IMPORTANT: This document reflects the U.S. framework as of July 2019 and has not been 

updated to include changes since that time.

UNITED STATES

BANKING SUPERVISION AND REGULATION 

WORKSTREAM

BASEL CORE PRINCIPLES SELF-ASSESSMENT FOR 

FSAP TECHNICAL NOTE
Page 1

Table of Contents

Introduction........................................................................................................................................... 2

Principle 1: Responsibilities, objectives and powers......................................................................... 11

Principle 2: Independence, accountability, resourcing and legal protection for supervisors............. 15

Principle 3: Cooperation and collaboration ....................................................................................... 20

Principle 4: Permissible activities...................................................................................................... 22

Principle 5: Licensing criteria ............................................................................................................ 24

Principle 6: Transfer of significant ownership................................................................................... 28

Principle 7: Major acquisitions.......................................................................................................... 30

Principle 8: Supervisory approach ..................................................................................................... 32

Principle 9: Supervisory techniques and tools................................................................................... 44

Principle 10: Supervisory reporting ................................................................................................... 52

Principle 11: Corrective and sanctioning powers of supervisors....................................................... 62

Principle 12: Consolidated supervision.............................................................................................. 67

Principle 13: Home-host relationships............................................................................................... 73

Principle 14: Corporate governance................................................................................................... 77

Principle 15: Risk management process ............................................................................................ 85

Principle 16: Capital adequacy ........................................................................................................ 102

Principle 17: Credit risk ................................................................................................................... 109

Principle 18: Problem assets, provisions and reserves..................................................................... 114

Principle 19: Concentration risk and large exposure limits............................................................. 121

Principle 20: Transactions with related parties................................................................................ 130

Principle 21: Country and transfer risks .......................................................................................... 133

Principle 22: Market risk ................................................................................................................ 136

Principle 23: Interest rate risk in the banking book ........................................................................ 139

Principle 24: Liquidity risk ............................................................................................................. 142

Principle 25: Operational risk ......................................................................................................... 151

Principle 26: Internal control and audit........................................................................................... 160

Principle 27: Financial reporting and external audit....................................................................... 166

Principle 28: Disclosure and transparency...................................................................................... 170

Principle 29: Abuse of financial services........................................................................................ 172

Glossary of U.S. Banking Terminology............................................................................................ 186
Page 2

In August 2014, the U.S. federal banking agencies (FBAs) provided a comprehensive self-assessment 

(2014 Self-Assessment) in preparation for the IMF’s Detailed Assessment Report of Observance on the 

Basel Core Principles for Effective Banking Supervision (2015 FSAP DAR on Banking). The 2014 SelfAssessment provided an extensive overview of the U.S. federal banking supervisory and regulatory 

framework (U.S. Framework) and a self-assessment of the U.S. Framework against all 29 Basel Core 

Principles for Effective Banking Supervision (BCPs). 

This document is intended to provide an update and supplement to the 2014 Self-Assessment by 

discussing material changes that have occurred in the U.S. Framework over the last five years. These 

changes may have occurred due to new or amended legislation, new or amended regulations, changes in 

agency approach or interpretations of agency mandates reflected in guidance, or changes in agency 

practice. This document should be reviewed in conjunction with the 2014 Self-Assessment and to the 

extent aspects of the U.S. Framework discussed in the 2014 Self-Assessment are not addressed in this 

document, they remain in effect and have not been revoked, repealed, or materially amended.1

 As the 

IMF acknowledged in the 2015 FSAP DAR on Banking, the U.S. Framework has a high degree of 

compliance with the BCPs. Much of the information provided in the 2014 Self-Assessment, which 

resulted in compliant ratings, has not materially changed.

This document reflects the state of the U.S. Framework as of July 2019. It is intended to be a snapshot 

review of material changes that have occurred in the U.S. Framework over the past five years as of this 

point in time; it is not intended to detail or explain changes that may occur in the future, for example, as a 

result of proposed rulemakings. In general, the only proposed rulemakings or other anticipated changes 

discussed in the BCP self-assessment relate to a statutory requirement.

For purposes of this self-assessment, the following terminology will be used: 

• U.S. federal banking agencies (FBAs) – includes the Federal Reserve System (Federal Reserve), 

Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation 

(FDIC). 

• U.S. federal banking supervisors – includes the staff of the U.S. FBAs and the Consumer 

Financial Protection Bureau (CFPB). Also referred to as the “supervisors,” which in this context 

is interchangeable with “regulators” and “examiners.” The CFPB generally oversees consumer 

protection regulations applicable to banking organizations with assets of more than $10 billion 

and participates in examinations under certain circumstances described below.

• Banks – includes all national banks supervised by the OCC; FDIC-insured state-chartered 

banks—both Federal Reserve member (supervised by the Federal Reserve) and nonmember 

1 In certain areas, the BCP assessment provides clarifications to the 2014 Self-Assessment.

Introduction to the Self-Assessment of Compliance with the Basel 

Core Principles for Effective Banking Supervision by the 

U.S. Federal Banking Agencies
Page 3

(supervised by the FDIC); and FDIC-insured savings associations (supervised by the OCC and 

FDIC); collectively, these institutions are referred to as “insured depository institutions” (IDIs), 

unless the content indicates otherwise.

• Commercial banks – includes “banks” as described above, but excludes savings associations.

• Foreign banking organizations (FBOs) – foreign banks that conduct commercial banking 

operations in the United States. 

• Bank holding companies (BHCs) and savings and loan holding companies (SLHCs) – includes 

any company that controls a bank or savings association, respectively. For the purposes of this 

document, they are referred to as “holding companies” except in cases where there is a material 

difference between BHCs and SLHCs (in terms of legal authority, operations, or structure). 

BHCs and SLHCs are supervised by the Federal Reserve. 

• Financial holding companies – holding companies that, along with their depository institution 

subsidiaries, meet enhanced capital and managerial standards and are authorized to engage in 

expanded financial activities, including securities and insurance underwriting, and merchant 

banking. 

• Intermediate holding companies (IHCs) – holding companies for certain U.S. operations of 

FBOs, as defined under the Federal Reserve’s Regulation YY.

• Consolidated organization – the consolidated entity including the parent and its bank and 

nonbank subsidiaries.

• Banking group or banking organization – the holding company and its banking and non-banking 

subsidiaries.

• Branches and Agencies of FBOs – place of business of foreign bank in the U.S., as defined under 

the Federal Reserve’s Regulation K. 

• Functionally regulated affiliate – entities within the consolidated organization that are regulated 

by the Securities and Exchange Commission (SEC), the Commodity Futures Trading 

Commission (CFTC), or state insurance regulators.

• Designated nonbank financial companies – companies that are predominately engaged in 

financial activities and that have been designated by the Financial Stability Oversight Council 

(FSOC) for supervision by the Federal Reserve. 

I. Methodology

The U.S. self-assessment was conducted in accordance with the Core Principles for Effective Banking 

Supervision published by the Basel Committee for Banking Supervision (BCBS) in September 2012. The 

general guidance for completing the self-assessment against those BCPs is the BCBS publication, 

Conducting a Supervisory Self-Assessment – Practical Application, published in April 2001, and the 

Financial Sector Assessment – A Handbook, published by The World Bank and the IMF. 
Page 4

To complete this self-assessment, subject matter experts and legal staff from each FBA have provided 

input in response to the BCPs and their associated criteria. As mentioned above, responses focus on 

highlighting material changes that have occurred for each BCP since the 2014 Self-Assessment. 

II. Summary of Recent Changes to the U.S. Federal Bank Regulatory Framework

As detailed below, a number of legislative, regulatory and supervisory developments in the U.S. 

Framework have occurred over the last five years. While the FBAs continue to implement post-crisis 

reforms, with the benefit of experience, efforts are underway to refine and improve the post-crisis 

regulatory framework. As part of this initiative, the U.S. Framework continues to move toward a more 

risk-based approach to supervision and regulation. In addition, there has been increased focus on 

transparency and simplification.

A. Continued implementation/refinement of post-crisis reforms

A number of measures were implemented following the 2008 financial crisis, including reforms required 

by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). These reform 

measures continued to be implemented and refined over the last five years. 

1. Enhanced Prudential Standards

As detailed in the 2014 Self-Assessment introduction (pp. 14-15), section 165 of the Dodd-Frank Act

requires the Federal Reserve to establish Enhanced Prudential Standards (EPS), such as resolution 

planning and stress testing requirements, and concentration limits for certain large BHCs and designated 

nonbank financial companies supervised by the Federal Reserve. As discussed further below, the 

Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCPA), which was passed into 

law in May 2018, raised the asset threshold at which certain EPS apply from $50 billion in total 

consolidated assets to $250 billion in total consolidated assets. In addition, EGRRCPA specifically 

authorizes that the Federal Reserve may apply any of the EPS to BHCs that have between $100 billion 

and $250 billion in total consolidated assets if it determines that it would be appropriate to address 

financial stability or safety and soundness concerns and it takes into account the firm’s capital structure, 

complexity, and other factors. EGRRCPA did not change application of the EPS to designated nonbank 

financial companies supervised by the Federal Reserve. For more information on examples of EPS see 

BCP 1, EC 3, BCP 10, EC 1, BCP 16, BCP 19, and BCP 24.

2. Stress Testing

As detailed in the 2014 Self-Assessment introduction (pp. 15-16), the Federal Reserve conducts 

supervisory stress tests to help ensure that large BHCs operating in the U.S. will be able to lend to 

households and businesses even in a severe recession. The tests are known as the Dodd-Frank Act stress 

test (DFAST) and the Comprehensive Capital Analysis and Review (CCAR). In February 2019, the 

Federal Reserve announced that it was providing relief to less complex firms from stress testing 

requirements by moving the firms to an extended stress test cycle. The relief applies to firms generally 

with total consolidated assets between $100 billion and $250 billion. In February 2019, the Federal 

Reserve issued an amended policy statement on the scenario design framework for supervisory stress 

testing aimed at increasing the transparency of its DFAST and CCAR requirements. In addition, the 
Page 5

Federal Reserve published new details on the relevant methodology and models, to improve public 

understanding of the program and maintain the integrity of its results. While maintaining a rigorous 

evaluation of capital planning, the Federal Reserve is committed to addressing qualitative deficiencies at 

most firms through supervisory ratings and enforcement actions, rather than through a stand-alone 

qualitative objection. The Federal Reserve recently held a public stress testing research conference, 

inviting the broad participation, insight, and challenge that are essential for effectiveness of the stress 

testing process. See BCP 8, EC 1 for information on changes to the stress-testing framework attributable 

to EGRRCPA.

3. Resolution Planning

As detailed in the 2014 Self-Assessment introduction (pp. 15-16), section 165(d) of the Dodd-Frank Act 

requires that large BHCs and designated nonbank financial companies supervised by the Federal Reserve 

periodically submit resolution plans to the Federal Reserve and the FDIC. Since the 2014 SelfAssessment, the agencies have received and reviewed multiple iterations of resolution plans, have 

communicated firm-specific feedback, and have provided detailed guidance to certain groups of filers. In 

April 2019, the Federal Reserve and the FDIC invited public comment on a proposal to modify their 

resolution plan requirements. The proposal would keep existing resolution plan expectations in place for 

the largest firms, while reducing requirements for smaller firms whose failure or financial distress pose 

less risk to U.S. financial stability. See BCP 8, EC 6 for information on changes to the resolution 

requirements attributable to EGRRCPA, as well as developments in the resolution planning framework 

generally.

In January 2017, the Federal Reserve also issued a final rule to improve the resiliency and resolvability of 

certain U.S. banking organizations, including imposing total loss-absorbing capacity (TLAC) 

requirements, separate eligible long-term debt (LTD) requirements, and clean holding company 

requirements. For more information see BCP 16.

4. Capital Regulation

As detailed in the 2014 Self-Assessment introduction (pp. 17-19), the Dodd-Frank Act establishes floors 

for regulatory capital requirements applied to domestic BHCs, SLHCs, and designated nonbank financial 

companies supervised by the Federal Reserve. Over the past five years, the FBAs have continued to work 

on developing and refining the regulatory capital framework. For example, in August 2015, the Federal 

Reserve issued a final rule requiring the largest, most systemically important U.S. BHCs to further 

strengthen their capital positions. Under the rule, a firm that is identified as a global systemically 

important BHC (G-SIB), will have to hold additional capital, as a result of a risk-based capital surcharge, 

to increase its resiliency in light of the greater threat it poses to the financial stability of the United States. 

In November 2017, the FBAs simplified certain aspects of the applicable Basel III capital rules for nonadvanced approaches banking organizations, including simplified treatment of threshold deduction items 

and minority interests. In April 2018, the Federal Reserve and OCC issued a proposed rule that would 

calibrate the buffer over the supplementary leverage ratio to be half of the firm’s G-SIB surcharge and 

that would set at the same level the supplementary leverage ratio necessary for an IDI subsidiary of a GSIB to be considered well-capitalized. In addition, the Federal Reserve issued a proposed rule that would 

introduce a “stress capital buffer,” which would in part integrate the Federal Reserve’s forward-looking 

stress test results with its non-stress capital requirements. 
Page 6

As directed by EGRRCPA, the FBAs issued proposed rules to exclude certain central bank deposits from 

the total leverage exposure of custodial banking organizations. In addition, the FBAs issued a proposed 

rule that would simplify capital requirements for qualifying community banks by providing an alternative 

community bank leverage ratio (CBLR).

In October 2018, the FBAs issued a proposed rule that would update the calculation of derivative contract 

exposure amounts under regulatory capital rules. In December 2018, the FBAs issued a final rule

modifying regulatory capital rules by providing an option to phase-in over a period of three years the dayone regulatory capital effects of updated accounting standard known as the “Current Expected Credit 

Losses” (CECL) methodology. In April 2019, the FBAs issued a proposed rule to address an advanced 

approaches banking organization’s regulatory capital treatment of an investment in unsecured debt 

instruments issued by foreign or U.S. G-SIBs for the purposes of meeting minimum TLAC and, where 

applicable, LTD requirements, or unsecured debt instruments issued by G-SIBs that are pari passu or 

subordinated to such debt instruments. Under the proposal, investments by an advanced approaches 

banking organization in such unsecured debt instruments generally would be subject to deduction from 

the advanced approaches banking organization’s own regulatory capital.

In July 2019, the FBAs issued a final rule to simplify the regulatory capital rules for banking 

organizations that do not use the “advanced approaches” capital framework, which are generally firms 

with less than $250 billion in total consolidated assets and less than $10 billion in total foreign exposure. 

In particular, the rule included simplified treatment of threshold deduction items and minority interests. 

For more information on capital regulation see BCP 16.

5. Volcker Rule

As detailed in the 2014 Self-Assessment introduction (pp. 23-24), section 619 of the Dodd-Frank Act (the 

Volcker Rule) generally prohibits banking entities from engaging in proprietary trading or from investing 

in, sponsoring, or having certain relationships with a hedge fund or private equity fund. On December 10, 

2013, the FBAs, along with the CFTC and SEC, issued final rules to implement section 619, which went 

into effect in July 2015. Subsequently the agencies issued guidance on the topic in the form of Frequently 

Asked Questions. Sections 203 and 204 of EGRRCPA made changes to the statutory provisions 

underlying the Volcker Rule, including reducing the number of institutions subject to its requirements. 

These changes provide regulatory relief to institutions that do not pose the types of risks the Volcker Rule 

was intended to limit. The agencies finalized amendments to the Volcker Rule regulations implementing 

the changes made by sections 203 and 204 of EGRRCPA on July 9, 2019, which included amendments 

that exclude community banking organizations with $10 billion or less in total consolidated assets and 

total trading assets and liabilities of 5 percent or less of total consolidated assets from the restrictions of 

the Volcker Rule, as well as amending the restrictions on common names between banks and sponsored 

funds, consistent with the Act. In July 2018, the agencies issued a notice of proposed rulemaking that, if 

finalized, would revise the regulations implementing section 619 in order to provide regulated institutions 

with more clarity about what activities are prohibited and to improve supervision and implementation of 

the statute. Finally, in July 2019, the FBAs issued a policy statement extending for two additional years 

the “no action” relief currently provided to foreign banking entities with respect to their investments in 

and relationships with certain foreign funds. For more information see BCP 10, EC 1.
Page 7

6. Swaps Pushout and Swaps Margin Rule 

As detailed in the 2014 Self-Assessment introduction (pp. 25-26), section 716 of the Dodd-Frank Act, 

commonly referred to as the “swaps push-out” section, prohibits the provision of certain kinds of federal 

assistance to banks and other institutions with respect to their derivatives activities. The section was 

amended in December 2014 by Section 630 of the Consolidated and Further Continuing Appropriations 

Act, 2015 that narrowed the scope of swaps subject to the pushout requirement. The amendment now 

requires IDIs and U.S. branches and agencies of foreign banks that are swaps dealers or security-based 

swap dealers to push out certain swaps based on an asset-backed security (ABS) or a group or index 

primarily comprised of ABS (ABS Swaps). These entities may enter into ABS Swaps if the swaps are (i)

undertaken for hedging or risk management purposes, or (ii) permitted by rules jointly adopted by the 

prudential regulators authorizing such swap activity by covered depository institutions. The amendment 

codifies the Federal Reserve’s rule that uninsured branches and agencies of foreign banks are entitled to 

the same exceptions as IDIs under section 716. It confirms that uninsured branches and agencies of 

foreign banks do not need to push out swaps to an affiliate, except for certain ABS Swaps.

Sections 731 and 764 of the Dodd-Frank Act required the FBAs, the Farm Credit Administration (FCA),

and the Federal Housing Finance Agency (FHFA) to adopt rules that establish capital and margin 

requirements for swap entities (Swaps Margin rule). The Swaps Margin rule went into effect in April 

2016 and it was slightly amended in October 2018.

7. Nonbank SIFI designations 

As detailed in the 2014 Self-Assessment introduction (pp. 12-13), Title I of the Dodd-Frank Act 

established the FSOC, charged with a number of important duties, including monitoring and identifying 

emerging risks to financial stability across the entire financial system, identifying potential regulatory 

gaps, coordinating agency responses to potential systemic risks, and designating nonbank financial 

companies as systemically important financial institutions (SIFIs) for supervision by the Federal Reserve. 

The FSOC rescinded the SIFI designations of GE Capital Global Holdings, LLC in June 2016; American 

International Group, Inc. in September 2017; and Prudential Financial, Inc. in October 2018. In March 

2016, a federal district court overturned FSOC’s designation of MetLife, Inc. As a result, there are 

currently no companies designated by the FSOC for Federal Reserve supervision and EPS. On March 6, 

2019, the FSOC issued a notice of proposed interpretive guidance and request for public comment 

regarding proposed changes in the approach to nonbank financial company determinations. 

8. Qualified Financial Contract Rules 

In September 2017, the FBAs adopted final rules to enhance financial stability by requiring U.S. G-SIBs

and the U.S. operations of foreign G-SIBs to amend qualified financial contracts (QFCs) to prevent their 

immediate cancellation or termination if the firm enters bankruptcy or a resolution process. QFCs include 

derivatives, securities lending, and short-term funding transactions such as repurchase agreements. Given 

the large volume of QFCs to which G-SIBs are a party, the mass termination of QFCs in the event of 

financial distress or failure of a G-SIB may lead to the disorderly failure of the firm, spark distressed asset 

sales, and transmit financial distress across the U.S. financial system. The final rule contains two key 

requirements. First, the final rule requires QFCs of G-SIBs, including those with foreign counterparties, 

to clarify that U.S. resolution laws providing for a temporary stay to prevent mass terminations apply to 
Page 8

the contracts. Second, the final rule prohibits the QFCs of G-SIBs from allowing the exercise of default 

rights that could spread the bankruptcy of one G-SIB entity to its solvent affiliates.

B. Tailoring / Risk-Based Approach

With the benefit of experience in implementing post-crisis reforms, the FBAs have undertaken an effort to 

review and refine the existing U.S. Framework. In particular, the FBAs have shifted towards a more riskbased approach to supervision and regulation. In response to the 2008 financial crisis, financial regulators 

strengthened the existing regulatory and supervisory framework by increasing capital, liquidity, and riskmanagement requirements for supervised financial institutions, most significantly for the largest 

institutions. After a decade of post-crisis regulation, the FBAs are focused on making the current 

regulatory and supervisory environment more efficient, and ensuring that compliance burden is 

minimized without compromising an institution’s safety and soundness. This has been evidenced in 

legislation, regulation, and agency practices.

1. Legislation

In May 2018, Congress enacted the EGRRCPA. The focus of this legislation is on tailoring supervision 

and regulations to focus on the largest, most systemically important banking firms while reducing burden 

for less complex firms, especially community banking organizations. EGRRCPA changed several aspects 

of U.S. banking laws to reduce regulatory burden on community banking organizations and require the 

FBAs to further tailor their regulations to reflect the character of the different banking firms that the 

agencies supervise. For G-SIBs, which are largely not affected by EGRRCPA, standards remain 

unchanged. The legislation specifically directed the FBAs to tailor oversight of institutions to ensure that 

regulations better align with the characteristics and risk profile of the regulated firm, with specific 

Congressional direction to the Federal Reserve to tailor oversight for BHCs between $100 billion and 

$250 billion in total consolidated assets. In July 2018, the FBAs jointly published a statement, and the 

Federal Reserve also published a separate statement, on how EGRRCAP would impact existing 

regulations and associated requirements.

2. Regulation

In November 2018, the Federal Reserve proposed revisions to the EPS for large BHCs and SLHCs and in 

December 2018 the FBAs proposed changes to the applicability thresholds for regulatory capital and 

liquidity requirement for domestic banking organizations. In May 2019, the Federal Reserve proposed 

revisions to the EPS for large FBOs and the FBAs proposed changes to the applicability thresholds for 

regulatory capital requirements and liquidity requirements for FBOs. These proposed changes would 

reduce compliance requirements for firms with less risk while maintaining more stringent requirements 

for firms with more risk. The proposed framework would establish four categories of standards for large 

banking organizations—i.e., those with $100 billion or more in total consolidated assets. These firms 

would be sorted into categories of increasingly stringent requirements based on several factors. The 

factors, which reflect banks’ risks to safety and soundness and the U.S. financial stability, include asset 

size, cross-jurisdictional activity, reliance on short-term wholesale funding, nonbank assets, and offbalance sheet exposure.
Page 9

3. Supervision

The FBAs have substantially strengthened supervisory programs for large institutions since the financial 

crisis. In particular, the Federal Reserve has introduced several cross-institutional (horizontal) 

examinations focusing on capital, liquidity, governance and controls, and resolution planning. 

The Federal Reserve created and developed the Large Institution Supervision Coordinating Committee 

(LISCC) framework to provide a national program that uses both horizontal and firm-specific supervisory 

activities to assess the financial resiliency and risk-management practices of firms. LISCC is a Federal 

Reserve System-wide committee that is tasked with overseeing the supervision of the largest, most 

systemically important banking organizations in the U.S. This approach to the supervision of 

systemically important banking organizations fosters rigorous supervision of individual firms while 

formalizing the use of horizontal reviews and analyses of activities and risks across the portfolio. LISCC 

focuses on understanding these risks and taking steps to materially increase the financial and operational 

resiliency of systemically important banking organizations to reduce the probability of, and cost 

associated with, their material financial distress or failure.

Furthermore, information collections from large institutions have increased, providing supervisors, as 

well as senior management at the firms, with more timely and better insight into firms’ risk profiles and 

activities. The focus of attention is on both the institutions that pose the greatest risks to financial 

stability and the activities that are most likely to challenge safety and soundness. Additional supervisory 

guidance has been issued over the past five years. The Federal Reserve issued SR Letter 15-19, which 

explains its supervisory expectations for capital planning at large and noncomplex bank holding 

companies and IHCs of FBOs, and SR Letter 15-18, which explains its supervisory expectations for 

capital planning at LISCC-supervised and large and complex BHCs and IHCs of FBOs. The OCC issued 

guidelines for establishing heightened standards for certain large insured national banks, which 

established minimum standards for the design and implementation of a covered bank’s risk governance 

framework and minimum standards for the covered bank’s board of directors in providing oversight to the 

framework’s design and implementation. In addition, in June 2018, the OCC updated its examination 

process booklets for supervision of large banks and other banks. In March 2019, the FDIC also updated 

its examiner instructions on principles and techniques related to risk-focused, forward-looking 

supervision.

4. Community Banking Organizations2

As mentioned above, the FBAs issued a final rule to simplify the regulatory capital rules for smaller 

banking organizations. For qualifying community banking organizations, the FBAs issued a proposal to 

offer an option to calculate a simple leverage ratio, rather than multiple measures of capital adequacy. In 

addition the eligibility of community banking organizations for both longer examination cycles and 

exemptions from holding company capital requirements was expanded, and community banking 

organizations were exempted from the Volcker Rule and regulatory thresholds for conducting appraisals 

for commercial real estate transactions were raised. The FBAs have also finalized more limited 

regulatory reporting requirements for community banks, raising the regulatory threshold for residential 

real estate transactions. Additionally, the FBAs have proposed adjusting the regulatory capital treatment 

2

 In general, community banking organizations have less that $10 billion in total consolidated assets.
Page 10

of high-volatility commercial real estate exposures and providing certain relief from the rules related to 

management interlocks. The FBAs also issued an interagency statement clarifying how collaboration 

among smaller institutions can help them address their BSA/AML risk.

At the same time, the FBAs have increased an emphasis on risk-focused examination activities for 

regional and community banks, conducting more in-depth examinations for banks with high-risk activities 

and less-intensive examinations for lower-risk banks. In addition, the FBAs have taken steps to reduce 

the amount of supervisory burden by reducing information collection requirements for smaller banks and 

minimizing the burden associated with their examinations by conducting larger portions of examinations 

away from bank premises (off-site).

C. Focus on Transparency and Simplification

The FBAs continue to promote the principles of transparency and simplicity in their approach to 

supervising and regulating institutions. In particular, efforts over the last five years have been made to 

present regulations, guidance, and supervisory findings in a manner that regulated institutions and the 

public can understand and without unnecessary complexity. 

In September 2018, the FBAs issued an interagency statement clarifying the role of supervisory guidance

explaining that the FBAs issue various types of supervisory guidance to their respective supervised 

institutions, including; interagency statements, advisories, bulletins, policy statements, questions and 

answers, and frequently asked questions. The statement, which is grounded in existing law under the 

Administrative Procedure Act, clarifies that, unlike a statute or regulation, supervisory guidance does not 

have the force and effect of law, and the FBAs do not take enforcement actions based on supervisory 

guidance. Guidance-related developments will be discussed in the Practices & Procedures sections of 

each BCP in this document. 

Other recent steps to promote transparency include the Federal Reserve’s new ratings system for large 

institutions for BHCs, which aligns more closely with the supervisory feedback provided to such 

institutions and offers greater clarity on the Federal Reserve’s expectations, as well as the consequences 

of falling short. The Federal Reserve also issued a proposal to formalize how it determines one 

company’s control of another, which clarifies and invites feedback on an important concept that, among 

other things, determines the perimeter of the Federal Reserve’s regulatory authority. The Federal Reserve 

also recently published new details on the relevant methodology and models for the stress testing 

program, to improve public understanding of the program. Another transparency initiative is a 

semiannual report on the Federal Reserve’s prudential supervisory activities. In addition, the Federal 

Reserve proposed amendments to guidelines on appeals of material supervisory determinations. 

The Federal Financial Institutions Examination Council (FFIEC), an interagency forum for the FBAs and 

other regulators, is undertaking an examination modernization project which identifies and assesses ways 

to improve the effectiveness, efficiency, and quality of community financial institutions safety and 

soundness examination processes, particularly through increased use of technology. As part of this 

project, the FFIEC members issued several statements emphasizing a commitment to risk-focused 

examination principles; and a series of principles for completing effective reports of examination. The 

FFIEC also recently issued a Policy Statement on the Report of Examination. The FBAs expect these 

efforts will help reduce unnecessary regulatory burden on community banking organizations.
Page 11

Principle 1: Responsibilities, objectives and powers

An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and 

banking groups.3 A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal

powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address 

safety and soundness concerns.4

EC1 Principle 1: Responsibilities, objectives and powers

Criterion The responsibilities and objectives of each of the authorities involved in banking supervision5 are clearly defined in 

legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a 

credible and publicly available framework is in place to avoid regulatory and supervisory gaps.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FBAs would like to clarify the 

following:

• Under sections 24 and 28 of the Federal Deposit Insurance Act (FDIA), an insured state-chartered bank or savings 

association may only engage in activities that are permissible for a national bank or federal savings association

(FSA), respectively, unless the FDIC determines that an activity poses no significant risk to the deposit insurance 

fund and the bank or savings association is in compliance with certain capital requirements. 12 U.S.C. §§ 1831a, 

1831e. This was discussed under BCP 4, EC 2 of the 2014 Self-Assessment.

• Regarding lines of responsibility for supervision and regulation, the Federal Reserve coordinates the supervisory 

program for the U.S. operations of FBOs with the other federal and state banking agencies.

• The FDIC may serve as a conservator, receiver, or liquidator of a failed or failing IDI, or receiver of covered 

financial company.

3 In this document, “banking group” includes the holding company, the bank and its offices, subsidiaries, affiliates and joint ventures, both domestic 

and foreign. Risks from other entities in the wider group, for example non-bank (including non-financial) entities, may also be relevant. This groupwide approach to supervision goes beyond accounting consolidation.

4 The activities of authorising banks, ongoing supervision and corrective actions are elaborated in the subsequent Principles.

5 Such authority is called “the supervisor” throughout this paper, except where the longer form “the banking supervisor” has been necessary for 

clarification.
Page 12

Principle 1: Responsibilities, objectives and powers

EC2 Principle 1: Responsibilities, objectives and powers

Criterion The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If 

the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not 

conflict with it.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC3 Principle 1: Responsibilities, objectives and powers

Criterion Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks 

and banking groups. The supervisor has the power to increase the prudential requirements for individual banks and 

banking groups based on their risk profile6 and systemic importance.7

Legal Framework/ 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• Pursuant to amendments passed into law under section 401(a) of EGRRCPA, the asset threshold triggering 

the automatic application of EPS to large BHCs increased from $50 billion to $250 billion in total 

consolidated assets. Pub. L. 115-174 § 401(a), implemented at 12 U.S.C. § 5365(a). 

• Section 401(a) of EGRRCPA also specifically authorized the Federal Reserve to apply EPS to BHCs with 

$100 billion or more but less than $250 billion in total consolidated assets by regulation or order. Any such 

application should take into account the risk characteristics of such BHCs. Pub. L. 115-174 § 401(a),

implemented at 12 U.S.C. § 5365(a)(2)(c). 

6 In this document, “risk profile” refers to the nature and scale of the risk exposures undertaken by a bank.

7 In this document, “systemic importance” is determined by the size, interconnectedness, substitutability, global or cross-jurisdictional activity (if 

any), and complexity of the bank, as set out in the BCBS paper on Global systemically important banks: assessment methodology and the 

additional loss absorbency requirement, November 2011.
Page 13

Principle 1: Responsibilities, objectives and powers

EC4 Principle 1: Responsibilities, objectives and powers

Criterion Banking laws, regulations and prudential standards are updated as necessary to ensure that they remain effective and 

relevant to changing industry and regulatory practices. These are subject to public consultation, as appropriate.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC5 Principle 1: Responsibilities, objectives and powers

Criterion The supervisor has the power to:

(a) have full access to banks’ and banking groups’ boards, management, staff and records in order to review compliance 

with internal rules and limits as well as external laws and regulations;

(b) review the overall activities of a banking group, both domestic and cross-border; and

(c) supervise the activities of foreign banks incorporated in its jurisdiction.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FBAs would like to clarify the 

following:

• A list of required interagency reports, along with a description of the report contents and instructions for 

completion, is available on the FFIEC website. The FBAs also require regulated entities to file other reports, as 

applicable.

• In addition to the International Banking Act (IBA) and its implementing regulations, certain subparts in the 

Federal Reserve’s EPS rule apply to foreign banks. See 12 CFR part 252, subparts L-Q.

EC6 Principle 1: Responsibilities, objectives and powers

Criterion When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or is likely to be engaging in 

unsafe or unsound practices or actions that have the potential to jeopardize the bank or the banking system, the supervisor 

has the power to:

(a) take (and/or require a bank to take) timely corrective action;

(b) impose a range of sanctions;

(c) revoke the bank’s license; and

(d) cooperate and collaborate with relevant authorities to achieve an orderly resolution of the bank, including triggering 

resolution where appropriate.
Page 14

Principle 1: Responsibilities, objectives and powers

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC7 Principle 1: Responsibilities, objectives and powers

Criterion The supervisor has the power to review the activities of parent companies and of companies affiliated with parent 

companies to determine their impact on the safety and soundness of the bank and the banking group.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FBAs would like to clarify that the

Federal Reserve oversees the implementation of sections 23A and 23B of the Federal Reserve Act involving covered 

transactions between banks and their affiliates. 12 U.S.C. §§ 371c and 371c-1. The Federal Reserve, OCC, and FDIC 

implement sections 23A and 23B as applied to their supervised institutions. See, e.g., 12 U.S.C. § 1828(j) (FDIC). For 

more information see BCP 24 of the 2014 Self-Assessment.
Page 15

Principle 2: Independence, accountability, resourcing and legal protection for supervisors

The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine 

autonomy and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking 

supervision includes legal protection for the supervisor.

