of directors (trus

EC 3 Principle 22: Accounting and disclosure Criterion The supervisor requires banks and holding companies to utilize valuation rules that are consistent, realistic 

account of current values where relevant, and to show profits net of appropriate provisions. 

Practices and Procedures 

U. S. supervisors require banks and holding companies to file applicable financial reports via Call Reports

Financial Statements that result in financial statements and reports of condition that reflect the capital to be principles applicable to reports or statements required to be filed with federal banking agencies by all bank

shall be uniform and consistent with, and no less stringent than U.S. GAAP as required in Section 37 of th§ 1831n(a)(2). The supervisors’ requirements for banks to utilize valuation rules that are consistent, realisaccount of current values, where relevant, are further described in EC 3 of Principle 21. The banking agencies, through the Federal Financial Institutions Examination Council (FFIEC), issue reporequired regulatory financial reports. Those reporting instructions require banks to report pretax income nand lease losses. The supervisory approach related to banks’ provisions and reserves is included in PrincipPolicy Statement on the Allowance for Loan and Lease Losses,” 66 Fed. Reg. 35629 (July 6, 2001); FDIC 

Bulletin 2001-37, “Policy Statement on Allowance for Loan and Lease Losses Methodologies and DocumSavings Institutions” (July 20, 2001).

EC 4 Principle 22: Accounting and disclosure 
EC 4 Principle 22: Accounting and disclosure Criterion Laws or regulations set, or the supervisor has the power, in appropriate circumstances, to establish, the sco

individual banks and holding companies and the standards to be followed in performing such audits. 

Legal Framework 

In general, external auditors must determine and report whether the financial statements of a bank are preswith GAAP. See 12 U.S.C. § 1831m(d)(2). In general, the external audits must meet or exceed the scope by generally accepted auditing standards (GAAS). Id. § 1831m(f). 

Practices and Procedures 

The U.S. supervisors require banks covered by section 36 of the Federal Deposit Insurance Act (12 U.S.C. implemented by part 363 of the FDIC's regulations (12 CFR 363) (i.e., banks with more than $500 million beginning of their fiscal year), to have an external financial statement audit by an independent public acco1831m(d)(1) and (g)(1). Savings associations with composite ratings of less than “1” or “2,” including tho

million in total assets, also require an independent audit. SLHCs that control savings association subsidiar

consolidated assets of $500 million or more also require an independent audit. 12 CFR 562.4(b). These banks and holding companies are required, and all other banks and holding companies are encourag

audit performed in accordance with GAAS. The scope of the audit engagement shall be sufficient to permand report whether the financial statements taken as a whole are presented fairly and in accordance with Ube conducted in accordance with GAAS and section 37 of the FDI Act. See 12 U.S.C. § 1831n. An “Inter

on External Auditing Programs of Banks and Savings Associations” was issued in September 1999, (64 Fe

(Sept. 28, 1999)), to provide guidance to banks in maintaining effective systems and internal control to pro

financial reports. For national banks, see 12 CFR 30, appendix A, § II.A. While some banks and holding 

to independent audit requirements, the agencies encourage them to obtain independent audits. See, e.g., O

7, 1999), “Interagency Policy Statement On External Auditing Programs” (Oct. 7, 1999) and Comptroller’

External Audits (Apr. 2003). GAAS generally require an auditor to adequately plan the audit, be independent, and obtain reliable eviden

non-public and public companies are prescribed by the American Institute of Certified Public Accountants 

Company Accounting Oversight Board (PCAOB), respectively. 

EC 5 Principle 22: Accounting and disclosure Criterion Supervisory guidelines or local auditing standards determine that audits cover such areas as the loan portfo

non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizatinternal controls over financial reporting. 

Legal Framework 

As noted under EC 4, external audits generally must meet or exceed the scope and procedures required by may have to comport with additional requirements, as determined by the supervisor by regulation, guidelinrelated materials. 
EC 5 Principle 22: Accounting and disclosure Practices and Procedures 

As previously discussed, U. S. supervisors require certain banks and holding companies to obtain annual astatements performed in accordance with appropriate U.S. GAAP and GAAS and external audits of interna

reporting. Financial statement audits cover areas such as loans, allowance for loan losses, and asset valuatenable the auditor to provide an opinion on whether the financial statements as a whole are presented fairlypercent of consolidated assets in U.S. bank holding companies were audited as of year-end 2007 as compilof the External Auditing Firm” collected on the Consolidated Financial Statements for Bank Holding Comthe Parent Company Only Financial Statements for Small Bank Holding Companies—FR Y-9SP. 

For a smaller bank not subject to the audit requirements, a non-audit attestation engagement is likely to be 

its financial statements. Such an attestation engagement may be performed for all internal controls relating 

annual financial statements or specified schedules of the bank’s regulatory reports. This type of engagemegenerally accepted standards for attestation engagements. This report could provide recommendations for control, including suggestions to mitigate risks. 

EC 6 Principle 22: Accounting and disclosure Criterion The supervisor has the power to reject and rescind the appointment of an external auditor that is deemed to 

or independence, or not to be subject to or not to follow established professional standards. 

Legal Framework 

As noted in the overview to this principle, independent public accountants providing these services to bankstatutory qualifying criteria. See 12 U.S.C. § 1831m(g)(3). The FDIC or an appropriate federal banking asuspend, or bar an independent public accountant, upon a showing of good cause, from performing the reqbank. Id. § 1831m(g)(4) and, for national banks, 12 CFR 19.243. “Good cause” would exist, for example

is determined to have inadequate expertise or independence or not to be subject to or follow established prnational banks, see 12 CFR 19.243(a). Each bank is required to provide the FDIC and the appropriate fedewritten notice, within a specified time period, of the engagement of an independent public accountant, or tof the independent public accountant previously engaged and must include a statement of the reason for su363.4(d). An independent public accountant performing an audit who ceases to be the accountant for a banFDIC and the appropriate federal banking agency in writing of such termination within a specified time pereasons for the termination. See 12 CFR 363.3(c). 

Practices and Procedures 

In the US, auditors are licensed by individual states and must comply with appropriate licensing requireme

censure or remove auditors who have been deemed not to comply with appropriate auditing standards. In 

audit public companies must register with the PCAOB which reviews selected audits and evaluates adhereGAAS. These reviews are performed at least every three years. The larger public accounting firms are evSection 36 of the FDI Act indicates that all auditors who provide services under the FDI Act must be subje

review. See 12 U.S.C. § 1831m(g)(3)(A). Banking agencies have the authority to remove, suspend or bar 
EC 6 Principle 22: Accounting and disclosure 

accountant upon showing of good cause from performing audit services under the act. For national banks, addition, in 1999 the federal banking agencies issued rules of practice with respect to the FDI Act (“InteraExternal Auditing Programs of Banks and Savings Institutions,” 64 Fed. Reg. 52319 (Sept. 28, 1999)) whi

guidance with respect to external audits. See 12 CFR 363. The key is that the board or audit committee approgram, the firm is independent, the engagement letter is adequate, and the board exercises adequate due supervisors typically review board minutes and other documents to evaluate external audit’s independence 

Annual Reports and Peer Review reports submitted by certain banks. In addition, the supervisors may revIf there is evidence that the work would not meet appropriate external audit standards, further action would disbarment of the accountant. If a supervisor concludes, based on the review of the specific work performed, discussions with the audit fdocumentation, that the external auditor does not have the requisite expertise, independence, or does not foprofessional standards, the supervisor discusses these findings and the actions the agency may take with thmanagement, board of directors (or audit committee), and the external auditor. If the issue cannot be resol

agency can bar the accountant from performing audits under the act.

EC 7 Principle 22: Accounting and disclosure Criterion The supervisor requires banks to produce annual audited financial statements based on accounting principl

widely accepted internationally and have been audited in accordance with internationally accepted auditing 

Legal Framework 

As discussed in the overview to this principle, banks are required by statute to produce annual audited fina

U.S. GAAP and that have been audited in accordance with GAAS. Other audit requirements apply to hold

Practices and Procedures 

U.S. federal banking agencies require banks to submit quarterly regulatory financial reports such as the Co

Condition and Income (Call Report) for banks, the TFR for OTS institutions, the Consolidated Financial SHolding Companies (FR Y-9C) for BHCs, and TFR Schedule HC and Form H-(b)11 Annual/Current Repoprepared in accordance with U.S. GAAP. These reports follow U.S. GAAP, which is accepted internationother reports for foreign-based banking organizations currently allow the option of U.S. GAAP or other ac

as International Financial Reporting Standards (IFRS). Banks that exceed a prescribed threshold are required by FDICIA 112 (12 U.S.C. § 1831m) and its implem363, to obtain an independent external audit of their annual financial statements. Annual financial statemeaccordance with U.S. GAAP and external audits must be prepared in accordance with GAAS. See 12 U.S(d)(1) and 12 CFR 363.2(a) and 363.3(a).
EC 8 Principle 22: Accounting and disclosure Criterion Laws, regulations or the supervisorrequire periodic public disclosures of information by banks and holdin

adequately reflect the bank’s true financial condition. The requirements imposed should promote the comreliability and timeliness of the information disclosed. 

Legal Framework 

Under the statutory provisions cited in the overview to this principle, interagency guidelines implementing approaches, and supervisory guidance, the federal banking agencies require the periodic public disclosures 

and holding companies that adequately reflect their true financial condition, including capital adequacy. Fgenerally 12 CFR 3 and 18. The disclosure requirements are broadly applicable, subject to uniform submi

ensure the timeliness and relevance of information. Uniform requirements ensure comparability of informreliability are ensured by separate requirements regarding the adequacy of financial record-keeping system

requirements is reinforced by the specter of substantial remedial consequences for submitting misleading o

Practices and Procedures 

As cited previously in this principle, banking supervisors require banks and holding companies to complet

regulatory reports which the supervisors make publicly available quarterly. These regulatory reports are b

reporting instructions that follow U.S. GAAP. These accounting principles and the required standardized and instructions for required quarterly regulatory reporting promote the comparability, relevance, and reliatimely fashion. Furthermore, banks and holding companies registered with the SEC and the OTS have addannual financial reporting and disclosure requirements. Federal banking agencies review regulatory report

the agencies determine that the information or disclosures are incorrect, they may require that the bank or 

regulatory reports. Information in regulatory reports may differ from that required in audited financial statU.S. banks adopting the Advanced Approaches or Standardized Approach rules under Basel II will also be public disclosure requirements. For national banks, see 12 CFR 3, appendix C, Part VIII.

EC 9 Principle 22: Accounting and disclosure Criterion The required disclosures include both qualitative and quantitative information on a bank’s financial perfor

risk management strategies and practices, risk exposures, transactions with related parties, accounting polimanagement and governance. The scope and content of information provided and the level of disaggregatcommensurate with the size and complexity of a bank’s operations. 

Practices and Procedures 

As described previously, federal banking agencies require that banks follow U.S. GAAP in their financial regulatory reporting. U.S. GAAP provides guidance on financial reporting and disclosures matters, includquantitative information. Financial reports of publicly traded banks [and holding companies] include finan

U.S. GAAP and PCAOB disclosures and Management’s Discussion and Analysis. Regulatory reports (such as the Call Report, TFR, and the FR Y-9C) consider the size and complexity of a company’s operations in the scope and content of required information and the commensurate level of disa

example, banks with a significant amount of trading activity (trading assets and trading liabilities that exce
EC 9 Principle 22: Accounting and disclosure 

are required to complete a detailed trading schedule. In addition, some of the regulatory reports provide the opportunity for the reporting banks to provide footndisclosures, which may be either quantitative or qualitative in nature. As mentioned previously, U.S. banksubject to the Pillar 3 disclosure requirements; these disclosures are both qualitative and quantitative in nat

EC 10 Principle 22: Accounting and disclosure Criterion Laws, regulations or the supervisor provide effective review and enforcement mechanisms designed to con

disclosure standards. 

Legal Framework 

As discussed under ECs 6 and 8 to Principle 21, federal banking agencies require by statute that banks com

requirements and information disclosure requests of federal banking agencies. Failure to comply can provor formal enforcement measures, including cease-and-desist (C&D) proceedings and the imposition of civ(CMP), against a bank and/or its IAPs. See 12 U.S.C. §§ 1813(u), 1817(a), and 1818(b) and (i). Under c

culpable IAP (such as an auditor) also may be subject to suspension and debarment. See 12 U.S.C. § 1818provisions are structured to be appropriate to the severity of the violation. These measures help ensure com

disclosure standards. 

Practices and Procedures 

The supervisory review of a bank’s safety and soundness includes review of internal controls related to fin

II Pillar 3 disclosures when implemented for applicable U.S. banks. If the supervisor determines managemcontrol process to be deficient, the supervisor has a number of available responses to address such deficienincreased regulatory capital or other supervisory measures. Further discussion of the available supervisory other principles, including Principle 21, EC 8. All regulatory reports filed with the federal bank supervisor are reviewed for accuracy and completeness (i

EC 9 of Principle 21). Follow-up with reporting banks is performed when necessary. The SEC has the primary responsibility for ensuring review of public disclosures of public companies and action, as necessary. The SEC coordinates with the appropriate banking supervisory on enforcement mattePCAOB reviews the auditors of public companies to ensure that the auditors comply with prescribed accoudisclosures. 

EC 11 Principle 22: Accounting and disclosure Criterion The supervisor or other relevant bodies publish aggregate information on the banking system to facilitate p

banking system and the exercise of market discipline. Such information includes aggregate data on balanc
EC 11 Principle 22: Accounting and disclosure 

statistical parameters that reflect the principal aspects of banks and holding companies’ operations (balanc

ratios, income earning capacity, and risk profiles). 