EC1 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The operational independence, accountability, and governance of the supervisor are prescribed in legislation and publicly 

disclosed. There is no government or industry interference that compromises the operational independence of the 

supervisor. The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups 

under its supervision.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC2 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The process for the appointment and removal of the head(s) of the supervisory authority and members of its governing 

body is transparent. The head(s) of the supervisory authority is (are) appointed for a minimum term and is removed from 

office during his/her term only for reasons specified in law or if (s)he is not physically or mentally capable of carrying out 

the role or has been found guilty of misconduct. The reason(s) for removal is publicly disclosed.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. The Federal Reserve would like to clarify, however, 

that two members of the Board of Governors of the Federal Reserve System are designated to serve as Vice Chair: one as 

Vice Chair and one as Vice Chair for Supervision. 12 U.S.C. § 242.

EC3 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The supervisor publishes its objectives and is accountable through a transparent framework for the discharge of its duties 

in relation to those objectives.8

Legal Framework/

Practices and 

Procedures

No material changes have occurred since 2014 Self-Assessment. However, the FBAs would like to clarify the 2014 SelfAssessment with respect to the Government Performance Results Act of 1993, as amended (GPRA). Consistent with the 

GPRA, the OCC publishes an annual performance report and plan that includes a mission statement and strategic 

8 Please refer to Principle 1, Essential Criterion 1.
Page 16

Principle 2: Independence, accountability, resourcing and legal protection for supervisors

objectives. Consistent with the GPRA, the FDIC publishes strategic plans, including annual performance plans. While 

the Board is not required to comply with the GPRA, it nonetheless prepares a strategic plan that covers a multi-year period 

and creates an annual report which is made public. See the Federal Reserve’s website for more information.

EC4 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The supervisor has effective internal governance and communication processes that enable supervisory decisions to be 

taken at a level appropriate to the significance of the issue and timely decisions to be taken in the case of an emergency. 

The governing body is structured to avoid any real or perceived conflicts of interest.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC5 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The supervisor and its staff have credibility based on their professionalism and integrity. There are rules on how to avoid 

conflicts of interest and on the appropriate use of information obtained through work, with sanctions in place if these are 

not followed.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC6 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner 

that does not undermine its autonomy or operational independence. This includes:

(a) a budget that provides for staff in sufficient numbers and with skills commensurate with the risk profile and systemic 

importance of the banks and banking groups supervised;

(b) salary scales that allow it to attract and retain qualified staff;

(c) the ability to commission external experts with the necessary professional skills and independence, and subject to 

necessary confidentiality restrictions to conduct supervisory tasks;

(d) a budget and program for the regular training of staff;

(e) a technology budget sufficient to equip its staff with the tools needed to supervise the banking industry and assess 

individual banks and banking groups; and
Page 17

Principle 2: Independence, accountability, resourcing and legal protection for supervisors

(f) a travel budget that allows appropriate on-site work, effective cross-border cooperation and participation in domestic 

and international meetings of significant relevance (e.g., supervisory colleges).

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC7 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion As part of their annual resource planning exercise, supervisors regularly take stock of existing skills and projected 

requirements over the short- and medium-term, taking into account relevant emerging supervisory practices. Supervisors 

review and implement measures to bridge any gaps in numbers and/or skill-sets identified.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC8 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion In determining supervisory programs and allocating resources, supervisors take into account the risk profile and systemic 

importance of individual banks and banking groups, and the different mitigation approaches available.

Legal Framework/ 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• As stated in the 2014 Self-Assessment, the FBAs can lengthen the examination cycle for banks that meet certain 

criteria from 12 months to 18 months. In 2014, only IDIs with assets of less than $500 million were eligible for 

this treatment. Pursuant to the Fixing America’s Surface Transportation Act (FASTA), the FBAs raised the 

threshold to $1 billion in 2016. See 81 Fed. Reg. 90949. Under section 210 of EGRRCPA, this threshold was 

raised to $3 billion. Pub. L. 155-174 § 210. The FBAs promulgated a final rule implementing this statutory 

requirement in December 2018. See 83 Fed. Reg. 67033.

• As discussed in the 2014 Self-Assessment, the FBAs use a risk-based supervisory approach in order to apply

supervisory programs that are appropriate to the geographic scope and degree of specialization, sophistication, risk,

size, and complexity of the activities and organization of banks. This approach has become more sophisticated 

since the 2014 Self-Assessment, as evidenced by the following changes:
Page 18

Principle 2: Independence, accountability, resourcing and legal protection for supervisors

o In general, the Federal Reserve scales its supervisory work to the size and complexity of regulated 

institutions. See pages 15-16 of the Federal Reserve’s May 2019 Supervision and Regulation Report.

o The Federal Reserve’s LISCC, which was established in 2010, provides heightened supervision of 12

large firms that may pose elevated risks to U.S. financial stability. In 2015, the Federal Reserve issued SR 

Letter 15-7 to explain LISCC’s governance structure. 

 The Federal Reserve now conducts an increased number of horizontal examinations on LISCCsupervised firms, including with respect to capital, liquidity, governance and controls, and 

resolution planning. In contrast, while Large and Foreign Banking Organization (LFBO) firms 

are subject to some horizontal examinations, over three-quarters of their examinations are on 

firm-specific activities; there were no on-site horizontal examinations of regional or community 

banking organizations. See page 18-22 of Federal Reserve’s May 2019 Supervision and 

Regulation Report.

 Financial and management information collections from large institutions have increased, giving 

supervisors more timely and better insight into firms’ risk profiles and activities. See page 1 of 

the Federal Reserve’s May 2019 Supervision and Regulation Report.

o The Federal Reserve has increased emphasis on risk-focused examination activities for regional and 

community banks, conducting more in-depth examinations for banks with high-risk activities and lessintensive examinations for lower-risk banks. See page 1 of the Federal Reserve’s May 2019 Supervision 

and Regulation Report.

 The Federal Reserve implemented the Community Bank Risk-Focused Consumer Compliance 

Supervision Program (CA 13-19) in 2014. Under this program, consumer compliance examiners 

base the examination intensity more explicitly on the individual community bank’s risk profile, 

including its consumer compliance culture and how effectively it identifies and manages 

consumer compliance risk. At the same time, the Federal Reserve revised its consumer 

compliance examination frequency policy (CA 13-20) to promote effective supervision through 

deployment of examiner resources commensurate with an institution’s size, compliance rating and 

CRA rating.

o The FBAs are implementing several burden-reducing supervisory changes with respect to smaller IDIs 

and their holding companies, including certain measures required by EGRRCPA. Among these changes, 

the FBAs have finalized a rule (84 Fed. Reg. 29039) to implement EGRRCPA section 205 (Pub. L. 115-
Page 19

Principle 2: Independence, accountability, resourcing and legal protection for supervisors

174 § 205) and reduce the volume of financial data that smaller, less-risky IDIs must submit to the FBAs

each quarter. 

EC9 Principle 2: Independence, accountability, resourcing and legal protection for supervisors

Criterion Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while 

discharging their duties in good faith. The supervisor and its staff are adequately protected against the costs of defending 

their actions and/or omissions made while discharging their duties in good faith.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 20

Principle 3: Cooperation and collaboration

Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign 

supervisors. These arrangements reflect the need to protect confidential information.9

EC 1 Principle 3: Cooperation and collaboration

Criterion Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and 

undertaking collaborative work, with all domestic authorities with responsibility for the safety and soundness of banks, 

other financial institutions and/or the stability of the financial system. There is evidence that these arrangements work in 

practice, where necessary.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment: 

• The Federal Reserve issued SR Letter 16-4 explaining its expectations for its examiners’ reliance on the work 

of IDI regulators in the supervision of BHCs and SLHCs with total consolidated assets of less than $50 billion. 

These expectations are designed to avoid duplication of examination activities, reporting requirements, and 

requests for information. See BCP 9, EC 2 for more information.

EC 2 Principle 3: Cooperation and collaboration

Criterion Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and 

undertaking collaborative work, with relevant foreign supervisors of banks and banking groups. There is evidence that 

these arrangements work in practice, where necessary.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 3 Principle 3: Cooperation and collaboration

Criterion The supervisor may provide confidential information to another domestic authority or foreign supervisor but must take 

reasonable steps to determine that any confidential information so released will be used only for bank specific or systemwide supervisory purposes and will be treated as confidential by the receiving party.

9 Principle 3 is developed further in the Principles dealing with “Consolidated supervision” (12), “Home-host relationships” (13) and “Abuse of 

financial services” (29). 
Page 21

Principle 3: Cooperation and collaboration

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 3: Cooperation and collaboration

Criterion The supervisor receiving confidential information from other supervisors uses the confidential information for bank

specific or system-wide supervisory purposes only. The supervisor does not disclose confidential information received 

to third parties without the permission of the supervisor providing the information and is able to deny any demand (other 

than a court order or mandate from a legislative body) for confidential information in its possession. In the event that the 

supervisor is legally compelled to disclose confidential information it has received from another supervisor, the 

supervisor promptly notifies the originating supervisor, indicating what information it is compelled to release and the 

circumstances surrounding the release. Where consent to passing on confidential information is not given, the supervisor 

uses all reasonable means to resist such a demand or protect the confidentiality of the information.

Legal Framework/ 

Practices and

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 3: Cooperation and collaboration

Criterion Processes are in place for the supervisor to support resolution authorities (e.g., central banks and finance ministries as 

appropriate) to undertake recovery and resolution planning and actions.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 22

Principle 4: Permissible activities

The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” 

in names is controlled.

EC 1 Principle 4: Permissible activities

Criterion The term “bank” is clearly defined in laws or regulations.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 2 Principle 4: Permissible activities

Criterion The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either 

by supervisors, or in laws or regulations.

Legal Framework/

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The OCC combined certain of its regulations into 12 CFR part 5 in May 2015. See 80 Fed. Reg. 28480. As a 

result, 12 CFR part 5 now includes regulations pertaining to, among other things, the permissible activities of 

operating subsidiaries of an FSA (12 CFR 5.38) and permissible pass through investments by an FSA (12 CFR 

5.58).

• On May 24, 2019, the OCC issued a final rule, 12 CFR part 101, to allow FSAs with total consolidated assets 

of $20 billion or less as of December 31, 2017, to elect to operate as covered savings associations. 84 Fed. 

Reg. 23991. This rule was issued pursuant to a statutory change implemented by section 206 of 

EGRRCPA. Pub. L. 115-174 § 206, implemented at 12 U.S.C. § 1464a. Covered savings associations 

generally have the same rights and privileges as national banks and are subject to the same duties, restrictions, 

penalties, liabilities, conditions, and limitations that apply to national banks. However, covered savings 

associations retain their FSA charter and continue to be treated as FSAs for enumerated purposes, including 

governance.

EC 3 Principle 4: Permissible activities

Criterion The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to 

licensed and supervised institutions in all circumstances where the general public might otherwise be misled.
Page 23

Principle 4: Permissible activities

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 4: Permissible activities

Criterion The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as 

banks.10

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 4: Permissible activities

Criterion The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including 

branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

10 The Committee recognizes the presence in some countries of nonbanking financial institutions that take deposits but may be regulated 

differently from banks. These institutions should be subject to a form of regulation commensurate to the type and size of their business and, 

collectively, should not hold a significant proportion of deposits in the financial system. 
Page 24

Principle 5: Licensing criteria

The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the 

licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and 

senior management11) of the bank and its wider group, and its strategic and operating plan, internal controls, risk management and projected 

financial condition (including capital base). Where the proposed owner or parent organisation is a foreign bank, the prior consent of its home 

supervisor is obtained.

EC 1 Principle 5: Licensing criteria

Criterion The law identifies the authority responsible for granting and withdrawing a banking license. The licensing authority 

could be the banking supervisor or another competent authority. If the licensing authority and the supervisor are not the 

same, the supervisor has the right to have its views on each application considered, and its concerns addressed. In 

addition, the licensing authority provides the supervisor with any information that may be material to the supervision of 

the licensed bank. The supervisor imposes prudential conditions or limitations on the newly licensed bank, where 

appropriate.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 2 Principle 5: Licensing criteria

Criterion Laws or regulations give the licensing authority the power to set criteria for licensing banks. If the criteria are not 

fulfilled or if the information provided is inadequate, the licensing authority has the power to reject an application. If the 

licensing authority or supervisor determines that the license was based on false information, the license can be revoked.

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment: 

• 12 CFR part 116 was integrated into 12 CFR part 5 without substantive changes.

11 This document refers to a governance structure composed of a board and senior management. The Committee recognises that there are 

significant differences in the legislative and regulatory frameworks across countries regarding these functions. Some countries use a two-tier board 

structure, where the supervisory function of the board is performed by a separate entity known as a supervisory board, which has no executive 

functions. Other countries, in contrast, use a one-tier board structure in which the board has a broader role. Owing to these differences, this 

document does not advocate a specific board structure. Consequently, in this document, the terms “board” and “senior management” are only used 

as a way to refer to the oversight function and the management function in general and should be interpreted throughout the document in 

accordance with the applicable law within each jurisdiction.
Page 25

Principle 5: Licensing criteria

EC 3 Principle 5: Licensing criteria

Criterion The criteria for issuing licenses are consistent with those applied in ongoing supervision.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 5: Licensing criteria

Criterion The licensing authority determines that the proposed legal, managerial, operational, and ownership structures of the bank 

and its wider group will not hinder effective supervision on both a solo and a consolidated basis.12 The licensing 

authority also determines, where appropriate, that these structures will not hinder effective implementation of corrective 

measures in the future.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 5: Licensing criteria

Criterion The licensing authority identifies and determines the suitability of the bank’s major shareholders, including the ultimate 

beneficial owners, and others that may exert significant influence. It also assesses the transparency of the ownership 

structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where 

needed.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 6 Principle 5: Licensing criteria

Criterion A minimum initial capital amount is stipulated for all banks.

12 Please refer to Principle 14, Essential Criterion 8.
Page 26

Principle 5: Licensing criteria

Legal Framework/

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• 12 CFR 143.3(b) was folded into 12 CFR 5.20. 12 CFR 5.20(h)(4) stipulates that a proposed national bank or 

FSA must have sufficient initial capital, net of any organizational expenses to support the institution’s projected 

volume and type of business. In connection with this change, the requirement that FSAs must have $2 million 

has been deleted.

• The 2014 Self-Assessment states that the FDIC requires state non-member institutions to maintain a minimum 

tier 1 leverage capital ratio of 8 percent throughout the first seven years of operation. This requirement is now 

applicable for the first three years of a de novo bank’s operation. See rescission of FIL-50-2009 in April 2016. 

• The references to a $2 million capital minimum for FSAs is outdated and should be deleted. 

EC 7 Principle 5: Licensing criteria

Criterion The licensing authority, at authorisation, evaluates the bank’s proposed Board members and senior management as to 

expertise and integrity (fit and proper test), and any potential for conflicts of interest. The fit and proper criteria include: 

(i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) 

no record of criminal activities or adverse regulatory judgments that make a person unfit to uphold important positions 

in a bank.13 The licensing authority determines whether the bank’s Board has collective sound knowledge of the material 

activities the bank intends to pursue, and the associated risks.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 8 Principle 5: Licensing criteria

Criterion The licensing authority reviews the proposed strategic and operating plans of the bank. This includes determining that an 

appropriate system of corporate governance, risk management and internal controls, including those related to the 

detection and prevention of criminal activities, as well as the oversight of proposed outsourced functions, will be in 

place. The operational structure is required to reflect the scope and degree of sophistication of the proposed activities of 

the bank.14

13 Please refer to Principle 14, Essential Criterion 8.

14 Please refer to Principle 29. 
Page 27

Principle 5: Licensing criteria

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment: 

• 12 CFR part 116 was folded into 12 CFR part 5. 

EC 9 Principle 5: Licensing criteria

Criterion The licensing authority reviews pro forma financial statements and projections of the proposed bank. This includes an 

assessment of the adequacy of the financial strength to support the proposed strategic plan as well as financial 

information on the principal shareholders of the bank.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 10 Principle 5: Licensing criteria

Criterion In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the host supervisor establishes 

that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border banking 

operations in its country, the host supervisor determines whether the home supervisor practices global consolidated 

supervision.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 11 Principle 5: Licensing criteria

Criterion The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting their 

business and strategic goals, and to determine that supervisory requirements outlined in the license approval are being 

met.

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The de novo period for state non-member institutions is now three years given the rescission of FIL-50-2009. 

As such, there is no requirement to submit a business plan for operating years four through seven.
Page 28

Principle 6: Transfer of significant ownership

The supervisor15 has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling 

interests held directly or indirectly in existing banks to other parties.

EC 1 Principle 6: Transfer of significant ownership

Criterion Laws or regulations contain clear definitions of “significant ownership” and “controlling interest”.

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• 12 CFR 152.13, 152.14, 152.15, and relevant parts of 12 CFR 146 were folded into 12 CFR 5.33. 

EC 2 Principle 6: Transfer of significant ownership

Criterion There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would 

result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular 

threshold or change in controlling interest.

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• 12 CFR 163.22 was integrated into 12 CFR 5.33 without substantive changes.

EC 3 Principle 6: Transfer of significant ownership

Criterion The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial 

ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that 

any change in significant ownership meets criteria comparable to those used for licensing banks. If the supervisor 

determines that the change in significant ownership was based on false information, the supervisor has the power to 

reject, modify or reverse the change in significant ownership.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

15 While the term “supervisor” is used throughout Principle 6, the Committee recognises that in a few countries these issues might be addressed by 

a separate licensing authority. 
Page 29

Principle 6: Transfer of significant ownership

EC 4 Principle 6: Transfer of significant ownership

Criterion The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all 

significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares 

being held by nominees, custodians and through vehicles that might be used to disguise ownership.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 6: Transfer of significant ownership

Criterion The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that 

has taken place without the necessary notification to or approval from the supervisor.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 6 Principle 6: Transfer of significant ownership

Criterion Laws or regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any 

material information which may negatively affect the suitability of a major shareholder or a party that has a controlling 

interest.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 30

Principle 7: Major acquisitions

The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential 

conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, 

and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision.

EC 1 Principle 7: Major acquisitions

Criterion Laws or regulations clearly define: 

(a) what types and amounts (absolute and/or in relation to a bank’s capital) of acquisitions and investments need prior 

supervisory approval; and 

(b) cases for which notification after the acquisition or investment is sufficient. Such cases are primarily activities 

closely related to banking and where the investment is small relative to the bank’s capital.

Legal Framework/ 

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment.

• 12 CFR 159 (subordinate organizations) was integrated into 12 CFR 5.38 (operating subsidiaries of an FSA)

without substantive changes. 

EC 2 Principle 7: Major acquisitions

Criterion Laws or regulations provide criteria by which to judge individual proposals.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 3 Principle 7: Major acquisitions

Criterion Consistent with the licensing requirements, among the objective criteria that the supervisor uses is that any new 

acquisitions and investments do not expose the bank to undue risks or hinder effective supervision. The supervisor also 

determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of 

corrective measures in the future.16 The supervisor can prohibit banks from making major acquisitions/investments 

(including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting 

16 In the case of major acquisitions, this determination may take into account whether the acquisition or investment creates obstacles to the orderly 

resolution of the bank.
Page 31

Principle 7: Major acquisitions

information flows deemed necessary for adequate consolidated supervision. The supervisor takes into consideration the 

effectiveness of supervision in the host country and its own ability to exercise supervision on a consolidated basis.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 7: Major acquisitions

Criterion The supervisor determines that the bank has, from the outset, adequate financial, managerial and organisational 

resources to handle the acquisition/investment.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 7: Major acquisitions

Criterion The supervisor is aware of the risks that non-banking activities can pose to a banking group and has the means to take 

action to mitigate those risks. The supervisor considers the ability of the bank to manage these risks prior to permitting 

investment in non-banking activities.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 6 Principle 7: Major acquisitions

Additional 

Criterion

The supervisor reviews major acquisitions or investments by other entities in the banking group to determine that these 

do not expose the bank to any undue risks or hinder effective supervision. The supervisor also determines, where 

appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures 

in the future. Where necessary, the supervisor is able to effectively address the risks to the bank arising from such 

acquisitions or investments.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 32

Principle 8: Supervisory approach

An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of 

individual banks and banking groups, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the 

banking system as a whole; have a framework in place for early intervention; they also have plans in place, in partnership with other relevant 

authorities, to take action to resolve banks in an orderly manner if they become non-viable.

Overview

The following material changes have been made since the 2014 Self-Assessment:

• The Federal Reserve has continued to develop frameworks and programs for the supervision of its largest and most complex financial 

institutions to achieve its supervisory objectives, incorporating the lessons learned from the 2007 to 2009 financial crisis and in the 

period since. As part of these supervisory frameworks and programs, the Federal Reserve assesses whether BHCs with $100 billion or 

more in total consolidated assets and U.S. IHCs of FBOs are sufficiently capitalized to absorb losses during stressful conditions, while 

meeting obligations to creditors and counterparties and continuing to be able to lend to households and businesses. The Federal 

Reserve’s expectations for capital planning practices are tailored to the size, scope of operations, activities, and systemic importance of a 

particular firm. In particular, the Federal Reserve has heightened expectations for BHCs and U.S. IHCs supervised by LISCC and firms 

with average total consolidated assets of $250 billion or more or average total nonbank assets of $75 billion or more. See BCP 2, EC 8

and BCP 9 for more information on these frameworks and programs.

• For changes in the FBAs’ stress testing and resolution planning frameworks, see EC 1 and EC 6 of this BCP, respectively.

• In July 2018, OCC Bulletin 2012-16 was incorporated into the “Capital Planning” section of the “Capital and Dividends” booklet of the 

Comptroller’s Handbook. 

EC 1 Principle 8: Supervisory approach

Criterion The supervisor uses a methodology for determining and assessing on an ongoing basis the nature, impact and scope of 

the risks: 

(a) which banks or banking groups are exposed to, including risks posed by entities in the wider group; and 

(b) which banks or banking groups present to the safety and soundness of the banking system. 

The methodology addresses, among other things, the business focus, group structure, risk profile, internal control 

environment and the resolvability of banks, and permits relevant comparisons between banks. The frequency and 

intensity of supervision of banks and banking groups reflect the outcome of this analysis.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• The Federal Reserve’s supervisory stress testing framework consists of two primary components: DFAST and 
Page 33

Principle 8: Supervisory approach

CCAR. The following are the changes made to these programs since the 2014 Self-Assessment: 

o In February 2017, the Federal Reserve amended the capital plan rule to no longer subject firms 

considered large and noncomplex to provisions of the capital plan rule whereby the Federal Reserve 

could object to a capital plan on the basis of qualitative deficiencies in the firm’s capital planning 

processes (“qualitative objection”). See 82 Fed. Reg. 9308 (Feb. 3, 2017).

o As discussed in the 2014 Self-Assessment, section 165(i) of the Dodd-Frank Act requires the FBAs to 

adopt rules requiring various BHC and bank level stress tests. 12 U.S.C. § 5365 (2011). On May 24, 

2018, section 401 of EGRRCPA (Pub. L. 115-174 § 401) amended section 165 of the Dodd-Frank Act 

and increased the threshold for the automatic application of EPS for BHCs from $50 billion to $250 

billion in total consolidated assets in two stages. 

 Upon enactment, BHCs with total consolidated assets of less than $100 billion (for FBOs, 

$100 billion in total global assets) were no longer subject to section 165 of the Dodd-Frank Act. 

Pub. L. 115-174 § 401(d)(2). The Federal Reserve issued a statement to clarify the impact of 

this and other changes made by EGGRCPA. See statement regarding the impact of EGRRCPA

(July 6, 2018).

 Eighteen months after the date of enactment (Nov. 25, 2019), the $50 billion total consolidated 

asset threshold generally was raised to $250 billion. Pub. L. 115-174 § 401(d)(1).

o Section 401(e) of EGRRCPA (Pub. L. 115-174 § 401(e)), however, requires the Federal Reserve, on a 

periodic basis, to conduct supervisory stress tests of BHCs with total consolidated assets between $100 

billion and $250 billion. In addition, EGRRCPA provides that the Board may apply any standards under 

section 165 of the Dodd-Frank Act to BHCs with total consolidated assets between $100 billion and 

$250 billion, provided that the Board determines that application of the standard is appropriate to 

prevent or mitigate risks to the financial stability of the United States or to promote the safety and 

soundness of BHCs. Pub. L. 115-174 § 401(a)

 Consistent with EGRRCPA, the Federal Reserve has proposed rules that would revise the 

applicability and frequency of the supervisory and company-run stress testing requirements to 

BHCs, SLHCs, and FBOs. See 83 Fed. Reg. 66024 (Dec. 21, 2018); 84 Fed. Reg. 24296 (May 

24, 2019). The Federal Reserve also has provided relief to less complex firms from supervisory 

stress testing requirements and the CCAR by effectively moving these firms to an extended 

stress test cycle for 2019. See Press Release: “Federal Reserve Board Releases Scenarios for 

2019 CCAR and DFAST Exercises”.
Page 34

Principle 8: Supervisory approach

o As discussed in the 2014 Self-Assessment, under section 165(i)(2) of the Dodd-Frank Act, the FBAs 

required banks and savings associations more than $10 billion in assets to conduct annual company-run 

stress tests themselves using baseline, adverse, and severely adverse scenarios. 12 U.S.C. § 5365(i)(2) 

(2011). Section 401 of EGRRCPA subsequently raised the total consolidated asset threshold for 

conducting such company-run stress tests from $10 billion to $250 billion, revised the frequency from 

annual to periodic, and eliminated the mandatory use of the adverse scenario. Pub. L. 115-174 § 401; 

12 U.S.C. § 5365(i)(2). In February 2019, the Federal Reserve proposed changes to its company-run 

stress testing rules and its Policy Statement on the Scenario Design Framework for Stress Testing to 

implement these changes. See 84 Fed. Reg. 4002 (Feb. 14, 2019). 

o In February 2019, the Federal Reserve adopted changes to increase the transparency of its stress testing 

program. The changes included amendments to the Federal Reserve’s Policy Statement on the Scenario 

Design Framework for Stress Testing along with the adoption of a new stress testing policy statement

and a notification of enhanced disclosure of the models used in the supervisory stress test. See 84 Fed. 

Reg. 6651 (Feb. 28, 2019); 84 Fed. Reg. 6664 (Feb. 28, 2019); 84 Fed. Reg. 6784 (Feb. 28, 2019).

o In April 2019, the Board amended the capital plan rule to remove the qualitative objection for any firm 

that has been subject to the qualitative objection for four consecutive years and that does not receive a 

qualitative objection in the fourth year. See 84 Fed. Reg. 8953 (Mar. 13, 2019). Instead, the capital 

planning practices of large holding companies will continue to be reviewed through the supervisory 

process. For example, in all aspects of capital planning, the Federal Reserve has significantly 

heightened supervisory expectations for the largest and most complex BHCs and expects these BHCs to 

have the most sophisticated, comprehensive, and robust capital planning practices. 

• The Federal Reserve has two frameworks for rating holding companies: one for large financial institutions, 

including global systemically important institutions over $100 billion in total consolidated assets (referred to as 

the “LFI rating system”); and one for holding companies with total consolidated assets between $10 billion and 

$100 billion (referred to as the “RFI rating system”). See 83 Fed. Reg. 58724 (Nov. 21, 2018) and 84 Fed. Reg. 

4309 (Feb. 15, 2019); SR Letter 19-3 / CA Letter 19-2, Large Financial Institution (LFI) Rating System; SR 

Letter 19-4 / CA Letter 19-3, Supervisory Rating System for Holding Companies with Total Consolidated Assets 

Less Than $100 Billion. Consistent with the Federal Reserve’s proposal on tailoring its supervisory expectations 

for domestic institutions, see 83 Fed. Reg. 61408 (Nov. 29, 2018), the Federal Reserve continues to consider 

tailoring for FBOs. 

o The LFI rating system represents a supervisory evaluation of whether a firm possesses sufficient 

financial and operational strength and resilience to maintain safe-and-sound operations and comply with 
Page 35

Principle 8: Supervisory approach

laws and regulations, including those related to consumer protection, through a range of conditions. The 

LFI rating system comprises three components: (1) capital planning and positions, (2) liquidity risk 

management and positions, and (3) governance and controls:

 Capital Component: A firm’s capital rating under the LFI rating system will reflect a broad 

assessment of the firm’s capital planning and positions, based on horizontal reviews and firmspecific supervisory work focused on capital planning and positions taking into account the 

materiality of a firm’s outstanding and newly identified supervisory issues. A firm’s compliance 

with minimum regulatory capital requirements will be considered in the assignment of the firm’s 

Capital Planning and Positions component rating. However, the Federal Reserve may determine 

that a firm does not meet expectations regarding its capital position in light of idiosyncratic 

activities and risks. In addition, any findings from supervisory stress testing such as CCAR or 

similar activities, will represent inputs into the Capital Planning and Positions component rating. 

 Liquidity Component: The Federal Reserve evaluates each firm’s liquidity risk management 

practices by reviewing the processes that firms use to identify, measure, monitor, and manage 

liquidity risk and make funding decisions in order to determine a firm’s Liquidity Risk 

Management and Positions component rating. Similar to the Capital Planning and Positions 

component rating, the Federal Reserve evaluates a firm’s liquidity positions against applicable 

regulatory requirements and assesses a firm’s ability to support its obligations through other 

means, such as its funding concentrations. Horizontal work such as the Comprehensive 

Liquidity Assessment Review (CLAR) and firm-specific examination work conducted under the 

LISCC liquidity program, represent material inputs into a firm’s liquidity rating. 

 Governance and Controls Component: This component includes an evaluation of the 

effectiveness of a firm’s board of directors, management of business lines and independent risk 

management and controls, and recovery planning. In addition, the governance and controls 

component also is designed to assess a firm’s effectiveness in aligning strategic business 

objectives with the firm’s risk appetite and risk management capabilities; maintaining effective 

and independent risk management and control functions, including internal audit; promoting 

compliance with laws and regulations, including those related to consumer protection; and 

otherwise planning for the ongoing resiliency of the firm.

o The Federal Reserve assigned initial LFI ratings to globally systemic firms in early 2019. For all other 

firms subject to the LFI rating system, the Federal Reserve will assign initial LFI ratings in early 2020.
Page 36

Principle 8: Supervisory approach

• The Board’s regulations require all FBOs with $50 billion and more in U.S. non-branch assets to establish U.S. 

IHCs to hold their respective subsidiary operations. 12 CFR 252.153. This requirement provides a platform for 

the application of EPS for capital, liquidity, and risk management and also provides a mechanism for FBOs to 

more effectively manage their U.S. operations. In 2016, 12 FBOs established U.S. IHCs. The IHCs required by 

Regulation YY are subject to the components of the Federal Reserve’s large bank supervision programs 

including capital and liquidity planning and positions and are routinely examined in a manner similar to 

domestic BHCs. 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• The Federal Reserve has substantially strengthened its supervisory program for large institutions since the 

financial crisis. In addition to shifting supervisory resources to its large institution supervision program, the 

Federal Reserve has introduced several cross-institutional (horizontal) examinations focusing on capital, 

liquidity, governance and controls, and resolution planning. Furthermore, information collections from large 

institutions have increased, providing supervisors, as well as senior management at the firms, with more timely 

and better insight into firms’ risk profiles and activities. See BCP 2, EC 8 and BCP 9 for more information on 

this these changes.

o The Federal Reserve also has established a Monitoring and Analysis program (MAP) in January 2018 

for LISCC-supervised firms. The MAP’s mission is the identification and exploration of developments 

and risks that are new, changing, misunderstood, or underappreciated to ensure that LISCC Supervision 

is adapting to changes in the world around us. MAP executes on its mission in order to inform 

supervisory planning, prioritization, and policy making. Unlike CCAR and CLAR, MAP is not an 

assessment program, and thus does not generate ratings or issue supervisory findings. Rather, MAP’s 

principal aims to serve as a focal point for risk-identification efforts.

• In December 2015, the Federal Reserve issued two guidance documents on its capital planning expectations for 

large BHCs subject to the capital plan rule: SR letter 15-18 “Federal Reserve Supervisory Assessment of Capital 

Planning and Positions for LISCC Firms and Large and Complex Firms” (Dec. 18, 2015) and SR letter 15-19

“Federal Reserve Supervisory Assessment of Capital Planning and Positions for Large and Noncomplex Firms” 

(Dec. 18, 2015).

o The guidance documents differentiate expectations for the largest most complex firms from those 

deemed large and noncomplex. Previously, both groups of banking organizations were subject to the 

full CCAR; however, to better differentiate groups of banks and the supporting reviews, the Federal 

Reserve created the Horizontal Capital Review (HCR). 
Page 37

Principle 8: Supervisory approach

o HCR establishes a framework and protocols for the horizontal review of capital plans for large 

noncomplex banking organizations. HCR is more limited in scope than CCAR and includes targeted 

horizontal evaluations of specific areas of capital planning, and focuses on the more tailored standards 

set forth in supervisory guidance specific to these firms. Both the expectations and framework are 

material changes from the 2014 Self-Assessment. 

• To complement the LCR (see BCP 24 for more information on LCR), the Federal Reserve launched the CLAR

for firms in the LISCC portfolio. See Speech from former Governor Daniel K. Tarullo and SR 15-7: 

Governance Structure of the LISCC Supervisory Program. 

o Like CCAR, CLAR is an annual horizontal assessment, with quantitative and qualitative elements, 

overseen by a multidisciplinary committee of liquidity experts from across the Federal Reserve. In 

CLAR, supervisors assess the adequacy of LISCC portfolio firms’ liquidity positions relative to their 

unique risks and test the reliability of these firms' approaches to managing liquidity risk. CLAR 

provides a regular opportunity for supervisors to respond to evolving liquidity risks and firm practices 

over time. 

o CLAR involves evaluations of firms’ liquidity positions both through a range of supervisory liquidity 

metrics and through analysis of firms’ internal stress tests. As with CCAR, this analysis helps inform 

supervisors of the reliability of firms’ own risk measurement and management. CLAR does not include 

a specific quantitative post-stress minimum. Because CLAR assesses all LISCC-supervised firms 

simultaneously, the Federal Reserve is also able to compare the range of practices in liquidity risk 

management across the LISCC portfolio. Knowledge gained through CLAR assessments also provides 

a macroprudential perspective on liquidity vulnerabilities and funding concentrations in the system as a 

whole. 

o Changes to the CLAR program since 2014 have been in two areas: (1) as the Federal Reserve 

formalized the LISCC Program, the agency transitioned from CLAR to the LISCC Liquidity Program; 

and (2) the reporting technology of the “Complex Institution Liquidity Monitoring Report,” or FR 

2052a, has evolved from a PDF/Excel template to a more comprehensive and flexible XML format. 

• In 2017, the Federal Reserve implemented the Horizontal Liquidity Review (HLR), which established a new 

framework and protocols for the horizontal review of liquidity risk management practices at large banking 

organizations not subject to the LISCC CLAR review. Through the HLR, the Federal Reserve assesses liquidity 

planning and positions at non-LISCC banking organizations using an approach that is tailored to the 

organizations’ risk profiles. 
Page 38

Principle 8: Supervisory approach

EC 2 Principle 8: Supervisory approach

Criterion The supervisor has processes to understand the risk profile of banks and banking groups and employs a well-defined 

methodology to establish a forward-looking view of the profile. The nature of the supervisory work on each bank is 

based on the results of this analysis.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• See EC 1 of this BCP for relevant changes.

• The FBAs implemented a Liquidity Coverage Ratio (LCR) rule that together with associated public disclosure 

requirements, is consistent with the Basel III LCR standard. See 79 Fed. Reg. 61440 (Oct. 10, 2014), codified at 

12 CFR part 50 (OCC), 12 CFR part 249 (Federal Reserve), and 12 CFR part 329 (FDIC). See BCP 24 for more 

information about the LCR.

• See BCP 2, EC 8 for information about changes to the asset threshold that determine the frequency of 

examination for banks pursuant to section 210 of EGRRCPA. Pub. L. 155-174 § 210. 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• The Federal Reserve is conducting more supervisory activities off-site and simplifying pre-examination requests 

for documentation to ease the burden associated with community bank examinations. The Federal Reserve 

recognizes that there are differences in risk among community banks and has further tailored the supervision of 

these banks. The Federal Reserve continues to follow a risk-focused approach that aims to deploy examination 

resources to higher-risk banks. This risk-focused approach contributes to reduced regulatory burden, allowing 

banks more time and resources to serve the credit needs of their local community. 

o The Federal Reserve uses the metrics-based Bank Exams Tailored to Risk (BETR) program in its 

implementation of a risk-focused supervisory program for small banks (See SR Letter 19-9 (June 3, 

2019)). The BETR program relies upon regulatory reporting (largely quarterly Call Report) data and 

examiner judgement to appropriately classify areas of risk into low, moderate, and high risk. This 

allows Reserve Bank staff to direct their resources effectively to areas of heightened risk and to 

minimize excessive burden on low- and moderate-risk areas and institutions. The Federal Reserve has 

developed exam procedures that are tailored to the BETR risk classification. 

o In addition, holding company inspections are conducted on either an annual or two year basis depending 

upon size, complexity, and rating, with smaller (less than $1 billion in assets) holding companies subject 
Page 39

Principle 8: Supervisory approach

to off-site reviews (see section 5000 of the BHC Supervision Manual (updated July 2016) for more 

information on the Federal Reserve’s BHC Inspection Program). 

• See BCP 2, EC 8 and BCP 9 for more information on changes to the supervisory approach.

EC 3 Principle 8: Supervisory approach

Criterion The supervisor assesses banks’ and banking groups’ compliance with prudential regulations and other legal 

requirements.

Legal Framework See EC 1 and EC 2 above for relevant changes since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 8: Supervisory approach

Criterion The supervisor takes the macroeconomic environment into account in its risk assessment of banks and banking groups. 

The supervisor also takes into account cross-sectoral developments, for example in non-bank financial institutions, 

through frequent contact with their regulators.

Legal Framework See Overview, EC 1 and EC 2 above for relevant changes since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 8: Supervisory approach

Criterion The supervisor, in conjunction with other relevant authorities, identifies, monitors and assesses the build-up of risks, 

trends and concentrations within and across the banking system as a whole. This includes, among other things, banks’ 

problem assets and sources of liquidity (such as domestic and foreign currency funding conditions, and costs). The 

supervisor incorporates this analysis into its assessment of banks and banking groups and addresses proactively any 

serious threat to the stability of the banking system. The supervisor communicates any significant trends or emerging 

risks identified to banks and to other relevant authorities with responsibilities for financial system stability.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:
Page 40

Principle 8: Supervisory approach

• The FBAs have changed the process from an annual to a semi-annual review of the largest, complex credits that 

are shared by three or more banks. These reviews provide an opportunity for the FBAs to identify trends in 

underwriting and credit classification practices, as well as overall commercial credit conditions, across the 

banking system. The 2018 review included over 8,500 credit facilities totaling $4.4 trillion extended to 

approximately 5,300 borrowers. 

• See BCP 9, EC 9 for information on the FDIC’s clarification of expectations related to Matters Requiring Board 

Attention (MRBA). 

EC 6 Principle 8: Supervisory approach

Criterion Drawing on information provided by the bank and other national supervisors, the supervisor, in conjunction with the 

resolution authority, assesses the bank’s resolvability where appropriate, having regard to the bank’s risk profile and 

systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires, where 

necessary, banks to adopt appropriate measures, such as changes to business strategies, managerial, operational and 

ownership structures, and internal procedures. Any such measures take into account their effect on the soundness and 

stability of ongoing business.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• As discussed in the Overview, EGRRCPA raised the total consolidated asset threshold for many EPS 

requirements, including resolution planning, from $50 billion to $250 billion. Pub. L. 115-174 § 401. The 

threshold increase occurs in two stages:

o Upon enactment, BHCs with total consolidated assets of less than $100 billion (for FBOs, $100 billion 

in total global assets) were no longer subject to the resolution planning requirement. Pub. L. 115-174

§ 401(d)(2). 

o Eighteen months after the date of EGRRCPA’s enactment, the total consolidated asset threshold is 

raised to $250 billion in total consolidated assets. Pub. L. 115-174 § 401(d)(1).

• However, EGRRCPA provides the Board with the authority to apply resolution planning requirements to firms 

with $100 billion to $250 billion in total consolidated assets. Specifically, under section 165(a)(2)(C) of the 

Dodd-Frank Act, as amended by EGRRCPA, the Board may, by order or rule, apply the resolution planning 

requirement to any firm or firms with total consolidated assets of $100 billion (for FBOs, $100 billion in total 

global assets) or more. 12 U.S.C. § 5365(a)(2)(c). 
Page 41

Principle 8: Supervisory approach

• In April 2019, the Federal Reserve and the FDIC proposed modifications to their resolution plan rule consistent 

with changes made by EGRRCPA. 84 Fed. Reg. 21600. 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• The LISCC Recovery and Resolution Planning program has undergone substantial development since the 2014

self-assessment and includes:

o In September 2014, the Federal Reserve issued guidance on recovery planning for large, domestic BHCs 

in the LISCC portfolio. See SR Letter 14-08. The letter provides guidance on supervisory expectations 

for recovery planning, the role of a BHC’s board of directors, and the expected elements of a recovery 

plan.

o The 12 LISCC-supervised firms (eight domestic and four foreign banks) submitted their comprehensive 

resolution plans in July 2015. See Press Release (July 6, 2015).

o In April 2016, the Federal Reserve and FDIC announced determinations that five of the eight domestic 

banks’ resolution plans had deficiencies that required remediation. The agencies also issued a white 

paper describing the resolution plan assessment framework and determinations and guidance for the 

eight domestic LISCC-supervised firms’ 2017 resolution plans.. See Press Release (Apr. 13, 2016).

o In December 2016, the Federal Reserve and FDIC announced that four domestic firms had remedied 

deficiencies, while a fifth firm failed to remedy its deficiency noted in their 2015 resolution plans. For 

the fifth firm, the agencies imposed restrictions on the growth of international and non-bank activities 

and required the firm to submit a revised plan. Following a review of the revised plan, the agencies 

determined that the firm had adequately remediated the deficiencies in its 2015 resolution plan and 

withdrew the imposed growth restrictions. See Press Release (Dec. 13, 2016) and Press Release (Apr. 

24, 2017).

o In March 2017, the Federal Reserve and FDIC announced that they had completed their 2015 resolution 

plan evaluations for the four LISCC-supervised FBOs, and issued guidance on identified vulnerabilities 

organized around capital, liquidity, governance mechanisms, and their recent IHC restructurings. See

Press Release (Mar. 24, 2017). The 2017 guidance described the agencies’ expectations regarding the 

foreign firms’ 2018 resolution plans and highlighted specific areas where additional information should 

be provided regarding certain capabilities or optionality. The agencies sent feedback letters to each firm 

detailing the shortcomings and specific actions that can be taken to address them. Firms were required 
Page 42

Principle 8: Supervisory approach

to address shortcomings in their next resolution plans and are expected to implement certain interim 

resolution projects.

o The eight LISCC-supervised domestic banks again submitted their resolution plans in July 2017. In 

December 2017, the Federal Reserve and FDIC announced that the eight LISCC-supervised domestic 

firms had no deficiencies in their respective resolution plans, and substantive progress had been made 

by the firms, yet they must continue to improve their resolvability, intra-group liquidity, loss-absorbing 

capacity, derivatives, and PCS activities. See Press Release (Dec. 19, 2017).

o In December 2018, the FDIC and Federal Reserve, adopted final guidance for the 2019 and subsequent 

resolution plan submissions by the eight largest, complex U.S. banking organizations. The final 

guidance is intended to assist covered companies in developing their resolution plans, which are 

required to be submitted pursuant to the Dodd-Frank Act. The final guidance is largely based on prior 

guidance issued to these covered companies and describes the agencies’ expectations regarding a 

number of key vulnerabilities in plans for an orderly resolution under the U.S. Bankruptcy Code (i.e., 

capital; liquidity; governance mechanisms; operational; legal entity rationalization and separability; and 

derivatives and trading activities). The final guidance also updates certain aspects of prior guidance 

based on the agencies’ review of these firms’ most recent resolution plan submissions. See 84 Fed. Reg. 

1438.

o In December 2018, the agencies identified shortcomings, but not deficiencies, in the review of four FBO 

resolution plans. See Press Release (Dec. 20, 2018).

While not a change from the 2014 Self-Assessment, the FDIC would like to clarify that it has also adopted resolution 

planning requirements for insured banks with total assets of $50 billion or more (the “IDI Rule”). 12 CFR 360.10. The 

IDI Rule requires covered banks to periodically submit resolution plans that should enable the FDIC, as receiver, to 

resolve the bank in the event of its insolvency, under the FDIA, in a manner that ensures that depositors receive access 

to their insured deposits within one business day of the bank's failure (two business days if the failure occurs on a day 

other than Friday), maximizes the net present value return from the sale or disposition of its assets, and minimizes the 

amount of any loss realized by the creditors in the resolution. The IDI Rule is intended to ensure that the FDIC has 

timely access to the essential information concerning a bank's structure, operations, business practices, financial 

responsibilities, and risk exposure, which the FDIC would need to handle a resolution of a bank under the FDIA.
Page 43

Principle 8: Supervisory approach

EC 7 Principle 8: Supervisory approach

Criterion The supervisor has a clear framework or process for handling banks in times of stress, such that any decisions to require 

or undertake recovery or resolution actions are made in a timely manner.

Legal Framework/ 

Practices and 

Procedures

See EC6 of this BCP for relevant changes since the 2014 Self-Assessment.

EC 8 Principle 8: Supervisory approach

Criterion Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory 

perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. Where 

the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor 

takes appropriate steps to address this.

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• The FSOC is currently considering changes in its approach to the designation of nonbank financial companies 

for enhanced supervision. See 84 Fed. Reg. 9028.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 44

Principle 9: Supervisory techniques and tools

The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a 

proportionate basis, taking into account the risk profile and systemic importance of banks.

Overview

The following material changes have been made since the 2014 Self-Assessment:

• As explained in detail in BCP 2, EC 8 and BCP 8, EC 2 the FBAs’ risk-based supervisory approach has become more sophisticated since 

the 2014 Self-Assessment. In addition to the detail provided in those BCPs, the FBAs would like to note the following:

o In 2017, the FFIEC members initiated an examination modernization project focused on improving the efficiency and 

effectiveness of the examination process. As part of that project, in November 2018, the FFIEC members issued a statement

emphasizing a commitment to risk-focused examination principles. See Press Release: “FFIEC Emphasizes Risk-Focused 

Supervision in Second Update of the Examination Modernization Project” (Nov. 27, 2018). 

o In March 2019, the FDIC leveraged the interagency work to further enhance its own risk-focused examination program by 

updating, revising, clarifying, and emphasizing the risk-focused examination approach through revisions to examiner instructions 

on principles and techniques related to risk-focused, forward-looking supervision. This approach emphasizes tailoring 

examination focus and resources on areas of highest risk, and reducing attention on low risk areas. Key components of these new 

instructions ensure that examiners develop a thorough understanding of the business model, complexity, and risk profile of the 

institution examined, and tailor the examination scope to the specific characteristics of that institution. New instructions also 

provide more time for examiners to plan risk-focused examinations and enhance instructions related to choosing a risk-focused 

loan sample during examinations. These new instructions have currently only been issued to examiners, but publication of these 

instructions is planned for later in 2019. 

o In July 2019, the FBAs and FinCEN issued a Joint Statement on Risk-Focused Bank Secrecy Act/Anti-Money Laundering 

(BSA/AML) Supervision (June 22, 2019). The Statement describes the agencies’ risk-focused approach to BSA/AML 

supervision, which enables them to better tailor examination plans and procedures based on the unique risk profile of each 

bank. The Statement outlines common practices for assessing a bank’s money laundering/terrorist financing risk profile, assisting 

examiners in scoping and planning the examination and initially evaluating the adequacy of the BSA/AML compliance 

program. Using this approach, the agencies generally are able to allocate more resources to higher-risk areas and fewer resources 

to lower-risk areas when conducting BSA/AML examinations; banks likewise are able to allocate their compliance resources 

commensurate with their risk.

• See BCP 8, EC 1 for information on changes to the stress-testing framework attributable to EGRRCPA.

• See BCP 8, EC 6 for information on changes to the resolution requirements attributable to EGRRCPA, as well as developments in the 

resolution planning framework for large banking organizations generally.
Page 45

Principle 9: Supervisory techniques and tools

• Regarding supervisory techniques, the FBAs would like to clarify the following:

o For midsize banks, the OCC has dedicated supervision staff assigned to each institution who conduct both off-site and on-site 

supervisory activities. 

o The FDIC generally assigns dedicated staff and employs a continuous examination process for state non-member banks with total 

assets exceeding $10 billion.

o Additionally, FDIC is increasing its use of technology to enhance the risk-focused approach while also lessening banker burden 

by conducting more examination functions off-site. Recognizing that banks are increasing use of imaged loan files to manage 

their documents. In 2018, the FDIC began piloting a loan file viewer technology to facilitate off-site loan file review thereby 

further enhancing efficiency and reducing banker burden. See FIL-22-2018 and FIL-4-2019.

o At the Federal Reserve, the supervision of the largest, most systemically important financial institutions is conducted by the 

LISCC program—a national program that uses both horizontal and firm-specific supervisory activities to assess the financial 

resiliency and risk-management practices of firms. By contrast, the supervision of institutions in the LFBO portfolio includes 

some horizontal elements, but firm-specific teams at the local Reserve Bank conduct most of the supervisory work, subject to 

oversight by the Board. For regional and community banking organizations, the supervision model is more decentralized with 

greater decision-making flexibility provided to Reserve Banks, subject to oversight by Board staff.

EC 1 Principle 9: Supervisory techniques and tools

Criterion The supervisor employs an appropriate mix of on-site17 and off-site18 supervision to evaluate the condition of banks and 

banking groups, their risk profile, internal control environment and the corrective measures necessary to address 

supervisory concerns. The specific mix between on-site and off-site supervision may be determined by the particular 

conditions and circumstances of the country and the bank. The supervisor regularly assesses the quality, effectiveness 

and integration of its on-site and off-site functions, and amends its approach, as needed.

Legal 

Framework

See the Overview to BCP 9 and BCP 2, EC 8 for relevant material changes and clarifications.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

17 On-site work is used as a tool to provide independent verification that adequate policies, procedures and controls exist at banks, determine that 

information reported by banks is reliable, obtain additional information on the bank and its related companies needed for the assessment of the 

condition of the bank, monitor the bank’s follow-up on supervisory concerns, etc.

18 Off-site work is used as a tool to regularly review and analyze the financial condition of banks, follow up on matters requiring further attention, 

identify and evaluate developing risks and help identify the priorities, scope of further off-site and on-site work, etc
Page 46

Principle 9: Supervisory techniques and tools

EC 2 Principle 9: Supervisory techniques and tools

Criterion The supervisor has a coherent process for planning and executing on-site and off-site activities. There are policies and 

processes to ensure that such activities are conducted on a thorough and consistent basis with clear responsibilities, 

objectives and outputs, and that there is effective coordination and information sharing between the on-site and off-site 

functions.

Legal Framework/ 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment: 

• In March 2016, the Federal Reserve issued SR 16-4 “Relying on the Work of the Regulators of the Subsidiary 

Insured Depository Institution(s) of Bank Holding Companies and Savings and Loan Holding Companies with 

Total Consolidated Assets of Less than $50 Billion,” in order to reiterate its longstanding practice of relying to 

the work of the IDI regulators. The SR letter aligns with 12 U.S.C. § 1844(c)(2)(C)(ii), which requires the 

Federal Reserve, to the fullest extent possible, to coordinate with other regulators to avoid duplication of 

examination activities, reporting requirements and requests for information.

o The letter outlines the principles the Federal Reserve follows to foster the timely sharing of information, 

including risk-focused supervisory analysis and conclusions, with the IDI regulators, so that Federal 

Reserve staff have an adequate basis for relying on the IDI regulators’ work. Although SR 16-4 was 

directed at supervision of banking companies with assets less than $50 billion, similar principles are 

followed in the LISCC and LFBO portfolios. Sharing supervisory information and analysis among the 

relevant FBAs promotes effective supervisory coordination and information sharing across the 

prudential bank regulators, and informs both the on-site and off-site supervisory work performed by the 

FBAs. 

o In 2017, the Federal Reserve Office of the Inspector General (OIG) issued a report evaluating how the 

Federal Reserve was implementing SR 16-4. It concluded that the Reserve Banks rely on the work of 

the IDI regulators, and have increased that reliance since SR 16-4 was issued. See also additional 

details in EC 13 below. 

EC 3 Principle 9: Supervisory techniques and tools

Criterion The supervisor uses a variety of information to regularly review and assess the safety and soundness of banks, the 

evaluation of material risks, and the identification of necessary corrective actions and supervisory actions. This includes 

information, such as prudential reports, statistical returns, information on a bank’s related entities, and publicly 

available information. The supervisor determines that information provided by banks is reliable and obtains, as 

necessary, additional information on the banks and their related entities.

Legal Framework/ See the Overview to BCP 9 and BCP 2, EC 8 for relevant material changes and clarifications.
Page 47

Principle 9: Supervisory techniques and tools

Practices and 

Procedures

EC 4 Principle 9: Supervisory techniques and tools

Criterion The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking 

system, such as:

• analysis of financial statements and accounts;

• business model analysis;

• horizontal peer reviews;

• review of the outcome of stress tests undertaken by the bank; and

• analysis of corporate governance, including risk management and internal controlsystems.

The supervisor communicates its findings to the bank as appropriate and requires the bank to take action to mitigate any 

particular vulnerabilities that have the potential to affect its safety and soundness. The supervisor uses its analysis to 

determine follow-up work required, if any.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 9: Supervisory techniques and tools

Criterion The supervisor, in conjunction with other relevant authorities, seeks to identify, assess and mitigate emerging risks 

across banks and to the banking system as a whole, potentially including conducting supervisory stress tests (on 

individual banks or system-wide). The supervisor communicates its findings as appropriate to either banks or the 

industry and requires banks to take action to mitigate any particular vulnerabilities that have the potential to affect the 

stability of the banking system, where appropriate. The supervisor uses its analysis to determine follow-up work 

required, if any.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 9: Supervisory techniques and tools

Criterion The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to what extent, it 

may rely on the internal auditors’ work to identify areas of potential risk.

Legal No material changes have occurred since the 2014 Self-Assessment.
Page 48

Principle 9: Supervisory techniques and tools

Framework/ 

Practices and 

Procedures

EC 7 Principle 9: Supervisory techniques and tools

Criterion The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, non-executive Board 

members and senior and middle management (including heads of individual business units and control functions) to 

develop an understanding of and assess matters such as strategy, group structure, corporate governance, performance, 

capital adequacy, liquidity, asset quality, risk management systems and internal controls. Where necessary, the 

supervisor challenges the bank’s Board and senior management on the assumptions made in setting strategies and 

business models.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 9: Supervisory techniques and tools

Criterion The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses in a timely manner by 

means of written reports or through discussions or meetings with the bank’s management. The supervisor meets with the 

bank’s senior management and the Board to discuss the results of supervisory examinations and the external audits, as 

appropriate. The supervisor also meets separately with the bank’s independent Board members, as necessary.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 9: Supervisory techniques and tools

Criterion The supervisor undertakes appropriate and timely follow-up to verify that banks have addressed supervisory concerns or 

implemented requirements communicated to them. This includes early escalation to the appropriate level of the 

supervisory authority and to the bank’s Board if action points are not addressed in an adequate or timely manner.

Legal 

Framework

No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment: 

• In July 2016, the FDIC Board of Directors issued a Statement of the FDIC Board of Directors on the 
Page 49

Principle 9: Supervisory techniques and tools

Development and Communication of Supervisory Recommendations, which directs examiners to communicate 

supervisory concerns clearly and in writing, to address meaningful concerns, and to discuss corrective action. 

• In 2017, the FDIC updated its examiner instructions to incorporate the FDIC Board’s directions, including 

updated instructions for MRBA, to ensure that FDIC-supervised institutions take timely action to address 

deficiencies. See section 16.1 of the Risk Management Manual of Examination Policies. 

o MRBA are a subset of supervisory recommendations, which are an FDIC communication intended to 

inform the institution of the FDIC’s views about changes needed in its practices, operations, or financial 

condition to help directors prioritize their efforts to address examiner concerns, identify emerging 

problems, and correct deficiencies before the bank’s condition deteriorates (or to keep the bank viable if 

conditions already deteriorated). A principal purpose of supervisory recommendations is to 

communicate supervisory concerns to a bank so that it can make appropriate changes in its practices, 

operations or financial condition and thereby avoid more formal remedies in the future, such as 

enforcement actions. MRBA highlight material issues and recommendations that require prompt 

attention by the directorate and senior management and are tracked and followed-up by regulators 

between examinations, who make decisions as to whether concerns have been addressed or require 

escalation. 

o FDIC staff were trained on the revised instructions in 2017 and 2018.

EC 10 Principle 9: Supervisory techniques and tools

Criterion The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall 

condition, or as soon as they become aware of any material adverse developments, including breach of legal or 

prudential requirements.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 11 Principle 9: Supervisory techniques and tools

Criterion The supervisor may make use of independent third parties, such as auditors, provided there is a clear and detailed 

mandate for the work. However, the supervisor cannot outsource its prudential responsibilities to third parties. When 

using third parties, the supervisor assesses whether the output can be relied upon to the degree intended and takes into 

consideration the biases that may influence third parties.

Legal No material changes have occurred since the 2014 Self-Assessment.
Page 50

Principle 9: Supervisory techniques and tools

Framework

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• In 2016, the FBAs issued Interagency Advisory on External Audits of Internationally Active U.S. 

Financial Institutions, which discusses BCBS Guidance on “External Audits of Banks.” The guidance 

sets out expectations for the relationship between supervisors and external auditors.

EC 12 Principle 9: Supervisory techniques and tools

Criterion The supervisor has an adequate information system which facilitates the processing, monitoring and analysis 

of prudential information. The system aids the identification of areas requiring follow-up action.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 13 Principle 9: Supervisory techniques and tools

Additional 

Criterion

The supervisor has a framework for periodic independent review, for example by an internal audit function or third party 

assessor, of the adequacy and effectiveness of the range of its available supervisory tools and their use, and makes 

changes as appropriate.

Legal 

Framework

No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. The FBAs would like to clarify, however, that each 

FBA has a framework for periodic independent review of the adequacy and effectiveness of the range of its available 

supervisory tools, and the OIG for each FBA conducts internal audits of the agency. 

For example, in June 2018, the Federal Reserve’s OIG issued a report that focused on evaluation of the effectiveness of 

the consolidated supervision of regional banking organization portfolio. Specifically, the OIG commented on the extent 

to which the Reserve Banks rely on the primary federal regulator in executing consolidated supervision and the 

effectiveness of interagency coordination. The report concluded that “[i]n accordance with applicable guidance related to 

consolidated supervision, we determined that the Federal Reserve Banks relied on the primary federal regulator of RBOs’ 

IDIs to supervise the RBOs we sampled.” All other Federal Reserve OIG audits and other reviews relating to the 

program and operations of the Federal Reserve are available on the OIG’s website.

As another example, in 2018 the Federal Reserve revised the Board’s oversight function for greater effectiveness, 

efficiency and collaboration. The revised program places more reliance on horizontal reviews, continuous monitoring 
Page 51

Principle 9: Supervisory techniques and tools

and feedback, greater leveraging of internal audit and quality assurance work in the Reserve Banks, greater use of 

governance meetings, and more frequent communication with Reserve Bank staff. The new function is being piloted 

during 2019.
Page 52

Principle 10: Supervisory reporting

The supervisor collects, reviews and analyses prudential reports and statistical returns19 from banks on both a solo and a consolidated basis, and 

independently verifies these reports through either on-site examinations or use of external experts.

Overview 

The following material changes have been made since the 2014 Self-Assessment:

• The 2014 Self-Assessment correctly noted that the authority to collect information from banks and holding companies is limited by the 

Paperwork Reduction Act of 1995 (PRA). The 2014 Self-Assessment also noted that federal agencies generally must obtain approval 

from the U.S. Office of Management and Budget (OMB) prior to engaging in information collections subject to the PRA. Although it is 

correct that the FBAs, other than the Federal Reserve, must receive OMB approval prior to engaging in such an information collection, 

the Federal Reserve has been delegated the authority to approve under the PRA information collections conducted or sponsored by the 

Federal Reserve. In approving such information collections, the Federal Reserve must comply with the substantive and procedural 

requirements of the PRA and any implementing regulations, including the requirement to publish two Federal Register notices. The 

Federal Reserve’s delegated authority does not apply to information collected under the auspices of the FFIEC.

EC 1 Principle 10: Supervisory reporting

Criterion The supervisor has the power20 to require banks to submit information, on both a solo and a consolidated basis, on their 

financial condition, performance, and risks, on demand and at regular intervals. These reports provide information such 

as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk 

concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related 

party transactions, interest rate risk, and market risk.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• On June 1, 2016, the Federal Reserve published a final notice in the Federal Register (81 Fed. Reg. 35016) that 

required IHCs of FBOs to (1) file regulatory reports applicable to BHCs; and (2) comply with the information 

collection requirements associated with regulatory capital requirements. The revisions to the mandatory information 

collections were effective July 1, 2016.

19 In the context of this Principle, “prudential reports and statistical returns” are distinct from and in addition to required accounting reports. The 

former are addressed by this Principle, and the latter are addressed in Principle 27.

20 Please refer to Principle 2. 
Page 53

Principle 10: Supervisory reporting

• EGRRCPA, which was enacted on May 24, 2018, amended various statutes administered by the FBAs. Pub. L. No. 

115-174. The amendments made by EGRRCPA provide for additional tailoring of various provisions of federal 

banking laws while maintaining the authority of the FBAs to ensure the safety and soundness of depository 

institutions and their holding companies and to apply EPS to address financial stability. More information about 

changes specific to stress testing and resolution planning can be found in BCP 8, EC 1 and BCP 8, EC 6,

respectively. On July 6, 2018, the FBAs published a statement regarding the impact of EGRRCPA on regulations 

and associated reporting requirements that the FBAs administer and that EGRRCPA immediately affected. The 

FBAs are taking the positions detailed in the statement in the interim until their regulations are amended to 

incorporate these changes, as necessary. The following bullet points provide additional information about certain 

provisions of EGRRCPA.

o In 2010, section 619 of the Dodd-Frank Act added a new section 13 to the Bank Holding Company Act 

(BHC Act) (codified at 12 U.S.C. § 1851), also known as the Volcker Rule, that generally prohibits any 

banking entity from engaging in proprietary trading or from acquiring or retaining an ownership interest in, 

sponsoring, or having certain relationships with a hedge fund or private equity fund (covered fund), subject to 

certain exemptions. The 2014 Self-Assessment explained that the final rules implementing the Volcker Rule 

require banking entities with significant trading operations to report certain quantitative measurements 

designed to monitor certain trading activities, subject to a phase-in based on the type and size of the entity’s 

trading activities. 

 Sections 203 and 204 of EGRRCPA amend section 13 of the BHC Act by narrowing the definition of 

banking entity and revising the statutory provisions related to the naming of covered funds. Pub. L. 

No. 115-174, §§ 203, 204. The amendments to section 13 took effect upon enactment. 

 The FBAs’ July 6, 2018, statement explains that, in the interim between enactment of EGRRCPA

and the adoption of implementing regulations, the agencies will not enforce their 2013 final rule 

implementing section 619 of the Dodd-Frank Act in a manner inconsistent with EGRRCPA 

amendments to section 13 of the BHC Act with respect to institutions excluded by the statute and 

with respect to the naming restrictions for covered funds. 

 On July 17, 2018, the FBAs (and the SEC and CFTC) proposed amendments to their respective 

regulations implementing section 13 of the BHC Act. 83 Fed. Reg. 33432. The amendments are 

intended to provide banking entities with clarity about what activities are prohibited and to improve 

supervision and implementation of section 13. The July 2018 proposal does not include proposed 

changes that would implement sections 203 and 204 of EGRRCPA. Pub. L. No. 115-174, §§ 203, 

204. The FBAs plan to address these statutory amendments through a separate rulemaking process. 
Page 54

Principle 10: Supervisory reporting

 In August 2019, pursuant to sections 203 and 204 of EGRRCPA, the FBAs issued a final rule to 

exclude certain firms that have total consolidated assets equal to $10 billion or less and total trading 

assets and liabilities equal to 5 percent or less of total consolidated assets and modify the definition 

of IDI. The rule also amends the restrictions applicable to the naming of a hedge fund or private 

equity fund to permit an investment adviser that is a banking entity to share a name with the fund 

under certain circumstances. See 84 Fed. Reg. 38115.

o Some of the other amendments made by EGRRCPA that affect or relate to supervisory reporting include:

 providing for a simplified measure of capital adequacy for certain community banking organizations 

(Pub. L. No. 115-174, § 201); 

 excepting a capped amount of reciprocal deposits from treatment as brokered deposits for qualifying 

institutions (Pub. L. No. 115-174, § 202); 

 requiring the FBAs to issue regulations that allow for a reduced reporting requirement in the 

Call Reports for the first and third calendar quarters of the year for certain IDIs (Pub. L. No. 115-

174, § 205); 

 raising the threshold for applicability of the Small BHC and SLHC Policy Statement from $1 billion 

to $3 billion in consolidated assets (previously raised from $500 Million to $1 billion by the Federal 

Reserve) (Pub. L. No. 115-174, § 207); and 

 providing that the FBAs may only require a depository institution to assign a heightened risk weight 

to a high volatility commercial real estate (HVCRE) exposure if such exposure is an “HVCRE 

acquisition, development, or construction loan,” as defined in EGRRCPA (Pub. L. No. 115-174, 

§ 214).

o Effective March 31, 2017, the FBAs, under the auspices of the FFIEC, implemented a new streamlined 

FFIEC 051 Call Report for eligible small institutions, which generally consist of those with domestic offices 

only and less than $1 billion in total assets. In creating the new FFIEC 051 report, which is a streamlined 

version of the FFIEC 041 Call Report otherwise applicable to such institutions, the FBAs aimed to balance 

institutions’ requests for a less burdensome regulatory reporting process with the need for sufficient data to 

monitor the condition and performance of, and ensure the safety and soundness of, institutions and carry out 

agency-specific missions. Pursuant to a final rule implementing section 205 of EGRRCPA that the FBAs

published on June 21, 2019, eligibility to file the FFIEC 051 Call Report has been expanded to include 
Page 55

Principle 10: Supervisory reporting

certain institutions with less than $5 billion in total consolidated assets effective as of the September 30, 

2019, report date. 84 Fed. Reg. 29039. See the discussion in EC 5 “Practices and Procedures” below. 