Legal Framework 

The federal banking agencies publish aggregate information on the banking system, including balance she

parameters reflecting the principal aspects of banks’ operations (e.g., balance sheet structure, capital ratio

and risk profiles). This facilitates public understanding of the banking system and the exercise of market d

Practices and Procedures 

For each bank, the banking agencies publish Uniform Bank Performance Reports (UBPR) and the OTS puPerformance reports (UTPR) which are primarily based on the information reported on the Call Reports analso made publicly available by the banking supervisors. The UBPR and TFR include various indicators afinancial position, financial performance, and capital for peer groups, including deposit composition and scommitments to total loans and of standby letters of credit to total loans, the loan-to-deposit ratio (at comm

temporary investments to volatile liabilities, and the ratio of pledged securities to total securities. A similaFederal Reserve for aggregated BHC information, the Bank Holding Company Performance Report (BHC

AC 1 Principle 22: Accounting and disclosure Criterion The supervisor meets periodically with external audit firms to discuss issues of common interest relating to Practices and Procedures 

The federal banking agencies meet periodically with external audit firms as well as the FASB, AICPA and accounting, audit, and financial disclosure issues related to banks and holding companies. Supervisors als

external audit firms with respect to individual banks and holding companies to discuss general and specific 

their accounting and disclosure practices. In addition, external auditors will typically ask to speak to the su

off on annual financial statements to ensure that the supervisors do not have information that would preclu

AC 2 Principle 22: Accounting and disclosure Criterion External auditors, whether or not utilised by the supervisor for supervisory purposes, have the duty to repo

of material significance, for example failure to comply with the licensing criteria or breaches of banking omatters which they believe are likely to be of material significance to the functions of the supervisor. Law

that auditors who make any such reports in good faith cannot be held liable for breach of a duty of confide

Legal Framework 

External auditors, as with banking organizations and other IAPs, must not provide inaccurate or misleadinsupervisors. 

Practices and Procedures 

Supervisors in the United States do not use auditors for supervisory purposes. However, as part of the eva

compliance with part 363 of the FDIC rules, supervisors would review communication to management and 
AC 2 Principle 22: Accounting and disclosure 

made by the external auditors. External auditors will also notify management and the audit committee (or control issues noted as a result of the financial statement audit (usually contained in a management letter). also be engaged to audit or examine the effectiveness of a bank’s internal control over financial reporting a

it at the end of the fiscal year under section 112 of FDICIA (see 12 U.S.C. § 1831m or section 404 of the S2002 (15 U.S.C. § 7262)). In connection with such an engagement, the auditor also has a responsibility to information concerning internal control matters to management and the audit committee. Banks subject to 

rules and regulations must provide any management letter or other report from their auditor to the approprsupervisors within 15 days of receipt of such communication. (see guideline 25 of part 363) Guidelines and professional standards related to the auditor’s communication of internal control deficiencievolving. Standards are established by the AICPA for nonpublic company audits and attestation engagemfor public company audits. Depending on a bank’s size and whether it or its parent is a public company, i

reports submitted pursuant to part 363 would include the auditor’s report on the effectiveness of internal coreporting, either as part of the part 363 annual report or separately; reports on significant deficiencies and mreports on other internal control matters, which may be in the form of a management letter. Supervisory guidance requires audits of banking organizations to be performed in accordance with the P

auditing standards. Under those standards, when an auditor concludes that an illegal act (i.e., violations of regulations) has or is likely to have occurred, the auditor is expected to consider the effect of the illegal ac

statements and to ensure that those charged with governance are adequately informed of the illegal act. Th

charged with governance may be conveyed either orally or in writing. However, if the communication is o

must document the communication. Supervisory guidance gives federal banking supervisors access to comauditor and the bank client. In addition, federal banking supervisors have the authority to review auditors

AC 3 Principle 22: Accounting and disclosure Criterion Laws, regulations or the supervisor require banks and holding companies to rotate their external auditors (

individuals within the firm) from time to time. 

Legal Framework Section 203 of the Sarbanes Oxley Act of 2002 made it unlawful for a registered public accounting firm to 

an issuer if the lead (or coordinating) audit partner (having primary responsibility for the audit), or the audreviewing the audit, has performed audit services for that issuer in each of the 5 previous fiscal years of th78j-1(j). 

Practices and Procedures 

To strengthen auditor independence and improve audit quality, the Sarbanes-Oxley Act includes a provisioaudit partner rotation for firms auditing public companies. The act requires the lead audit partner and audi

concurring reviewer) to be rotated every five years on all public company audits. See 15 U.S.C. § 78j-1(j)
AC 3 Principle 22: Accounting and disclosure 

concurring review of all audits of issuers (as defined in the act). See id. § 7213(a)(2)(A)(ii). The SEC ado

statutory requirement of audit partner rotation found in section 203 of the Sarbanes-Oxley Act. See 17 CF

addition to the five-year rotation requirement of the lead and concurring audit partners, the rules also mand

period after rotation. The rules, as adopted, specify that certain other significant audit partners will be subj

rotation requirement with a two-year “timeout” period. The rule provides an alternative for firms with fewclients and fewer than ten partners. The alternative requires the PCAOB to review all of the firm’s engageat least once every three years. As described in the “Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Prov

Engagement Letters,” (see 71 Fed. Reg. 6847 (Feb. 9, 2006), FIL-13-2006, OCC Bulletin 2006-7 (Feb. 9, 

independence standard-setters include the SEC, PCAOB, and the AICPA. Auditors of large banks are reqindependence requirements of the SEC, PCAOB and AICPA. Auditors of all other banks are required to cindependence standards issued by one or more of these standard-setters. For other non-public banks that aannual independent audit pursuant to either part 363 of the FDIC’s regulations or section 562.4 of the OTS

auditor must meet only the AICPA independence standards. 

AC 4 Principle 22: Accounting and disclosure Criterion The supervisor requires banks and holding companies to have a formal disclosure policy. Legal Framework 

Banks, particularly those adhering to the interagency guidelines on the 1996 Market Risk Amendment and are required to have a formal disclosure policy.

Practices and Procedures 

The accounting systems and procedures used for general-purpose financial statements and regulatory repocritically important to enhancing the transparency of a bank’s risk profile and financial position. Adequate 

participants to better understand the bank’s financial condition and apply market discipline, thus creating i

inappropriate risk-taking or inadequate risk-management practices. Accordingly, a bank is required to havgovernance and control structure over the preparation of financial reporting and disclosures. This includes written policies that provide clear guidelines on accounting and disclosure matters, consistent with U.S. GAregulatory requirements. 

AC 5 Principle 22: Accounting and disclosure Criterion The supervisor has the power to access external auditors’ working papers, where necessary. Legal External auditors of large banks are required to agree to provide related audit working papers, policies, and 
AC 5 Principle 22: Accounting and disclosure Framework supervisors, if requested. See 12 U.S.C. § 1831m(g)(3)(A). As a matter of best practice, supervisors expe

asset size, to obtain agreement of an independent public accountant or other external auditor in the engagesupervisors access to all the accountant's or auditor's work papers and other material pertaining to the bank performing the completed external auditing program. 

Practices and Procedures 

The independent public accountant or external auditor of a large bank is required to provide the supervisor working papers. As set forth in “Interagency Policy Statement on External Auditing Programs of Banks an(see 64 Fed. Reg. 52319 (Sept. 28, 1999)), banks should obtain an engagement letter from their auditors w

will be granted immediate and full access to the external auditing reports and related workpapers prepared 

fail to grant access of such audit working papers are subject to informal or formal enforcement actions as p

Federal Reserve SR letter 99-33 (SUP) and OCC Bulletin 99-37. 
Principle 23: Corrective and remedial powers of supervisorsSupervisors must have at their disposal an adequate range of supervisory tools to bring about timely corrective actions. This appropriate, to revoke the banking license or to recommend its revocation. (Reference document: Parallel-owned banking structures, January 2003)Overview If a U.S. federal banking agency determines that a bank or holding company has problems that may affect safety and soundnewith laws and regulations, it may take a supervisory action to ensure that the bank or holding company undertakes corrective m

findings are communicated to the management and directors of a bank or holding company in a written report. The managemeasked to address all identified problems voluntarily and to take measures to ensure that the problems are corrected and will no

are resolved promptly after they are brought to the attention of a bank’s or holding company’s management and directors. In the appropriate agency may need to take an informal supervisory action, requesting that a bank or holding company adopt a b

the provisions of a memorandum of understanding to address the problem. If necessary, the appropriate agency may take formal enforcement actions to compel the management and directors of a troublcompany, or persons associated with it, to address the bank’s or holding company’s problems. For example, if a bank or holdisignificant deficiencies or fails to comply with an informal action, the agency may enter into a written agreement with the trou

company or may issue a cease-and-desist order against the bank or holding company or against an individual associated with 

director. The agency may also assess a fine (a “civil monetary penalty” or “CMP”); remove an officer or director from office 

or her from the banking industry, or both. CMPs are tiered and applied in accordance with the severity of the violation at issu

enforcement orders issued and written agreements executed by the agencies are published on the agencies’ public websites. A special remedial regime applies when a bank has a capital deficiency. Under this so-called Prompt Corrective Action or PC

and banks are required to take certain actions promptly to resolve capital deficiencies . The PCA statute, 12 U.S.C. § 1831o, discretionary restrictions on any bank that fails to remain at least adequately capitalized. By regulation, the agencies have deand the restrictions each triggers. See12 CFR 208.43 (Federal Reserve), 12 CFR 6 (OCC), and 12 CFR 565 (OTS). The prim

supervisor for a bank may take a range of mandatory and discretionary actions if a bank’s capital falls below the required min

relevant capital measure. The severity of the supervisory action depends on the severity of the capital shortfall. In addition to the remedies discussed above, there are also other actions to penalize banks and holding companies and their mrules and regulations and failing to correct safety-and-soundness concerns. These actions can include restricting new activities 

most serious instances, revoking the charter of the bank and terminating Federal Reserve membership or federal deposit insur

EC 1 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor raises supervisory concerns with management or, where appropriate, the Board, at an early 
EC 1 Principle 23: Corrective and remedial powers of supervisors 

these concerns are addressed in a timely manner. Where the supervisor requires the bank to take significan

are addressed in a written document to the Board. The supervisor requires the bank to submit regular writtchecks that remedial actions are completed satisfactorily. 

Practices and Procedures 

Generally, U.S. federal banking agencies identify problems or deficiencies at a bank or holding company dexaminations. Most problems or deficiencies are resolved informally during the course of the examination 

the bank’s or holding company’s management and directors in which the bank or holding company immedcorrect or commits to promptly correct the problems or deficiencies and address the regulatory concerns. examination of a bank, supervisors send a written “Report of Examination” (ROE) to the bank for review b

officers. The ROE assesses the condition of the bank’s capital, asset quality, management, earnings, liquidmarket risk (CAMELS); identifies any violations of law; assesses compliance with the Bank Secrecy Act; 

to consumer laws and regulations and the Community Reinvestment Act. See Attachment A of the Interag

Financial Institutions Rating System” as described in Principle 7. The narrative of the ROE also calls atten

attention. One example of a U.S. federal banking agency policy on communication of examination finding

2008 supervisory letter “Communication of Examination/Inspection Findings” at www.federalreserve.gov/BoardDocs/srletters/2008/SR0801.htm. Similarly, the OCC’s policy on communBank Supervision Process, Community Bank Supervision, and Large Bank Supervision booklets of the OC

Handbook1, and OTS’s communication policy can be found in Regulatory Bulletin 37-4, “Ratings, Assign

Similar reports are issued after the inspection of a holding company. Holding company rating systems are those of banks and are described in connection with Principle 6, EC 3. Some problems or deficiencies may not be easily addressed through discussion with the bank’s or holding especially if the problems or deficiencies are serious, pervasive, or repeated. In such cases, the agencies m

actions, which are described in detail in the responses to EC 3, 4, and 5. Generally, supervisory actions recompany to take certain affirmative actions and make periodic (monthly or quarterly) reports to the federaprogress that the bank or holding company has made to address the deficiencies identified in the examinatiaction plans with specific target dates may be requested from a bank or holding company, and supervisors sufficiency and examine progress against key milestone dates. 

EC 2 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor participates in deciding when and how to affect the orderly resolution of a problem bank si

include closure, or assisting in restructuring, or merger with a stronger institution). 

Practices and Please see the responses to EC 3, 4, and 5 for a description of supervisory tools available to address proble

1 www.occ.gov/handbook/banksup.pdf; www.occ.gov/handbook/cbsh2003intro.pdf; www.occ.gov/handbook/lbs.pdf. 
EC 2 Principle 23: Corrective and remedial powers of supervisors Procedures violations at banks and holding companies. 

When a problem bank does not have the ability or resources to solve its deficiencies, the U.S. federal bank

authority to appoint a conservator or a receiver.2 The agencies may appoint a conservator or receiver unde

circumstances, including when a bank is critically undercapitalized or when it is undercapitalized and has 

becoming adequately capitalized; is unable to meet depositors’ demands for payment; or is operating in an condition that would likely cause insolvency or substantially dissipate the bank’s assets. It should be note

ability to appoint a conservator or receiver for a holding company is more limited by statute than the OCC

a bank. The FDIC may use its back-up authority to appoint itself conservator or receiver of any insured bacriteria. The conservator takes full control of the bank and assumes the powers of the shareholders and bo

federal law, a conservator can repudiate contracts and temporarily limit customer withdrawals and paymenavoiding a liquidity crisis and liability for failure to make payments. If the bank returns to a safe and sounconservator may return control of the bank to the shareholders or prepare the bank for sale. The agencies may generally close a bank and appoint a receiver on the same grounds described above for cstate-chartered banks, the appropriate state banking agencies have concurrent powers to close banks, but th

By law, the FDIC is always appointed the receiver for closed insured banks. 

EC 3 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor has available an appropriate range of supervisory tools for use when, in the supervisor’s jud

complying with laws, regulations or supervisory decisions, or is engaged in unsafe or unsound practices, odepositors are otherwise threatened. These tools include the ability to require a bank to take prompt remedpenalties. In practice, the range of tools is applied in accordance with the gravity of a situation. 

Legal Framework 

As described in the overview to this principle, U.S. federal banking agencies have a range of supervisory o

supervisors’ judgment, a bank or holding company is not complying with laws, regulations or supervisory 

an unsafe and unsound practice. The agencies may take prompt remedial action and impose penalties. In is applied in accordance with the gravity of a situation. See 12 U.S.C. § 1818 for a description of many of the types of formal enforcement actions that the agencie

Practices and Procedures 

 U.S. federal banking agencies have a broad range of supervisory tools to address problems or deficiencies companies they supervise. Supervisory actions are generally remedial and are intended to provide the ban

2 A holding company is subject to the same Federal bankruptcy laws that apply to other types of companies. 
EC 3 Principle 23: Corrective and remedial powers of supervisors 

guidance on how to fix the problems or deficiencies identified at the examination. Informal, non-public susufficient to resolve most deficiencies. Such action may include requiring the bank’s or holding companyadopt a resolution to cure the deficiencies, develop and implement a safety-and-soundness plan, conform tcapital ratios established by the agencies (applicable to banks only), or execute a memorandum of understa

In the event that the problems, deficiencies or violations of law are pervasive, repeated, unresolved by man

serious concern, the agencies may exercise their statutory enforcement authority by taking a formal enforcbank or holding company. Formal enforcement actions against banks and holding companies include (i) FAgreements (Agreements); (ii) Cease and Desist Orders (C&D); (iii) Safety and Soundness Orders; (iv) Ca

Directives (applicable to banks only); and (vi) Civil Money Penalty Assessments (CMP). Federal banking temporary injunctive action using a temporary C&D order under certain conditions. The federal enforcemwith such actions are the same for all of the agencies. Formal enforcement action often requires affirmativ

holding company and may include restitution or reimbursement. In determining whether a formal enforce

the agency staffs consider all relevant factors, including the nature, severity, and duration of the problem, t

particular bank or holding company, the anticipated resources and actions necessary to resolve the problem

of the directors and management. Under certain circumstances, such as the failure of a bank to establish oanti-money laundering compliance program , the federal enforcement statutes require formal enforcement 1818(s)(3) Formal enforcement actions are legally enforceable, remain in effect until modified or terminated, and mu

the appropriate agency. See 12 U.S.C. §1818(u). In addition to the overall enforcement authority of the federal banking agencies, specific statutes authorize 

actions. For example, under the Truth in Lending Act (15 U.S.C. § 1601 et seq.), the federal banking agento make monetary and other adjustments to the accounts of consumers in cases where an annual percentagwas inaccurately disclosed. For more details on the guidelines regarding these orders of restitution, see the 

Administrative Enforcement of the Truth in Lending Act – Restitution. www.fdic.gov/regulations/laws/fede

(See also statutory requirement that federal banking agencies use C&D orders for failures to establish or co

money laundering compliance, 12 USC § 1818(s). For specific examples, links to the agencies’ enforcement actions public websites are Federal Reserve: www.federalreserve.gov/boarddocs/enforcement/search.cfm

OCC: www.occ.treas.gov/enforcementactions/

FDIC: www.fdic.gov/bank/individual/enforcement/index.html

OTS: www.ots.treas.gov?p=Enforcement
EC 3 Principle 23: Corrective and remedial powers of supervisors 

A CMP may be assessed by the agencies under various federal banking laws. See, e.g., 12 U.S.C. § 1818(iassessments may include violations of law, regulation, or the terms of a formal supervisory action, or failu

reporting requirements. Assessments are based on an analysis of the facts and circumstances of the case an

mitigating factors that are required to be taken into account by law, such as the financial resources of the b

individual, good faith, gravity of the violation, history of previous violations, and other mitigating factors. All informal supervisory actions and Agreements are taken with the consent of the bank or holding compa

assessments are generally issued with the consent of the bank or holding company. In the event that a banto consent, the agency may initiate a contested proceeding to impose the order or assessment. In cases where there is an immediate threat to the viability of the bank or holding company or to the deposviolations of law, regulation, or ongoing unsafe or unsound practices, an agency may take immediate actioorder to C&D. Such an order is effective immediately and may be issued with or without the bank’s or hoThe provisions are narrowly focused to address the cause of immediate harm to the bank or holding compa

to cease and desist remains in place until either the bank or holding company consents to a C&D order or tcontested proceeding to impose a C&D order. As more fully described in the response to EC 5, the agencies are also required by statute to take action to 

deficiencies at banks.

EC 4 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor has available a broad range of possible measures to address such scenarios as described in 

clear prudential objectives or sets out the actions to be taken, which may include restricting the current actwithholding approval of new activities or acquisitions, restricting or suspending payments to shareholders 

restricting asset transfers, barring individuals from banking, replacing or restricting the powers of managercontrolling owners, facilitating a takeover by or merger with a healthier institution, providing for the interibank, and revoking or recommending the revocation of the banking license. 

Legal Framework 

The U. S. federal banking agencies have available a broad range of possible measures to address the scenaTogether, statutes, regulations, guidelines, and guidance contain clear prudential objectives and set out the Possible remedial measures include restricting the current activities and operations of the bank or holding 

conditioning approval of new activities or acquisitions; restricting or suspending payments to shareholders restricting asset transfers; barring individuals from banking; replacing or restricting the powers of managercontrolling owners; facilitating a takeover by, or merger with, a healthier bank or holding company, providmanagement of the bank or holding company; and revoking or recommending the revocation of the bankin
EC 4 Principle 23: Corrective and remedial powers of supervisors Practices and Procedures 

As specifically authorized by statute, the U.S. federal banking agencies may, through formal supervisory aholding company to cease and desist from violations of law or regulation or unsafe or unsound practices an

Among the actions specifically enumerated in the statute, an agency may restrict the bank’s or holding comthe bank or holding company to dispose of any loan or asset involved in the violation or unsafe or unsound 

or holding company to employ qualified officers and employees; and take any other action that the agency Formal enforcement actions generally include provisions that specifically address the bank’s or holding co

deficiencies, violations, or unsafe or unsound practices. The provisions may require the bank or holding c

actions or to take affirmative actions. Some provisions may require a bank or holding company to submit procedures that are acceptable to the federal banking agency. Common provisions for formal enforcement 

or holding company to cure specified violations, correct risk management or board of directors oversight wacceptable plan to increase or maintain sufficient capital, provide for an adequate allowance for loan and lqualified officers and employees, and restrict the payment of dividends. As described in the response to EC 2, the agencies generally have the power to provide interim manageme

bank or to close a bank (receivership) under a variety of circumstances. As described in the response to EC 6, the agencies also have statutory authority to take formal enforcemen

directors, or employees of a bank or holding company supervised by the federal banking agencies. Enforcement action examples: Federal Reserve Agreement with First Pryority Bank, Pryor, Oklahoma: dated March 23, 2008, requires ca

and improvements in corporate governance, loan policies, and credit administration. www.federalreserve.gov/newsevents/press/enforcement/enf20080403a1.pdf

OCC Agreement with Millennium Bank, N.A., Reston, Virginia: dated January 24, 2008, requires mainten

ratios, hiring a senior lending officer, and improvements to lending policies, loan portfolio management, amanagement. www.occ.treas.gov/FTP/EAs/ea2008-012.pdf

FDIC Cease and Desist Order against Integrity Bank, Alpharetta, Georgia: dated February 20, 2008, requir

of directors’ oversight, maintenance of specific capital ratios, and reductions in classified assets. www.fdic.gov/bank/individual/enforcement/2008-02-02.pdf

OTS Cease and Desist Order against Downey Savings and Loan Association, Newport Beach, California: 

requires capital augmentation, reduction of classified assets, disposition of real estate owned, strengthening implementation of a business plan, and imposes restrictions on asset growth, management changes, emplo
EC 4 Principle 23: Corrective and remedial powers of supervisors 

compensation arrangements, severance and indemnification arrangements, capital distributions, transactioncertain forms of lending. http://files.ots.treas.gov/enforcement/97011.pdf

EC 5 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor has the power to take measures should a bank fall below the minimum capital ratio, and se

stage to prevent capital from falling below the minimum. The supervisor has a range of options to address 

Legal Framework 

As discussed in the overview to this principle and under EC 6 to Principle 6 (on capital adequacy), a PCA 

instances in which a bank’s capital falls below the minimum ratios. The regime encourages intervention aissues and prevent further deterioration. The specific capital level triggers and remedial consequences attain detail under EC 6 of Principle 6. In addition, under 12 U.S.C. § 3907 the federal banking agencies are required to “cause banking institution

adequate capital” by, among other things, establishing minimum capital levels. If a bank or holding compcapital at or above its minimum level, the statue specifically provides that the appropriate federal banking 

failure an unsafe or unsound practice within the meaning of 12 U.S.C. §1818 and issue a capital directive – extent as a C&D – that requires the bank or holding company to submit a capital plan to achieve its requirefederal banking agencies have issued implementing regulations. See, e.g., 12 CFR 263.80, et seq. (Federa

Practices and Procedures 

The above-described PCA statute and accompanying regulations were enacted to promptly resolve capital 

thereby reduce failures, as well as to impose mandatory and discretionary restrictions on a bank that fails tadequately capitalized. For example, any bank that is less than adequately capitalized cannot pay dividendcapital restoration plan that is acceptable to the supervisor. Capital categories definitions, which are unifofederal banking agencies, can be found at edocket.access.gpo.gov/cfr_2007/janqtr/pdf/12cfr208.43.pdf. A

restrictions apply to significantly and critically undercapitalized banks, such as limitations on growth. The 

several discretionary actions when the bank is less than adequately capitalized. These restrictions are impoissuance of a PCA Directive, with or without the consent of the bank. For a bank that is critically underca

generally requires that the bank be recapitalized, sold, merged, or liquidated within 90 days. Procedurally, once a bank becomes less than adequately capitalized, it must submit, within 45 days or lessagency to restore the bank to an adequately capitalized condition. The above-described capital directive scavailable to federal banking agencies to facilitate the prompt resolution of capital deficiencies at banks and It should be noted that the agencies intervene at even earlier stages to address capital weaknesses through t
EC 5 Principle 23: Corrective and remedial powers of supervisors 

actions described in the response to EC 3. PCA examples: OCC Prompt Corrective Action Directive against Community National Bank: dated June 19, 2008, requir

CEO and president and sever ties with themwww.occ.treas.gov/FTP/EAs/ea2008-062.pdf

Federal Reserve Prompt Corrective Action Directive against Neighborhood Community Bank, Newnan, G

2009, requires the sale or merger of the bank within 30 days. http://www.federalreserve.gov/newsevents/press/enforcement/enf20090528a1.pdf OTS Prompt Corrective Action Directive against Imperial Savings and Loan Association, Martinsville, Vi

2008, requires the sale or merger of the bank within 60 days; imposes mandatory restrictions on dividendsgrowth, brokered deposits, and executive compensation. 

files.ots.treas.gov/enforcement/96377.pdf

EC 6 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor applies penalties and sanctions not only to the bank but, when and if necessary, also to man

Board, or individuals therein. 

Legal Framework 

As discussed in the overview to this principle, remedial penalties and sanctions may be applied to banks anwhen appropriate, to management, board members, employees, and other individuals who participate in a company’s affairs (Institution-Affiliated Parties or IAPs). 

Practices and Procedures 

Formal supervisory actions, including penalties and sanctions, may be taken against the bank or holding coThese actions include: 

Cease and Desist Order – provisions may limit the individual’s activities at the bank or holding company, rtake affirmative action, or make restitution or reimbursement to the bank or holding company if the individby the violation or practice or demonstrated reckless disregard for the law. 

Removal and Prohibition Order – a U.S. federal banking agency may remove any current IAP from the banviolations of law and other misconduct and prohibit any current or former IAP from further participation in 

removed or prohibited individual may not serve as an officer, director, or employee of a bank or holding c

a bank or holding company, or exercise certain shareholder rights without prior regulatory approval. To su
EC 6 Principle 23: Corrective and remedial powers of supervisors 

Prohibition order, in addition to determining that the individual involved has engaged in a violation of law specified misconduct, the agency must determine that the individual’s misconduct caused or will probably holding company, prejudice depositors, or resulted in gain to the individual and that the individual has demwillful disregard for the safety and soundness of the bank or holding company or the individual’s action indishonesty. Suspension Order – an agency may suspend a current IAP if the agency determines that the party’s conducremoval and that a suspension is necessary to protect the bank or holding company or its depositors. A Suimmediately effective upon being served and remains in effect until the proceeding on the proposed Remo

is resolved, unless stayed by a court. Civil Money Penalty – may be assessed by an agency against an individual under the same circumstances response to EC 3. Examples of enforcement actions against an individual: FDIC Prohibition Order and Assessment of a Civil Money Penalty: In the Matter of Bobby G. Sorrells, an 

of Valley State Bank, Russellville, Alabama, dated February 8, 2008, prohibits the individual from particip

holding company supervised by the agencies and requires the payment of a civil money penalty of $30,000www.fdic.gov/bank/individual/enforcement/2008-02-10.pdf

OCC Order of Prohibition, Removal, Restitution, and Assessment of a Civil Money Penalty: In the Matter 

President and Director, Hamilton Bank, N.A., Miami, Florida, dated October 31, 2002, prohibits the indivany bankor holding company supervised by the agencies, requires restitution of $210,000, and requires the 

penalty of $40,000. www.occ.treas.gov/FTP/EAs/ea2003-122.pdf

OTS Order of Prohibition: In the Matter of Curtis VanDerWal, former Loan Officer and Institution-Affilia

Federal Savings Bank, Oskaloosa, Iowa, dated April 30, 2008, prohibits the individual from participation 

company supervised by the agencies. files.ots.treas.gov/enforcement/96369.pdf

Federal Reserve Order of Prohibition and Order of Assessment of Civil Money Penalty Issued Upon Cons

Craig Chupik, a Former Institution-Affiliated Party of PlainsCapital Bank, Dallas, Texas, dated March 19from participation in any banking organization supervised by the agencies and requires the payment of a c$20,000. http://www.federalreserve.gov/newsevents/press/enforcement/enf20090323b1.pdf 
AC 1 Principle 23: Corrective and remedial powers of supervisors Criterion Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions. Legal Framework 

The PCA statute requires early intervention by supervisors to address capital shortfalls of banks. The capi

supervisory action are clear and objective, and the associated remedial measures are mandatory. 

Practices and Procedures 

In general, the U.S. federal banking agencies strive to promptly address deficiencies, problems, or violatiothe supervised banks and holding companies. As described in the response to EC 1, the deficiencies or proresolved through the ongoing dialogue that occurs during the examination process. When further supervisis, again, most often accomplished through informal supervisory action (which is not mandated by statute)When formal supervisory action is necessary, the agencies take appropriate measures in a timely manner. generally no specific statutory requirements that establish timetables for taking supervisory action. Howev

actions require that corrective measures should be established within adequate timeframes for each of the aaction. As described in the response to EC 5, PCA requires the agencies to take actions to promptly address capitabank or holding company must submit a capital restoration plan within 45 days or less of becoming less ththe agency must review the plan within 60 days of submission and determine if it is acceptable. 