• Effective March 31, 2015, the FBAs, under the auspices of the FFIEC, implemented the Market Risk Regulatory 

Report for Institutions Subject to the Market Risk Capital Rule (FFIEC 102). This quarterly report must be submitted 

by all banks and holding companies to which the FBAs’ market risk capital rule applies. All data reported in the 

FFIEC 102 is made available to the public.

EC 2 Principle 10: Supervisory reporting

Criterion The supervisor provides reporting instructions that clearly describe the accounting standards to be used in preparing 

supervisory reports. Such standards are based on accounting principles and rules that are widely accepted internationally.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 3 Principle 10: Supervisory reporting

Criterion The supervisor requires banks to have sound governance structures and control processes for methodologies that produce 

valuations. The measurement of fair values maximizes the use of relevant and reliable inputs and is consistently applied 

for risk management and reporting purposes. The valuation framework and control procedures are subject to adequate 

independent validation and verification, either internally or by an external expert. The supervisor assesses whether the 

valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not 

sufficiently prudent, the supervisor requires the bank to make adjustments to its reporting for capital adequacy or 

regulatory reporting purposes.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• In January 2016, the Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) No. 

2016-01, “Recognition and Measurement of Financial Assets and Financial Liabilities.” For institutions that are 

public business entities, the ASU is currently in effect. For all other entities, the ASU is effective for fiscal years 

beginning after December 15, 2018, and interim periods within fiscal years beginning after December 15, 2019. This 

ASU requires: 
Page 56

Principle 10: Supervisory reporting

o Investments in equity securities, except those accounted for under the equity method and those that result in 

consolidation, to be measured at fair value with changes in fair value recognized in net income. However, 

for an equity security that does not have a readily determinable fair value, the ASU permits an entity to elect 

to measure the security at cost minus impairment, if any, plus or minus changes resulting from observable 

price changes in orderly transactions for the identical or a similar investment of the same issuer. Under 

previous U.S. generally accepted accounting principles (GAAP), only those equity securities held for trading 

or for which the fair value option for financial instruments had been elected were measured at fair value 

through net income.

o The portion of the total change in the fair value of a liability resulting from a change in the instrumentspecific credit risk (own credit risk) to be reported in other comprehensive income, rather than in net income, 

when the institution has elected to measure the liability at fair value in accordance with the fair value option 

for financial instruments.

o Public business entities that are required to disclose fair value of financial instruments measured at amortized 

cost on the balance sheet to measure that fair value using the exit price notion consistent with Accounting 

Standards Codification (ASC) Topic 820, Fair Value Measurement. This change to U.S. GAAP eliminates 

the entry price method previously used by some entities for disclosure purposes for some financial assets.

• In August 2018, the FASB issued ASU No. 2018-13, “Disclosure Framework—Changes to the Disclosure 

Requirements for Fair Value Measurement.” This ASU amended the financial statement disclosure requirements on 

fair value measurements in ASC Topic 820, Fair Value Measurement, based on the concepts in the Concepts 

Statement No. 8, “Conceptual Framework for Financial Reporting—Chapter 8, Notes to Financial Statements,” 

including the consideration of costs and benefits. The amendments remove certain existing disclosures, modify 

others, and, for public business entities only, add certain other disclosures. 

EC 4 Principle 10: Supervisory reporting

Criterion The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the 

information requested, and the risk profile and systemic importance of the bank.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 57

Principle 10: Supervisory reporting

EC 5 Principle 10: Supervisory reporting

Criterion In order to make meaningful comparisons between banks and banking groups, the supervisor collects data from all banks 

and all relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock 

data) and periods (flow data).

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• Section 201 of EGRRCPA requires the FBAs to develop a CBLR of not less than 8 percent and not more than 10 

percent for qualifying depository institutions and depository institution holding companies with total consolidated 

assets of less than $10 billion, which would be a simplified alternative to the generally applicable leverage and riskbased capital requirements under the FBAs’ capital rule. Pub. L. No. 115-174, § 201.

o On February 8, 2019, the FBAs issued a proposed rule to implement the CBLR and on April 19, 2019, the 

FBAs issued proposed revisions to the Call Report for the collection of data from institutions that opt into the 

CBLR framework. See 84 Fed. Reg. 3062 and 84 Fed. Reg. 16560, respectively. Under these proposals, 

qualifying institutions that opt into the CBLR framework would no longer report the detailed leverage and 

risk-based capital data reported by other institutions, but would instead report simplified regulatory capital 

data. 

• Section 205 of EGRRCPA requires the FBAs to issue regulations that allow for a reduced reporting requirement in 

the Call Reports for the first and third calendar quarters of the year for IDIs that have less than $5 billion in total 

consolidated assets and satisfy such other criteria as the FBAs determine appropriate. Pub. L. No. 115-174, § 205. 

On June 21, 2019, the FBAs issued a final rule to implement section 205 of EGRRCPA, which expands the eligibility 

for filing the FBAs’ most streamlined report of condition, the FFIEC 051 Call Report, to include certain IDIs with 

less than $5 billion in total consolidated assets that meet other criteria. 84 Fed. Reg. 29039. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• In connection with section 201 of EGRRCPA (Pub. L. No. 115-174, § 201) and the CBLR proposed rule, the 

Federal Reserve will separately propose to make corresponding revisions to the Consolidated Financial 

Statements for Holding Companies (FR Y-9C).

• In connection with the final rule to implement section 205 of EGRRCPA, the FBAs approved certain reporting 

changes to the FFIEC 051 Call Report, which are discussed in EC 1 of this BCP.
Page 58

Principle 10: Supervisory reporting

EC 6 Principle 10: Supervisory reporting

Criterion The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the 

wider group, irrespective of their activities, where the supervisor believes that it is material to the condition of the bank or 

banking group, or to the assessment of the risks of the bank or banking group or is needed to support resolution planning. 

This includes internal management information.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 7 Principle 10: Supervisory reporting

Criterion The supervisor has the power to access all bank records for the furtherance of supervisory work21. The supervisor also has 

similar access to the bank’s Board, management and staff, when required.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 8 Principle 10: Supervisory reporting

Criterion The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely 

and accurate basis. The supervisor determines the appropriate level of the bank’s senior management is responsible for 

the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate 

information be amended.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

21 Please refer to Principle 1, Essential Criterion 5.
Page 59

Principle 10: Supervisory reporting

EC 9 Principle 10: Supervisory reporting

Criterion The supervisor utilises policies and procedures to determine the validity and integrity of supervisory information. This 

includes a programme for the periodic verification of supervisory returns by means either of the supervisor’s own staff or 

of external experts.22

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• In June 2016, the FASB issued ASU No. 2016-13, “Measurement of Credit Losses on Financial Instruments,” which 

introduces the CECL for estimating allowances for credit losses, thereby replacing the existing incurred loss 

methodology in U.S. GAAP. The ASU also modifies the treatment of credit impairment on available-for-sale debt 

securities. Although an institution’s adoption of this ASU will represent a material accounting change, the accuracy 

of its reported allowances for credit losses will remain an area of significant regulatory interest and scrutiny, as is the 

case with allowances measured at present under existing U.S. GAAP, and comprehensive examination procedures 

will continue to be used to evaluate the appropriateness of the reported amounts of allowances for credit losses. 

EC 10 Principle 10: Supervisory reporting

Criterion The supervisor clearly defines and documents the roles and responsibilities of external experts,23 including the scope of 

the work, when they are appointed to conduct supervisory tasks. The supervisor assesses the suitability of experts for the 

designated task(s) and the quality of the work and takes into consideration conflicts of interest that could influence the 

output/recommendations by external experts. External experts may be utilized for routine validation or to examine 

specific aspects of banks’ operations.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

22May be external auditors or other qualified external parties, commissioned with an appropriate mandate, and subject to appropriate 

confidentiality restrictions. 

23 May be external auditors or other qualified external parties, commissioned with an appropriate mandate, and subject to appropriate 

confidentiality restrictions. External experts may conduct reviews used by the supervisor, yet it is ultimately the supervisor that must be satisfied 

with the results of the reviews conducted by such external experts. 
Page 60

Principle 10: Supervisory reporting

EC 11 Principle 10: Supervisory reporting

Criterion The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during 

the course of any work undertaken by them for supervisory purposes.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 12 Principle 10: Supervisory reporting

Criterion The supervisor has a process in place to periodically review the information collected to determine that it satisfies a 

supervisory need.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FFIEC, whose members include the FBAs, launched a formal initiative in December 2014 to identify potential 

opportunities to reduce burden associated with Call Report requirements for banks, particularly community banks. 

Efforts on the actions comprising this initiative were concluded during 2018. 

o The initiative included the following five actions:

(1) issuing a proposal in 2015 to implement the limited number of burden-reducing changes identified 

during the FBAs’ 2012 review of the Call Report required every five years by section 604 of the 

Financial Services Regulatory Relief Act of 2006 (statutorily mandated review), as well as any other 

readily identifiable burden-reducing changes; 

(2) accelerating the start of the next statutorily mandated review of the Call Report, which would not 

otherwise have begun until 2017, and requiring agency users of Call Report data to provide a robust 

justification of the need for the data items they use and deem essential; 

(3) considering the feasibility and merits of creating a less burdensome version of the Call Report for 

institutions that meet certain criteria, which may include an asset-size threshold or activity limitations; 

(4) gaining a better understanding, through industry dialogue, of sources of reporting burden, including 

manual efforts necessary to generate Call Report data items, including discussions with bankers and core 
Page 61

Principle 10: Supervisory reporting

processing system vendors and agency staff visits to banks to observe their report preparation processes; 

and 

(5) providing targeted training to bankers via teleconferences and webinars to explain upcoming reporting 

changes and provide guidance on challenging areas of the Call Report.

o As a framework for these actions, in March 2015, the FFIEC adopted a set of guiding principles for use in 

evaluating potential additions and deletions of Call Report data items and other revisions to the Call Report.

o The effort to consider the feasibility and merits of creating a less burdensome version of the Call Report for 

certain institutions led to the creation of a new streamlined FFIEC 051 Call Report for institutions with 

domestic offices only and total assets of less than $1 billion. These changes are discussed in EC 1 of this 

BCP. 

o The statutorily mandated review of all Call Report data items was completed in December 2017 with the 

delivery of a report from the FFIEC Task Force on Reports to the FFIEC principals. 

 The foundation for this review was a series of nine surveys of agency users that covered all Call Report 

schedules and data items, which was conducted between July 2015 and February 2017 and required 

agency users of Call Report data to provide robust justifications of the need for the data items they deem 

essential. 

 Based on the responses to the surveys, the Task Force and the agencies identified and evaluated data 

items that could be removed or combined, collected less frequently, or subject to new or upwardly 

revised reporting thresholds in all versions of the Call Report. Burden-reducing changes resulting from 

these evaluations were incorporated into Call Report proposals that were published in August 2016, June 

2017, and November 2017, and implemented in March 2017 and June 2018.

• Pursuant to section 2222 of the EGRPRA of 1996 (12 U.S.C. § 3311), the FFIEC and the FBAs are required to 

conduct a review of all their regulations to identify outdated, unnecessary, or unduly burdensome regulations 

applicable to IDIs. The FFIEC and the FBAs must conduct this review at least once every 10 years. The FBAs’ 

report on the second EGRPRA review was issued on March 21, 2017. Public comments received in connection with 

this review also were considered in the development of the Call Report proposals mentioned above. 
Page 62

Principle 11: Corrective and sanctioning powers of supervisors

The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. 

The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions. This includes the ability to 

revoke the banking license or to recommend its revocation.

Overview

The following material changes have occurred since the 2014 Self-Assessment:

• See BCP 10, EC5 for information regarding section 201 of EGRRCPA, which directs the FBAs to develop a CBLR. Pub. L. 115-174

§ 201(b)(1). 

EC 1 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor raises supervisory concerns with the bank’s management or, where appropriate, the bank’s Board, at an 

early stage, and requires that these concerns be addressed in a timely manner. Where the supervisor requires the bank to 

take significant corrective actions, these are addressed in a written document to the bank’s Board. The supervisor 

requires the bank to submit regular written progress reports and checks that corrective actions are completed 

satisfactorily. The supervisor follows through conclusively and in a timely manner on matters that are identified.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor has available an appropriate range of supervisory tools for use when, in the supervisor’s judgment, a 

bank is not complying with laws, regulations or supervisory actions, is engaged in unsafe or unsound practices or in 

activities that could pose risks to the bank or the banking system, or when the interests of depositors are otherwise 

threatened.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 63

Principle 11: Corrective and sanctioning powers of supervisors

EC 3 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor has the power to act where a bank falls below established regulatory threshold requirements, including 

prescribed regulatory ratios or measurements. The supervisor also has the power to intervene at an early stage to require 

a bank to take action to prevent it from reaching its regulatory threshold requirements. The supervisor has a range of 

options to address such scenarios.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. For recent prompt corrective action (PCA)

examples, see the following:

• Federal Reserve Prompt Corrective Action Directive against Fayette County Bank, St. Elmo, Illinois (Oct. 31, 

2016) requires the sale, merger, or recapitalization of the bank within 90 days.

• OCC Prompt Corrective Action Directive against City National Bank of New Jersey, Newark, New Jersey

(Nov. 1, 2018) requires, among other things, the bank to submit acceptable capital restoration and liquidity 

plans, the board to ensure that the bank has competent management in place on a full-time basis in all executive 

positions, accurate books and records, compliance with GAAP, appropriate risk management, restrictions on 

compensation, severance payments and indemnification, and restrictions on third-party contracts. 

• FDIC Prompt Corrective Action Directive against First NBC Bank, New Orleans, Louisiana (Feb. 24, 2017)

required the bank to recapitalize, sell, or merge. Docket number: FDIC-17-0026PCAS.

EC 4 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor has available a broad range of possible measures to address, at an early stage, such scenarios as described 

in EC 2 above. These measures include the ability to require a bank to take timely corrective action or to impose 

sanctions expeditiously. In practice, the range of measures is applied in accordance with the gravity of a situation. The 

supervisor provides clear prudential objectives or sets out the actions to be taken, which may include restricting the 

current activities of the bank, imposing more stringent prudential limits and requirements; withholding approval of new 

activities or acquisitions; restricting or suspending payments to shareholders or share repurchases; restricting asset 

transfers; barring individuals from the banking sector; replacing or restricting the powers of managers, board members, 

or controlling owners; facilitating a takeover by or merger with a healthier institution; providing for the interim 

management of the bank; revoking or recommending the revocation of the banking license; revoking membership in the 

Federal Reserve; and terminating deposit insurance.
Page 64

Principle 11: Corrective and sanctioning powers of supervisors

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. For recent enforcement action examples, see the 

following:

• Federal Reserve Agreement with AllNations Bank, Calumet, Oklahoma (Oct. 22, 2018) requires capital 

maintenance plan and improvements in corporate governance, credit, and operations-related issues. 

• OCC Agreement with USAA Federal Savings Bank, San Antonio, Texas (Jan. 7, 2019) requires improvements to, 

among other things, the Bank’s compliance management system, risk governance framework, and information 

technology program. 

• FDIC Consent Order against FirstCity Bank of Commerce, Palm Beach Gardens, Florida (Oct. 10, 2018)

requires improvements to board of directors’ oversight and BSA program. Docket Number: FDIC-18-0154b.

EC 5 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the Board, 

or individuals therein.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. For recent examples of enforcement actions against 

individuals, see the following:

• Federal Reserve Order of Prohibition Issued Upon Consent: In the Matter of Raysol Villalobos, a Former 

Institution-Affiliated Party of Frost Bank, San Antonio, Texas (Jan. 25, 2019) prohibits the individual from 

participation in any banking organization supervised by the FBAs. 

• Federal Reserve Order of Prohibition and Order of Assessment of Civil Money Penalty Issued Upon Consent: 

In the Matter of Tim Leissner, a Former Institution-Affiliated Party of The Goldman Sachs Group, Inc., New 

York, New York (Mar. 11, 2019) prohibits the individual from participation in any banking organization 

supervised by the FBAs and requires the payment of a civil money penalty of $1,425,000. 

• FDIC Prohibition Order and Assessment of a Civil Money Penalty: In the Matter of Donald C. Lancaster, an 

Institution-Affiliated Party of Union Bank & Trust Company, Oxford, North Carolina (Feb. 1, 2018) prohibits 

the individual from participation in any bank or holding company supervised by the FBAs and requires the 

payment of a civil money penalty of $35,000. Docket numbers: FDIC-16-0018e, FDIC-16-0017k.

• OCC Order of Prohibition, Order for Civil Money Penalty, and Order for Payment of Restitution (all by 

consent): In the Matter of William Olsen, former Vice President and Trust Officer, BOKF, N.A., Tulsa, 

Oklahoma (Jan. 28, 2019) prohibits the individual from participation in, among others, any IDI or federal 
Page 65

Principle 11: Corrective and sanctioning powers of supervisors

depository institution regulatory agency, requires the payment of a civil money penalty in the amount of 

$20,000, and requires the payment of restitution in the amount of $681,617 (consistent with plea agreement with 

law enforcement). 

EC 6 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent 

companies, subsidiaries, parallel-owned banking structures, and other related entities in matters that could impair the 

safety and soundness of the bank or the banking system.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. For recent PCA examples, see the following:

• Federal Reserve Cease & Desist Order against Wells Fargo and Company, San Francisco, California (Feb. 2, 

2018) requires the parent holding company to act as a source of strength to the bank, and places limits on the 

firm’s growth until the parent BHC improves its board effectiveness and risk management practices. 

• OCC Prompt Corrective Action Directive against City National Bank of New Jersey, Newark, NJ (Nov. 1, 2018)

requires, among other things, the bank to submit acceptable capital restoration and liquidity plans, the board to 

ensure that the bank has competent management in place on a full-time basis in all executive positions, accurate 

books and records, compliance with GAAP, appropriate risk management, restrictions on compensation, 

severance payments and indemnification, and restrictions on third-party contracts.

• FDIC Modified Consent Order against First Savanna Savings Bank, Savanna, Illinois (Mar. 8, 2019) requires 

adoption of profit plan and strategic plan and requires improvement in BSA program. Docket number: FDIC18-0194b.

EC 7 Principle 11: Corrective and sanctioning powers of supervisors

Criterion The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly 

resolution of a problem bank situation (which could include closure, assisting in restructuring, or merger with a stronger 

institution).

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 66

Principle 11: Corrective and sanctioning powers of supervisors

EC 8 Principle 11: Corrective and sanctioning powers of supervisors

Additional 

Criterion

Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 11: Corrective and sanctioning powers of supervisors

Additional 

Criterion

When taking formal corrective action in relation to a bank, the supervisor informs the supervisor of non-bank related 

financial entities (e.g., SEC) of its actions and, where appropriate, coordinates its actions with them.

Legal Framework/

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• In June 2018, the FBAs released a Policy Statement on Interagency Notification of Formal Enforcement Actions 

(83 Fed. Reg. 27371), which superseded the rescinded 1997 Policy Statement on Interagency Notification and 

Coordination of Enforcement Actions (62 Fed. Reg. 7782). The goal of the policy statement is to promote 

notification of, and coordination on, formal enforcement actions among the FBAs at the earliest practicable date.
Page 67

Principle 12: Consolidated supervision

An essential element of banking supervision is that the supervisor supervises the banking group on a consolidated basis, adequately monitoring 

and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide.

EC 1 Principle 12: Consolidated supervision

Criterion The supervisor understands the overall structure of the banking group and is familiar with all the material activities 

(including non-banking activities) conducted by entities in the wider group, both domestic and cross-border. The 

supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the 

banking group and other entities in the wider group, in particular contagion and reputation risks, may jeopardize the 

safety and soundness of the bank and the banking system.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• On May 24, 2018, EGRRCPA amended provisions in the Dodd-Frank Act, as well as other statutes administered 

by the FBAs. The amendments made by EGRRCPA provide for additional tailoring of various provisions of the 

banking laws while maintaining the authority of the FBAs to ensure the safety and soundness of the institutions 

they supervise and to apply EPS in the Dodd-Frank Act that address financial stability. See the Interagency 

statement regarding the impact of EGRRCPA and the Federal Reserve’s Statement regarding the impact of 

EGRRCPA.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The Federal Reserve issued new guidance in the form of supervisory letters:

o SR Letter 19-4 / CA Letter 19-3 (Supervisory Rating System for Holding Companies with Total 

Consolidated Assets Less Than $100 Billion) clarifies the applicability of the supervisory rating system 

for holding companies with total consolidated assets less than $100 billion, the Risk Management, 

Financial Condition, and Impact rating system (RFI rating system).

o SR Letter 19-3 / CA Letter 19-2 (Large Financial Institution (LFI) Rating System) provides an overview 

of a new rating system for the supervision of LFI and replaces the RFI rating system for holding 

companies with total consolidated assets of $100 billion or more, and U.S. IHCs of FBOs with 

combined U.S. assets of $50 billion or more.

o SR Letter 18-4 (Policy Statement on Interagency Notification of Formal Enforcement Actions) this 

interagency policy statement replaces the FFIEC’s 1997 policy statement, “Interagency Coordination of 

Formal Corrective Action by the Federal Bank Regulatory Agencies.” The interagency policy statement 
Page 68

Principle 12: Consolidated supervision

promotes notification of, and coordination on, formal enforcement actions among the FBAs at the 

earliest practicable date.

o SR Letter 16-4 (Relying on the Work of the Regulators of the Subsidiary Insured Depository 

Institution(s) of Bank Holding Companies and Savings and Loan Holding Companies with Total 

Consolidated Assets of Less than $50 Billion) introduces supervisory approaches for relying on the work

of the regulators of IDI subsidiaries of holding companies with total consolidated assets less than $50 

billion.

o SR Letter 15-19 (Federal Reserve Supervisory Assessment of Capital Planning and Positions for Large 

and Noncomplex Firms) clarifies capital planning expectations for firms with total consolidated assets of 

$50 billion or more, but are not complex and are not included in the LISCC program.

o SR Letter 15-18 (Federal Reserve Supervisory Assessment of Capital Planning and Positions for LISCC 

Firms and Large and Complex Firms) clarifies capital planning expectations for LISCC-supervised

firms and complex large and complex companies.

o SR Letter 14-9 (Incorporation of Federal Reserve Policies into the Savings and Loan Holding Company 

Supervision Program) incorporates historic and applicable Federal Reserve policies into the SLHC

supervision program. 

EC 2 Principle 12: Consolidated supervision

Criterion The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated 

basis for the banking group, covering areas such as resolution and recovery plans, capital adequacy, liquidity, large 

exposures, exposures to related parties, lending limits and group structure.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• Section 401 of EGRRCPA (Pub. L. 115-174 § 401, implemented at 12 U.S.C. § 5365) amended the section 

165 of the Dodd-Frank Act with respect to nonbank financial companies supervised by the Federal Reserve 

and certain BHCs, including by:

o increasing the total consolidated asset threshold at which certain EPS shall apply from $50 billion to 

$250 billion, while allowing the Federal Reserve discretion in determining whether a financial 

institution with assets equal to or greater than $100 billion must be subject to such standards (See 

BCP 8, EC1 for more information);
Page 69

Principle 12: Consolidated supervision

o increasing the total consolidated asset threshold at which company-run stress tests are required from 

$10 billion to $250 billion (See BCP 8, EC1 for more information); and 

o increasing the asset threshold for mandatory risk committees, from $10 billion to $50 billion (See 

BCP 15, EC1 for more information). 

• Pursuant to section 207 of EGRRCPA (Pub. L. 115-174, § 207), the threshold for reporting financial data on a 

consolidated basis was raised such that only BHCs with more than $3 billion in assets are requiring to submit 

such reports. See the Federal Reserve’s interim final rule changing such reporting requirements at 83 Fed. 

Reg. 44195 (Aug. 2018).

• In 2019, the Federal Reserve adopted the LFI rating system for assessment of large holding companies. SR 

Letter 19-3 / CA Letter 19-2, Large Financial Institution (LFI) Rating System. For more information on the 

LFI rating system see BCP 8, EC 1. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FR Y-2052b quarterly liquidity monitoring report for companies with total assets between $10 billion and 

less than $50 billion was eliminated. The report collected quantitative information on selected assets, 

liabilities, funding activities, and contingent liabilities on a consolidated basis and by material subsidiary 

entity. In place of the FR 2052b, Federal Reserve staff will monitor and assess liquidity risks of previous FR 

2052b filers using the recently implemented Liquidity Focus Report (LFR). The LFR provides a consistent 

method for benchmarking liquidity risk for individual regional banks based on information derived from the 

Call Report. 

• With the passage of EGRRCPA, the FFIEC 0016 Annual Dodd-Frank Act Company-Run Stress Test Report 

for Depository Institutions and Holding Companies with $10-$50 Billion in Total Consolidated Assets was 

eliminated. See p. 6 of the Federal Reserve’s Statement regarding the impact of EGRRCPA. The annual 

FFIEC 016 collected quantitative projections of balance sheet assets and liabilities, income, losses, and capital 

across three scenarios (baseline, adverse, and severely adverse) and qualitative information on methodologies 

used to develop these internal projections. 

• With the passage of EGRRCPA, the FR Y-14 series (FR Y-14A, FR Y-14M, FR Y-14Q) are no longer 

collected for the companies with total consolidated assets of more than $50 billion but less than $100 billion. 

The FR Y-14A report collects detailed data on BHCs and IHCs quantitative projections of balance sheet 

assets and liabilities, income, losses, and capital across a range of macroeconomic scenarios and qualitative 

information on methodologies used to develop internal projections of capital across scenarios. 
Page 70

Principle 12: Consolidated supervision

• With the passage of EGRRCPA, the FR Y-2052a is no longer collected for companies with total consolidated 

assets between $50 billion and $100 billion. See p. 7 of the Federal Reserve’s Statement regarding the impact 

of EGRRCPA. The FR 2052a report collects quantitative information on selected assets, liabilities, funding 

activities, and contingent liabilities on a consolidated basis and by material entity subsidiary. 

EC 3 Principle 12: Consolidated supervision

Criterion The supervisor reviews whether management oversight of a bank’s foreign operations by management (of the parent 

bank or head office and, where relevant, the holding company) is adequate in context of the organization’s risk profile 

and systemic importance. Host supervisors have access to all the material information from their foreign branches and 

subsidiaries, including host regulatory reports. The host supervisor also assesses whether local policies and processes are 

adequate and local management has the necessary expertise to manage host country operations in a safe and sound 

manner, and in compliance with supervisory and regulatory requirements of the host country. The home supervisor takes 

into account the effectiveness of supervision conducted in the host countries in which its banks have material operations.

They may, but need not, rely on the supervisory work and conclusions of host country supervisors.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 12: Consolidated supervision

Criterion The home supervisor visits the foreign offices periodically, the location and frequency being determined by the risk 

profile and systemic importance of the foreign operation. The supervisor meets the host supervisors during these visits. 

The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank’s foreign 

operations, or require additional reporting, and has the power and resources to take those steps as and when appropriate.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 71

Principle 12: Consolidated supervision

EC 5 Principle 12: Consolidated supervision

Criterion The supervisor reviews the main activities of parent companies, and of companies affiliated with the parent companies, 

that have a material impact on the safety and soundness of the bank and the banking group, and takes appropriate 

supervisory action.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The Federal Reserve continues to assess the risks that the parent holding company and its nonbank 

subsidiaries may pose to the whole organization, its depository institution subsidiaries, and to the U.S. 

financial system. Where there are no significant nonbank activities, however, the Federal Reserve leverages 

the work and ratings from the other banking regulators. See BCP 9, EC 2 for more information. 

EC 6 Principle 12: Consolidated supervision

Criterion The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can 

be conducted (including the closing of foreign offices) if it determines that: 

(a) the safety and soundness of the bank and banking group is compromised because the activities expose the bank or 

banking group to excessive risk and/or are not properly managed; 

(b) the supervision by other supervisors is not adequate relative to the risks the activities present; and/or 

(c) the exercise of effective supervision on a consolidated basis is hindered.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 7 Principle 12: Consolidated supervision

Criterion In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group. 

The responsible supervisor supervises each bank on a stand-alone basis and understands its relationship with other 

members of the group.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.
Page 72

Principle 12: Consolidated supervision

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• In 2017, a Memorandum of Understanding was executed between the Federal Reserve and the Financial Industry 

Regulatory Authority (FINRA) which facilitates Federal Reserve’s reliance on its work at broker-dealer 

subsidiaries as needed.

EC 8 Principle 12: Consolidated supervision

Additional 

Criterion

For countries which allow corporate ownership of banks, the supervisor has the power to establish and enforce fit and 

proper standards for owners and senior management of parent companies.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 73

Principle 13: Home-host relationships

Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group 

entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards 

as those required of domestic banks.

EC 1 Principle 13: Home-host relationships

Criterion The home supervisor establishes bank-specific supervisory colleges for banking groups with material cross-border 

operations to enhance its effective oversight, taking into account the risk profile and systemic importance of the banking 

group and the corresponding needs of its supervisors. In its broadest sense, the host supervisor who has a relevant 

subsidiary or a significant branch in its jurisdiction and who, therefore, has a shared interest in the effective supervisory 

oversight of the banking group, is included in the college. The structure of the college reflects the nature of the banking 

group and the needs of its supervisors.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 13: Home-host relationships

Criterion Home and host supervisors share appropriate information on a timely basis in line with their respective roles and 

responsibilities, both bilaterally and through colleges. This includes information both on the material risks and risk 

management practices of the banking group24 and on the supervisors’ assessments of the safety and soundness of the 

relevant entity under their jurisdiction. Informal or formal arrangements (such as memoranda of understanding) are in 

place to enable the exchange of confidential information.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The frequency and depth of engagement with foreign supervisors has increased since the 2014 Self-Assessment. 

• As explained in SR 17-13, the Federal Reserve is phasing out the Strength of Support Assessment (SOSA), and 

will therefore no longer deliver the SOSA to home country supervisors as discussed in the 2014 Self-Assessment. 

The decision to eliminate the use of the SOSA recognizes that Federal Reserve supervisory staff now have more 

24 See Examples of information exchanges in colleges of the June 2014 BCBS Principles for effective supervisory colleges for further information 

on the extent of information sharing expected.
Page 74

Principle 13: Home-host relationships

timely access to a variety of resources for information on FBO parent banks, home country accounting practices 

and financial systems, and international supervisory and regulatory developments. Although the SOSA will be 

eliminated, Reserve Bank staff will continue to monitor and assess an FBO parent company and home country 

factors previously summarized in the SOSA documents through other components of the FBO supervision

program.

EC 3 Principle 13: Home-host relationships

Criterion Home and host supervisors coordinate and plan supervisory activities or undertake collaborative work if common areas of 

interest are identified in order to improve the effectiveness and efficiency of supervision of cross-border banking groups.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, we note that U.S. supervisors have 

generally engaged in more coordinated examination work (both on a home and host basis) with foreign supervisors since 

the last FSAP.

EC 4 Principle 13: Home-host relationships

Criterion The home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and 

nature of the strategy reflects the risk profile and systemic importance of the cross-border operations of the bank or 

banking group. Home and host supervisors also agree on the communication of views and outcomes of joint activities and 

college meetings to banks, where appropriate, to ensure consistency of messages on group-wide issues.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 13: Home-host relationships

Criterion Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national 

resolution authorities, develops a framework for cross-border crisis cooperation and coordination among the relevant 

home and host authorities. The relevant authorities share information on crisis preparations from an early stage in a way 

that does not materially compromise the prospect of a successful resolution and subject to the application of rules on 

confidentiality.
Page 75

Principle 13: Home-host relationships

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 13: Home-host relationships

Criterion Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national 

resolution authorities and relevant host authorities, develops a group resolution plan. The relevant authorities share any 

information necessary for the development and maintenance of a credible resolution plan. Supervisors also alert and 

consult relevant authorities and supervisors (both home and host) promptly when taking any recovery and resolution 

measures.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 7 Principle 13: Home-host relationships

Criterion The host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to 

prudential, inspection and regulatory reporting requirements similar to those for domestic banks.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, we note that the Federal Reserve is 

requesting comment on a proposed rule that would revise the framework for applying the EPS applicable to FBOs under 

section 165 of the Dodd-Frank Act, as amended by EGRRCPA. See 84 Fed. Reg. 21988. The proposal would establish 

categories that would be used to tailor the stringency of EPS based on the risk profile of a FBO’s operations in the United 

States. The proposal also would amend certain EPS, including standards relating to liquidity, risk management, stress 

testing, and single-counterparty credit limits, and would make corresponding changes to reporting forms.