AC 2 Principle 23: Corrective and remedial powers of supervisors Criterion The supervisor has the power to take remedial actions, including ring-fencing of the bank from the actions 

subsidiaries, parallel-owned banking structures and other related companies in matters that could impair th

the bank. 

Legal Framework 

The U.S. federal banking agencies have the authority to impose conditions on the relationships between bincluding a holding company, subsidiary, parallel owned banking organization or other related company in address a threat to the safety and soundness of the banks. 

Practices and Procedures 

As described in the responses to EC 3 and 4, the U.S. federal banking agencies have broad powers to order 

protect a bank from adverse actions by its holding company or affiliate. For example, remedial actions mapayments from the bank to its holding company or affiliates. The Federal Reserve and the OTS, as the sup

companies, have the authority to take a full range of enforcement actions against holding companies and thProvisions of such enforcement actions may include restrictions on intercorporate transactions, prohibitionaccepting payments from the bank, and requirements for the holding company to provide managerial and fbank. 
AC 2 Principle 23: Corrective and remedial powers of supervisors 

Enforcement action examples: Federal Reserve Agreement with WSB Financial Group, Inc., Bremerton, Washington: dated April 23, 200

holding company from taking dividends or other payments from the bank. www.federalreserve.gov/newsevents/press/enforcement/enf200800429a1.pdf

Federal Reserve Agreement with Heritage Bancorp Company, Inc. and First Bank of Cleveland, Cleveland

October 26, 1999, see paragraphs 25 and 26 for limitations on intercorporate and affiliate transactions. 

www.federalreserve.gov/boarddocs/press/enforcement/1999/199911163/Attachment.pdf

OCC C&D Order against International City Bank dated February 12, 2009; prohibits transactions with affiboard approval. http://www.occ.treas.gov/FTP/EAs/ea2009-011.pdf OTS Cease and Desist Order: In the Matter of American Sterling Corporation, Foothill Ranch, California

limits holding company transactions with its bank subsidiary, requires a capital augmentation plan, limits h

requires liquidity reports and notices of changes of directors or senior executive officers, and restricts sevecompensation arrangements. files.ots.treas.gov/enforcement/97009.pdf

AC 3 Principle 23: Corrective and remedial powers of supervisors Criterion When taking formal remedial action in relation to a bank, the supervisor ensures that the regulators of non

entities are aware of its actions and, where appropriate, coordinates its actions with them. 

Legal Framework 

The “Policy Statement on Interagency Notification and Coordination of Enforcement Actions” discusses fcoordination. See Federal Reserve SR letter 97-5 (ENF) and 62 Fed. Reg. 7782 (1997) . 

Practices and Procedures 

 The U.S. federal banking agencies work closely together to address supervisory concerns of common inteand the OTS, as the “umbrella” supervisors of holding companies and their subsidiaries, rely on the federa“functionally regulated” subsidiaries to examine those subsidiaries and take supervisory actions when appr

Reserve and OTS coordinate their actions and share information where appropriate with other U.S. federal foreign supervisors to effect supervisory action and reduce regulatory redundancies. The following examples illustrate coordination of supervisory actions among the supervisors. In 2005, the Federal Reserve, OCC, and SEC took separate, coordinated formal supervisory actions agains
AC 3 Principle 23: Corrective and remedial powers of supervisors 

Corporation, Charlotte, N.C., a bank holding company; its wholly owned subsidiary bank, Bank of Americand Banc of America Capital Management LLC, a registered investment adviser; BACAP Distributors, LLadviser; and Banc of America Securities, LLC, a registered investment adviser and broker dealer, respectiv

www.federalreserve.gov/boarddocs/press/enforcement/2005/20050209/attachment.pdf

In 2006, the Federal Reserve, FDIC, OTS and SEC took separate, coordinated formal supervisory actions holding companies and their wholly owned subsidiary banks (Doral Financial Corp. and Doral Bank; R&G 

Premier Bank; First Bancorp and First Bank). www.federalreserve.gov/newsevents/press/enforcemen

www.federalreserve.gov/newsevents/press/enforcement/enf20060317a1.pdf

www.federalreserve.gov/newsevents/press/enforcement/enf20060317b1.pdf
Principle 24: Consolidated supervision

An essential element of banking supervision is that supervisors supervise the banking group on a consolidated basis, adeqappropriate, applying prudential norms to all aspects of the business conducted by the group worldwide. OverviewThe Federal Reserve is responsible for the comprehensive consolidated supervision for U.S. bank holding companies (BHCs)holding companies (FHCs). The Federal Reserve’s recently issued supervisory guidance entitled, “Consolidated Supervision Companies and the Combined U.S. Operations of Foreign Banking Organizations,” provides comprehensive guidance on this ((www.federalreserve.gov/boarddocs/srletters/2008/SR0809.htm) SR letter 08-9). With respect to savings and loan holding co

consolidated supervisor is the OTS. See the OTS’s Holding Companies Handbook. Other reference documents of interest inc

supervision of banks’ international activities, March 1979; Principles for the supervision of banks’ foreign establishments, Mstandards for the supervision of international banking groups and their cross-border establishments, July 1992; and The supebanking, October 1996; Home-host information sharing for effective Basel II implementation, June 2006. 

EC 1 Principle 24: Consolidated supervision Criterion The supervisor is familiar with the overall structure of banking groups and has an understanding of the act

of these groups, domestic and cross-border. 

Legal Framework 

As an essential component of consolidated supervision, the consolidating supervisors have and maintain a all material parts of these groups, including their domestic and cross-border operations. For BHCs, the conthe Federal Reserve, as set out in the Bank Holding Company Act (BHC Act) and enhanced by Gramm-LeWith respect to SLHCs, the consolidating supervisor is the OTS, as set forth in the Home Owners’ Loan AReserve and OTS rely on relevant primary supervisors2 and functional regulators for information about fin

holding companies. The Federal Reserve and the OTS obtain this information at the time of formation of authorization of a new activity or activity including in a new supervisory jurisdiction, changes in a bank’s structure, in the course of ongoing supervision, in identifying and addressing supervisory concerns, in crisiperiodic and ad hoc meetings among supervisors and with the banking group’s management. Among othefamiliar with the banking group’s legal structure and entities, nature and locus of activities, interrelationsh(transactions among affiliates), and methods for exercising oversight over domestic and cross-border opera

of implementing policies and procedures, such as by or across legal entities). 

Practices and All BHCs (including FHCs) are subject to supervision by the Federal Reserve on a consolidated basis. Al

1 www.bis.org/publ/bcbsc112.pdf?noframes=1; www.bis.org/publ/bcbsc312.pdf?noframes=1; www.bis.org/publ/bcbsc314.pdf?noframes=1

www.bis.org/publ/bcbs27.pdf?noframes=1; and www.bis.org/publ/bcbs125.pdf?noframes=1. 

2 The term “primary supervisor” refers to the primary federal banking supervisor of a bank or savings association subsidiary of a holding co

office of an FBO. See the self assessment introduction for a description of supervisory responsibilities held by primary supervisors. 
EC 1 Principle 24: Consolidated supervision 

Procedures supervision by the OTS on a consolidated basis (See OTS Holding Companies Handbook.) Consolidated s

consolidated supervisor to understand the banking organization’s structure, activities, resources and risks a

managerial, operational or other deficiencies before they pose a danger to the holding company’s subsidiarIn order to develop a risk assessment and supervisory plan, the consolidated supervisor must have an unde

operating, and corporate governance structure of the consolidated organization (domestic and cross-border

strategies, businesses, and risk management and internal controls functions. As described above, the Fede

on primary supervisors to obtain much of this information. (See SR letter 08-9 attachment A.1, for a descrthe supervisory strategy and the OTS Holding Companies Handbook.) 

EC 2 Principle 24: Consolidated supervision Criterion The supervisor has the power to review the overall activities of a BHC, both domestic and cross-border. Th

power to supervise the foreign activities of banks incorporated within its jurisdiction. 

Legal Framework 

The BHC Act grants the Federal Reserve broad authority to inspect and obtain reports from a BHC and its among other things, the organization’s financial condition, systems for monitoring and controlling financiaand compliance with the BHC Act and other federal law (including consumer protection laws) that the Fedjurisdiction to enforce. Similarly, the HOLA grants the OTS broad authority to examine, regulate, and sup

to take any necessary actions against these entities to prevent them from engaging in unsafe or unsound pr

law. In addition, federal law authorizes the Federal Reserve and the OTS to take action against a holding c

subsidiary to prevent these entities from engaging in unsafe or unsound practices, or to address violations connection with their own business operations even if those operations are not directly connected to the hosubsidiary banks. The Federal Reserve has also established consolidated capital standards for BHCs. The maintain capital levels that are sufficient to support the risk profile of the overall SLHC enterprise. These 

standards help ensure that a SLHC maintains adequate capital to support its consolidated activities, does n

leveraged, and is able to serve as a source of strength for its bank subsidiaries. Foreign Operations of Domestic Banking Organizations. The consolidated supervisor has broad authority examinations and off-site surveillance, the activities of a bank and holding company whether conducted doborder. This extends to obtaining information (directly or indirectly, from other supervisors) on affiliates 

(wherever located) necessary to assess the impact of those affiliates on the bank and holding company. Se1467a(b)(4). The U.S. federal banking agencies are authorized by statute to regulate and supervise the foreign activities the Federal Reserve has statutory power to authorize the establishment of foreign branches of member banestablishment of so-called Edge corporations (essentially, domestically chartered entities through which mBHCs hold foreign operations), authorize the investments and activities of Edges and so-called agreement 
EC 2 Principle 24: Consolidated supervision 

chartered corporations that agree with the Federal Reserve to limit their activities to those permissible for E

acquisition of foreign banking organizations by member banks or BHCs. See 12 U.S.C. §§ 601-02 and 12 Federal Reserve also is expressly authorized to supervise these operations. See 12 U.S.C. § 602. The OCC supervise foreign branches of national banks as well as other foreign operations undertaken by national basubsidiaries. In fact, the OCC has examination staff located in London to assist in the on-site supervision 

operations in Europe. See 12 U.S.C. §§ 161, 481, 602, and 12 CFR 28.3(c). The OTS has broad authority 

associations, SLHCs, and their affiliates, wherever located. See 12 U.S.C. §§ 1464(a) and (d)(1)(B)(i), 14

As part of its regulation and supervision of banks and holding companies, the relevant U.S. supervisor evaforeign legal requirements might restrict its access to information necessary to determine and enforce comlaws. If material impediments exist and cannot be adequately addressed, the U.S. banking supervisor may 

bank or holding company to expand in a foreign jurisdiction that restricts access to essential information. 

also take remedial actions if information cannot be obtained due to foreign law restrictions. Such actions mtermination of the foreign operations.3

EC 3 Principle 24: Consolidated supervision Criterion The supervisor has a supervisory framework that evaluates the risks that non-banking activities conducted 

group may pose to the bank or banking group. 

Legal Framework 

The U.S. federal banking agencies have implemented a comprehensive supervisory framework that evaluaactivities conducted by banks and holding companies may pose to the consolidated organization. The auth

the overarching duty of the agencies to protect the safety and soundness of banks, 12 U.S.C. § 1831p-1, inimposition of prudential safeguards. Statutory provisions expressly authorize examinations of and the sub

regulated banks, see, 12 U.S.C. §§ 324-26 & 438 (the Federal Reserve with respect to member banks and t§§ 334, 338, and 1844(c), including parent holding companies; 12 U.S.C. §§ 161, 481 and 602 (the OCC wbanks), 12 U.S.C. §§ 1464(d)(1) and 1467 a(b)(4) (OTS with respect to savings associations and SLHCs a

Practices and Procedures 

As the U.S. federal banking agencies charged with supervising holding companies on a consolidated basisthe OTS have the authority and responsibility to understand and assess the risks that the parent holding com

subsidiaries may pose to itself or its banks. See SR letter 08-9 for a description of the primary objectives osupervision of the nonbank subsidiaries of a BHC and the OTS Holding Company Handbook for the superapplies to SLHCs. Supervisory activities: For all significant nonbanking subsidiaries and nonbanking activities of the parent 

Federal Reserve and the OTS use continuous monitoring activities and periodic discovery review examina

3 See, e.g., page 158 of the 2007 FFIEC BSA/AML Examination Manual (www.occ.gov/handbook/1-BSA-AMLwhole.pdf ). 
EC 3 Principle 24: Consolidated supervision 

maintain an understanding of these units’ operations, financial condition, inherent risks and risk-managemassess the adequacy of risk management and internal controls, including those relating to compliance risk. examination activities may also be used to ensure that key risk management and internal control practices requirements and to internal policies, and to understand and assess operations presenting a moderate or gresignificant negative impact to a subsidiary bank or the consolidated organization. Areas of potential negatfinancial or operational risks that pose a potential threat to the safety and soundness of a bank, or to the hoserve as a source of financial and managerial strength to its bank subsidiaries, and testing will focus on con

monitoring, and controlling such risks. 

• Functionally regulated subsidiaries - In all situations, the consolidated supervisors rely to the fullest 

information and assessments developed by the appropriate functional regulator of a functionally reguaddition, the consolidated supervisors adhere to the procedural and other requirements governing ex

for a specialized report from, a functionally regulated subsidiary. Under these provisions, for exampsupervisors may conduct an examination of a functionally regulated subsidiary if, after reviewing re

reasonably determine that the examination is necessary to adequately inform the consolidated supervused to monitor and control financial and operational risks within the consolidated organization that safety and soundness of a bank subsidiary of the organization. See 12 U.S.C. § 1844(c)(2)(B) 

EC 4 Principle 24: Consolidated supervision Criterion The supervisor has the power to impose prudential standards on a consolidated basis for the banking group

power to establish prudential standards on a consolidated basis to cover such areas as capital adequacy, larrelated parties and lending limits. The supervisor collects consolidated financial information for each bank

Legal Framework 

In general, the consolidated supervisors impose the prudential standards discussed under Principles 6-16 (omanagement, and risk-specific measures), the internal audit and controls measures described under Principand disclosure standards discussed under Principle 22 on a consolidated, group-wide basis. As those discuauthority to impose measures in this manner is explicitly conferred by statute or expressly addressed by reguideline, supervisory guidance, or related materials. In addition, this authority is implicit in the U.S. fede

responsibility for safeguarding the safety and soundness of banks. 