EC 8 Principle 13: Home-host relationships

Criterion The home supervisor is given on-site access to local offices and subsidiaries of a banking group in order to facilitate their 

assessment of the group’s safety and soundness and compliance with customer due diligence requirements. The home 

supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups.
Page 76

Principle 13: Home-host relationships

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 13: Home-host relationships

Criterion The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The 

supervisor does not permit shell banks or the continued operation of shell banks.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 10 Principle 13: Home-host relationships

Criterion A supervisor that takes consequential action on the basis of information received from another supervisor consults with 

that supervisor, to the extent possible, before taking such action.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 77

Principle 14: Corporate governance

The supervisor determines that banks and banking groups have robust corporate governance policies and processes covering, for example, 

strategic direction, group and organisational structure, control environment, responsibilities of the banks’ Boards and senior management, and 

compensation. These policies and processes are commensurate with the risk profile and systemic importance of the bank.

EC 1 Principle 14: Corporate governance

Criterion Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior management with respect 

to corporate governance to ensure there is effective control over the bank’s entire business. The supervisor provides 

guidance to banks and banking groups on expectations for sound corporate governance.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• See BCP 15, EC 1 for information regarding changes to risk committee requirements for certain publicly traded 

holding companies pursuant to section 401 of EGRRCPA (Pub. L. 115-174, § 401), as well as related proposed 

rules. 

• See BCP 15, EC 1 for information regarding the OCC’s Guidelines Establishing Heightened Standards for 

Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches in 

Appendix D to 12 CFR part 30 (Heightened Standards Guidelines). These final, enforceable guidelines provide

minimum standards for a board of directors’ oversight of a covered institution’s risk governance framework. 

• In 2019, the Federal Reserve instituted a new LFI rating system, which is discussed in further detail BCP 8, 

EC 1. The new rating system includes a governance and controls component, which includes an evaluation of 

the effectiveness of a firm’s board of directors, management of business lines and independent risk management 

and controls, and recovery planning. In addition, the governance and controls component also is designed to 

assess a firm’s effectiveness in aligning strategic business objectives with the firm’s risk appetite and risk 

management capabilities; maintaining effective and independent risk management and control functions, 

including internal audit; promoting compliance with laws and regulations, including those related to consumer 

protection; and otherwise planning for the ongoing resiliency of the firm.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• The OCC has issued new and updated guidance relating to the responsibilities of boards of directors and senior 

management of national banks, savings associations, and insured federal branches, as well as corporate 

governance generally. This guidance includes: 
Page 78

Principle 14: Corporate governance

o The Comptroller’s Handbook on Corporate and Risk Governance (issued July 2016), which provides 

examiners with an overview of corporate and risk governance, the associated risks, the board and 

management’s roles in these activities, and examination procedures. This new booklet updates, 

consolidates, and rescinds the following Comptroller’s Handbook booklets: “Duties and Responsibilities 

of Directors,” issued in March 1990 (and examination procedures issued in January 1998), 

“Management and Board Processes,” issued in March 1990 (and examination procedures issued in 

March 1998), “Management Information Systems,” issued in May 1995. “Risk Management and 

Insurance,” issued in March 1990, and others.

o The OCC’s Licensing Manual for Charters (updated Sept. 2016) explains for directors and senior 

management the OCC’s policies and procedures with respect to the granting of charters.

o The Director’s Book-The Role Directors for National Banks and Federal Savings Associations (issued 

July 2016), which outlines directors’ responsibilities and management’s role, explains bank concepts 

and standards for safe and sound operation of banks, and delineates laws and regulations that apply to 

banks. This booklet reflects the contents of the Corporate and Risk Governance booklet.

o The Comptroller’s Handbook on Internal and External Audits (updated Dec. 2016), which provides 

examiner guidance regarding OCC supervised institutions, replacing two sections of the Office of Thrift 

Supervision Examination Handbook—section 350, “External Audit,” and section 355, “Internal Audit.” 

This revised booklet also reflects the OCC compliance efforts with the Economic Growth and 

Regulatory Paperwork Reduction Act of 1996, as well as other relevant laws and regulations.

o The Comptroller’s Licensing Manual for Changes in Directors and Senior Executive Officers (June 

2019) discusses the OCC’s policies and processes regarding notices of changes in directors and senior 

executive officers and incorporates revised relevant regulations.

o OCC Bulletin 2015-48 (December 2015) conveyed modifications to the OCC’s risk assessment system. 

These updates are incorporated in the OCC Comptroller’s Handbook, Bank Supervision Process booklet 

(updated June 2018). 

o The OCC has reinforced existing guidance with examiners to clearly delineate roles and responsibilities 

in bank communication. 

• The OCC also offers workshops across the country for community bank directors.

• The FDIC has also issued information to its regulated entities regarding governance principles that are scalable 

to an institution’s size, complexity, risk profile, and business model. These include:
Page 79

Principle 14: Corporate governance

o A Statement of the FDIC Board of Directors on the Development and Communication of Supervisory 

Recommendations (July 2016), which directs examiners to communicate supervisory concerns clearly 

and in writing, to address meaningful concerns, and to discuss corrective action. 

o A Special Corporate Governance Edition to its Supervisory Insights Journal, FIL-23-2016 (Apr. 2016; 

revised Oct. 2018), which highlights key governance concepts, roles, and responsibilities of directors 

and senior management, and discusses how FDIC examiners evaluate governance at community banks, 

including a discussion regarding “The Tone at the Top – Maintaining a Strong Corporate Culture” and a 

section on strategic planning. A list of resources, with links to regulations, guidance and training 

materials, is included to help community bank directors fulfill their duties. 

o Principles for specific risk areas are also embedded in topical guidance.

• The Federal Reserve has also issued new guidance, which reinforces the responsibility of a BHC’s board of 

directors to establish a comprehensive and effective compliance function that is appropriately tailored for the 

institution’s risk profile. The guidance seeks to clarify the roles and responsibilities of the board of directors 

versus those of senior management. New and updated guidance includes:

o SR Letter 19-3 / CA Letter 19-2 (Large Financial Institution (LFI) Rating System) provides an overview 

of a new rating system for the supervision of LFI and replaces the RFI rating system for holding 

companies with total consolidated assets of $100 billion or more, and U.S. IHCs of FBOs with 

combined U.S. assets of $50 billion or more; 

o SR Letter 19-4 / CA Letter 19-3 (Supervisory Rating System for Holding Companies with Total 

Consolidated Assets Less Than $100 Billion) clarifies the applicability of the supervisory rating system 

for holding companies with total consolidated assets less than $100 billion, the Risk Management, 

Financial Condition, and Impact rating system (RFI rating system).

o SR Letter 16-11 (Supervisory Guidance for Assessing Risk Management at Supervised Institutions with 

Total Consolidated Assets Less than $50 Billion) clarifies risk management expectations for institutions 

with total consolidated assets of less than $50 billion.

EC 2 Principle 14: Corporate governance

Criterion The supervisor regularly assesses a bank’s corporate governance policies and practices, and their implementation, and 

determine that the bank has robust corporate governance policies and processes commensurate with its risk profile and 

systemic importance. The supervisor requires banks and banking groups to correct deficiencies in a timely manner.
Page 80

Principle 14: Corporate governance

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• See BCP 2, EC 8 for information about changes to the asset threshold that determines the frequency of 

examination for banks pursuant to section 210 of EGRRCPA. Pub. L. 155-174 § 210.

• See BCP 10, EC 5 for information regarding changes to reporting for smaller banks and IDIs pursuant to section 

205 of EGRRCPA. Pub. L. 115-174 § 205.

• See BCP 8, EC 1 and EC 1 of this BCP for changes to the rating system for large financial institutions.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• See BCP 2, EC 8 and the Overview to BCP 9 for information about how the FBAs have generally tailored 

expectations for institutions of different sizes, scope of operations, activities, and systemic importance. This 

tailoring extends to corporate governance expectations. 

o The OCC’s Corporate and Risk Governance booklet states, “A bank’s governance practices should be 

commensurate with the bank’s size, complexity, and risk profile. Corporate and risk governance 

structure and practices should keep pace with the bank’s changes in size, risk profile, and complexity. 

Larger or more complex banks should have more sophisticated and formal board and management 

structure and practices.” See also OCC issuances listed in EC 1 of this BCP for more information.

o The Federal Reserve’s guidance that applies in the case of governance is generally tailored when 

applying expectations to institutions of different size and complexity. 

 For example, the Federal Reserve’s SR Letter 16-11 discusses supervisory expectations for 

assessing risk management of all institutions with less than $50 billion in total assets, including 

expectations for board and management. 

 The Federal Reserve’s expectations for smaller less complex holding companies are also 

expressed in the BHC Supervision Manual, “Consolidated Supervision of Regional Bank 

Holding Companies” (beginning at subsection 1050.2.5), which was revised in July 2016 to 

include guidance for regional banking organizations based on Federal Reserve SR Letter 16-4. 

See BCP 9, EC 2 for more information on SR Letter 16-4.

 See also the following new guidance issued by the Federal Reserve: SR Letter 18-7, Updates to 

the Expanded Examination Cycle for Certain Statement Member Banks and U.S. Branches and 
Page 81

Principle 14: Corporate governance

Agencies of Foreign Banking Organizations (Oct. 2018); and section 1000.1 of the Commercial 

Bank Examination Manual (updated Apr. 2017).

o As described in the Overview to BCP 9, in March 2019, the FDIC revised instructions to examiners 

regarding conducting risk-focused, forward-looking examinations. These require examiners to develop 

a full understanding of the institution’s business model, complexity, and risk profile, which includes a 

heightened focus and assessment of the institution’s strategic plan and implementation efforts. This 

facilitates tailoring supervisory activities to the specific characteristics of the institution and enables 

earlier identification of strategic changes, including risk appetites, and the implementation of 

supervisory responses to address unmitigated risks. See also FDIC issuances listed in EC 1 of this BCP

for more information.

• See BCP 2, EC 8 and the BCP 9 Overview for more information on the FBAs’ risk-based approach to 

supervision.

• In June 2018, the FBAs released a Policy Statement on Interagency Notification of Formal Enforcement Actions

(83 Fed. Reg. 27371, which superseded the rescinded 1997 Policy Statement on Interagency Notification and 

Coordination of Enforcement Actions (62 Fed. Reg. 7782). The goal of the policy statement is to promote 

notification of, and coordination on, formal enforcement actions among the FBAs at the earliest practicable date.

EC 3 Principle 14: Corporate governance

Criterion The supervisor determines that governance structures and processes for nominating and appointing Board members are 

appropriate for the bank and across the banking group. Board membership includes experienced non-executive members, 

where appropriate. Commensurate with the risk profile and systemic importance, Board structures include audit, risk 

oversight and remuneration committees with experienced non-executive members.

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• See BCP 15, EC 1 for information regarding risk committee requirements for publicly traded BHCs, which were 

amended by section 401 of EGRRCPA. Pub. L. 115-174 § 401.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. As a public example of an enforcement action 

evidencing supervisory expectations, see paragraph 2 of In the Matter of Wells Fargo & Company (Feb. 2018), wherein 

the Federal Reserve required a range of remedial actions to ensure a board of directors was appropriately overseeing 

firm-wide risk management.
Page 82

Principle 14: Corporate governance

EC 4 Principle 14: Corporate governance

Criterion Board members are suitably qualified, effective and exercise their “duty of care” and “duty of loyalty”.25

Legal Framework No material changes have occurred since the 2014 Self-Assessment. While not a change since 2014, the FBAs would 

like to clarify that Depository Institution Management Interlocks Act (DIMIA) (12 U.S.C. § 3201 et seq.) fosters 

competition by prohibiting a management official from serving at the same time as a management official of an 

unaffiliated depository organization in situations where the management interlock may have an anticompetitive effect. It

prohibits a management official of a depository organization with total assets exceeding $2.5 billion (or any affiliate of 

such an organization) from serving at the same time as a management official of an unaffiliated depository organization 

with total assets exceeding $1.5 billion (or any affiliate of such an organization), regardless of the location of the two 

depository organizations. It also provides that the FBAs may adjust the thresholds as necessary to allow for inflation or 

market changes.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 14: Corporate governance

Criterion The supervisor determines that the bank’s Board approves and oversees implementation of the bank’s strategic direction, 

risk appetite26 and strategy, and related policies; establishes and communicates corporate culture and values (e.g.,

through a code of conduct), and establishes conflicts of interest policies and a strong control environment.

25 The OECD (OECD glossary of corporate governance-related terms in “Experiences from the Regional Corporate Governance Roundtables”, 

2003, www.oecd.org/dataoecd/19/26/23742340.pdf.) defines “duty of care” as “The duty of a board member to act on an informed and prudent 

basis in decisions with respect to the company. Often interpreted as requiring the board member to approach the affairs of the company in the same 

way that a ’prudent man’ would approach their own affairs. Liability under the duty of care is frequently mitigated by the business judgment rule.” 

The OECD defines “duty of loyalty” as “The duty of the board member to act in the interest of the company and shareholders. The duty of loyalty 

should prevent individual board members from acting in their own interest, or the interest of another individual or group, at the expense of the 

company and all shareholders.”

26 “Risk appetite” reflects the level of aggregate risk that the bank’s Board is willing to assume and manage in the pursuit of the bank’s business 

objectives. Risk appetite may include both quantitative and qualitative elements, as appropriate, and encompass a range of measures. For the 

purposes of this document, the terms “risk appetite” and “risk tolerance” are treated synonymously. 
Page 83

Principle 14: Corporate governance

Legal Framework/ 

Practices and 

Procedures

See EC 1 and EC 2 of this BCP.

EC 6 Principle 14: Corporate governance

Criterion The supervisor determines that the bank’s Board, except where required otherwise by laws or regulations, has 

established fit and proper standards in selecting senior management, maintains plans for succession, and actively and 

critically oversees senior management’s execution of Board strategies, including monitoring senior management’s 

performance against standards established for them.

Legal Framework/ 

Practices and 

Procedures

See EC 1 and EC 2 of this BCP.

EC 7 Principle 14: Corporate governance

Criterion The supervisor determines that the bank’s Board actively oversees the design and operation of the bank’s and banking 

group’s compensation system, and that it has appropriate incentives, which are aligned with prudent risk taking. The 

compensation system, and related performance standards, are consistent with long-term objectives and financial 

soundness of the bank and is rectified if there are deficiencies.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• See BCP 10, EC 1 for more information on changes to Dodd-Frank Act section 619, commonly referred to as the 

Volcker Rule, and its implementing regulations. The Volcker Rule contains both compensation and compliance 

elements that require a framework reasonably designed to ensure that incentive compensation arrangements are 

designed not to reward or incentivize proprietary trading, and are structured to balance risk and financial results 

in a manner that does not encourage employees to expose the firm to excessive or imprudent risks.

• The OCC’s Heightened Standards Guidelines provides that covered banks should establish and adhere to 

compensation programs that prohibit incentive-based payment arrangements that encourage inappropriate risks 

by providing excessive compensation or that could lead to material financial loss. The OCC includes an 

assessment of the banks’ compensation practices when determining compliance with the OCC’s Heightened 

Standards Guidelines. 12 CFR Part 30, Appendix D. See BCP 15, EC 1 for more information on the OCC’s 

Heightened Standards Guidelines. 
Page 84

Principle 14: Corporate governance

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 14: Corporate governance

Criterion The supervisor determines that the bank’s Board and senior management know and understand the bank’s and banking 

group’s operational structure and its risks, including those arising from the use of structures that impede transparency 

(e.g., special-purpose or related structures). The supervisor determines that risks are effectively managed and mitigated, 

where appropriate.

Legal Framework See EC 1 of this BCP.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 14: Corporate governance

Criterion The supervisor has the power to require changes in the composition of the bank’s Board if it believes that any 

individuals are not fulfilling their duties related to the satisfaction of these criteria.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 10 Principle 14: Corporate governance

Additional Criterion Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material 

and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of 

the senior management.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 85

Principle 15: Risk management process

The supervisor determines that banks27 have a comprehensive risk management process, including effective board of directors (board) and senior 

management oversight, to identify, measure, evaluate, monitor, report and control or mitigate28 all material risks on a timely basis and to assess 

the adequacy of their capital and liquidity in relation to their risk profile and market and macroeconomic conditions. This extends to development 

and review of contingency arrangements (including robust and credible recovery plans where warranted) that take into account the specific 

circumstances of the bank. The supervisor determines that the risk management process is commensurate with the risk profile and systemic 

importance of the bank.29

EC 1 Principle 15: Risk management process

Criterion The supervisor determines that banks have appropriate risk management strategies that have been approved by the 

banks’ Boards and that the Boards set a suitable risk appetite to define the level of risk the banks are willing to assume 

or tolerate. The supervisor also determines that the Board ensures that: 

(a) a sound risk management culture is established throughout the bank; 

(b) policies and processes are developed for risk-taking, that are consistent with the risk management strategy and the 

established risk appetite; 

(c) uncertainties attached to risk measurement are recognised; 

(d) appropriate limits are established that are consistent with the bank’s risk appetite, risk profile and capital strength, 

and that are understood by, and regularly communicated to, relevant staff; and 

(e) senior management take the steps necessary to monitor and control all material risks consistent with the approved 

strategies and risk appetite.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• As discussed in the 2014 Self-Assessment, pursuant to the Dodd-Frank Act and regulations promulgated 

thereto, publicly traded BHCs with total consolidated assets over $10 billion were required to maintain a board 

27 For the purposes of assessing risk management by banks in the context of Principles 15 to 25, a bank’s risk management framework should take 

an integrated “bank-wide” perspective of the bank’s risk exposure, encompassing the bank’s individual business lines and business units. Where a 

bank is a member of a group of companies, the risk management framework should in addition cover the risk exposure across and within the 

“banking group” (see footnote 19 under Principle 1) and should also take account of risks posed to the bank or members of the banking group 

through other entities in the wider group.

28 To some extent the precise requirements may vary from risk type to risk type (Principles 15 to 25) as reflected by the underlying reference 

documents. 

29 It should be noted that while, in this and other Principles, the supervisor is required to determine that banks’ risk management policies and 

processes are being adhered to, the responsibility for ensuring adherence remains with a bank’s Board and senior management.
Page 86

Principle 15: Risk management process

risk committee that approves and periodically reviews risk-management policies and a global risk-management 

framework. 12 U.S.C. § 5365(h)(2)(A) (2012). Further, the Federal Reserve had the authority to require 

publicly traded BHCs with less than $10 billion to establish a board risk committee. 12 U.S.C. § 5365(h)(2)(B) 

(2012). Section 401 of EGRRCPA (Pub. L. 115-174, § 401) changed the statutory requirements as follows: (i) 

board risk committees are required only for publicly traded BHCs with total consolidated assets of $50 billion 

or more, and (ii) the Federal Reserve is permitted to require by regulation that publicly listed BHCs with total 

consolidated assets of less than $50 billion establish a risk committee, if necessary or appropriate to promote 

sound risk management practices. See 12 U.S.C. § 5365(h)(2). 

o After this statutory amendment passed into law, the Federal Reserve released a statement clarifying that 

it would not take any action to require BHCs with total consolidated assets of less than $50 billion to 

comply with the risk committee requirements in 12 CFR 252.22. See Statement Regarding the Impact 

of EGRRCPA (issued July 2018). 

o Consistent with section 401 of EGRRCPA, the Federal Reserve issued a proposal in November 2018 to 

amend regulatory risk committee requirements to apply only to publicly traded BHCs and SLHCs with 

$50 billion or more in consolidated assets. See 83 Fed. Reg. 61408 (Nov. 29, 2018). 

o The Federal Reserve also issued a separate proposal relating to FBOs in May 2019. See 84 Fed. Reg.

21988 (May 2019). Under the FBO proposal, FBOs with at least $50 billion but less than $100 

billion in total consolidated assets, as well as FBOs with total consolidated assets of $100 billion or 

more but less than $50 billion in combined U.S. assets, would be required to maintain a board risk 

committee and make an annual certification to that effect. Additionally, FBOs with total 

consolidated assets of $100 billion or more and $50 billion or more in combined U.S. assets would 

be required to comply with the more detailed board risk committee and risk-management 

requirements in the Federal Reserve’s EPS, which include the chief risk officer requirement.

• In September 2014, the OCC issued its Heightened Standards Guidelines as Appendix D to 12 CFR part 30. 

The final enforceable guidelines apply to insured national banks, insured FSAs, and insured federal branches of 

foreign banks with total consolidated assets of $50 billion or more. See 79 Fed. Reg. 54517.

o The guidelines establish standards for the design and implementation of a covered bank’s risk 

governance framework. The guidelines provide minimum standards for oversight of that framework by 

the board of directors, including the expectation that management establish an effective risk governance 

framework, and the board or its risk committee should approve any significant changes to the risk 

governance framework. 
Page 87

Principle 15: Risk management process

o The guidelines provide that a covered bank should have a comprehensive written statement that 

articulates its risk appetite and serves as a basis for the framework (i.e., risk appetite statement). The 

term risk appetite refers to the aggregate level and types of risk that the board and management are 

willing to assume to achieve a covered bank’s strategic objectives and business plan, consistent with 

applicable capital, liquidity, and other regulatory requirements. The risk appetite statement should 

include both qualitative components and quantitative limits. The qualitative components of the risk 

appetite statement should describe a safe and sound risk culture and how a covered bank will assess and 

accept risks, including those that are difficult to quantify, on a consistent basis throughout the 

institution. Quantitative limits should incorporate sound stress testing processes, as appropriate, and 

should address a covered bank’s earnings, capital, and liquidity positions. 

In addition, the FBAs would like to clarify that holding companies and banks are subject to corporate governance rules 

under applicable state corporate and/or banking law, which address, among other things, the responsibilities of boards 

of directors. Additionally, publicly-listed holding companies and banks are subject to federal regulations and selfregulatory organization rules concerning corporate governance, including financial disclosures, the auditing process, 

incentive compensation, ethical conduct, conflict of interest standards, internal controls over financial reporting, board 

structure and composition, and board committees. See NYSE listing requirements, NASDAQ listing requirements 

(including sections 303A.00, 303A.02, 303A.05, and 303A.07 of the NASDAQ Listing Rules), the Sarbanes-Oxley Act 

of 2002 (SOX), 15 U.S.C. § 78j-1, 15 U.S.C. § 7262(b), 15 U.S.C. § 7265. This is not a material change from the 2014 

Self-Assessment, but was not discussed therein.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• FBAs have issued several new guidance documents discussing governance and risk management, which are 

noted below. As these issuances demonstrate, the FBAs have generally tailored expectations for institutions of 

different sizes, scope of operations, activities, and systemic importance, with more rigorous expectations 

generally set for larger institutions. Larger institutions tend to be significantly more complex, and the risktaking of these institutions and their potential failure implicate greater risks for the financial system and the 

overall economy. Tailoring the application of requirements is consistent with this view. It is also consistent 

with provisions of the Dodd-Frank Act and EGRRCPA.

• The OCC developed the Comptroller’s Handbook, Corporate and Risk Governance booklet (issued July 2016, 

updated July 2019). It provides examiners with principles-based and concrete guidance on the roles and 

responsibilities of the board of directors and senior management in overseeing corporate and risk governance 

activities. 
Page 88

Principle 15: Risk management process

•

o The handbook states: “A bank’s governance practices should be commensurate with the bank’s size, 

complexity, and risk profile. Corporate and risk governance structure and practices should keep pace 

with the bank’s changes in size, risk profile, and complexity. Larger or more complex banks should 

have more sophisticated and formal board and management structure and practices.” 

• In 2015, the Federal Reserve issued SR 15-18 “Federal Reserve Supervisory Assessment of Capital Planning 

and Positions for LISCC Firms and Large and Complex Firms” and SR 15-19 “Federal Reserve Supervisory 

Assessment of Capital Planning and Positions for Large and Noncomplex firms.” The guidance clarifies the 

capital planning requirements for the Federal Reserve’s capital plan rule and stress test rules as well as 

highlights the differences between the LISCC-supervised and complex firms, as compared to the less complex 

firms. 

• In June 2016, the Federal Reserve issued SR 16-11 “Supervisory Guidance for Assessing Risk Management at 

Supervised Institutions with Total Consolidated Assets Less than $50 Billion.” This letter updates the Federal 

Reserve’s supervisory guidance for assessing risk management at supervised institutions with less than $50 

billion in total consolidated assets. In addition to outlining core risk categories and risk-management principles, 

this guidance provides clarification on and distinguishes supervisory expectations for the roles and 

responsibilities of the board of directors and senior management for an institution's risk management. 

o The letter sets out the elements of risk management, including board of directors and senior 

management oversight; policies, procedures, and limits; risk monitoring and management information 

systems; and internal controls. 

o Where appropriate, the Federal Reserve will advise an institution that supervisory action will be 

initiated, if the institution fails to timely remediate risk management weaknesses when such failures 

create the potential for serious losses or if material deficiencies or situations threaten its safety and 

soundness. Such supervisory actions may include formal enforcement actions against the institution, or 

its responsible officers and directors, or both, and would require the immediate implementation of all 

necessary corrective measures. 

o With the issuance of SR 16-11, SR 95-51 is applicable to only state member banks and BHCs having 

$50 billion or more in total assets.

• The Federal Reserve’s SR 08-8 / CA 08-11 “Compliance Risk Management Programs and Oversight at Large 

Banking Organizations with Complex Compliance Profiles” clarifies Federal Reserve expectations regarding 

compliance risk management and oversight at certain large, complex banking organizations. While all 
Page 89

Principle 15: Risk management process

organizations supervised by the Federal Reserve, regardless of size and complexity, should have effective 

compliance risk management programs, larger, more complex banking organizations that tend to conduct a 

wide range of business activities that are subject to complex compliance requirements typically require a firmwide approach to compliance risk management and oversight that includes a corporate compliance 

function. SR 08-8 / CA 08-11 provides guidance to large banking organizations with complex compliance 

profiles in the following areas:

o Organizations that should implement a firm-wide approach to compliance risk management and 

oversight;

o Independence of compliance staff;

o Compliance monitoring and testing; and 

o Responsibilities of boards of directors and senior management regarding compliance risk management 

and oversight.

• Examples of other new guidance relating to risk management that has been issued since the 2014 SelfAssessment: Third-Party Relationships: Frequently Asked Questions to Supplement OCC Bulletin 2013-29

(issued June 2017), Interagency Guidance on Home Equity Lines of Credit Nearing Their End-of-Draw Periods 

(SR 14-5/CA 14-4) (issued July 2014), Guidance on Private Student Loans with Graduated Repayment Terms 

at Origination (SR 15-2/CA 15-1) (issued January 2015), Interagency Statement on Prudent Risk Management 

for Commercial Real Estate Lending (SR 15-17) (issued Dec. 2015), Interagency Guidance on Funds Transfer 

Pricing Related to Funding and Contingent Liquidity Risks (SR 16-3) (issued Mar. 2016), and Supervisory 

Expectations for Risk Management of Reserve-Based Energy Lending Risk (SR 16-17) (issued Dec. 2016).

• In 2016, the Federal Reserve established an annual Large Bank Directors Conference for BHC directors of 

banking organizations with consolidated assets of $50 billion and greater (including those owned by foreign 

banks) – directors of newly formed U.S. IHCs of FBOs were subsequently added. The conference serves as a 

forum for the Federal Reserve to disseminate information on specific risk-management topics, such as cyber 

security, money laundering, and consumer compliance risks. The Federal Reserve also uses the opportunity to 

discuss expectations for boards of directors, specifically the risk and audit committees of boards. The 

conference has also been a venue for communicating policy initiatives such as the proposed BHC rating 

systems. This outreach has been useful in aiding directors in the execution of their responsibilities. It provides 

directors an opportunity to directly hear from and make inquiries to the Federal Reserve and is a useful 

exchange with directors from other organizations. Similarly, OCC has for many years held an annual Outside 

Directors Roundtable and semi-annual Chief Risk Officers Roundtables for large banks, and numerous similar 
Page 90

Principle 15: Risk management process

events for smaller institutions, to provide bank directors a better understanding of their roles and responsibilities 

as board members, familiarize them with relevant law and regulation, and address issues facing the banking 

industry.

• As explained in the 2014 Self-Assessment, whether banks have met supervisory expectations around board 

oversight of risk management is assessed through supervision activities. As public examples of enforcement 

actions evidencing these expectations, see paragraph 2 of In the Matter of Wells Fargo & Company (Feb. 2018) 

and Article III of In the Matter of Eastern National Bank, wherein the Federal Reserve and the OCC, 

respectively, required a range of remedial actions to ensure a board of directors was appropriately overseeing 

firm-wide risk management.

• In 2018, the Federal Reserve restructured its framework for the LISCC supervisory program. The program is 

aligned with the focus areas outlined in SR 12-17 / CA 12-14: Consolidated Supervision Framework for Large 

Financial Institutions and with SR 19-3 / CA 19-2: Large Financial Institution (LFI) Rating System, which is 

the supervisory rating system that focuses on a firm’s capital, liquidity and governance. The Capital Program is 

a year-round supervisory program assessing the capital adequacy and capital planning processes of LISCCsupervised firms on a forward-looking basis. The Capital Program is executed through the CCAR and through 

the assessment of the risk management and controls around financial risks. The Liquidity Program assesses the 

adequacy of LISCC-supervised firms’ liquidity risk management practices and liquidity positions through both 

horizontal and firm-specific examinations and analyses conducted throughout the year. The CLAR is the 

horizontal component of this program. The Governance and Controls Program assesses the effectiveness of the 

LISCC-supervised firms’ boards of directors with regard to safety and soundness issues, the strength of risk 

management executed by the firms’ core business lines, and the adequacy of the firms’ independent risk 

management and controls. The Recovery and Resolution Program assesses the LISCC-supervised firms’ 

resolution plans and conducts horizontal assessments of recovery and resolution preparedness.

• See also EC5 for discussion of capital planning requirements, EC13 for discussion of stress testing, and BCP 24 

for discussion of liquidity stress testing.

EC 2 Principle 15: Risk management process

Criterion The supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, 

evaluate, monitor, report and control or mitigate all material risks. The supervisor determines that these processes are 

adequate: 

(a) to provide a comprehensive “bank-wide” view of risk across all material risk types; 
Page 91

Principle 15: Risk management process

(b) for the risk profile and systemic importance of the bank; and 

(c) to assess risks arising from the macroeconomic environment affecting the markets in which the bank operates and to 

incorporate such assessments into the bank’s risk management process.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• New guidance issued since the 2014 Self-Assessment and identified in EC 1 of this BCP emphasizes the 

expectation that banks and holding companies have comprehensive risk management processes to identify, 

measure, evaluate, monitor, report, and control all material risks. 

• As explained in the 2014 Self-Assessment, whether banks have met supervisory expectations around risk 

management is assessed through supervision activities. As public examples of enforcement actions evidencing 

these expectations, see paragraphs 2(a)(i), 2(d)(i)(A), and 2(d)(iii) of In the Matter of Wells Fargo & Company

(Feb. 2018), wherein the Federal Reserve required remedial actions to ensure a board of directors aligns the 

firm’s strategy, risk tolerance, and risk management capacity; establish an effective independent firmwide risk 

management function that covers all material risks; and establish an effective risk identification and escalation 

framework that identifies, aggregates, evaluates, and appropriately reports material risk issues. Similarly, In the 

Matter of Resolute Bank, the OCC required the bank to undertake remedial actions to its risk management 

systems across a number of business lines.

z

EC 3 Principle 15: Risk management process

Criterion The supervisor determines that risk management strategies, policies, processes, and limits are: 

(a) properly documented; 

(b) regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles, and market and 

macroeconomic conditions; and 

(c) communicated within the bank. 

The supervisor determines that exceptions to established policies, processes and limits receive the prompt attention of, 

and authorisation by, the appropriate level of management and the bank’s Board where necessary.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• New guidance issued since the 2014 Self-Assessment and identified in EC 1 of this BCP emphasizes the 

expectation that banks and holding companies have properly documented policies, processes and limits that are 
Page 92

Principle 15: Risk management process

regularly reviewed and adjusted and communicated within the organization. For example, the Federal Reserve’s 

SR 16-11 sets out the expectations regarding establishment, oversight, and review of policies, procedures, and 

limits at institutions with total consolidated assets less than $50 billion.