Practices and Procedures 

Holding companies are expected to serve as sources of financial and managerial strength to their subsidiarstanding ready to use available resources to provide adequate capital funds during periods of financial stremaintaining the financial flexibility and capital-raising capacity to obtain additional resources for providinHolding companies must comply with a broad range of prudential standards aimed to assure their ongoing of financial and managerial strength to subsidiary banks. The agencies apply a common standard for measuring risk-based capital adequacy that is consistent with th
EC 4 Principle 24: Consolidated supervision 

and U.S. banks are subject to tier 1 risk-based and total risk-based capital ratio requirements on a consolidsubject on a consolidated basis to a capital requirement (a leverage ratio) that is not adjusted for risk. The requirements for BHCs and U.S. banks are 4 percent tier 1 risk-based capital, 8 percent total risk-based capleverage capital (3 percent for certain strong BHCs). Most BHCs, particularly those that are expanding or 

high levels of risk, operate with capital levels well above these minimums. An FHC must comply with the capital rules applicable to BHCs. Moreover, to qualify as and to remain an subsidiary of the FHC must, among other things, be well-capitalized (i.e., maintain tier 1 leverage, tier 1 ribased capital ratios of at least 5 percent, 6 percent, and 10 percent, respectively) and well-managed (as det

assigned management by the primary supervisor). Functionally regulated subsidiaries of BHCs and FHCs 

requirements imposed by their functional regulator. BHCs must report all relevant capital measures to U.S. federal banking agencies quarterly. This informatiLeverage and risk-based capital minimums apply to banks and BHCs, and federal banking agencies requirinternal capital management processes and capital levels that meaningfully tie the identification, monitorin

to the determination of the bank and BHC’s capital needs. Current capital adequacy and future capital neesystematic and comprehensive manner in light of their risk profiles and business plans (See SR letter 99-18

the OTS Holding Companies Handbook, and OCC’s Capital and Dividend Accounts Handbook4). These i

management processes are subject to regular internal review as well as review during the supervisory examprocess. While the OTS maintains standardized capital requirements for all savings associations, the OTS does not standardized requirement to all SLHCs. SLHCs are too diverse to develop a single, meaningful capital rat

are engaged in significant lines of business other than banking. The OTS takes a case-by-case approach, wrisk profile of the entire conglomerate to ensure solvency and assess the adequacy of capital on a consolidaOTS considers three capital measures in determining SLHC capital sufficiency: GAAP equity, tangible casimilar to tier 1 core capital ratio for SLHCs that are primarily engaged in financial activities. Other funct

may impose additional regulatory capital measures. SLHCs must report GAAP capital and tangible capital components to the OTS on a quarterly basis. The qschedule filed with the OTS became public as of the quarter ended March 31, 2009. Holding companies file consolidated financial reports on a quarterly basis and most of the content of these publicly. In addition, publicly traded holding companies are subject to SEC filing requirements, which inc

reports containing extensive quantitative and qualitative data. Disclosure information is verified on an ong

4 www.occ.gov/handbook/Capital1.pdf
EC 4 Principle 24: Consolidated supervision 

examination process and through the review of surveillance data.

EC 5 Principle 24: Consolidated supervision Criterion The supervisor has arrangements with other relevant supervisors, domestic and cross-border, to receive inf

condition and adequacy of risk management and controls of the different entities of the banking group. 

Legal Framework 

See Principle 1(6). 

Practices and Procedures 

Under the information sharing arrangements described under Principle 1(6), the U.S. federal banking agenfrom other supervisors, domestic and foreign, on the financial condition and adequacy of risk management different entities of the bank or holding company. Effective consolidated supervision requires strong, cooperative relationships between the federal banking adomestic and foreign primary banking supervisors or functional regulators. These relationships respect the 

authorities and responsibilities of the respective supervisors and regulators and provide for appropriate infcoordination so that individual responsibilities can be carried out effectively while limiting the potential foburden. Information sharing among domestic and international supervisors, consistent with applicable law each supervisor, is essential to ensure that a bank’s and holding company’s global activities are supervised These concepts underlie the provisions of the GLBA that govern the interaction between the Federal Reserconsolidated supervisors, and the other primary banking supervisors and functional regulators. Under thesconducting consolidated supervisory responsibilities the Federal Reserve and the OTS rely to the fullest ex

that a bank holding company or its subsidiary has provided to other federal or state supervisors or to an aporganization; (ii) information that is otherwise required to be reported publicly; and (iii) externally audited addition, the Federal Reserve and the OTS rely to the fullest extent possible on the reports of examination appropriate federal or state supervisory authority, (ii) a broker-dealer or investment adviser made by or on 

Commodity Futures Trading Commission (CFTC), relevant state regulatory authority, or (iii) a licensed inby, or on behalf of, its appropriate state regulatory authority. In developing its overall assessment of a banthe Federal Reserve and the OTS also rely to the fullest extent possible on the assessments and information 

supervisors and regulators. The federal banking agencies assist each other by sharing pertinent information to the extent permissible. 

regarding the financial condition, risk-management policies, and operations of a bank and holding compan

impact on the bank subsidiaries, as well as information concerning transactions or relationships between thThe U.S. federal banking agencies, in conjunction with state bank and thrift supervisors, have in place a nu
EC 5 Principle 24: Consolidated supervision 

informal mechanisms to facilitate consolidated supervision. These mechanisms cover, among other thingsexaminations, communication protocols for emergency situations, and shared access to electronic databasereports, financial records, and other supervisory information. In addition, functional regulators, such as thinsurance supervisors exchange information with the federal banking agencies related to securities and ins

holding company or a financial conglomerate that includes a bank. U.S. law authorizes the federal bankin

financial records, examination reports and other information regarding banks and holding companies. Information sharing among international supervisors, consistent with applicable law, is essential to ensure 

company’s global activities are supervised on a consolidated basis. See Principle 25 for more details. 

EC 6 Principle 24: Consolidated supervision Criterion The supervisor has the power to limit the range of activities the consolidated group may conduct and the lo

can be conducted; the supervisor uses this power to determine that the activities are properly supervised ansoundness of the bank are not compromised. 

Legal Framework/ Practices and Procedures 

As discussed under Principles 3, 23, and 25, the U.S. federal banking agencies have the power, at authorizmeasure, to limit the range of activities a bank or holding company may conduct and the locations in whicconducted. In practice, the federal banking agencies use this power to ensure that the consolidated organizproperly supervised and that the safety and soundness of the bank and holding company are not compromi

EC 7 Principle 24: Consolidated supervision Criterion The supervisor determines that management is maintaining proper oversight of the bank’s foreign operatio

joint ventures and subsidiaries. The supervisor also determines that banks’ policies and processes ensure thof any cross-border operations has the necessary expertise to manage those operations in a safe and sound with supervisory and regulatory requirements. 

Practices and Procedures 

As outlined in SR letter 08-9, section 3, the Federal Reserve’s processes for understanding and assessing fcompliance risk management encompass both domestic and international operations. Most areas of supervmanagement of legal and compliance risks are applicable to both domestic and international banks and holinclude proper oversight of licensed operations, operating in compliance with supervisory and regulatory rsufficiency of MIS. The OTS’s assessment of a SLHC’s risk-management function also includes both dom

holding companies. See OTS Holding Companies Handbook, sections 200, 400 and 500. 

The supervisory approach used by the federal banking agencies is implemented on an enterprise-wide basi

so doing, the agencies evaluate the effectiveness of the bank’s and holding company’s policies, procedures
EC 7 Principle 24: Consolidated supervision 

management processes across the organization. This includes audit programs, management information syprocesses that provide the organization with input on the performance of local managers. An assessment ois incorporated into the evaluation of key corporate governance functions and primary firm-wide risk mana

control functions, including legal and regulatory risk management. Usually there are issues that are unique to a bank’s or holding company’s international operations. For exalegal and regulatory structures and supervisory approaches are fundamentally different from those in the Urequires the organization to devote additional resources necessary for maintaining expertise in local regula

some instances, privacy concerns have led to limits being placed on information that can be shared by a fo

holding company, limiting the parent holding company’s ability to exercise consolidated risk management these cases, strong internal controls and audit processes are particularly important. Supervisory activities: The Federal Reserve and the OTS conduct continuous monitoring activities to und

holding company’s cross-border strategy, trends, and legal entity structure, and related governance, risk m

controls. For a holding company with international operations or risks, an assessment of cross-border operthe evaluation of key corporate governance functions and primary firm-wide risk management and internaincluding legal and regulatory risk management. In addition, the agencies review materials prepared by host country supervisors, including examination rep

conduct ongoing communication with involved foreign and domestic supervisors regarding trends and asseoperations. These continuous monitoring activities are supplemented, as appropriate, by examination activassess the large, complex bank’s or holding company’s cross-border strategy, trends, and legal entity struc

governance, risk management and internal controls. For example, in the case of large, complex banking oroperations, OCC supervisors perform on-site inspections of high-risk foreign operations and analyze the m

risks in countries in which U.S. banks operate. (See SR letter 08-9 and OCC’s Bank Supervision Process a

Supervision Handbooks.5)

EC 8 Principle 24: Consolidated supervision Criterion The supervisor determines that oversight of a bank’s foreign operations by management (of the paren

where relevant, the holding company) includes: (i) information reporting on its foreign operations that 

frequency to manage their overall risk profile and is periodically verified; (ii) assessing in an appropriatinternal controls; and (iii) ensuring effective local oversight of foreign operations. For the purposes of consolidated risk management and supervision, there should be no hindrance in host c

5 www.occ.gov/handbook/banksup.pdf; and www.occ.gov/handbook/lbs.pdf
EC 8 Principle 24: Consolidated supervision 

bank to have access to all the material information from their foreign branches and subsidiaries. Transmisson the understanding that the parent bank itself undertakes to maintain the confidentiality of the data submavailable only to the parent supervisory authority and when legally compelled to do so. 

Practices and Procedures 

As noted in EC 7, for a holding company with international operations or risks, an assessment of cross-borincorporated into the processes for developing an understanding and assessment of key corporate governan

firm-wide risk management and internal control functions, including legal and regulatory risk managemencompanies are required by regulation to provide federal banking agencies with specific information regardoperations and any other information supervisors deem necessary to determine compliance with U.S. bankis not a separate and distinct assessment regarding management’s oversight of a holding company’s foreigof the capability of the board and management encompass the entirety of a holding company’s domestic anThe consolidated supervisor may obtain information about management’s assessment of foreign operationregulators. For example, under the OCC’s risk-based approach to supervision, an evaluation of a bank’s cor country risk management includes review of the policies, procedures, controls, systems (including audit information systems), and effectiveness of management and board oversight across the organization. Genverification procedures are performed in locations with the highest risk exposure. In some jurisdictions, threstrictions on the access to customer records. Federal banking agencies assess restrictions under host country laws that may limit the ability of banks or obtain information on host country operations. They obtain information for this purpose from the relevant as well as from the host country supervisor. Communications with host country authorities may be ad hoc

banking agencies’ consideration of specific expansionary proposals, and/or as part of supervisors’ on-goin

authorities.

EC 9 Principle 24: Consolidated supervision Criterion The home supervisor has the power to require the closing of foreign offices, or to impose limitations on th

it determines that oversight by the bank and/or supervision by the host supervisor is not adequ

office presents; and/or 

it cannot gain access to the information required for the exercise of supervision on a consolidated 

Legal Framework 

As discussed under EC 2, where material impediments exist, the agencies can take remedial measures, wh

limits on the foreign operations or requiring the bank or holding company to terminate those operations. A 
EC 9 Principle 24: Consolidated supervision 

could include where management oversight and/or supervision by the host supervisor is not adequate relatoperations present. When a U.S. bank or holding company wishes to establish or acquire operations in a foreign jurisdiction, tevaluates the extent to which foreign legal requirements may restrict its access to information necessary to compliance with relevant U.S. laws. If material impediments exist and cannot be adequately addressed, thwould not permit the U.S. bank or holding company to expand in the foreign jurisdiction. 

Practices and Procedures 

U.S. federal banking agencies expect U.S. banks and holding companies to supervise and administer their a manner as to ensure that their operations conform to high standards of banking and financial prudence. Uagencies may prohibit or require termination of, or modification to, a bank’s foreign operations’ and/or actand soundness concerns, including those which might hamper adequate consolidated supervision. 

EC 10 Principle 24: Consolidated supervision Criterion The supervisor confirms that oversight of a bank’s foreign operations by management (of the parent bank 

relevant, the holding company) is particularly close when the foreign activities have a higher risk profile oconducted in jurisdictions or under supervisory regimes differing fundamentally from those of the bank’s h

Practices and Procedures 

As described in EC 8, the agencies evaluate risk-management processes for banking products or lines of buentities and perform testing procedures where the exposure or risk is greatest. In implementing this risk-bsupervision, the agencies may not focus on a jurisdiction even though its supervisory regime may be signif

AC 1 Principle 24: Consolidated supervision Criterion For those countries that allow corporate ownership of banking companies: 

the supervisor has the power to review the activities of parent companies and of companies 

companies, and uses the power in practice to determine the safety and soundness of the ba

the supervisor has the power to establish and enforce fit and proper standards for owners and se

companies.

Legal Framework 

As discussions under the preceding principles indicate, the Federal Reserve and OTS have the power to revparent holding companies and of companies affiliated with those and use this power to determine and ensusoundness of bank subsidiaries. As discussed under Principle 4, the Federal Reserve and the OTS have the 

suitability of owners and senior management of holding companies. The Federal Reserve and the OTS use 
AC 1 Principle 24: Consolidated supervision 

ensure the safety and soundness of bank subsidiaries. 

Practices and Procedures 

As noted in EC3, the Federal Reserve and the OTS, as consolidated supervisors, have the authority and resand assess the risks that the parent holding company may pose to the holding company itself or its bank su

EC6, they have the authority to take action against a parent holding company to prevent it from engaging ipractices, or to address violations of law that occur in connection with its own business operations even if 

directly connected to the holding company’s subsidiary banks. 