EC 4 Principle 15: Risk management process

Criterion The supervisors determine that the bank’s board and senior management obtain sufficient information to understand the 

nature and level of risk being taken by the bank and how this risk relates to adequate levels of capital and liquidity. The 

supervisor also determines that the board and senior management regularly review and understand the implications and 

limitations (including the risk measurement uncertainties) of the risk management information that they receive.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• An updated list of relevant guidance includes: 

o The OCC’s Corporate and Risk Governance Handbook (issued July 2016 and updated July 2019),

Community Bank Supervision Handbook (issued June 2018), Large Bank Supervision Handbook (issued 

June 2018), The Director’s Book – The Role of a National Bank Director (issued July 2016), and Detecting 

Red Flags in Board Reports – A Guide for Directors (issued Feb. 2004).

o The Federal Reserve’s BHC Supervision Manual – e.g., sections 1060.0.3.3 and 1062.0.5.2 (updated Feb. 

2019), section 2124.05.3.2 (updated July 2014) and 2124.07.4 (updated Jan. 2009), Commercial Bank 

Examination Manual – e.g., sections 1000.1 (updated Oct. 2016), and Examination Manual for U.S. 

Branches and Agencies of Foreign Banking Organizations – e.g., section 3000.1 (updated Sept. 1997).

o The FDIC’s Risk Management Manual of Examination Policies - section 4.1 – Management (updated Apr. 

2018). 

In addition, while not stated in response to EC 4 of the 2014 Self-Assessment, the FBAs would like to clarify that 

boards of directors are expected to understand and periodically review liquidity risks and the contingency funding plans 

designed to manage adverse liquidity events. Senior management is expected to regularly report liquidity risk factors to 

boards of directors. Individuals or committees responsible for implementing liquidity risk management programs are 

expected to ensure that risk measurement systems adequately identify risk exposures and that reporting mechanisms 

communicate accurate, timely, and relevant information about the level and sources of risk exposures.
Page 93

Principle 15: Risk management process

EC 5 Principle 15: Risk management process

Criterion The supervisor determines that banks have an appropriate internal process for assessing their overall capital and 

liquidity adequacy in relation to their risk appetite and risk profile. The supervisor reviews and evaluates banks’ internal 

capital and liquidity adequacy assessments and strategies.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• In 2014, the FBAs created a standardized minimum LCR for large and internationally active firms. 79 Fed. Reg. 

61439 (Oct. 2014), codified at 12 CFR part 50 (OCC), 12 CFR part 249 (Federal Reserve), and 12 CFR part 329

(FDIC). See BCP 24 for more information on the LCR. To review large firm practices and risk areas not entirely 

captured in the LCR, the Federal Reserve also conducts its annual CLAR, which also serves to evaluate large firms’ 

liquidity positions and risk management practices. 

• Large holding companies became subject to the Federal Reserve’s LFI rating system. For description of the ratings 

framework see BCP 8 EC1 and SR Letter 19-3 / CA Letter 19-2, Large Financial Institution (LFI) Rating System).

• See also BCP 8, EC 1 and EC13 of this BCP for discussions of stress testing.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• New guidance has been issued that is relevant to this EC, including SR 15-18 and SR 15-19, which are 

discussed in EC 1. In addition, the OCC updated OCC Bulletin 2012-16 and in 2018 incorporated it into the 

Comptroller’s Handbook, Capital and Dividends booklet; this booklet emphasizes the importance of forwardlooking assessments of capital adequacy and business resiliency in both normal and stressed environments.

EC 6 Principle 15: Risk management process

Criterion Where banks use models to measure components of risk, the supervisor determines that: 

(a) banks comply with supervisory standards on their use; 

(b) the banks’ Boards and senior management understand the limitations and uncertainties relating to the output of the 

models and the risk inherent in their use; and 

(c) banks perform regular and independent validation and testing of the models. 

The supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.
Page 94

Principle 15: Risk management process

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• With respect to organizations with significant exposure to market risk, requirements for internal models have 

been put in place that include that these organizations should (i) incorporate internal models into their risk 

management process, (ii) periodically review their internal models, (iii) have a rigorous process for reestimating their internal models, and (iv) have an outcomes analysis process that includes backtesting.

EC 7 Principle 15: Risk management process

Criterion The supervisor determines that banks have information systems that are adequate (both under normal circumstances and 

in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bankwide basis across all risk types, products and counterparties. The supervisor also determines that these reports reflect the 

bank’s risk profile and capital and liquidity needs, and are provided on a timely basis to the bank’s Board and senior 

management in a form suitable for their use.

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• OCC’s Heightened Standards Guidelines (Appendix D to 12 CFR part 30), which are discussed in EC1 of this 

BCP, provide that covered banks should have risk data aggregation and reporting capabilities sufficient to 

provide reporting on material risks, concentrations, and emerging risks in a timely manner to the board and to 

the OCC. This is consistent with BCBS 239 - Principles for effective risk data aggregation and risk reporting.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• As explained in the 2014 Self-Assessment, whether banks have met supervisory expectations around risk data 

aggregation and reporting is assessed through supervision activities. As public examples of enforcement 

actions evidencing these expectations, see paragraphs 2(d)(iv), and 2(f) of In the Matter of Wells Fargo & 

Company (Feb. 2018), wherein the Federal Reserve required remedial actions to establish and maintain a 

comprehensive and effective risk data governance and management framework, and comprehensive reporting 

regarding execution of risk management responsibilities. Similarly, the OCC In the Matter of USAA Savings 

Bank required the bank to implement the information systems required in 12 CFR Part 30, Appendix A.

While it has not changed since the 2014 Self-Assessment, the Federal Reserve’s Commercial Bank Examination 

Manual (section 4060) and its BHC Supervision Manual (section 2124.1.2) instruct examiners to assess the bank’s 

critical systems that support the major business activities, and the degree of reliance those activities have on IT systems. 

The manual states that the level of review should be sufficient to determine that the systems are delivering the services 

necessary for the organization to conduct its business in a safe and sound manner. The bank’s IT systems should be 
Page 95

Principle 15: Risk management process

considered in relation to the size, activities, and complexity of the organization, as well as the degree of reliance on 

these systems across particular business lines. 

EC 8 Principle 15: Risk management process

Criterion The supervisor determines that banks have adequate policies and processes to ensure that the banks’ Board and senior 

management understand the risks inherent in new products,30 material modifications to existing products, and major 

management initiatives (such as changes in systems, processes, business model and major acquisitions). The supervisor 

determines that the boards and senior management are able to monitor and manage these risks on an ongoing basis. The 

supervisor also determines that the bank’s policies and processes require the undertaking of any major activities of this 

nature to be approved by their board or a specific committee of the board.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• In October 2017, the OCC issued guidance, OCC 2017-43, on new, modified, or expanded bank products and 

services. The guidance served to significantly expand on previous guidance issued in 2004. OCC 2017-43 

provides risk management principles that inform bank management and boards of directors on their need to 

consider the impact of new activities on banks’ financial performance, strategic planning process, risk profiles, 

traditional banking models, and ability to remain competitive.

• As explained in the 2014 Self-Assessment, whether banks have met supervisory expectations around new 

product risk management is assessed through supervision activities. As public examples of enforcement actions

evidencing these expectations, see paragraphs 3(c) of In the Matter of JPMorgan Chase & Co. (May 2015) and 

paragraph 2 of Article X of In the Matter of Admirals Bank, wherein the Federal Reserve and the OCC 

respectively, required remedial actions related to a review of potential risks associated with new financial 

products or instruments.

EC 9 Principle 15: Risk management process

Criterion The supervisor determines that banks have risk management functions covering all material risks with sufficient 

resources, independence, authority and access to the banks’ Boards to perform their duties effectively. The supervisor 

determines that their duties are clearly segregated from risk-taking functions in the bank and that they report on risk 

30 New products include those developed by the bank or by a third party and purchased or distributed by the bank.
Page 96

Principle 15: Risk management process

exposures directly to the Board and senior management. The supervisor also determines that the risk management 

function is subject to regular review by the internal audit function. 

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• New issuances since the 2014 Self-Assessment and identified in EC1 of this BCP emphasizes the expectation 

that banks have independent risk management functions covering all material risks. For example, the OCC’s 

Heightened Standards Guidelines (Appendix D to 12 CFR part 30) outline the role and responsibilities of 

independent risk management and require reporting of material risks to the bank’s board of directors and CEO.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• As explained in the 2014 Self-Assessment, whether banks have met supervisory expectations around 

independent risk management are assessed through supervision activities. As public examples of enforcement 

actions evidencing these expectations, see paragraphs 2(d)(i), of In the Matter of Wells Fargo & Company (Feb. 

2018) and Article V of In the Matter of USAA Federal Savings Bank, wherein the Federal Reserve and the 

OCC, respectively, required remedial actions to establish and maintain an effective and independent firm-wide 

risk management function that covers all material risks facing the firm, and has sufficient stature, authority, and 

resources. 

EC 10 Principle 15: Risk management process

Criterion The supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief 

Risk Officer (CRO) or equivalent function. If the CRO of a bank is removed from his/her position for any reason, this 

should be done with the prior approval of the Board and generally should be disclosed publicly. The bank should also 

discuss the reasons for such removal with its supervisor.

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• New issuances since the 2014 Self-Assessment and identified in EC1 of this BCP discuss expectations 

regarding chief risk officers. For example, the OCC’s Heightened Standards Guidelines (Appendix D to 12 

CFR part 30) state that covered banks should have a chief risk executive that has unrestricted access to the 

board of directors. The enforceable guidelines state that the board of directors or its risk committee should 

approve all decisions regarding the appointment or removal of the chief risk executive.

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:
Page 97

Principle 15: Risk management process

• The Federal Reserve provided FBOs additional detail on how they may comply with the risk committee 

requirements of Regulation YY in response to individual requests. These actions provided certain foreign 

banks flexibility in locating their risk committees in the U.S., an option that had been explicitly afforded foreign 

banks required to create U.S. IHCs, since their inception. It also provided flexibility in the composition of the 

risk committees. A number of FBOs with U.S. assets greater than $50 billion but with non-branch assets below 

the IHC formation requirement of Regulation YY sought flexibility in the composition and/or location of the 

U.S. risk committee. The Federal Reserve acted affirmatively on these direct requests through letters to the 

organizations made public on the Federal Reserve’s website.

• In January 2018, the Federal Reserve adopted a proposal to revise the reporting form FR Y-7, Annual Report of 

FBOs. 83 Fed. Reg. 3141. Finalizing the proposal also implemented the risk committee certifications for FBOs

subject to 12 U.S.C. § 252. In adopting the reporting proposal, the Federal Reserve provided clarifying 

comments to questions from the public regarding the ability of an FBO with consolidated assets between $10 

and $50 billion and publically traded and foreign banks with consolidated assets greater than $50 billion but 

with U.S. assets less than $50 billion to locate their risk committee in the U.S. versus locating the committee at 

the foreign parent bank. The clarification provided foreign banks with a limited U.S. footprint flexibility 

similar to that provided to counterparts with a large U.S. presence. Consistent with the passage of EGRRCPA, 

and until the adoption of amendments to certain regulations, the Federal Reserve announced that it would not 

take action to enforce the risk committee requirement for foreign banks that are publically traded with assets 

between $10 and $50 billion to meet the requirement. 

While not a change from the 2014 Self-Assessment, the FBAs would like to clarify that public disclosure requirements 

and financial reporting by banks and holding companies is a complement to supervision. Some regulatory reports 

provide the opportunity for the reporting banks and holding companies to provide footnotes or narrative disclosures, 

which may be either qualitative or quantitative in nature. Certain banks and BHCs adopting Basel III will be subject to 

the Pillar 3 disclosure requirements; these disclosures are both qualitative and quantitative in nature as well. See 78 

Fed. Reg. 62017 (Oct. 11, 2013) (OCC and Federal Reserve) and 78 Fed. Reg. 55340 (Sept. 10, 2013) (FDIC).

EC 11 Principle 15: Risk management process

Criterion The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, interest rate risk in the 

banking book and operational risk.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:
Page 98

Principle 15: Risk management process

• Large holding companies became subject to the Federal Reserve’s LFI rating system. For description of the 

ratings framework see BCP 8, EC1 and SR Letter 19-3 / CA Letter 19-2, (LFI Rating System).

• New issuances since the 2014 Self-Assessment and identified in EC1 of this BCP discuss the expectation that a 

bank’s risk management framework take into account all material risks. For example, the OCC’s Heightened 

Standards Guidelines (Appendix D to 12 CFR part 30) state that covered bank’s risk governance frameworks 

should cover credit risk, interest rate risk, liquidity risk, and operational risk, among others.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 12 Principle 15: Risk management process

Criterion The supervisor requires banks to have appropriate contingency arrangements, as an integral part of their risk 

management process, to address risks that may materialise and actions to be taken in stress conditions (including those 

that will pose a serious risk to their viability). If warranted by its risk profile and systemic importance, the contingency 

arrangements include robust and credible recovery plans that take into account the specific circumstances of the bank. 

The supervisor, working with resolution authorities as appropriate, assesses the adequacy of banks’ contingency 

arrangements in the light of their risk profile and systemic importance (including reviewing any recovery plans) and 

their likely feasibility during periods of stress. The supervisor seeks improvements if deficiencies are identified.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• In September 2016 (amended in December 2018), the OCC issued its final Guidelines Establishing Standards 

for Recovery Planning by Certain Large Insured National Banks, Insured Federal Savings Associations, and 

Insured Federal Branches. See 81 Fed. Reg. 66791, 12 CFR part 30, Appendix E. These are enforceable 

guidelines for recovery planning for insured banks, insured federal thrifts, and insured federal branches of 

foreign banks with $250 billion or more in total consolidated assets . 

• The FDIC and Federal Reserve have issued regulations requiring certain BHCs (including FBOs that are or are 

treated as BHCs) and regulated nonbank financial companies, to develop resolution plans (or “living wills”) for 

how the companies would be resolved in a rapid and orderly manner under the Bankruptcy Code (or other 

applicable insolvency regime) in the event of material financial distress or failure. See 12 CFR parts 243 and 

381. Pursuant to EGRRCPA, in May 2019, the FDIC and Federal Reserve issued a joint notice of proposed 

rulemaking soliciting comments on proposed revision to such regulations. See 84 Fed. Reg. 21600. See BCP 8, 

EC 6 for more information on changes with respect to resolution planning.
Page 99

Principle 15: Risk management process

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• In addition, the OCC updated OCC Bulletin 2012-16 and in 2018 incorporated it into the Comptroller’s 

Handbook, Capital and Dividends booklet. This booklet emphasizes the importance of forward-looking 

assessments of capital adequacy and business resiliency in both normal and stressed environments.

• See BCP 8, EC 6 for more information on the LISCC Recovery and Resolution Planning program, which has 

undergone substantial development since the 2014 Self-Assessment.

EC 13 Principle 15: Risk management process

Criterion The supervisor requires banks to have forward-looking stress testing programmes, commensurate with their risk profile 

and systemic importance, as an integral part of their risk management process. The supervisor regularly assesses a 

bank’s stress testing programme and determines that it captures material sources of risk and adopts plausible adverse 

scenarios. The supervisor also determines that the bank integrates the results into its decision-making, risk management 

processes (including contingency arrangements) and the assessment of its capital and liquidity levels. Where 

appropriate, the scope of the supervisor’s assessment includes the extent to which the stress testing programme: 

(a) promotes risk identification and control, on a bank-wide basis; 

(b) adopts suitably severe assumptions and seeks to address feedback effects and system-wide interaction between risks; 

(c) benefits from the active involvement of the Board and senior management; and 

(d) is appropriately documented and regularly maintained and updated. 

The supervisor requires corrective action if material deficiencies are identified in a bank’s stress testing programme or if 

the results of stress tests are not adequately taken into consideration in the bank’s decision-making process.

Legal Framework The following material changes have been made since the 2014 Self-Assessment:

• As a result of an amendment to the stress testing authority in 165 of the Dodd-Frank Act by section 401 of 

EGRRCPA, the FBAs proposed rules to revise existing stress testing regulations. Pub. L. 115-174 § 401. 

Specifically, the proposed rules would revise the minimum total consolidated threshold for banks required to 

conduct stress test from $10 billion to $250 billion, revise the frequency of stress test for certain banks, and 

reduce the number of required stress testing scenarios. See 83 Fed. Reg. 67149 (Dec. 28, 2018) (FDIC); 84 

Fed. Reg. 3345 (Feb. 12, 2019) (OCC); and 84 Fed. Reg. 4002 (Feb. 14, 2019) (Federal Reserve). The FBAs 

continue to emphasize that all banking organizations, regardless of size, should have the capacity to analyze the 

potential impact of adverse outcomes on their financial condition. See BCP 8, EC 1 for more information on 

stress testing changes.
Page 100

Principle 15: Risk management process

• The FBAs would like to clarify, in light of EGRRCPA changes, that certain portions of existing interagency 

guidance applicable to all banking organizations discuss addressing potential adverse outcomes as part of sound 

risk management practices. The FBAs note that such existing guidance, including that covering interest rate 

risk management, commercial real estate concentrations, and funding and liquidity management (among 

others), continues to apply. 

Practices and 

Procedures

The following material changes have been made since the 2014 Self-Assessment:

• New guidance has been issued that is relevant to this EC, including SR 15-18, SR 15-19, and SR 16-11, which 

are discussed in EC 1 of this BCP.

EC 14 Principle 15: Risk management process

Criterion The supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in their internal 

pricing, performance measurement and new product approval process for all significant business activities.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has been made since the 2014 Self-Assessment:

• The FBAs issued Interagency Guidance on Funds Transfer Pricing Related to Funding and Contingent 

Liquidity Risks in March 2016. The guidance applies to national banks, FSAs, and state-chartered banks with 

total consolidated assets of $250 billion or more, domestic BHCs and SLHCs with total consolidated assets of 

$250 billion or more or foreign exposure of $10 billion or more, and FBOs with combined U.S. assets of $250 

billion or more. The guidance describes general principles to incorporate funds transfer pricing (FTP) costs and 

benefits into product pricing, business metrics, and new product approval for material business lines, products, 

and activities to align risk-taking incentives with the firm’s risk appetite. The principles include (i) allocating 

FTP costs and benefits based on funding risk and contingent liquidity risk; (ii) having a consistent and 

transparent FTP framework for identifying and allocating FTP costs and benefits on a timely basis and at a 

sufficiently granular level, commensurate with the firm’s size, complexity, business activities, and overall risk 

profile; (iii) having a robust governance structure for FTP, including the production of a report on FTP and 

oversight from a senior management group and central management function; and (iv) aligning business 

incentives with risk management and strategic objectives by incorporating FTP costs and benefits into product 

pricing, business metrics, and new product approval. The FTP framework should be adequately tailored to a 

firm’s size, complexity, business activities, and overall risk profile.
Page 101

Principle 15: Risk management process

EC 15 Principle 15: Risk management process

Additional Criterion The supervisor requires banks to have appropriate policies and processes for assessing other material risks not directly 

addressed in the subsequent Principles, such as reputational and strategic risks.

Legal Framework The following material change has been made since the 2014 Self-Assessment:

• New issuances since the 2014 Self-Assessment and identified in EC 1 discuss the expectation that banks have 

appropriate policies for assessing all material risks. For example, OCC’s Heightened Standards Guidelines 

(Appendix D to 12 CFR part 30) specifically state that a covered bank’s risk governance framework should 

cover strategic risk and reputation risk, among others.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 102

Principle 16: Capital adequacy31

The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken by, and presented by, a bank 

in the context of the markets and macroeconomic conditions in which it operates. The supervisor defines the components of capital, bearing in 

mind their ability to absorb losses. 

Overview

Material changes to the Overview in the 2014 Self-Assessment are listed below by category, where applicable. 

Laws and Regulations

Under Laws and Regulations, the following material change has occurred since the 2014 Self-Assessment:

• The FBAs currently are in the process of further revising various portions of the regulatory capital framework to implement changes 

mandated by EGRRCPA enacted on May 24, 2018. See EGRRCPA, Pub. L. No. 115-174 (2018). Specific proposed amendments are 

discussed in the relevant sections below. 

Risk-based Capital

Under Risk-based Capital, the following material changes have occurred since the 2014 Self-Assessment:

• The largest, most systemically important U.S. BHCs are identified as G-SIBs by the Federal Reserve’s G-SIB surcharge rule. The 

measurement to identify a G-SIB is based on the indicators of five factors: size, interconnectedness, substitutability, complexity and 

cross-jurisdictional activity. G-SIBs are required to hold an additional regulatory capital buffer. See 12 CFR 217, subpart H. The G-SIB 

surcharge is added to a bank’s capital conservation buffer requirement and any countercyclical capital buffer (CCyB) and is required to 

be met with CET1 capital. In addition, G-SIBs are required to meet TLAC and LTD requirements to improve resiliency and 

resolvability. See 82 Fed. Reg. 8266. 

• Currently, the FBAs have issued several proposed rules to amend the capital framework to reflect changes mandated by EGRRCPA 

including:

(1) A proposed rule to establish risk-based categories for determining the application of EPS, including enhanced capital standards. 

The proposed rule would establish four categories of standards for U.S. banking organizations with total consolidated assets of 

$100 billion or more (Domestic Tailoring Proposed Rule). See 83 Fed. Reg. 66024 (Dec. 21, 2018). 

(2) A proposed rule that generally proposed substantially the same tailoring framework to certain U.S. IHCs of FBOs and their 

depository institution subsidiaries. See 84 Fed. Reg. 21988.

31 The Basel Committee’s documents covering capital standards are not legally binding on the FBAs for purposes of their compliance programs.
Page 103

Principle 16: Capital adequacy31

(3) A proposed rule to adopt a CBLR that would be applicable to certain qualifying community banking organizations (with less than 

$10 billion in total consolidated assets). See 84 Fed. Reg. 3062 (Feb. 8, 2019).

(4) A proposed rule to modify the regulatory capital treatment for HVCRE. See 83 Fed. Reg. 48990.

(5) An interim final rule to amend the Small BHC and SLHC Policy Statement to raise the threshold for application of the policy 

statement from $1 billion to $3 billion as directed by section 207 of EGRRCPA.

• Further, pursuant to section 201 EGRRCPA (Pub. L. No. 115-174, § 201), the FBAs have issued a final rule to simplify the thresholdbased capital deductions in the numerator of the risk-based capital ratios for financial institutions not subject to the advanced approaches.

See 84 Fed. Reg. 35234 (July 22, 2019).

Leverage Requirements

Under Leverage Requirements, the following material changes have occurred since the 2014 Self-Assessment:

• In 2014, the FBAs adopted enhanced supplementary leverage ratio standards. The enhanced supplementary leverage ratio standards 

apply to U.S. G-SIBs and their IDI subsidiaries. These BHCs must maintain a leverage buffer greater than 2 percentage points above the 

minimum supplementary leverage ratio requirement of 3 percent, for a total of more than 5 percent, to avoid restrictions on capital 

distributions and discretionary bonus payments to executive officers. IDI subsidiaries of these BHCs must maintain at least a 6 percent 

supplementary leverage ratio to be considered “well capitalized” under the FBAs’ PCA supervisory framework. See 79 Fed. Reg. 24528 

(May 1, 2014) (effective Jan. 1, 2018).

• In April 2019, the FBAs published a proposal to implement section 402 of EGRRCPA which directed the FBAs to amend the 

supplementary leverage ratio to exclude certain funds of banking organizations deposited with central banks if the banking organization 

is predominantly engaged in custody, safekeeping, and asset servicing activities. Pub. L. 115-174 § 402; 84 Fed. Reg. 18175 (Apr. 30, 

2019).

Capital Plan Rule 

Under Capital Plan Rule, the following material change has occurred since the 2014 Self-Assessment:

• In April 2019, the Federal Reserve amended the capital plan rule to remove the qualitative objection for any firm that has been subject to 

the qualitative objection for four consecutive years and that does not receive a qualitative objection in the fourth year. See 84 Fed. Reg. 

8953 (Mar. 13, 2019). Instead, the capital planning practices of large holding companies will continue to be reviewed through the 

supervisory process. For example, in all aspects of capital planning, the Federal Reserve has significantly heightened supervisory 

expectations for the largest and most complex BHCs and expects these BHCs to have the most sophisticated, comprehensive, and robust 

capital planning practices. 
Page 104

Principle 16: Capital adequacy31

Stress-Test Rule

Under Stress Test Rules, the following material changes have occurred since the 2014 Self-Assessment:

• In 2019, the FBAs published separate proposed rules to implement certain provisions of section 401 of EGRRCRA. Pub. L. 115-174

§ 401. The proposed rules would revise the minimum total consolidated asset threshold for banks required to conduct stress test from 

$10 billion to $250 billion, revise the frequency of stress test for certain banks, and reduce the number of required stress testing scenarios. 

See 84 Fed. Reg. 03345 (Feb. 12, 2019) (OCC); 84 Fed Reg. 4002 (Feb. 14, 2019) (Federal Reserve); 83 Fed. Reg. 67149 (FDIC) (Dec. 

28, 2018).

• The Federal Reserve has proposed to raise the threshold and amend the frequency of its DFAST rules. 84 Fed. Reg. 21988 (May 15, 

2019); 83 Fed. Reg. 66024 (Dec. 21, 2018).

• See BCP 8, EC 1 for more information on changes to stress testing.

EC 1 Principle 16: Capital adequacy

Criterion Laws, regulations or the supervisor require banks to calculate and consistently observe prescribed capital requirements, 

including thresholds by reference to which a bank might be subject to supervisory action. Laws, regulations or the 

supervisor define the qualifying components of capital, ensuring that emphasis is given to those elements of capital 

permanently available to absorb losses on a going concern basis.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• U.S. G-SIBs and their IDI subsidiaries are required to hold a buffer above the supplementary leverage ratio 

(“enhanced supplementary leverage ratio standards”). See the BCP 16 Overview for more information.

• U.S. G-SIBs are subject to an additional risk-based capital surcharge. See the BCP 16 Overview for more 

information.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The Federal Reserve has established a policy statement for setting the CCyB. 
Page 105

Principle 16: Capital adequacy31

EC 2 Principle 16: Capital adequacy

Criterion At least for internationally active banks,32 the definition of capital, the risk coverage, the method of calculation and 

thresholds for the prescribed requirements are not lower than those established in the applicable Basel standards.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 16: Capital adequacy

Criterion The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, if 

warranted, including in respect of risks that the supervisor considers not to have been adequately transferred or mitigated 

through transactions (e.g., securitisation transactions33) entered into by the bank. Both on-balance sheet and off-balance 

sheet risks are included in the calculation of prescribed capital requirements.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• Large holding companies became subject to the Federal Reserve’s LFI rating system. The LFI system includes 

an evaluation of (i) the effectiveness of a firm’s governance and planning processes used to determine the 

amount of capital necessary to cover risks and exposures, and to support activities through a range of conditions 

and events; and (ii) the sufficiency of a firm’s capital positions to comply with applicable regulatory 

requirements and to support the firm’s ability to continue to serve as a financial intermediary through a range of 

conditions. For more information on the LFI rating system, see BCP 8 EC1 and SR Letter 19-3 / CA Letter 19-

2.

32 The Basel Capital Accord was designed to apply to internationally active banks, which must calculate and apply capital adequacy ratios on a 

consolidated basis, including subsidiaries undertaking banking and financial business. Jurisdictions adopting the Basel II and Basel III capital 

adequacy frameworks would apply such ratios on a fully consolidated basis to all internationally active banks and their holding companies; in 

addition, supervisors must test that banks are adequately capitalised on a stand-alone basis.

33 Reference documents: Enhancements to the Basel II framework, July 2009 and: International convergence of capital measurement and capital 

standards: a revised framework, comprehensive version, June 2006. 
Page 106

Principle 16: Capital adequacy31

• The Federal Reserve has heightened supervisory expectations capital management for the largest and most 

complex holding companies. See SR Letter 15-18 - Federal Reserve Supervisory Assessment of Capital 

Planning and Positions for LISCC Firms and Large and Complex Firms.

EC 4 Principle 16: Capital adequacy

Criterion The prescribed capital requirements reflect the risk profile and systemic importance of banks34 in the context of the 

markets and macroeconomic conditions in which they operate and constrain the build-up of leverage in banks and the 

banking sector. Laws and regulations in a particular jurisdiction may set higher overall capital adequacy standards than 

the applicable Basel requirements.

Legal Framework/ 

Practices and 

Procedures

The following material change has occurred since 2014 Self-Assessment:

• In October 2018 and April 2019, the Federal Reserve proposed changes to its EPS consistent with EGRRCPA. 

In particular, the proposals raise the thresholds for application of the EPS. See the BCP 16 Overview for more 

information.

EC 5 Principle 16: Capital adequacy

Criterion The use of banks’ internal assessments of risk as inputs to the calculation of regulatory capital is approved by the 

supervisor. If the supervisor approves such use: 

(a) such assessments adhere to rigorous qualifying standards; 

(b) any cessation of such use, or any material modification of the bank’s processes and models for producing such 

internal assessments, are subject to the approval of the supervisor; 

(c) the supervisor has the capacity to evaluate a bank’s internal assessment process in order to determine that the relevant 

qualifying standards are met and that the bank’s internal assessments can be relied upon as a reasonable reflection of the 

risks undertaken; 

(d) the supervisor has the power to impose conditions on its approvals if the supervisor considers it prudent to do so; and 

34 In assessing the adequacy of a bank’s capital levels in light of its risk profile, the supervisor critically focuses, among other things, on (a) the 

potential loss absorbency of the instruments included in the bank’s capital base, (b) the appropriateness of risk weights as a proxy for the risk 

profile of its exposures, (c) the adequacy of provisions and reserves to cover loss expected on its exposures and (d) the quality of its risk 

management and controls. Consequently, capital requirements may vary from bank to bank to ensure that each bank is operating with the 

appropriate level of capital to support the risks it is running and the risks it poses. 
Page 107

Principle 16: Capital adequacy31

(e) if a bank does not continue to meet the qualifying standards or the conditions imposed by the supervisor on an 

ongoing basis, the supervisor has the power to revoke its approval.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 16: Capital adequacy

Criterion The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the 

conduct of appropriate stress testing).35 The supervisor has the power to require banks: 

(a) to set capital levels and manage available capital in anticipation of possible events or changes in market conditions 

that could have an adverse effect; and 

(b) to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as 

appropriate in the light of the risk profile and systemic importance of the bank.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• As a result of an amendment to the stress testing authority in 165 of the Dodd-Frank Act by section 401 of 

EGRRCPA, the FBAs are proposing rules to revise the stress testing rules. Pub. L. 115-174 § 401. Specifically, 

the proposed rules would revise the minimum threshold for banks and holding companies, revise the frequency 

of stress test for certain banks, and reduce the number of required stress testing scenarios. See 83 Fed. Reg.

67149 (Dec. 28, 2018) (FDIC); 84 Fed. Reg. 3345 (Feb. 12, 2019) (OCC); 84 Fed. Reg. 4002 (Feb. 14, 2019) 

(Federal Reserve); 84 Fed. Reg. 21988 (May 15, 2019) (Federal Reserve); 83 Fed. Reg. 66024 (Dec. 21, 2018) 

(Federal Reserve). See BCP 8, EC 1 for more information on changes to stress testing.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The Federal Reserve finalized a set of changes to improve the transparency of its stress testing program in 

February 2019. See Press Release: “Federal Reserve finalizes set of changes that will increase the transparency 

of its stress testing program for nation’s largest and most complex banks.”

• In April 2019, the Federal Reserve amended the capital plan rule to remove the qualitative objection for any firm 

that has been subject to the qualitative objection for four consecutive years and that does not receive a qualitative 

objection in the fourth year. See 84 Fed. Reg. 8953 (Mar. 13, 2019). Instead, the capital planning practices of 

35 “Stress testing” comprises a range of activities from simple sensitivity analysis to more complex scenario analyses and reverse stress testing.
Page 108

Principle 16: Capital adequacy31

large holding companies will continue to be reviewed through the supervisory process. For example, in all 

aspects of capital planning, the Federal Reserve has significantly heightened supervisory expectations for the 

largest and most complex BHCs and expects these BHCs to have the most sophisticated, comprehensive, and 

robust capital planning practices.

EC 7 Principle 16: Capital adequacy

Additional 

Criterion

For non-internationally active banks, capital requirements, including the definition of capital, the risk coverage, the 

method of calculation, the scope of application and the capital required, are broadly consistent with the principles of the 

applicable Basel standards relevant to internationally active banks.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• Per section 207 of EGRRCPA, the $500 million asset threshold for small holding companies has increased to $3 

billion. Pub. L. 115-174 § 207; 83 Fed. Reg. 44195.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 16: Capital adequacy

Additional 

Criterion

The supervisor requires adequate distribution of capital within different entities of a banking group according to the 

allocation of risks.36

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• Per section 207 of EGRRCPA, the $500 million asset threshold for small holding companies has increased to $3 

billion. Pub. L. 115-174 § 207; 83 Fed. Reg. 44195.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

36 Please refer to Principle 12, Essential Criterion 7. 
Page 109

Principle 17: Credit risk37

The supervisor determines that banks have an adequate credit risk management process that takes into account their risk appetite, risk profile and 

market and macroeconomic conditions. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control 

or mitigate credit risk (including counterparty credit risk) on a timely basis. The full credit lifecycle is covered including credit underwriting, 

credit evaluation, and the ongoing management of the bank’s loan and investment portfolios.