AC 2 Principle 24: Consolidated supervision Criterion The home supervisor assesses the quality of supervision conducted in the countries in which its banks have Legal Framework 

As discussed under Principles 5 and 25, the federal banking agencies assess the quality of supervision conwhich its banks and holding companies seek to establish material operations. Once material operations are banking agencies informally evaluate host country supervisors through ongoing communication with host and inspection of the cross-border establishments. 

Practices and Procedures 

As noted in EC 7, for a holding company with international operations or risks, an assessment of cross-borincorporated into the processes for developing an understanding and assessment of key corporate governan

firm-wide risk management and internal control functions, including legal and regulatory risk managemenFederal Reserve’s or the OTS’s ability to access information on host country operations or to engage in onconsidered when assessing the appropriate extent of the organization’s activities in that jurisdiction. 

AC 3 Principle 24: Consolidated supervision Criterion The supervisor arranges to visit the foreign locations periodically, the frequency being determined by the s

foreign operation. The supervisor meets the host supervisors during these visits. The supervisor has a polic

needs to conduct on-site examinations of a bank’s foreign operations, or require additional reporting, and hresources to take those steps as and when appropriate. 

Practices and Procedures 

As noted in EC 7, for holding companies with international operations or risks, the federal banking agencioperations as part of their evaluation of key corporate governance functions and primary firm-wide risk mcontrol functions. Also, the federal banking agencies’ formal strategies for the supervision of individual bcompanies include assessments of risk, including risks of foreign operations. On-site work is performed wWhen foreign offices are inspected, supervisors meet with host supervisors. Agencies have the ability to u

approaches to supervision and have, for example, required special reports and audits of foreign offices. 
AC 3 Principle 24: Consolidated supervision 

Additionally, the U.S. federal banking supervisors have worked for many years with counterparts from varstrengthen communication and cooperation as it relates to the supervision of banks and holding companies borders. These efforts have intensified in recent years and now take place in a variety of settings at the mu

bilateral level. At the multilateral level, the BCBS is a forum in which supervisors from member countries meet to discus

consistent supervision of banks with similar business and risk profiles, promote the sharing of best superviformulate guidance to enhance and refine the process of banking supervision globally. As discussed in Principle 25, the agencies have formal information sharing arrangements with many superarrangements set out essential elements in the areas of on-site inspections, ongoing coordination, and prote

facilitate timelier sharing of information. Also, the agencies make periodic visits to develop working relatforeign supervisors. During these visits there are banking industry discussions and strategy sessions focusissues and initiatives. 
Page | 1

Principle 25: Home-host relationships

Cross-border consolidated supervision requires cooperation and information exchange between home supervisors and the various other supervisors 

involved, primarily host banking supervisors. Banking supervisors must require the local operations of foreign banks to be conducted to the same 

standards as those required of domestic institutions. 

Overview

The federal banking agencies are responsible for comprehensive supervision of globally active banks and holding companies while each host country 

supervisor is responsible for supervision of the offices and subsidiaries in its jurisdiction. The federal banking agencies (except the OTS) carry out their 

responsibilities as host country supervisors through the risk-focused procedures including the Interagency Program for Supervising the U.S. Operations 

of Foreign Banking Organizations (Federal Reserve SR letter 00-14 http://fedweb.frb.gov/fedweb/bsr/srltrs/SR0014.htm). See also the OCC’s Federal 

Branches and Agencies Supervision Handbook1. The program coordinates the supervision and examination of foreign banking organizations’

operations in the United States in a similar manner to the supervision of large, complex U.S. banks and holding companies. The OTS applies a single 

examination and risk assessment program to both U.S. and foreign-owned SLHCs and their savings association subsidiaries. See the OTS’s Holding 

Companies Handbook. As a host supervisor, OTS coordinates the application of this program with home country supervisory authorities.

Over the past decade, information sharing through Memorandums of Understanding (MoU), Statements of Cooperation (SOC) or similar arrangements 

has become increasingly common. These vehicles, while not legally binding, broadly govern information access and information sharing between 

supervisors acting in a home and host capacity. U.S. federal banking agencies are authorized to share relevant supervisory information with foreign 

banking supervisors even in the absence of a formal arrangement such as an MoU, and in practice the agencies share significant information with 

foreign supervisors whether the U.S. agencies act in a home or host capacity. All sharing is subject to certain statutory requirements including those 

relating to the ability of the foreign bank supervisor to maintain the confidentiality of information provided to it. In appropriate cases the agencies also 

have the authority to share information with financial supervisors other than bank supervisors.

Typically, an MoU addresses sharing of information, including contact during the authorization process of a cross-border establishment and contact and 

communication in the ongoing supervision of such entities; supervisory cooperation in carrying out inspections in the host jurisdiction, as well as 

cooperation in BSA/AML violations, terrorist financing, and unauthorized banking business; information sharing about parallel banking organizations; 

sharing and safeguarding confidential information and using it for lawful supervisory purposes only; encouraging continuous and informal contacts 

between the supervisors; and arranging visits and internships where practical.

Also, the agencies support the following reference documents2: Principles for the supervision of banks' foreign establishments (Concordat), May 1983; 

Information flows between Banking Supervisory Authorities, April 1990; Report on Cross-Border Banking Supervision, October 1996; Shell banks and 

booking offices, January 2003; and The high-level principles for the cross-border implementation of the New Accord, August 2003; and Home-host 

information sharing for effective Basel II implementation, June 2006.

 

1 www.occ.treas.gov/handbook/fba.pdf

2 www.bis.org/publ/bcbsc312.pdf?noframes=1; www.bis.org/publ/bcbsc313.pdf?noframes=1; www.bis.org/publ/bcbs27.pdf?noframes=1; 

www.bis.org/publ/bcbs95.pdf?noframes=1; http://www.bis.org/publ/bcbs100.pdf?noframes=1; and www.bis.org/publ/bcbs125.pdf?noframes=1
Page | 2

EC 1 Principle 25: Home-host relationships

Criterion Information to be exchanged by home and host supervisors should be adequate for their respective roles and responsibilities.

Legal 

Framework

As discussed in detail under Principle 1(6), U.S. federal banking agencies have clear authority to share confidential supervisory 

information with domestic and foreign banking and other financial sector supervisors. In general, the information must be used for 

lawful supervisory purposes only, and the recipients of such information must keep it confidential. The responses to ECs 1-4 and 

AC 1 address the practical application of this authority and assume that all sharing described would comply with any legal 

restrictions on information sharing.

Practices and

Procedures

U.S. federal banking agencies provide adequate data and information in a timely manner to host country supervisors about U.S.

banks and holding companies, including any significant issues of a supervisory nature, to enable the host authority to supervise the 

overseas operations of the U.S. banks effectively and appropriately. The U.S. federal banking agencies have ongoing contact with 

supervisors in other countries in which U.S. banks have material operations.

Information sharing by the U.S. agencies as both home and host supervisors involves sharing significant supervisory concerns and 

supervisory documents; providing information to assist with the authorization process and with investigations; discussing and 

coordinating supervisory plans and strategies with foreign supervisors; managing and participating in bilateral and multilateral 

meetings in the United States and overseas; developing joint enforcement actions when warranted; and participating in “colleges” of 

supervisors to focus on a specific bank, holding company or supervisory issue. Additionally, U.S. supervision staff periodically visit 

foreign supervisory authorities to discuss supervisory issues. See Overview for how these responsibilities are discharged. 

EC 2 Principle 25: Home-host relationships

Criterion For material cross-border operations of its banks, the supervisor identifies all other relevant supervisors and establishes informal or 

formal arrangements (such as memoranda of understanding) for appropriate information sharing, on a confidential basis, on the

financial condition and performance of such operations in the home or host country. Where formal cooperation arrangements are 

agreed, their existence should be communicated to the banks and banking groups affected.

Legal 

Framework

Typically, the U.S. federal banking agencies identify other relevant supervisors at the time a banking organization seeks authority, or 

provides notice of its intent, to establish operations in a foreign jurisdiction. The federal banking agencies will evaluate any 

restrictions on disclosure that may exist under the laws of the foreign jurisdiction and will confirm, indirectly through the bank/

holding company or directly with the foreign supervisor, that the agencies will have access to all information necessary to determine 

and enforce compliance with relevant U.S. laws. If material impediments exist and cannot be adequately addressed, the agencies 

would not permit the bank to expand in the foreign jurisdiction. As appropriate, the agencies will establish formal or informal 

arrangements for the sharing of relevant confidential supervisory information regarding the bank’s operations in the home or host 

country. Information sharing arrangements with foreign supervisors are made available to the public through the Freedom of 

Information Act process. The existence of institution- or group-specific arrangements generally is disclosed to the involved bank but 

is not otherwise made publicly known.

Practices and Today, federal banking agencies have joint information sharing arrangements in place with banking supervisors in many foreign 
Page | 3

EC 2 Principle 25: Home-host relationships

Procedures jurisdictions. These arrangements, while not required by law, support the agencies’ efforts to oversee the operations of foreign 

banks operating in the United States as well as to supervise the foreign operations of U.S. banks. Information sharing arrangements 

are in process or near completion with supervisors in several additional jurisdictions. These arrangements generally cover those 

elements set forth in the Basel Committee’s paper “Essential elements of a statement of cooperation between banking supervisors” 

(May, 2001).3 The above processes are buttressed by an informal system which relies on peer-to-peer contact, and this informal 

network remains an invaluable complement to the overall, global, consolidated supervisory process.

See Overview for a description of MoUs. 

EC 3 Principle 25: Home-host relationships

Criterion The home supervisor provides information to host supervisors, on a timely basis, concerning: • the overall framework of supervision 

in which the banking group operates; • the bank or banking group, to allow a proper perspective of the activities conducted within 

the host country’s borders; • the specific operations in the host country; and • where possible and appropriate, significant problems 

arising in the head office or other parts of the banking group if these are likely to have a material effect on the safety and soundness 

of subsidiaries or branches in host countries. A minimum level of information on the bank or banking group will be needed in most 

circumstances, but the overall frequency and scope of this information will vary depending on the materiality of a bank’s or banking 

group’s activities to the financial sector of the host country. In this context, the host supervisor will inform the home supervisor 

when a local operation is material to the financial sector of the host country.

Practices and 

Procedures

The U.S. banking supervisors provide relevant information on U.S. banks and holding companies to host supervisors in response to 

specific requests regarding their supervision and provide information on significant problems that might have a material effect on the 

subsidiaries or branches in the host country. Information on a home to host basis is also provided for in MoUs and similar 

arrangements. These arrangements provide for cooperation during the licensing process, in the supervision of ongoing activities, and 

in the handling of problem banks. U.S. federal banking agencies endeavor to inform host country supervisors in a timely manner 

about events that could endanger the stability of cross-border establishments in the host country. The federal banking agencies also 

inform host country supervisors when administrative penalties have been imposed or any other formal enforcement action has been 

taken against a U.S. bank or holding company if the agencies believe such information will be important to the host country 

supervisor as it may relate to the cross-border operations in that country.

EC 4 Principle 25: Home-host relationships

 

3 www.bis.org/publ/bcbs83.pdf?noframes=1
Page | 4

EC 4 Principle 25: Home-host relationships

Criterion The host supervisor provides information to home supervisors, on a timely basis, concerning: • material or persistent non-compliance 

with relevant supervisory requirements, such as capital ratios or operational limits, specifically applied to a bank’s operations in the 

host country; • adverse or potentially adverse developments in the local operations of a bank or banking group regulated by the home 

supervisor; • adverse assessments of such qualitative aspects of a bank’s operations as risk management and controls at the offices in 

the host country; and • any material remedial action it takes regarding the operations of a bank regulated by the home supervisor. A 

minimum level of information on the bank or banking group, including the overall supervisory framework in which they operate,

will be needed in most circumstances, but the overall frequency and scope of this information will vary depending on the materiality 

of the cross-border operations to the bank or banking group and financial sector of the home country. In this context, the home 

supervisor will inform the host supervisor when the cross-border operation is material to the bank or banking group and financial 

sector of the home country.

Legal 

Framework

The federal banking agencies have authority to share supervisory information with home country banking supervisors. See Principle 

1(6) and 12 U.S.C. § 3109. The agencies have adopted internal procedures to facilitate the provision of relevant information to home 

country banking supervisors.

Practices and 

Procedures

As a host country supervisor, the agencies cooperate with the home country supervisors of foreign banking organizations (FBOs) 

with U.S. banking operations in order to facilitate the consolidated supervision activities of those supervisors. (See EC 2 for a 

discussion of information sharing.)

Under the FBO Supervision Program (Interagency Program for Supervising the U.S. Operations of Foreign Banking Organizations, 

i.e., Federal Reserve SR letter 00-14 and OCC’s Federal Branches and Agencies Supervision Handbook4), the Federal Reserve and 

the OCC routinely provide copies of essential supervisory products to home country supervisors. This includes an annual 

assessment of the combined U.S. operations of the FBO which contains a supervisory rating, summary examination and supervisory 

findings along with details of areas requiring management attention, and notice of any proposed or pending formal or informal

supervisory action; a copy of the notification to the head office of the FBOs Strength-of-Support Assessment ranking (the SOSA) that 

is a considered assessment by the U.S. supervisor of the support that the parent bank/head office provides to its U.S. operations. 

Where specifically requested by the home country supervisor, copies of examination reports of the U.S. operations of the FBOs may 

be provided to the home country supervisor. See also the OTS’s Holding Companies Handbook (information sharing regarding 

cross-border operations of SLHCs.)

Similarly, the federal banking agencies communicate with home country supervisors on subsidiaries of foreign banks and banking 

organizations. The agencies will apprise home supervisors of significant concerns and impending supervisory actions, and will 

provide reports of examination upon request.

 

4 www.occ.treas.gov/handbook/fba.pdf
Page | 5

EC 5 Principle 25: Home-host relationships

Criterion A host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, 

inspection and regulatory reporting requirements similar to those for domestic banks.

Legal 

Framework

The local operations of foreign banks are subject to prudential, inspection, and regulatory reporting requirements similar to those 

applicable to domestic banks. In general, these requirements can be found in the statutes and regulations applicable to domestic 

banks and in the International Banking Act (IBA), 12 U.S.C. § 3101 et seq., and its implementing regulations, see 12 CFR 211, 

subpart B and 12 CFR 28, subpart B. 

Practices and 

Procedures

The IBA provides for “national treatment” of foreign banks doing business in the United States. The principle of “national 

treatment” means that the U.S. law generally accords the same treatment to FBOs as it does to domestic (i.e., U.S.) banks. However, 

a number of regulations do not apply to FBOs that do not have retail operations. The Federal Reserve’s CA letter 04-3 and the 

OCC’s Federal Branches and Agencies Supervision Handbook5provide guidance for assessing whether a consumer compliance or 

Community Reinvestment Act (CRA) examination of an FBO is necessary (see 12 CFR 228.11(c)(3)). These assessments are 

conducted according to the frequencies mandated in the OCC’s Bank Supervision Process Handbook6and the Federal Reserve’s CA 

letter 03-12.

Where foreign banking organizations own and/or control subsidiary U.S. savings associations, those savings associations are subject 

to the same requirements and treatment as savings associations7

EC 6 Principle 25: Home-host relationships

Criterion Before issuing a license, the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor 

has been received. For purposes of the licensing process, as well as ongoing supervision of cross-border banking operations in its 

country, the host supervisor assesses whether the home supervisor practices global consolidated supervision.

Legal 

Framework

As discussed under EC 11 to Principle 3, a foreign entity must obtain approval from the Federal Reserve and either the OCC8or a 

state banking supervisor before establishing a banking office or a subsidiary bank in the United States. A foreign entity must obtain 

the approval of OTS to establish or acquire a subsidiary savings association or SLHC. The FDIC does not issue licenses but must 

grant deposit insurance approval before a subsidiary bank is licensed. The Federal Reserve or OTS, as applicable, routinely contacts 

the home country supervisor during the application process and, in making a decision on an application, takes into account whether 

the home country supervisor has approved (or expressed no objection) to the proposal. If the foreign entity is a foreign bank, the 

 

5 www.occ.gov/handbook/fba.pdf

6 www.occ.treas.gov/handbook/banksup.pdf (pages 17-19)

7 The statute and regulations governing SLHCs apply to both foreign and domestic SLHCs. See generally, 12 U.S.C.1467a; 12 CFR Parts 583-585.

8 A foreign bank wishing to establish a federal branch or agency in the United States must receive approval from the OCC. See 12 U.S.C. § 3102(a). In evaluating a 

foreign bank’s application for a federal branch or agency, the OCC considers whether the home country supervisor has consented to the proposed establishment of the 

office. 12 CFR 28.12(b)(6). With respect to applications to establish a federal branch or agency outside of a foreign bank’s home state, the OCC also considers whether 

the applicant foreign bank is subject to CCS by its home country supervisor.
Page | 6

EC 6 Principle 25: Home-host relationships

Federal Reserve or OTS, as applicable, must determine that the foreign bank, and any foreign bank parent, is subject to 

comprehensive and consolidated supervision by its home country supervisor. The Federal Reserve or OTS also assesses the extent 

to which home country supervisors oversee or monitor the operations between a foreign bank and any foreign non-bank parent. The 

adequacy of home country supervision is evaluated at authorization, and as part of on-going supervision. Consideration of home 

country supervision and head office support is part of regular risk assessment. 

Practices and 

Procedures

The assessment of whether a home supervisor practices global consolidated supervision depends on a methodical analysis conducted 

by the primary U. S. federal banking agency. This process was legally mandated by the Foreign Bank Supervision Enhancement Act 

of 1991 (FBSEA) as a required standard for allowing a foreign bank to establish a branch or agency or subsidiary bank or savings 

association in the United States. The objective of the analysis, known as “CCS” (for Comprehensive Consolidated Supervision) is to 

determine whether the foreign bank is supervised or regulated in a manner such that its home country supervisor receives sufficient 

information on the worldwide operations of the foreign bank—including affiliated parties—to assess the foreign bank’s overall 

financial condition and compliance with law and regulation. The assessment of CCS is not based on a rigid formula and looks to the 

same objectives as the Basel Core Principles.

A full CCS finding is not required for approval of branch and agency applications but the Federal Reserve must find that the home 

supervisor is “actively working towards” establishing arrangements for CCS. 12 U.S.C. § 3105 (d)(6).

EC 7 Principle 25: Home-host relationships

Criterion Home country supervisors are given on-site access to local offices and subsidiaries of a banking group in order to facilitate their 

assessment of the group’s safety and soundness and compliance with KYC requirements. Home supervisors should inform host 

supervisors of intended visits to local offices and subsidiaries of banking groups.

Legal 

Framework

Nothing in U.S. federal law would prevent a home supervisor from conducting on-site inspections of U.S. offices and subsidiaries of 

foreign banks to assess the banking organization’s safety and soundness and compliance with KYC requirements.

Practices and 

Procedures

Foreign supervisors may conduct on-site examinations of their banks’ cross-border establishments in the United States and would 

generally have access to all information, including individual customer account information, necessary for assessing safety and 

soundness and compliance with KYC requirements. Before conducting such examinations, foreign supervisors should contact the 

relevant federal banking agencies and the state banking authority if the operations to be examined are state-chartered or statelicensed. With prior arrangement, foreign supervisors typically may conduct their on-site examinations without being accompanied 

by representatives of the federal banking agencies. Note, however, there may be state laws (e.g. FLA.STAT. 655.059 (2007)) that 

limit access to certain types of information at state-licensed entities. 

In general, the U.S. banking agencies expect to be permitted on-site access to foreign offices and subsidiaries of a U.S. bank and 

holding company’s foreign operations in order to facilitate their assessment of the bank and holding company’s safety and soundness 

and compliance with KYC requirements. The U.S. agencies inform host supervisors in advance of intended visits to foreign offices 
Page | 7

EC 7 Principle 25: Home-host relationships

and subsidiaries. MOUs and SOCs generally contain provisions regarding on-site examinations.

EC 8 Principle 25: Home-host relationships

Criterion The host supervisor supervises shell banks, where they still exist, and booking offices in a manner consistent with internationally 

agreed standards.

Legal 

Framework

The establishment of shell banks is not permitted in the United States, at the federal or state levels, and no legacy shell banks or 

booking offices exist in the United States.

Practices and 

Procedures

A foreign shell bank is a foreign bank without a physical presence in any country. Shell banks are not permitted to operate in the 

United States. In addition, the United States has taken measures to prevent foreign shell banks from directly or indirectly accessing 

the U.S. financial system. Banks also must take reasonable steps to ensure that any correspondent account established, maintained, 

administered, or managed in the United States for a foreign bank is not being used by that foreign bank to provide banking services

indirectly to foreign shell banks, i.e., that the foreign correspondent bank of the U.S. bank does not in turn give a foreign shell bank 

the ability to access the U.S. correspondent account through its account. A bank is required to terminate immediately any account 

that it knows to be the account of a foreign shell bank or that it knows is being used indirectly by a foreign shell bank. Recent 

amendments to the Bank Secrecy Act (BSA) prohibit U.S. banks from establishing, maintaining, administering or managing a 

correspondent account in the United States for any foreign shell bank other than a regulated affiliate of a U.S. or foreign bank. See

31 CFR 103.177

EC 9 Principle 25: Home-host relationships

Criterion A supervisor that takes consequential action on the basis of information received from another supervisor consults with that 

supervisor, to the extent possible, before taking such action.

Practices and 

Procedures

Effective cross-border supervision relies on clear, open communication between home and host supervisors. This is particularly the 

case where a banking supervisor contacts a supervisor in another country about significant or serious (including criminal) 

supervisory issues requiring attention. By the very nature of U.S. federal (and state) banking supervision, the agencies involved 

work within a communication web that demands continuous coordination and consideration. The same methodology applies with 

cross-border information exchanges and requests for action or opinions. In such cases, the agencies always confer at the appropriate 

level and to the appropriate extent with the foreign supervisor before taking any action. See Federal Reserve AD letter 03-27/SR 

letter 01-21/AD letter 01-30; and OCC’s PPM 5500-1.

AC 1 Principle 25: Home-host relationships
Page | 8

AC 1 Principle 25: Home-host relationships

Criterion Where necessary, the home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and 

nature of the strategy should reflect the size and complexity of the cross-border operations of the bank or banking group.

Practices and 

Procedures

The U.S. banking supervisors establish communication strategies through formal processes (i.e., MOUs and SOCs) and informal 

processes (e.g., Basel II and Financial Stability Board supervisory colleges). For example, in relation to Basel II, the U.S. 

supervisors hold periodic meetings with host supervisors to share information as applicable on home country risk-management 

practices and models which may be employed in host country entities of the globally supervised banks and holding companies. 

Also, the U.S. supervisors are implementing the Financial Stability Board’s protocols for establishing supervisory colleges for major 

global banks. In doing so, the U.S. supervisors have convened supervisory colleges with host supervisors of significant operations of 

U.S. banks.
Glossary of Terms

This glossary gives basic definitions of terms used in the text. A Administrative Procedures Act (APA) Federal legislation that, in part, sets up a process for the U.S. federal courts to directly review agency decisions. Under the 

aggrieved by a final agency action—including promulgation of a rule or policy or application of that policy to a particular c

challenge the agency’s action in court. Interested parties also may petition for issuance, amendment, or repeal of a rule or tthat is “unlawfully withheld or unreasonably delayed.” The standard of judicial review in these instances generally is high

affiliate transactions Sections 23A and 23B of the Federal Reserve Act, and their implementing regulation, Regulation W, restrict a bank’s transaffiliates to safeguard the interests of banks and prevent abuses by banks’ affiliates. The laws establish certain quantitative 

prudential requirements for loans, purchases of assets, and certain other transactions between a member bank and its affiliaCFR 223) implements sections 23A and 23B by defining terms used in the statute, explaining the statute's requirements, antransactions. agreement corporation Corporation chartered by a state to engage in international banking; so named because the corporation enters into an “agree

of Governors to limit its activities to those permitted an Edge Act corporation. Typically organized as a subsidiary of a banration may conduct activities abroad that are permissible to foreign banks abroad but that may not otherwise be permissible Allowance for Loan and Lease Losses (ALLL) An appropriate ALLL covers estimated credit losses on individually evaluated loans that are determined to be impaired as w

losses inherent in the remainder of the loan and lease portfolio. For purposes of this, the term “estimated credit losses” mecurrent amount of loans that it is probable the institution will be unable to collect given facts and circumstances as of the evestimated credit losses represent net charge-offs that are likely to be realized for a loan or group of loans. Attorney General In the context of the Federal Tort Claims Act in Principle 1, the attorney general refers to the U.S. Attorney General, who iDepartment of Justice and chief law enforcement officer of the federal government. 
B 

bank All FDIC-insured national banks (supervised by the OCC), FDIC-insured state-chartered banks (both Federal Reserve mem

Federal Reserve) and nonmember (supervised by the FDIC), and FDIC-insured savings associations (supervised by the OT

otherwise requires. Bank for International Settlements (BIS) International organization established in 1930 and based in Basel, Switzerland, that serves as a forum for central banks for developing analyses, and cooperating on a wide range of policy-related matters; also provides certain financial services to cbank holding companies (BHCs) and savings and loan holding companies (SLHCs) Any company that has control over a bank or savings association, respectively. For the purposes of this document, they are companies” except in cases where there is a material difference between BHCs and SLHCs (in terms of legal authority, ope

BHCs are supervised by the Federal Reserve and SLHCs are supervised by the OTS. Bank Holding Company Act of 1956 Federal legislation that establishes the legal framework under which bank holding companies operate and places the formatcompanies and their acquisition of banking and nonbanking interests under the supervision of the Federal Reserve. banking group or banking organization A holding company and its banking subsidiaries, excluding certain nonbank subsidiaries. Basel Committee on Banking Supervision (BCBS)An international committee of bank supervisors, associated with the BIS, that is headquartered in Basel, Switzerland, and i

supervisors from Argentina, Australia, Belgium, Brazil, Canada, China, France, Germany, Hong Kong SAR, India, IndoneLuxembourg, Mexico, the Netherlands, Russia, Saudi Arabia, Singapore, South Africa, Spain, Sweden, Switzerland, Turkeand the United States. Basel II Informal name for the 2004 agreement updating the Basel Accord. Also known as the New Basel Accord, Basel II has thre

capital requirements, supervisory oversight, and market discipline. 
Board of Governors 

Central, governmental agency of the Federal Reserve System, located in Washington, D.C., and composed of seven membe

by the President and confirmed by the Senate. The Board, with other components of the System, has responsibilities associmonetary policy, the supervision and regulation of certain banking organizations, the operation of much of the nation’s payadministration of many federal laws that protect consumers in credit transactions. The Board also supervises the Federal ReC Call Report Informal name for quarterly Reports of Condition and Income (See Reports of Condition and Income). 

CAMELS Capital, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk—The six essential components of a condition in the UFIRS (See Uniform Financial Institutions Ratings System). 

Change in Bank Control Act (CBCA) Federal legislation that requires any party seeking to acquire the power to vote 25 percent or more of a class of voting secur

notice to the appropriate federal banking agency prior to the acquisition. In addition, persons seeking to acquire the power tmore of a class of voting securities are presumed to have acquired control in certain circumstances. This includes situations 

persons simultaneously acquire equal percentages of 10 percent or more of a bank’s voting securities. Also, persons acting 

their interests in a bank considered collectively.civil money penalties (CMPs) Civil money penalties , which require monetary payments, penalize directors or other persons participating in the affairs of 

of laws, regulations, orders, conditions imposed in writing, and written agreements; unsafe or unsound practices; and breacCMPs may be used alone or in combination with informal or formal enforcement actions. 

Code of Federal Regulations (CFR) Title 12 of the CFR contains the regulations of the U.S. federal banking agencies. Parts 1-199 contain the OCC’s regulatiocontain the Federal Reserve’s regulations, parts 300-499 contain the FDIC’s regulations, and parts 500-599 contain the OT

commercial bank “Bank” as described above, but excluding savings associations. 
consolidated organization 

The consolidated entity including the parent and its bank and nonbank subsidiaries. 