Overview

The following material changes have occurred since the 2014 Self-Assessment: 

• In September 2014, the OCC issued as Appendix D to 12 CFR part 30 of its regulations, guidelines establishing heightened standards to 

strengthen the governance and risk management practices of large financial institutions. See BCP 15, EC 1 for more information on the 

OCC’s Heightened Standards Guidelines. 

• The following Comptroller’s Handbook booklets have been issued or updated: Lease Financing (Aug. 2014); Real Estate Settlement 

Procedures Act (May 2019); Floor Plan Lending (Oct. 2015).

The 2014 Self-Assessment’s reference to peer practice comparisons and data analysis incorrectly implied that these were part of UFIRS rating 

criteria. The FBAs would like to clarify that comparisons to peer data are part of the overall assessment process. However, in order to avoid 

over reliance on peer comparisons when justifying assigned component ratings, peer comparisons are not part of the rating system.

EC 1 Principle 17: Credit risk

Criterion Laws, regulations or the supervisor require banks to have appropriate credit risk management processes that provide a 

comprehensive bank-wide view of credit risk exposures. The supervisor determines that the processes are consistent 

with the risk appetite, risk profile, systemic importance and capital strength of the bank, take into account market and 

macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, administration and 

monitoring.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• Effective February 23, 2015, (with compliance dates of Dec. 24, 2015 for asset-backed securities (ABS) backed 

by residential mortgages, and Dec. 24, 2016 for all other classes of ABS), the FBAs, SEC, FHFA, and HUD 

adopted a joint final rule to implement the credit risk retention requirements of section 15G of the Securities 

Exchange Act of 1934, as added by section 941 of the Dodd-Frank Act. Section 15G generally requires the 

securitizer of ABS to retain not less than 5 percent of the credit risk of the assets collateralizing the ABS. 

37 Principle 17 covers the evaluation of assets; Principle 18 covers the management of problem assets. 
Page 110

Principle 17: Credit risk37

Section 15G includes a variety of exemptions from these requirements, including an exemption for ABS that are 

collateralized exclusively by residential mortgages that qualify as “qualified residential mortgages,” which is 

defined to align with the definition of “qualified mortgage” in CFPB regulations. See 15 U.S.C. § 78o-11; 79 

Fed. Reg. 77602 (Dec. 24, 2014); 12 CFR part 43 (OCC); 12 CFR part 244 (Federal Reserve); 12 CFR part 373

(FDIC).

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 17: Credit risk

Criterion The supervisor determines that a bank’s Board approves, and regularly reviews, the credit risk management strategy and 

significant policies and processes for assuming, identifying, measuring, evaluating, monitoring, reporting and controlling 

or mitigating credit risk (including counterparty credit risk and associated potential future exposure) and that these are 

consistent with the risk appetite set by the Board. The supervisor also determines that senior management implements 

the credit risk strategy approved by the Board and develops the aforementioned policies and processes.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 17: Credit risk

Criterion The supervisor requires, and regularly determines, that such policies and processes establish an appropriate and properly 

controlled credit risk environment, including: 

(a) a well-documented and effectively implemented strategy and sound policies and processes for assuming credit risk, 

without undue reliance on external credit assessments; 

(b) well defined criteria and policies and processes for approving new exposures (including prudent underwriting 

standards) as well as for renewing and refinancing existing exposures, and identifying the appropriate approval authority 

for the size and complexity of the exposures; 

(c) effective credit administration policies and processes, including continued analysis of a borrower’s ability and 

willingness to repay under the terms of the debt (including review of the performance of underlying assets in the case of 

securitization exposures); monitoring of documentation, legal covenants, contractual requirements, collateral and other 

forms of credit risk mitigation; and an appropriate asset grading or classification system; 
Page 111

Principle 17: Credit risk37

(d) effective information systems for accurate and timely identification, aggregation and reporting of credit risk 

exposures to the bank’s board and senior management on an ongoing basis; 

(e) prudent and appropriate credit limits, consistent with the bank’s risk appetite, risk profile and capital strength, which 

are understood by, and regularly communicated to, relevant staff; 

(f) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior 

management or board where necessary; and 

(g) effective controls (including in respect of the quality, reliability and relevancy of data and in respect of validation 

procedures) around the use of models to identify and measure credit risk and set limits.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FDIC adopted the guidance on Model Risk Management previously issued by the OCC and Federal 

Reserve. See Supervisory Guidance on Model Risk Management, FDIC FIL-22-2017 (June 7, 2017). 

• The FBAs issued new frequently asked questions on the regulatory capital rules. 

EC 4 Principle 17: Credit risk

Criterion The supervisor determines that banks have policies and processes to monitor the total indebtedness of entities to which 

they extend credit and any risk factors that may result in default, including significant unhedged foreign exchange risk.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The Federal Reserve issued SR Letter 16-17 - Supervisory Expectations for Risk Management of Reserve-Based 

Energy Lending Risk in December 2016.

EC 5 Principle 17: Credit risk

Criterion The supervisor requires that banks make credit decisions free of conflicts of interest and on an arm’s length basis.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 112

Principle 17: Credit risk37

EC 6 Principle 17: Credit risk

Criterion The supervisor requires that the credit policy prescribes that major credit risk exposures exceeding a certain amount or 

percentage of the bank’s capital are to be decided by the bank’s Board or senior management. The same applies to credit 

risk exposures that are especially risky or otherwise not in line with the mainstream of the bank’s activities.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• Effective August 6, 2018, the Federal Reserve adopted a final rule to establish single-counterparty credit limits 

for BHCs and FBOs with $250 billion or more in total consolidated assets, including any U.S. IHC of such a 

FBO with $50 billion or more in total consolidated assets, and any BHC identified as a G-SIB holding company 

under the Board's capital rules. The final rule implements section 165(e) of the Dodd-Frank Act, which requires 

the Federal Reserve to impose limits on the amount of credit exposure that such a BHC or FBO can have to an 

unaffiliated company in order to reduce the risks arising from the company's failure. See 83 Fed. Reg. 38460. 

See BCP 19, EC 1 for more information.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 7 Principle 17: Credit risk

Criterion The supervisor has full access to information in the credit and investment portfolios and to the bank officers involved in 

assuming, managing, controlling and reporting on credit risk.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 17: Credit risk

Criterion The supervisor requires banks to include their credit risk exposures in their stress testing programs for risk management 

purposes.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:
Page 113

Principle 17: Credit risk37

• On May 24, 2018, EGRRCPA amended provisions in the Dodd-Frank Act, as well as other statutes administered 

by the FBAs. The amendments made by EGRRCPA provide for additional tailoring of various provisions of the 

banking laws while maintaining the authority of the FBAs to ensure the safety and soundness of the institutions 

they supervise and to apply the EPS in the Dodd-Frank Act that address financial stability. Using authorities 

established by the Dodd-Frank Act and other laws, the FBAs jointly strengthened capital, liquidity, risk 

management, and other standards for banking organizations in response to the 2008 financial crisis. Refer to the 

Interagency Statement Regarding the Impact of EGRRCPA (July 6, 2018). This Interagency Statement provides 

information on rules and associated reporting requirements that the FBAs jointly administer and that EGRRCPA 

immediately affected. The FBAs will take the positions described in the Statement until such time as the FBAs 

amend their regulations to incorporate EGRRCPA’s changes. Certain amendments took effect on the day of 

EGRRCPA’s enactment, whereas other provisions will take effect at a later date.
Page 114

Principle 18: Problem assets, provisions and reserves38

The supervisor determines that banks have adequate policies and processes for the early identification and management of problem assets, and 

the maintenance of adequate provisions and reserves.39

EC 1 Principle 18: Problem assets, provisions and reserves

Criterion Laws, regulations or the supervisor require banks to formulate policies and processes for identifying and managing 

problem assets. In addition, laws, regulations or the supervisor require regular review by banks of their problem assets 

(at an individual level or at a portfolio level for assets with homogenous characteristics) and asset classification, 

provisioning and write-offs.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• In June 2016, the FASB issued ASU No. 2016-13, Topic 326, Financial Instruments—Credit Losses (ASU 2016-

13). The FASB modified ASU 2016-13 through the issuance of ASU 2018-19 in November 2018, ASU 2019-04 in

April 2019, and ASU 2019-05 in May 2019 (collectively, with ASU 2016-13, the new credit losses standard). 

o The new credit losses standard has staggered effective dates with the first entities (those required to file 

financial statements with the SEC) required to adopt as of the beginning of their fiscal years beginning after 

December 15, 2019. 

o The new credit losses standard introduces CECL for estimating allowances for credit losses. CECL applies

to all financial instruments measured at amortized cost (including loans held for investment and held-tomaturity debt securities, as well as trade receivables, reinsurance recoverables, and receivables that relate to 

repurchase agreements and securities lending agreements), a lessor’s net investments in leases, and offbalance-sheet credit exposures.

o When effective, CECL will affect all institutions as it requires a change in the measurement objective for 

allowances for credit losses. Under the existing model, a credit loss is not recognized until it is probable the 

loss has been incurred and the amount can be reasonably estimated. CECL requires banks and holding 

companies to estimate the net amount the institution expects to collect on financial assets within the scope 

of the standard by considering past events, current conditions, and reasonable and supportable forecasts. 

CECL aims to provide for earlier recognition of credit losses in the financial statements by removing the 

“incurred” notion and “probable” threshold for recognizing credit losses. 

38 Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem assets. 

39 Reserves for the purposes of this Principle are “below the line” non-distributable appropriations of profit required by a supervisor in addition to 

provisions (“above the line” charges to profit). 
Page 115

Principle 18: Problem assets, provisions and reserves38

o Many concepts, processes, and practices detailed in the FBAs’ December 2006 Interagency Policy 

Statement on the ALLL will continue to remain relevant once the new credit losses standard is effective.

o The new credit losses standard also modifies the treatment of credit impairment on available-for-sale (AFS) 

debt securities. Under the new credit losses standard, institutions will recognize a credit loss on an AFS 

debt security through an allowance for credit losses, rather than the current practice required by U.S. GAAP 

of write-downs of individual securities for other-than-temporary impairment.

• On June 17, 2016, the FBAs and NCUA issued a “Joint Statement on the New Accounting Standard on Financial 

Instruments - Credit Losses” to provide initial information to institutions about ASU 2016-13, including initial 

supervisory views regarding the implementation of CECL by the institutions supervised by the FBAs.

• On April 3, 2019, the FBAs and NCUA issued an updated set of frequently asked questions and answers (FAQs)

that focus on the application of the new credit losses standard and related supervisory expectations. An appendix to 

the FAQs includes links to relevant resources that are available to institutions to assist with the implementation of 

CECL. The updated set of FAQs includes FAQs previously issued in December 2016 and September 2017. 

• In the FBAs’ safety and soundness standards related to asset quality, the asset quality standards applicable to FSAs

and state savings associations formerly in 12 CFR 170, Subpart B, Appendix A, § II(G), and 12 CFR 391, Subpart 

B, Appendix A, § II(G), respectively, have been integrated into the standards previously applicable only to national 

banks and insured state non-member banks in 12 CFR 30, Appendix A, § II(G), and 12 CFR 364, Appendix A, § 

II(G), respectively, in accordance with Title III of the Dodd-Frank Act, which transferred the former Office of 

Thrift Supervision regulations governing savings associations to the OCC and the FDIC. Thus, 12 CFR 30, 

Appendix A, § II(G), and 12 CFR 364, Appendix A, § II(G), now apply to all IDIs supervised by the OCC and the 

FDIC, respectively. These actions did not affect the Federal Reserve’s safety and soundness standards related to 

asset quality in 12 CFR 208, appendix D-1, § II(G), which apply to state member banks. 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor determines the adequacy of a bank’s policies and processes for grading and classifying its assets and 

establishing appropriate and robust provisioning levels. The reviews supporting the supervisor’s opinion may be 

conducted by external experts, with the supervisor reviewing the work of the external experts to determine the adequacy 

of the bank’s policies and processes.
Page 116

Principle 18: Problem assets, provisions and reserves38

Legal Framework See EC 1 for information regarding the integration of safety and soundness standards for former OTS-supervised 

institutions into those for OCC- and FDIC-supervised institutions.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FBAs would like to clarify the 

following:

• As stated in the 2014 Self-Assessment, the FBAs do not contract with external experts to perform reviews to 

support the supervisor’s opinion on the adequacy of a bank’s policies and processes. However, omitted from the 

2014 Self-Assessment was a statement that the FDIC’s regulations require external audits of financial statements 

and internal controls over financial reporting for institutions over certain thresholds (see BCP 27 of the 2014 SelfAssessment). The external auditor must agree to provide copies of any working papers, policies, and procedures 

relating to the performance of these audit services.

EC 3 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor determines that the bank’s system for classification and provisioning takes into account off-balance 

sheet exposures.40

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor determines that banks have appropriate policies and processes to ensure that provisions and write-offs 

are timely and reflect realistic repayment and recovery expectations, taking into account market and macroeconomic 

conditions.

Legal Framework See EC 1 of this BCP for information regarding the integration of safety and soundness standards for former OTSsupervised institutions into those for OCC- and FDIC-supervised institutions.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

40 It is recognized that there are two different types of off-balance sheet exposures: those that can be unilaterally cancelled by the bank (based on 

contractual arrangements and therefore may not be subject to provisioning), and those that cannot be unilaterally cancelled.
Page 117

Principle 18: Problem assets, provisions and reserves38

EC 5 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor determines that banks have appropriate policies and processes, and organizational resources for the early 

identification of deteriorating assets, for ongoing oversight of problem assets, and for collecting on past due obligations. 

For portfolios of credit exposures with homogeneous characteristics, the exposures are classified when payments are 

contractually in arrears for a minimum number of days (e.g., 30, 60, 90 days). The supervisor tests banks’ treatment of 

assets with a view to identifying any material circumvention of the classification and provisioning standards (e.g., 

rescheduling, refinancing or reclassification of loans).

Legal Framework See EC 1 of this BCP for information regarding the integration of safety and soundness standards for former OTSsupervised institutions into those for OCC- and FDIC-supervised institutions.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor obtains information on a regular basis, and in relevant detail, or has full access to information 

concerning the classification of assets and provisioning. The supervisor requires banks to have adequate documentation 

to support their classification and provisioning levels.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• To prepare for institutions’ adoption of ASU 2016-13, including CECL, the FBAs revised the forms and 

instructions for the Call Report and their other regulatory reports to address this accounting change effective March 

31, 2019, for quarterly reports and December 31, 2019, for annual reports.

EC 7 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor assesses whether the classification of the assets and the provisioning is adequate for prudential purposes. 

If asset classifications are inaccurate or provisions are deemed to be inadequate for prudential purposes (e.g., if the 

supervisor considers existing or anticipated deterioration in asset quality to be of concern or if the provisions do not 

fully reflect losses expected to be incurred), the supervisor has the power to require the bank to adjust its classifications

of individual assets, increase its levels of provisioning, reserves or capital and, if necessary, impose other remedial 

measures.
Page 118

Principle 18: Problem assets, provisions and reserves38

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor requires banks to have appropriate mechanisms in place for regularly assessing the value of risk 

mitigants, including guarantees, credit derivatives and collateral. The valuation of collateral reflects the net realizable 

value, taking into account prevailing market conditions.

Legal Framework See EC 1 of this BCP for information regarding the integration of safety and soundness standards for former OTSsupervised institutions into those for OCC- and FDIC-supervised institutions.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 18: Problem assets, provisions and reserves

Criterion Laws, regulations or the supervisor establish criteria for assets to be: 

(a) identified as a problem asset (e.g., a loan is identified as a problem asset when there is reason to believe that all 

amounts due, including principal and interest, will not be collected in accordance with the contractual terms of the loan 

agreement); and 

(b) reclassified as performing (e.g., a loan is reclassified as performing when all arrears have been cleared and the loan 

has been brought fully current, repayments have been made in a timely manner over a continuous repayment period and 

continued collection, in accordance with the contractual terms, is expected).

Legal Framework No material change has occurred since the 2014 Self-Assessment. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The 2014 Self-Assessment explained that the FBAs have established criteria for identifying problem assets based on 

their degree of risk and likelihood of repayment, but the explanation was focused on commercial lending and did 

not address retail lending where the established criteria for identifying problem assets are based on delinquency 

status. In this regard, because a retail credit portfolio generally consists of a large number of relatively smallbalance loans, evaluating the quality of the retail credit portfolio on a loan-by-loan basis is inefficient and 

burdensome for the institution being examined and for examiners. Therefore, the quality of retail credit is best 

indicated by the repayment performance of individual borrowers using delinquency status. Specific interagency 
Page 119

Principle 18: Problem assets, provisions and reserves38

criteria for the classification of problem retail assets are detailed within the “Interagency Uniform Retail Credit 

Classification and Account Management Policy” (June 12, 2000). Generally, open- and closed-end retail loans 

should be classified Substandard when they are past due 90 cumulative days from the contractual due date and 

classified as Loss when the institution becomes aware of the loss, but in no case should the timing of the charge-off 

exceed 120 cumulative days from the contractual due date for closed-end or 180 cumulative days for open-end 

loans. 

EC 10 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor determines that the bank’s Board obtains timely and appropriate information on the condition of the 

bank’s asset portfolio, including classification of assets, the level of provisions and reserves and major problem assets. 

The information includes, at a minimum, summary results of the latest asset review process, comparative trends in the 

overall quality of problem assets, and measurements of existing or anticipated deterioration in asset quality and losses 

expected to be incurred.

Legal Framework See EC 1 of this BCP for information regarding the integration of safety and soundness standards for former OTSsupervised institutions into those for OCC- and FDIC-supervised institutions.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 11 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor requires that valuation, classification and provisioning, at least for significant exposures, are conducted 

on an individual item basis. For this purpose, supervisors require banks to set an appropriate threshold for the purpose 

of identifying significant exposures and to regularly review the level of the threshold.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FBAs would like to clarify the 

following:

• The 2014 Self-Assessment correctly stated that large individual loans determined to be impaired under ASC 310 

must be individually reviewed for appropriate valuation and provisioning. However, the self-assessment did not 

explain the provisioning applicable to large individual loans that, upon evaluation, are determined to not be 

impaired, which may have implied that no provisioning is necessary for such loans. Thus, the FBAs note that for 

individually evaluated loans determined not to be impaired, and for all other loans not individually evaluated, the 
Page 120

Principle 18: Problem assets, provisions and reserves38

associated allowance for loan and lease losses is measured under ASC 450-20 to provide for all estimated credit 

losses that have been incurred on groups of loans with similar credit risk characteristics. See Interagency Policy 

Statement on the ALLL, p. 7. 

EC 12 Principle 18: Problem assets, provisions and reserves

Criterion The supervisor regularly assesses any trends and concentrations in risk and risk build-up across the banking sector in 

relation to banks’ problem assets and takes into account any observed concentration in the risk mitigation strategies 

adopted by banks and the potential effect on the efficacy of the mitigant in reducing loss. The supervisor considers the 

adequacy of provisions and reserves at the bank and banking system level in the light of this assessment.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 121

Principle 19: Concentration risk and large exposure limits

The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or 

mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups 

of connected counterparties.41

EC 1 Principle 19: Concentration risk and large exposure limits

Criterion Laws, regulations or the supervisor require banks to have policies and processes that provide a comprehensive bankwide view of significant sources of concentration risk.42 Exposures arising from off-balance sheet as well as onbalance sheet items and from contingent liabilities are captured.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• Single-Counterparty Credit Limits: 

o Section 165(e) of the Dodd-Frank Act requires the Federal Reserve to establish single-counterparty credit 

limits (SCCL) for large U.S. and foreign BHCs and nonbank financial companies, in order to limit the 

risks that the failure of any individual firm could pose to these firms. 12 U.S.C. § 5365(e). In particular, 

section 165(e) prohibits such firms from having credit exposure to any unaffiliated company that exceeds 

25 percent of the capital stock and surplus of the firm. The Federal Reserve is authorized to establish a 

lower amount to mitigate the risks to the financial stability of the United States. Credit exposure to a 

company is defined in section 165(e) to mean all extensions of credit to the company, including loans, 

deposits, and lines of credit; all repurchase agreements, reverse repurchase agreements, and securities 

borrowing and lending transactions with the company (to the extent that such transactions create credit 

exposure for the company); all guarantees, acceptances, and letters of credit (including endorsement or 

standby letters of credit) issued on behalf of the company; all purchases of, or investments in, securities 

issued by the company; counterparty credit exposure to the company in connection with derivative 

41 Connected counterparties may include natural persons as well as a group of companies related financially or by common ownership, 

management or any combination thereof. 

42 This includes credit concentrations through exposure to: single counterparties and groups of connected counterparties both direct and indirect 

(such as through exposure to collateral or to credit protection provided by a single counterparty), counterparties in the same industry, economic 

sector or geographic region and counterparties whose financial performance is dependent on the same activity or commodity as well as off-balance 

sheet exposures (including guarantees and other commitments) and also market and other risk concentrations where a bank is overly exposed to 

particular asset classes, products, collateral, or currencies. 
Page 122

Principle 19: Concentration risk and large exposure limits

transactions between the covered company and the company; and any other similar transaction that the 

Federal Reserve, by regulation, determines to be a credit exposure for purposes of section 165(e).

o In 2018, the Federal Reserve issued a final SCCL rule (83 Fed. Reg. 38460), under which the aggregate 

net credit exposure of a U.S. G-SIB (major covered company) and any BHC with total consolidated assets 

of $250 billion or more (collectively, covered companies) to a single counterparty is subject to one of two 

credit exposure limits that are tailored to the size and systemic footprint of the firm. The final rule does 

not apply to U.S. BHCs or FBOs with less than $250 billion in total consolidated assets. The first limit 

under the final rule prohibits any covered company that is not a major covered company from having 

aggregate net credit exposure to an unaffiliated counterparty in excess of 25 percent of its tier 1 capital. 

The second limit prohibits any major covered company from having aggregate net credit exposure in 

excess of 15 percent of its tier 1 capital to a major counterparty and in excess of 25 percent of its tier 1 

capital to any other counterparty. A “major counterparty” is defined as a G-SIB or a nonbank financial 

company supervised by the Federal Reserve. This framework is consistent with the requirement in section 

165(a)(1)(B) of the Dodd-Frank Act that the EPS established by the Federal Reserve under section 165 

increase in stringency based on factors such as the nature, scope, size, scale, concentration,

interconnectedness, and mix of the activities of the company. The framework also is consistent with the 

authorization provided to the Federal Reserve under section 165(e) to apply a lower limit to the extent 

necessary to mitigate risks to financial stability. 

o The final rule applies only to FBOs with $250 billion or more in total global consolidated assets, and their 

subsidiary U.S. IHCs with total assets of $50 billion or more. An FBO subject to the final rule can comply 

with the combined U.S. operations SCCL by certifying to the Federal Reserve that it meets, on a 

consolidated basis, an SCCL established by its home country supervisor that is consistent with the 

BCBS’s large exposure standard.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• In 2015, the FBAs issued a Statement on Prudent Risk Management for Commercial Real Estate Lending to 

highlight prudent risk management practices from existing regulatory guidance for commercial real estate 

(CRE) lending activity. The Statement encourages financial institutions to review the interagency 

“Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” and implement risk 

management practices and maintain capital levels commensurate with the level and nature of their CRE 

concentration risk. It provides that financial institutions should identify, measure, monitor, and manage 

concentration risk in CRE lending activities. These same risk management expectations are referenced in 
Page 123

Principle 19: Concentration risk and large exposure limits

interagency guidance on concentrations in Commercial Real Estate, which is cited in 71 Fed. Reg. 74580

(Dec. 12, 2006).

• In 2018, the OCC issued Bulletin 2018-25 to national banks, FSAs, and federal branches and agencies 

(collectively “banks” for purposes of this bullet) regarding the role of informal or implied expressions of 

support from foreign governments (implied sovereign support) in determining a borrower’s obligor and 

facility credit risk ratings. Because implied sovereign support is not a legally binding guarantee, this guidance 

reminds banks that such expressions of informal or implied support should be viewed as no more than a 

mitigating factor when evaluating a borrower’s credit risk. This guidance can also be applicable to banks with 

concentrations in loans or portfolios with informal or implied expressions of support from foreign 

governments. 

• In late 2014, the FDIC revised its examiner instructions to provide affirmative written analysis in examination 

reports documenting concentrations, and additional focus on assessing funding source concentrations. 

• In the 2Q 2017, the OCC began collecting and sharing CRE examination assessments with the FDIC and 

Federal Reserve for significantly concentrated banks as described in OCC Bulletin 2006-46. The CRE 

examination assessments provide ratings on the risk management principles referenced in the interagency 

guidance on Concentrations in CRE as well as if the banks had an adequate ALLL balance, appropriate ALLL 

methodology, adequate capital, and adequate funding strategy in relation to its CRE concentration level. 

Supervisory concerns related to the risk management elements of concentrations of credit were also identified.

In addition, the OCC’s Concentrations of Credit booklet was omitted from the 2014 Self-Assessment. The focus of 

this booklet is concentrations of credit risk, but management should also effectively manage other potential risk 

concentrations. Such concentrations and the associated risks include elevated interest rate risk due to maturity 

concentrations; liquidity risk due to funding concentrations; or operational risks associated with concentrations of 

certain lines of business, such as mortgage servicing. Credit risk concentrations, however, are often the most material 

concentration risk in a bank because lending is the primary activity for most banks.
Page 124

Principle 19: Concentration risk and large exposure limits

EC 2 Principle 19: Concentration risk and large exposure limits

Criterion The supervisor determines that a bank’s information systems identify and aggregate on a timely basis, and facilitate 

active management of, exposures creating risk concentrations and large exposure43 to single counterparties or groups 

of connected counterparties.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• In 2014, with a subsequent revision in 2019, the FDIC revised its Examination Instructions to require 

examiners to analyze concentrations meeting certain thresholds in the report of examination, and specifically 

requires them to identify the concentration; discuss management’s consideration of relevant economic, market, 

and competitive issues, discuss management’s risk stratification and vulnerability assessment of the 

concentration; address risk management and control processes; and provide an overall assessment of the risk 

the concentration presents to the institution.

EC 3 Principle 19: Concentration risk and large exposure limits

Criterion The supervisor determines that a bank’s risk management policies and processes establish thresholds for acceptable 

concentrations of risk, reflecting the bank’s risk appetite, risk profile and capital strength, which are understood by, 

and regularly communicated to, relevant staff. The supervisor also determines that the bank’s policies and processes 

require all material concentrations to be regularly reviewed and reported to the bank’s Board.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• Large holding companies became subject to the Federal Reserve’s LFI rating system. For description of the 

ratings framework see BCP 8, EC1 and SR Letter 19-3 / CA Letter 19-2, (LFI Rating System).

• In September 2014, the OCC finalized its Heightened Standards Guidelines, which are applicable to insured 

national banks, insured FSAs, and insured federal branches of foreign banks with total consolidated assets of 

43 The measure of credit exposure, in the context of large exposures to single counterparties and groups of connected counterparties, should reflect 

the maximum possible loss from their failure (i.e. it should encompass actual claims and potential claims as well as contingent liabilities). The risk 

weighting concept adopted in the Basel capital standards should not be used in measuring credit exposure for this purpose as the relevant risk 

weights were devised as a measure of credit risk on a basket basis and their use for measuring credit concentrations could significantly 

underestimate potential losses (see “Measuring and controlling large credit exposures, January 1991).
Page 125

Principle 19: Concentration risk and large exposure limits

$50 billion or more. 12 CFR Part 30, Appendix D. See BCP 15, EC 1 for more information on the OCC’s 

Heightened Standards Guidelines.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• See EC 1 for information about the FBA’s issuance of the Interagency Statement on Prudent Risk Management 

for CRE Lending. 

• See EC 2 for information about revisions to the FDIC’s Examination Instructions.

• LISSC:

o Within the Federal Reserve System, the supervision of the largest and most systemically important 

financial institutions is overseen by LISCC. LISCC comprises senior officers representing various 

functions at the Federal Reserve Board and Reserve Banks, bringing an interdisciplinary and crossfirm perspective to the supervision of these institutions. Firms’ credit exposure limits are reviewed 

regularly as part of the LISCC supervisory program. Specific elements of that review include, but are 

not limited to: 

 process for managing single name obligor and legal lending limits;

 identification of concentration risks (e.g., products, sectors, regions, high-risk segments) and 

the applicable limit structure;

 other limit types to ensure capture of material risks and or trends;

 linkage of limits to articulated risk appetite; and

 limit monitoring system, the timeliness of reports and data quality. 

o LISCC staff also review the quality of firms’ credit exposure limit governance, focusing on:

 compliance and/or conformance on escalations (e.g., due to breaches) as noted in policy;

 material limit changes and related substantiation;

 quality of reporting and monitoring of limits; and

 analytical support for selected limits warranting further supervisory attention.

o In addition to examinations covering traditional credit risk arising from bank lending activities, 

LISCC staff also conduct examinations that cover exposure limits to central clearing counterparties 
Page 126

Principle 19: Concentration risk and large exposure limits

(CCPs) for derivatives trading, and liquidity risk limits pursuant to Regulation YY. CCP exposure 

examinations typically cover governance, risk aggregation/measurement and risk management, 

including limit setting. Liquidity risk examinations probe the management of concentrations in 

sources of funding by instrument type, single counterparty, counterparty type, secured and unsecured 

funding, and other forms of liquidity risk.

EC 4 Principle 19: Concentration risk and large exposure limits

Criterion The supervisor regularly obtains information that enables concentrations within a bank’s portfolio, including sectoral, 

geographical and currency exposures, to be reviewed.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 19: Concentration risk and large exposure limits

Criterion In respect of credit exposure to single counterparties or groups of connected counterparties, laws or regulations 

explicitly define, or the supervisor has the power to define, a “group of connected counterparties” to reflect actual risk 

exposure. The supervisor may exercise discretion in applying this definition on a case by case basis.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The SCCL in the Federal Reserve’s final SCCL rule (83 Fed. Reg. 38460) apply to the credit exposures of a 

covered company on a consolidated basis, including any subsidiaries, to any unaffiliated counterparty. A 

subsidiary of a covered company under the final rule is defined to mean a company that is consolidated on the

financial statements of the covered company. A counterparty includes a company (including any consolidated

affiliates of the company under applicable accounting standards); a natural person (including the person’s 

immediate family) where the exposure to the natural person exceeds 5 percent of the covered company’s tier 1 

capital; a U.S. state (including all of its agencies, instrumentalities, and political subdivisions); certain foreign

sovereign entities (including their agencies and instrumentalities); and political subdivisions of foreign

sovereign entities (including their agencies and instrumentalities).

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 127

Principle 19: Concentration risk and large exposure limits

EC 6 Principle 19: Concentration risk and large exposure limits

Criterion Laws, regulations or the supervisor set prudent and appropriate44 requirements to control and constrain large credit 

exposures to a single counterparty or a group of connected counterparties. “Exposures” for this purpose include all 

claims and transactions (including those giving rise to counterparty credit risk exposure), on-balance sheet as well as 

off-balance sheet. The supervisor determines that senior management monitors these limits and that they are not 

exceeded on a solo or consolidated basis.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• As noted in EC 1 of this BCP, in 2018 the Federal Reserve issued a final SCCL rule (83 Fed. Reg. 38460)

under which the aggregate net credit exposure of covered companies (defined above) to a single counterparty 

is subject to one of two credit exposure limits that are tailored to the size and systemic footprint of the firm. In 

addition, as noted in EC 5 of this BCP, the final SCCL rule applies to the credit exposures of a covered 

company on a consolidated basis, including any subsidiaries, to any unaffiliated counterparty. A subsidiary of 

a covered company under the final rule is defined to mean a company that is consolidated on the financial 

statements of the covered company. A counterparty includes a company (including any consolidated affiliates 

of the company based on applicable accounting rules). 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• In connection with the Federal Reserve’s final SCCL rule issued in 2018, the Federal Reserve invited 

comment on a proposal to implement a new information collection reporting form (reporting form). The 

reporting form would comprehensively capture the credit exposures of a respondent organization to its 

counterparties in accordance with the final SCCL rule. The reporting form asks for general information about 

the respondent organization (e.g., the respondent organization’s full legal name; the amount of its capital stock 

and surplus; whether the respondent would be considered a major covered company, major FBO, or major 

U.S. IHC under the final SCCL rule). The reporting form also permits any respondent that is an FBO to 

certify that it is subject to and complies with large exposure standards on a consolidated basis established by 

its home-country supervisor that are consistent with the large exposures framework published by the BCBS. 

The reporting form would incorporate data required to calculate the respondent organization’s credit 

44 Such requirements should, at least for internationally active banks, reflect the applicable Basel standards. The Basel Committee on Banking 

Supervision finalized its Standard for a large exposure regime that would apply to all global banks on April 15, 2014. 
Page 128

Principle 19: Concentration risk and large exposure limits

exposures and requires identification of counterparties by name and by entity type (e.g., sovereign entities,

securitization funds). The form would require each respondent organization to report its top 50 counterparties.