E Edge Act corporation (or Edge corporation) Corporation chartered by the Federal Reserve to engage in international banking. The Board of Governors acts on applicati

Act corporations and also examines the corporations and their subsidiaries. Typically organized as a subsidiary of a bank, amay conduct activities abroad that are permissible to foreign banks abroad but that may not otherwise be permissible to U.S

Senator Walter Edge of New Jersey, who sponsored the original legislation to permit formation of such organizations. (Com

corporation.) 

F Federal Advisory Committee Act (FACA) Federal legislation that formalized a process for establishing, operating, overseeing, and terminating advisory committees, composed of representatives from industry. The FACA ensures that advice rendered to the executive branch by advisory c

boards, and commissions is both objective and accessible to the public. Federal Deposit Insurance Act (FDI Act) Derived from a 1933 amendment to the Federal Reserve Act, the FDI Act creates the Federal Deposit Insurance Corporatioof banks and savings associations; provides the FDIC with powers and authority to supervise state-chartered nonmember b

backup supervision and enforcement to all insured depository institutions regardless of charter; and establishes the regime uresolves failed, insured depository institutions.Federal Deposit Insurance Corporation (FDIC) An independent agency of the federal government that is managed by a five-member board of directors appointed by the Pby the Senate. The heads of the OCC and OTS hold seats on the FDIC board. The FDIC is subject to audits by the GovOffice and oversight by Congress. Besides being the federal regulator for nonmember state banks (i.e., not a member System), the FDIC administers the federal deposit insurance fund. 
Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA)

Federal legislation that greatly increased the powers and authority of the FDIC. Major provisions recapitalized the Bank In

merged with the Savings Association Insurance Fund into the Deposit Insurance Fund) and allowed the FDIC to borrow froAmong other significant changes, the FDICIA mandated a least-cost resolution method and a prompt resolution approach t

banks; ordered a risk-based deposit insurance assessment scheme; and restricted brokered deposits and the solicitation of dnonbank activities of insured state banks. FDIC Financial Institution Letter (FIL) Financial Institution Letters (FILs) are addressed to the Chief Executive Officers of the financial institutions on the FIL disgenerally, FDIC-supervised institutions. FILs may announce new regulations and policies, new FDIC publications, and a vof principal interest to those responsible for operating a bank or savings association. Federal Financial Institutions Examination Council (FFIEC) The FFIEC was established by Congress under Title X of the Financial Institutions Regulatory and Interest Rate Control Ais composed of the chairpersons of the FDIC and the National Credit Union Administration, the Comptroller of the CurrencOTS, a governor of the Federal Reserve Board, and the Chair of the FFIEC State Liaison Committee. The State Liaison Coof five representatives of state agencies that supervise financial institutions. The FFIEC prescribes uniform federal principlexamination of depository institutions, promotes coordination of bank supervision among the U.S. federal banking agenciecoordination of federal and state regulatory activities. Federal Reserve Act Federal legislation, enacted in 1913, that established the Federal Reserve System. Federal Reserve Bank One of the twelve operating arms of the Federal Reserve System, located throughout the nation, that together with their BraSystem functions, including providing payment services to depository institutions, distributing the nation’s currency and co

regulating member banks and bank holding companies. The Reserve Banks also serve as a fiscal agent for the U.S. govern

Federal Reserve District (Reserve District, or District) One of the twelve geographic regions served by a Federal Reserve Bank. 
Federal Reserve System (Federal Reserve)

The central bank of the United States, created by the Federal Reserve Act and made up of a seven-member Board of GoverD.C.; twelve regional Federal Reserve Banks; and Branches of the Federal Reserve Banks. Federal Tort Claims Act Federal legislation that allows lawsuits against federal banking agencies’ employees for acts and/or omissions that cause inwithin the scope of their employment. In such a case, the United States would substitute itself as the defendant upon the Acertification that an employee was acting within the scope of his/her office or employment at the time of the incident giving Moreover, an exception to the act protects employees from lawsuits involving the execution of a statute or regulation or the performance or the failure to exercise or perform a discretionary function or duty, whether or not the employee abused the financial holding companyBank holding companies, whose depository institution subsidiaries meet enhanced capital and managerial standards, that ar

in expanded financial activities, including securities, insurance, and merchant banking. foreign banking organization (FBO) Foreign banks that conduct commercial banking operations in the United States. Freedom of Information Act (FOIA) Federal legislation that serves as the vehicle to obtain federal agency records, unless the records (or any portion thereof) are 

disclosure by one of the FOIA's nine exemptions or by one of its three special law enforcement record exclusions. functionally regulated entity Entities within the consolidated organization that are regulated by the U.S. Securities and Exchange Commission, the ComCommission, or state insurance regulators. G Government Accountability Office (GAO) GAO is an independent, nonpartisan agency that works for Congress. Often called the “congressional watchdog,” GAO invfederal government spends taxpayer dollars. 
Government Performance and Results Act of 1993 

Federal legislation that provides, among other things, for the establishment of strategic planning and performance measuremgovernment. A primary purpose is to improve the confidence of the American people in the capability of the federal goversystematically holding federal agencies accountable for achieving program results. Each of the U.S. federal banking agencact, which requires federal agencies, in consultation with Congress and outside stakeholders, to prepare a strategic plan cov

period and submit an annual performance plan and performance report. The performance plans and assessments are incorp

agencies’ annual reports, which are required to be made public. Gramm-Leach-Bliley Act (GLBA)Federal legislation that allows affiliations among banks, securities firms, and insurance companies under a financial holdin

The GLBA reaffirmed the Federal Reserve’s role as “umbrella supervisor” over organizations that control banks, while als

regulators and functional regulators exercise their respective supervisory authority over supervised subsidiaries of a financi

H Home Owners’ Loan Act (HOLA) Federal legislation that provided for a type of savings association to be chartered and regulated by a federal agency, now thregulates state-chartered savings associations and holding companies of both federal and state-chartered savings associationcompanies (BHCs) and savings and loan holding companies (SLHCs).Housing and Economic Recovery Act of 2008 Federal legislation under which the agencies are developing a system to register mortgage loan originators at banks with thLicensing System and Registry, which was developed by state regulators. I Institution-affiliated party (IAP) An institution-affiliated party refers to (1) any director, officer, employee, or controlling shareholder (other than a bank hol

agent for, an insured bank; (2) any other person who has filed or is required to file a change-in-control notice with the appragency under section 1817(j) of the ??? ; (3) any shareholder (other than a bank holding company), consultant, joint venturperson as determined by the appropriate federal banking agency (by regulation or case-by-case) who participates in the coninsured bank; and (4) any independent contractor (including any attorney, appraiser, or accountant) who knowingly or reck
(A) any violation of any law or regulation; (B) any breach of fiduciary duty; or (C) any unsafe or unsound practice, which c

cause more than a minimal financial loss to, or a significant adverse effect on, the insured bank. interagency guidance Guidance issued jointly by more than one U.S. federal banking agency to banks and/or holding companies. International Banking Act of 1978 (IBA)Federal legislation that subjected foreign banks with U.S. branches and agencies to federal regulations. The IBA required th

reserves and generally limited their activities and geographic expansion in the United States in accordance with the compar

applicable to U.S. banking organizations. Based on a policy of national treatment, the IBA also attempted to adapt the dual 

U.S. system permitting banks to be chartered by either state or federal authorities—to the unique characteristics of foreign 

agencies. M member bank A bank that is a member of the Federal Reserve System. All national banks are, by law, members of the System; state-char

choose to apply to join the System. The term does not include a savings association. N national bank A commercial bank that is chartered by the Office of the Comptroller of the Currency. By law, national banks are memberReserve System. Some national banks are chartered for a special purpose and limit their operations to such things as credit fiduciary activities. For purposes of this FSAP, we have limited the discussion to insured national banks, however, it shoulOCC also supervises a small number of uninsured national trust banks. 

National Bank Act (NBA) Federal legislation signed into law by President Lincoln in 1864. The NBA revised the National Currency Act which had b

in 1863. These laws established a new system of national banks and a new government agency headed by a Comptroller of Comptroller's job was to organize and supervise the new banking system through regulations and periodic examinations. 
National Information Center (NIC) 

A central repository of data about banks and other institutions for which the Federal Reserve has a supervisory, regulatory, 

including both domestic and foreign banking organizations operating in the United States. nonmember bank A state-chartered commercial bank that is not a member of the Federal Reserve System. O OCC Advisory Letters Advise bankers and bank directors about activities and situations that could contribute to, or detract from, the safe and sounnational banks. OCC Bulletins Provide information of continuing concern on OCC or OCC-supported policies and guidelines, and inform readers of pendiand other general information. OCC PPM Internal Policies and Procedures Manual for OCC supervisors. Office of the Comptroller of the Currency (OCC) A bureau of the U.S. Department of the Treasury. The OCC charters, regulates, and supervises all national banks. It also l

primary supervisor of federally licensed branches and agencies of foreign banks. The head of the OCC is the Comptroller o

Officer of Inspector General (OIG) Each federal banking agency is subject to oversight by an OIG, with broad authority to identify and investigate fraud, wastagency. The OIGs conduct statutorily required and ad hoc reviews of agency operations, and have independent reporting liOffice of Thrift Supervision (OTS) A bureau of the U.S. Department of the Treasury. The OTS is responsible for chartering federal savings associations and fsupervising federal- and state-chartered savings associations and their holding companies, commonly referred to as thrift inand loan holding companies, respectively. The head of the OTS is formerly called the Director. 
OTS CEO Memorandums 

Supervisory memos to the Chief Executive Officers of all OTS-regulated savings associations and/or savings and loan holdOTS Thrift Bulletins Directives to thrift institutions and/or savings and loan holding companies providing clarification of regulations or laws, or 

and procedures. P prompt corrective action (PCA) Supervisory framework, created under the FDICIA (see Federal Deposit Insurance Corporation Improvement Act of 1

enforcement actions closely to the level of capital held by banks. R Reports of Condition and Income Quarterly financial reports that all banks, Edge and agreement corporations, and certain other types of organizations must fregulatory agency. (See Call Report.) 

Riegle Community Development and Regulatory Improvement Act Federal legislation that requires the federal banking agencies to submit a joint report annually to Congress (section 305 of tcoordination of examinations and supervision of institutions that are subject to multiple supervisors. The basic principles g

activities are set forth in the Interagency Policy Statement on Examination Coordination, issued in 1993. This report evide

the agencies place on working together to identify and reduce regulatory burden and on coordinating supervisory activitiesother and state bank and thrift supervisors, but also with U.S. securities and insurance regulators and foreign financial instit

S 
savings association 

A type of bank that is encouraged by law to focus on home mortgage lending. It may be chartered either by the OTS or by OTS regulates all savings associations. Securities and Exchange Commission (SEC) An independent agency of the U.S. government that holds primary responsibility for enforcing the federal securities laws a

the securities industry, the nation's stock and options exchanges, and other electronic securities markets. 

SR Letter Supervision and Regulation letters that address significant policy and procedural matters related to the Federal Reserve Sys

responsibilities. These letters are issued by the Board of Governors' Division of Banking Supervision and Regulation and a

disseminating information to banking supervision staff at the Board and the Reserve Banks, as well as to supervised bankinLetters concerning financial institution supervision are designated with [SUP]. state bank A bank that is chartered by a state. State banks are primarily supervised by state banking authorities; however, the FDIC alauthority over state banks that are not members of the Federal Reserve System, and the Federal Reserve also has supervisobanks that are members of the Federal Reserve System. state banking agencies The United States has a “dual banking system,” which refers to the parallel state and federal banking systems that co-exist 

The federal system (1) is based on a federal bank charter, (2) has powers defined under federal law, (3) operates under fede

provides oversight by a federal banking agency or supervisor. The state system (1) is based on a state charter, (2) has powestate law, (3) operates under state standards, and (4) provides oversight by state banking agencies or supervisors. A list of can be found at www.csbs.org. 

subpoena An official summons requiring a witness to attend a legal proceeding such as a trial or a deposition at a specific time and pl

on a certain matter. A person failing to obey a subpoena summoning them to appear before a court is liable to be punished subsidiary Company that is controlled by another corporation (called the parent corporation), typically through stock ownership or vo
T 

Thrift Financial Report or TFR Quarterly report of condition filed with the OTS by all savings associations, similar to the Call Report filed by other types ofederal regulators. U Uniform Bank Performance Report, Uniform Bank Holding Company Performance Report, and Uniform Thrift PeEach bank is required to file complete financial data to the Central Data Repository (CDR) on a quarterly basis. The formis known as the Call Report. The data contained within the report is processed within the CDR by the Federal Financial I

Council (FFIEC) and is then used in a multitude of distinctive formats across each of the regulatory agencies, and even by 

resulting data provides the agencies the ability to produce high level reports of the condition of the banking system in var

examples of these reports include the Uniform Bank Performance Report (UBPR), the Uniform Bank Holding Compa(UBHCPR), and the Uniform Thrift Performance Report (UTPR). Each UBPR also contains corresponding average data fand percentile rankings for most ratios. The UBPR therefore permits evaluation of a bank's current condition, trends in itand comparisons with the performance of its peer group. Generally peer groups are assigned based on average assets s

offices, and metropolitan or nonmetropolitan area. The system has the capability to run custom peer group information. 

Uniform Financial Institutions Rating System (UFIRS) Uniform Financial Institutions Ratings System was adopted by the FFIEC on November 13, 1979. Each bank is assigned a on an evaluation and rating of six essential components of a bank's financial condition and operations. These component faadequacy of capital, the quality of assets, the capability of management, the quality and level of earnings, the adequacy of l

sensitivity to market risk. (See CAMELS.) Evaluations of the components take into consideration the bank's size and sophand complexity of its activities, and its risk profile. United States Code (USC) Title 12 of the USC, Banks and Banking, contains the majority of specific U.S. federal banking law, and is the most often cTitle 15 contains a number of other banking-related laws and banks are, of course, subject to federal laws located in other t

U.S. federal banking agencies Includes the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), Federal Deposit 

(FDIC), and Office of Thrift Supervision (OTS). Also referred to as the “federal banking agencies” or the “agencies.” 
U.S. federal banking supervisors Includes the staff of the U.S. federal banking agencies. Also referred to as the “supervisors,” which in this context is interc

“regulators” and “examiners.”