EC 7 Principle 19: Concentration risk and large exposure limits

Criterion The supervisor requires banks to include the impact of significant risk concentrations into their stress testing programs 

for risk management purposes.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• See BCP 8, EC 1 for more information on changes to the FBAs’ stress testing programs.

The FBAs would like to clarify, in light of EGRRCPA changes, that certain portions of existing interagency guidance 

applicable to all banking organizations discuss addressing potential adverse outcomes as part of sound risk 

management practices. See, e.g., 2012 Supervisory Guidance on Stress Testing. This guidance emphasizes that 

banking organizations are able to identify potential concentrations to assess the impact of identified concentrations of 

exposures, activities and risks within and across portfolios and business lines and on the organization as a whole. The 

FBAs continue to emphasize that all banking organizations, regardless of size, should have the capacity to analyze the 

potential impact of adverse outcomes on their financial condition. The FBAs note that such existing guidance, 

including that covering interest rate risk management, commercial real estate concentrations, and funding and liquidity 

management (among others), continues to apply. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• Since 2014, the Federal Reserve has required eight large and complex banks with substantial trading or 

custodial operations to incorporate a counterparty default scenario component into their supervisory adverse 

and severely adverse stress scenarios for their annual CCAR stress testing exercises. The counterparty default 

scenario component involves the instantaneous and unexpected default of the bank’s largest counterparty, as 

measured by the size of net stressed losses generated across the bank’s derivatives and securities financing 

activities. This scenario is an add-on to the macroeconomic conditions and financial market environment 

specified in the Federal Reserve’s adverse and severely adverse stress scenarios that must be applied to all 

bank exposures and positions.

• For banks with significant concentrations of CRE exposures, the Interagency Statement on Prudent Risk 

Management for Commercial Real Estate (CRE) Lending (discussed in EC 1) states that such banks are 

expected to perform “market and scenario analyses of their CRE loan portfolio to quantify the potential impact 
Page 129

Principle 19: Concentration risk and large exposure limits

of changing economic conditions on asset quality, earnings, and capital” as part of their ongoing risk 

management activities.

EC 8 Principle 19: Concentration risk and large exposure limits

Additional 

Criterion

In respect of credit exposure to single counterparties or groups of connected counterparties, banks are required to 

adhere to the following: 

(a) 10 percent or more of a bank’s capital is defined as a large exposure; and 

(b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty 

or a group of connected counterparties. 

Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very small or 

specialized banks.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 130

Principle 20: Transactions with related parties

In order to prevent abuses arising in transactions with related parties45 and to address the risk of conflict of interest, the supervisor requires 

banks to enter into any transactions with related parties46 on an arm’s length basis; to monitor these transactions; to take appropriate steps to 

control or mitigate the risks; and to write off exposures to related parties in accordance with standard policies and processes.

Overview

The following material changes have occurred since the 2014 Self-Assessment:

• The OCC has issued updated guidance on third party relationships, which include any business arrangement between a bank and 

another entity, by contract or otherwise: 

o OCC Bulletin 2017-7, “Third-Party Relationships: Supplemental Examination Procedures”

o OCC Bulletin 2017-21, “Third-Party Relationships: Frequently Asked Questions to Supplement OCC Bulletin 2013-29.” 

EC 1 Principle 20: Transactions with related parties

Criterion Laws or regulations provide, or the supervisor has the power to prescribe, a comprehensive definition of “related 

parties”. This considers the parties identified in the footnote to the Principle. The supervisor may exercise discretion in 

applying this definition on a case by case basis.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

45 Related parties can include, among other things, the bank’s subsidiaries, affiliates, and any party (including their subsidiaries, affiliates and 

special purpose entities) that the bank exerts control over or that exerts control over the bank, the bank’s major shareholders, Board members, 

senior management and key staff, their direct and related interests, and their close family members as well as corresponding persons in affiliated 

companies. Regarding subsidiaries of banks, only insured depository institutions and financial subsidiaries of banks would be covered as 

“affiliates” under sections 23A and 23B of the Federal Reserve Act. Most subsidiaries of banks are not affiliates for purposes of section 23A.

46 Related party transactions include on-balance sheet and off-balance sheet credit exposures and claims, as well as, dealings such as service 

contracts, asset purchases and sales, construction contracts, lease agreements, derivative transactions, borrowings, and write-offs. The term 

transaction should be interpreted broadly to incorporate not only transactions that are entered into with related parties but also situations in which 

an unrelated party (with whom a bank has an existing exposure) subsequently becomes a related party.
Page 131

Principle 20: Transactions with related parties

EC 2 Principle 20: Transactions with related parties

Criterion Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favorable 

terms (e.g.., in credit assessment, tenor, interest rates, fees, amortization schedules, requirement for collateral) than 

corresponding transactions with non-related counterparties.47

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 20: Transactions with related parties

Criterion The supervisor requires that transactions with related parties and the write-off of related-party exposures exceeding 

specified amounts or otherwise posing special risks are subject to prior approval by the bank’s Board. The supervisor 

requires that Board members with conflicts of interest are excluded from the approval process of granting and 

managing related party transactions.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 20: Transactions with related parties

Criterion The supervisor determines that banks have policies and processes to prevent persons benefiting from the transaction 

and/or persons related to such a person from being part of the process of granting and managing the transaction.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 20: Transactions with related parties

Criterion Laws or regulations set, or the supervisor has the power to set on a general or case by case basis, limits for exposures to 

related parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralization of 

47 An exception may be appropriate for beneficial terms that are part of overall remuneration packages (e.g., staff receiving credit at favourable 

rates).
Page 132

Principle 20: Transactions with related parties

such exposures. When limits are set on aggregate exposures to related parties, those are at least as strict as those for 

single counterparties or groups of connected counterparties.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 20: Transactions with related parties

Criterion The supervisor determines that banks have policies and processes to identify individual exposures to and transactions 

with related parties as well as the total amount of exposures, and to monitor and report on them through an independent 

credit review or audit process. The supervisor determines that exceptions to policies, processes and limits are reported 

to the appropriate level of the bank’s senior management and, if necessary, to the Board, for timely action. The 

supervisor also determines that senior management monitors related party transactions on an ongoing basis, and that the 

Board also provides oversight of these transactions.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 7 Principle 20: Transactions with related parties

Criterion The supervisor obtains and reviews information on aggregate exposures to related parties.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 133

Principle 21: Country and transfer risks

The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or 

mitigate country risk48 and transfer risk49 in their international lending and investment activities on a timely basis.

EC 1 Principle 21: Country and transfer risks

Criterion The supervisor determines that a bank’s policies and processes give due regard to the identification, measurement, 

evaluation, monitoring, reporting and control or mitigation of country risk and transfer risk. The supervisor also 

determines that the processes are consistent with the risk profile and systemic importance and risk appetite of the bank, 

take into account market and macroeconomic conditions and provide a comprehensive bank-wide view of country and 

transfer risk exposure. Exposures (including, where relevant, intra-group exposures) are identified, monitored and 

managed on a regional and an individual country basis (in addition to the end-borrower/end-counterparty basis). Banks 

are required to monitor and evaluate developments in country risk and in transfer risk and apply appropriate 

countermeasures.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 21: Country and transfer risks

Criterion The supervisor determines that banks’ strategies, policies and processes for the management of country and transfer 

risks have been approved by the banks’ boards and that the boards oversee management in a way that ensures that these 

policies and processes are implemented effectively and fully integrated into the banks’ overall risk management 

process.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

48 Country risk is the risk of exposure to loss caused by events (economic, social, or political) in a foreign country. The concept is broader than 

sovereign risk as all forms of lending or investment activity whether to/with individuals, corporates, banks or governments are covered. 

49 Transfer risk is the risk that a borrower will not be able to convert local currency into foreign exchange and so will be unable to make debt 

service payments in foreign currency. The risk normally arises from exchange restrictions imposed by the government in the borrower’s country. 

(Reference document: IMF paper on External Debt Statistics – Guide for compilers and users, 2003.)
Page 134

Principle 21: Country and transfer risks

EC 3 Principle 21: Country and transfer risks

Criterion The supervisor determines that banks have information systems, risk management systems and internal control systems 

that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established 

country exposure limits.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 21: Country and transfer risks

Criterion There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk. There are 

different international practices that are all acceptable as long as they lead to risk-based results. These include: 

(a) The supervisor (or some other official authority) decides on appropriate minimum provisioning by regularly setting 

fixed percentages for exposures to each country taking into account prevailing conditions. The supervisor reviews 

minimum provisioning levels where appropriate. 

(b) The supervisor (or some other official authority) regularly sets percentage ranges for each country, taking into 

account prevailing conditions and the banks may decide, within these ranges, which provisioning to apply for the

individual exposures. The supervisor reviews percentage ranges for provisioning purposes where appropriate. 

(c) The bank itself (or some other body such as the national bankers association) sets percentages or guidelines or even 

decides for each individual loan on the appropriate provisioning. The adequacy of the provisioning will then be judged 

by the external auditor and/or by the supervisor.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 21: Country and transfer risks

Criterion The supervisor requires banks to include appropriate scenarios into their stress testing programmes to reflect country 

and transfer risk analysis for risk management purposes.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 135

Principle 21: Country and transfer risks

EC 6 Principle 21: Country and transfer risks

Criterion The supervisor regularly obtains and reviews sufficient information on a timely basis on the country risk and transfer 

risk of banks. The supervisor also has the power to obtain additional information, as needed (e.g., in crisis situations).

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 136

Principle 22: Market risk

The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, 

and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and 

processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis.

EC 1 Principle 22: Market risk

Criterion Laws, regulations or the supervisor require banks to have appropriate market risk management processes that provide a 

comprehensive bank-wide view of market risk exposure. The supervisors determine that these processes are consistent 

with the risk appetite, risk profile, systemic importance and capital strength of the bank; take into account market and 

macroeconomic conditions and the risk of a significant deterioration in market liquidity; and clearly articulate the roles 

and responsibilities for identifying, measuring, monitoring and controlling or mitigating market risk.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 22: Market risk

Criterion The supervisor determines that banks’ strategies, policies and processes for the management of market risk are 

appropriate for the level of risks assumed, have been approved by the banks’ Boards, and that the Boards oversee 

management in a way that ensures that these policies and processes are implemented effectively and fully integrated into 

the banks’ overall risk management process.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• In 2017, the FDIC issued similar guidance to that of the other FBAs on model risk management. See FDIC FIL 

22-2017 (June 7, 2017).

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 22: Market risk

Criterion The supervisor determines that the bank’s policies and processes establish an appropriate and properly controlled market 

risk environment, including: 

(a) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market 

risk exposure to the bank’s Board and senior management; 
Page 137

Principle 22: Market risk

(b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and capital strength, and with the 

management’s ability to manage market risk, and which are understood by, and regularly communicated to, relevant 

staff; 

(c) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior 

management or Board, where necessary; 

(d) effective controls around the use of models to identify and measure market risk, and set limits; and 

(e) sound policies and processes for allocation of exposures to the trading book.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 22: Market risk

Criterion The supervisor determines that there are systems and controls to ensure that banks’ marked-to-market positions are 

revalued daily. The supervisor also determines that all transactions are captured on a timely basis and that the valuation 

process uses consistent and prudent practices, and reliable market data verified by a function independent of the relevant 

risk-taking business units (or, in the absence of observable market prices, internal or industry-accepted models). To the 

extent that the bank relies on modelling for the purposes of valuation, the bank is required to ensure that the model is 

validated by a function independent of the relevant risk-taking businesses units. The supervisor requires banks to 

establish and maintain policies and processes for considering valuation adjustments for positions that otherwise cannot 

be prudently valued, including concentrated, less liquid, and stale positions.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 22: Market risk

Criterion The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate 

valuation adjustments for uncertainties in determining the fair value of assets and liabilities.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:
Page 138

Principle 22: Market risk

• See BCP 8, EC 2 for more information on changes to the FBAs’ stress testing programs. The FBAs continue to 

emphasize that all banking organizations, regardless of size, should have the capacity to analyze the potential 

impact of adverse outcomes on their financial condition.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 22: Market risk

Criterion The supervisor requires banks to include market risk exposure into their stress testing programmes for risk management 

purposes.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• See BCP 8, EC 2 for more information on changes to the FBAs’ stress testing programs. The FBAs continue to 

emphasize that all banking organizations, regardless of size, should have the capacity to analyze the potential 

impact of adverse outcomes on their financial condition.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 139

Principle 23: Interest rate risk in the banking book

The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate 

risk50 in the banking book on a timely basis. These systems take into account the bank’s risk appetite, risk profile and market and 

macroeconomic conditions.

EC 1 Principle 23: Interest rate risk in the banking book

Criterion Laws, regulations or the supervisor require banks to have an appropriate interest rate risk strategy and interest rate risk 

management framework that provides a comprehensive bank-wide view of interest rate risk. This includes policies and 

processes to identify, measure, evaluate, monitor, report and control or mitigate material sources of interest rate risk. The

supervisor determines that the bank’s strategy, policies and processes are consistent with the risk appetite, risk profile 

and systemic importance of the bank, take into account market and macroeconomic conditions, and are regularly 

reviewed and appropriately adjusted, where necessary, with the bank’s changing risk profile and market developments.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 2 Principle 23: Interest rate risk in the banking book

Criterion The supervisor determines that a bank’s strategy, policies and processes for the management of interest rate risk have 

been approved, and are regularly reviewed, by the bank’s board. The supervisor also determines that senior management 

ensures that the strategy, policies and processes are developed and implemented effectively.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 23: Interest rate risk in the banking book

Criterion The supervisor determines that banks’ policies and processes establish an appropriate and properly controlled interest 

rate risk environment including: 

(a) comprehensive and appropriate interest rate risk measurement systems; 

50 Wherever “interest rate risk” is used in this Principle the term refers to interest rate risk in the banking book. Interest rate risk in the trading book 

is covered under Principle 22. 
Page 140

Principle 23: Interest rate risk in the banking book

(b) regular review, and independent (internal or external) validation, of any models used by the functions tasked with 

managing interest rate risk (including review of key model assumptions); 

(c) appropriate limits, approved by the banks’ Boards and senior management, that reflect the banks’ risk appetite, risk 

profile and capital strength, and are understood by, and regularly communicated to, relevant staff; 

(d) effective exception tracking and reporting processes which ensure prompt action at the appropriate level of the 

banks’ senior management or Boards where necessary; and 

(e) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of interest 

rate risk exposure to the banks’ Boards and senior management.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 23: Interest rate risk in the banking book

Criterion The supervisor requires banks to include appropriate scenarios into their stress testing programmers to measure their 

vulnerability to loss under adverse interest rate movements.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 23: Interest rate risk in the banking book

Additional 

Criterion

The supervisor obtains from banks the results of their internal interest rate risk measurement systems, expressed in terms 

of the threat to economic value, including using a standardized interest rate shock on the banking book.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 23: Interest rate risk in the banking book

Additional 

Criterion

The supervisor assesses whether the internal capital measurement systems of banks adequately capture interest rate risk 

in the banking book.
Page 141

Principle 23: Interest rate risk in the banking book

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 142

Principle 24: Liquidity risk

The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) for 

banks that reflect the liquidity needs of the bank. The supervisor determines that banks have a strategy that enables prudent management of 

liquidity risk and compliance with liquidity requirements. The strategy takes into account the bank’s risk profile as well as market and 

macroeconomic conditions and includes prudent policies and processes, consistent with the bank’s risk appetite, to identify, measure, evaluate, 

monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity 

requirements are not lower than the applicable Basel standards.

Overview

The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented a LCR rule that together with associated public disclosure requirements, is consistent with the Basel III 

LCR standard. See 79 Fed. Reg. 61439 (Oct. 10, 2014), codified at 12 CFR part 50 (OCC), 12 CFR part 249 (Federal Reserve), and 

12 CFR part 329 (FDIC). See also 81 Fed. Reg. 94922 (Dec. 27, 2016,), codified as subpart J of the Federal Reserve’s LCR Rule.

• In May 2016, the FBAs proposed a rule that would implement a net stable funding requirement, consistent with the Basel III NSFR

standard, for the same set of institutions subject to the LCR Rule. See “81 Fed. Reg. 35124 (June 1, 2016). For depository 

institution holding companies with $50 billion or more, but less than $250 billion, in total consolidated assets and less than 

$10 billion in total on-balance sheet foreign exposure, the Federal Reserve separately proposed a modified NSFR requirement.

• In March 2016, the FBAs provided examples clarifying an effective funds transfer pricing (FTP) framework (Interagency Guidance 

on Funds Transfer Pricing Related to Funding and Contingent Liquidity Risks), which builds on the principles of sound liquidity 

risk-management practices outlined in existing regulatory guidance and is applicable to large financial institutions.

• In July 2016, FBOs with substantial activities in the United States became subject to certain additional minimum requirements under 

the Federal Reserve’s Regulation YY, generally consistent with the EPS for large domestic BHCs (as described in the 2014 SelfAssessment). Regulation YY require FBOs to perform an internal liquidity stress test for their U.S. operations; U.S. IHC, if any; and 

U.S. branches and agencies, in the aggregate. See 12 CFR. 252.152(c). 

EC 1 Principle 24: Liquidity risk

Criterion Laws, regulations or the supervisor require banks to consistently observe prescribed liquidity requirements including 

thresholds by reference to which a bank is subject to supervisory action. At least for internationally active banks, the 

prescribed requirements are not lower than, and the supervisor uses a range of liquidity monitoring tools no less 

extensive than, those prescribed in the applicable Basel standards.
Page 143

Principle 24: Liquidity risk

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• In 2014, the FBAs implemented the LCR Rule. See BCP 24 Overview. The LCR Rule requires a covered 

institution to hold minimum amounts of high-quality liquid assets (HQLA) such as central bank reserves and 

certain government and corporate debt that can be converted easily and quickly into cash to cover stressed cash 

outflows within a 30 day time horizon.

• Under the LCR Rule, the full LCR requirement generally applies to depository institution holding companies 

and depository institutions that meet or exceed the advanced approaches thresholds (i.e., $250 billion in total 

consolidated assets or $10 billion in on-balance sheet foreign exposure) and to their depository institution 

subsidiaries that each have total consolidated assets of $10 billion or more. The Federal Reserve’s regulations 

also apply a less stringent, modified LCR requirement to depository institution holding companies that do not 

meet the advanced approaches thresholds but have more than $50 billion in total consolidated assets. 

• The FBAs’ LCR Rule, and associated public disclosure requirements imposed by the Federal Reserve, are 

consistent with, and in some ways more stringent then, the Basel III LCR. See Basel III: The Liquidity 

Coverage Ratio and Liquidity Risk Monitoring tools (Jan. 2014) and Regulatory Consistency Assessment 

Programme (RCAP) Assessment of Basel III LCR Regulations―United States of America (July 2017). See

Basel III: The Liquidity Coverage Ratio and Liquidity Risk Monitoring tools (Jan. 2014) and Regulatory 

Consistency Assessment Programme (RCAP) Assessment of Basel III LCR Regulations―United States of 

America (July 2017). 

• On June 1, 2016, the FBAs invited comment on a proposed rule to implement an NSFR requirement for large 

and internationally active banking organizations (the NSFR Proposed Rule). See BCP 24 Overview. The NSFR 

Proposed Rule would establish a quantitative metric to measure the funding profile of a banking organization 

and ensure the stability of a banking organization’s funding over a one-year time horizon.

• Beginning in July 2016, the Federal Reserve’s Regulation YY applied enhanced liquidity risk management and 

minimum highly liquid asset buffer requirements to FBOs with substantial operations in the United States, 

including to U.S. IHCs required to be established by the regulation. See BCP 24 Overview. 

The FBAs would like to clarify that the liquidity standards described in the 2014 Self-Assessment continue to apply to 

firms that are not subject to the LCR rule (or the proposed NSFR rule).

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 144

Principle 24: Liquidity risk

EC 2 Principle 24: Liquidity risk

Criterion The prescribed liquidity requirements reflect the liquidity risk profile of banks (including on- and off-balance sheet 

risks) in the context of the markets and macroeconomic conditions in which they operate.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented the LCR Rule that together with associated public disclosure requirements, is consistent 

with the Basel III LCR. See Basel III: The Liquidity Coverage Ratio and liquidity risk monitoring tools (Jan.

2014).

o Banking organizations subject to the FBAs’ LCR Rule are required to determine their minimum 

liquidity requirement under the rule using standardized stressed cash outflow and inflow rates. Total net 

stressed cash outflows under the rule reflect the liquidity risk profile of the banking organization and 

includes both on- and off-balance sheet liquidity risk exposures. The standardized stress cash outflow 

and inflow amounts reflect the impact of a short-term stress (e.g., 30-day time horizon) on the markets 

and operating environments of banking organizations subject to the rule. The LCR Rule includes items 

that reflect the markets and conditions of the United States that are additions to the Basel III LCR 

standard. 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 24: Liquidity risk

Criterion The supervisor determines that banks have a robust liquidity management framework that requires the banks to maintain 

sufficient liquidity to withstand a range of stress events, and includes appropriate policies and processes for managing 

liquidity risk that have been approved by the banks’ board of directors. The supervisor also determines that these 

policies and processes provide a comprehensive bank-wide view of liquidity risk and are consistent with the banks’ risk 

profile and systemic importance.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented the LCR Rule, together with associated public disclosure requirements, consistent with 

the Basel III LCR.

o Under the LCR Rule, banking organizations and other institutions subject to the rule are required to 

implement and maintain appropriate policies and procedures and systems to enable them to exercise 
Page 145

Principle 24: Liquidity risk

operational control over high-quality liquid assets to ensure that they are available for use by the 

banking organization to provide liquidity, when and where needed, consistent with the Basel III LCR 

standard.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 24: Liquidity risk

Criterion The supervisor determines that banks’ liquidity strategy, policies and processes establish an appropriate and properly 

controlled liquidity risk environment including: 

(a) clear articulation of an overall liquidity risk appetite that is appropriate for the banks’ business and their role in the 

financial system and that is approved by the banks’ Boards; 

(b) sound day-to-day, and where appropriate intraday, liquidity risk management practices; 

(c) effective information systems to enable active identification, aggregation, monitoring and control of liquidity risk 

exposures and funding needs (including active management of collateral positions) bank-wide; 

(d) adequate oversight by the banks’ Boards in ensuring that management effectively implements policies and processes 

for the management of liquidity risk in a manner consistent with the banks’ liquidity risk appetite; and 

(e) regular review by the banks’ Boards (at least annually) and appropriate adjustment of the banks’ strategy, policies 

and processes for the management of liquidity risk in the light of the banks’ changing risk profile and external 

developments in the markets and macroeconomic conditions in which they operate.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 24: Liquidity risk

Additional 

Criterion

The supervisor requires banks to establish, and regularly review, funding strategies and policies and processes for the 

ongoing measurement and monitoring of funding requirements and the effective management of funding risk. The 

policies and processes include consideration of how other risks (e.g., credit, market, operational and reputation risk) may 

impact the bank’s overall liquidity strategy, and include: 

(a) an analysis of funding requirements under alternative scenarios;

(b) the maintenance of a cushion of high quality, unencumbered, liquid assets that can be used, without impediment, to 

obtain funding in times of stress;
Page 146

Principle 24: Liquidity risk

(c) diversification in the sources (including counterparties, instruments, currencies and markets) and tenor of funding, 

and regular review of concentration limits;

(d) regular efforts to establish and maintain relationships with liability holders; and

(e) regular assessment of the capacity to sell assets.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented the LCR Rule that together with associated public disclosure requirements, is consistent 

with the Basel III LCR.

o Under the LCR Rule, banking organizations and other institutions subject to the rule are required to 

implement and maintain appropriate policies and procedures and systems to enable them to exercise 

operational control over HQLA to ensure that they are available to provide liquidity when and where 

needed, consistent with the Basel standard.

o The LCR Rule requires institutions to calculate and maintain an amount of unencumbered HQLA 

(HQLA amount) that is sufficient to cover total net cash outflows as calculated under the rule. The 

standardized determination of the minimum HQLA amount complements covered firms’ own 

assessments of minimum liquidity needs in a stress. 

o The LCR Rule provides specific limits on the concentration of certain classes of HQLA within the 

composition of the HQLA amount, requiring diversity of unencumbered assets as a funding source. 

o The LCR Rule also requires that assets eligible for inclusion in the calculation of the HQLA amount be 

diversified and that an institution have the operational capacity to monetize eligible HQLA during a 

crisis, as evidenced by implementing and maintaining appropriate procedures and systems for 

monetization and by periodically testing access to the market through actual monetization of a sample of 

the eligible HQLA.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 6 Principle 24: Liquidity risk

Criterion The supervisor determines that banks have robust liquidity contingency funding plans to handle liquidity problems. The 

supervisor determines that the bank’s contingency funding plan is formally articulated, adequately documented and sets 

out the bank’s strategy for addressing liquidity shortfalls in a range of stress environments without placing reliance on 

lender of last resort support. The supervisor also determines that the bank’s contingency funding plan establishes clear 
Page 147

Principle 24: Liquidity risk

lines of responsibility, includes clear communication plans (including communication with the supervisor) and is 

regularly tested and updated to ensure it is operationally robust. The supervisor assesses whether, in the light of the 

bank’s risk profile and systemic importance, the bank’s contingency funding plan is feasible and requires the bank to 

address any deficiencies.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented an LCR Rule as a prospective assessment of liquidity needs in a time of stress. This 

standardized, forward-looking assessment complements the cash flow projections, contingency funding planning 

and liquidity stress testing requirements for covered firms under the Board’s Regulation YY and/or the 

examples of approaches to contingency funding described in the FBAs’ guidance.

o The LCR Rule prescribes a process for reporting to the appropriate agency when a covered company 

falls below the minimum liquidity requirement (similar to the notification requirement in the NSFR 

Proposed Rule). This reporting obligation includes a requirement that the covered company provide to 

the relevant FBA a plan for achieving compliance with the minimum liquidity requirements. The 

remediation plan must include, as applicable.

o An assessment of the covered company’s liquidity position.

o The actions that the covered company has taken and will take to achieve full compliance with the LCR 

Rule, including (A) a plan for adjusting the covered company’s risk profile, risk management, and 

funding sources in order to achieve full compliance, and (B) a plan for remediating any operational or 

management issues that contributed to noncompliance with this part.

 An estimated time frame for achieving full compliance, and

 A commitment to report to the relevant FBA no less than weekly on progress to achieve 

compliance in accordance with the plan until full compliance is achieved. See 12 CFR part 

50.40 (OCC), 12 CFR part 249.40 (Federal Reserve), and 12 CFR part 329.40 (FDIC).

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 7 Principle 24: Liquidity risk

Criterion The supervisor requires banks to include a variety of short-term and protracted bank-specific and market-wide liquidity 

stress scenarios (individually and in combination), using conservative and regularly reviewed assumptions, into their 
Page 148

Principle 24: Liquidity risk

stress testing programmes for risk management purposes. The supervisor determines that the results of the stress tests 

are used by the bank to adjust its liquidity risk management strategies, policies and positions and to develop effective 

contingency funding plans.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 8 Principle 24: Liquidity risk

Criterion The supervisor identifies those banks carrying out significant foreign currency liquidity transformation. Where a bank’s 

foreign currency business is significant, or the bank has significant exposure in a given currency, the supervisor requires 

the bank to undertake separate analysis of its strategy and monitor its liquidity needs separately for each such significant 

currency. This includes the use of stress testing to determine the appropriateness of mismatches in that currency and, 

where appropriate, the setting and regular review of limits on the size of its cash flow mismatches for foreign currencies 

in aggregate and for each significant currency individually. In such cases, the supervisor also monitors the bank’s 

liquidity needs in each significant currency, and evaluates the bank’s ability to transfer liquidity from one currency to 

another across jurisdictions and legal entities.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented an LCR requirement that, consistent with the Basel III LCR, incorporates a single 

consolidated quantitative requirement across all currency exposures and also requires assessment of currency 

risks.

o The LCR Rule allows covered companies to include certain foreign currency denominated equities in 

the HQLA amount if traded on an index that a covered company’s supervisor in a foreign jurisdiction 

recognizes for purposes of including equity shares in level 2B liquid assets, if the share is held in that 

foreign jurisdiction, the foreign currency is that of a jurisdiction where the covered institution operates, 

and the covered company holds the common equity share in order to cover its net cash outflows in that 

jurisdiction. 

o The LCR Rule requires that covered companies have policies and procedures that determine the 

composition of its eligible HQLA, by identifying, among other things, its eligible HQLA by 

geographical location and currency account. 
Page 149

Principle 24: Liquidity risk

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 9 Principle 24: Liquidity risk

Additional 

Criterion

The supervisor determines that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits 

to mitigate the risks posed by excessive levels of encumbrance in terms of the impact on the banks’ cost of funding and 

the implications for the sustainability of their long-term liquidity position. The supervisor requires banks to commit to 

adequate disclosure and to set appropriate limits to mitigate identified risks.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs implemented an LCR Rule that, together with associated public disclosure requirements, is consistent 

with the Basel III LCR. The minimum HQLA amount requirement and the standardized haircuts applied to 

level 2 liquid assets limit the extent of encumbrance of a covered firm’s balance sheet overall and specifically 

relative to potential needs in a short-term liquidity stress. Further, the LCR Rule provides general incentives for 

wholesale funding secured by encumbered assets to be supported by higher quality assets. 

• Under the LCR Rule, for an asset to qualify as eligible HQLA, the asset must be unencumbered, which includes 

meeting the following criteria that are set forth in the LCR Rule:

(i) The assets are free of legal, regulatory, contractual, or other restrictions on the ability of the FBO to 

monetize the assets; and

(ii) The assets are not pledged, explicitly or implicitly, to secure or to provide credit enhancement to any 

transaction, but the assets may be considered unencumbered if the assets are pledged to a central bank or 

a U.S. government-sponsored enterprise where:

(A) Potential credit secured by the assets is not currently extended to the FBO or its consolidated 

subsidiaries; and

(B) The pledged assets are not required to support access to the payment services of a central bank.

(iii) The asset is not:

(A) A client pool security held in a segregated account; or

(B) An asset received from a secured funding transaction involving client pool securities that were held 

in a segregated account. See 12 CFR part 50.22(b) (OCC), 12 CFR part 249.22(b) (Federal 

Reserve), and 12 CFR part 329.22 (b) (FDIC). Consistent with the Basel III standard, the NSFR 
Page 150

Principle 24: Liquidity risk

Proposed Rule would generally limit the encumbrance of assets relative to available stable funding 

and would, in general, provide incentives to the company to manage the remaining maturity of 

encumbered assets. 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 151

Principle 25: Operational risk

The supervisor determines that banks have an adequate operational risk management framework that takes into account their risk appetite, 

risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, assess, evaluate, monitor, 

report and control or mitigate operational risk51 on a timely basis.

Overview

To expand on the 2014 Self-Assessment, the FBAs would like to clarify that their oversight activities also were supported by the 

following components of the existing legal framework:

• The Dodd-Frank Act established the FSOC, which serves to identify a broad range of emerging operational risks and communicates 

these risks to the industry and helps inform examination strategies for the FBAs. The 2018 Annual Report provides a recent example 

of the FSOC’s assessment of operational risk, wherein it documents recommendations to strengthen banking operations, specifically 

as regards cybersecurity, financial innovation, and data quality, collection, and sharing.

• The Bank Service Company Act, 12 U.S.C. § 1861 et seq., allows the FBAs to examine third-parties that perform services for banks. 

FBA examinations serve to identify risks and operational issues inherent within these service providers. Reports of examination are 

subsequently shared with banks that contract for relevant services provided by the respective provider in order for them to better 

assess their risks. Since the 2014 Self-Assessment, the FBAs have increased their scrutiny of third party service providers and 

continued evolution of the former Multi-regional Data Processing Servicers (MDPS) program into the Significant Service Provider 

(SSP) program, as detailed below.

• Title V of the Gramm–Leach–Bliley Act (GLBA), Pub. L. 106–102, 113 Stat. 1338 (1999) and its implementing regulations require 

financial institutions that offer consumers financial products or services to disclose their information-sharing practices to their 

customers and to safeguard customer information. See 15 U.S.C. § 6801, et.seq.; for FBA information security guidelines on 

safeguarding customer information, see also 12 CFR part 30, Appendix B (OCC); 12 CFR part 208, Appendix D-2; 12 CFR part 225, 

Appendix F (Federal Reserve); 12 CFR part 364, Appendix B (FDIC) (collectively, Information Security Guidelines). The FBAs’ 

elevated focus on cybersecurity risk, as well as continued focus on information technology controls to secure sensitive customer data, 

is described below.

EC 1 Principle 25: Operational risk

Criterion Law, regulations or the supervisor require banks to have appropriate operational risk management strategies, policies 

and processes to identify, assess, evaluate, monitor, report and control or mitigate operational risk. The supervisor 

51 The Committee has defined operational risk as the risk of loss resulting from inadequate or failed internal processes, people, and systems or 

from external events. The definition includes legal risk but excludes strategic and reputational risk.
Page 152

Principle 25: Operational risk

determines that the bank’s strategy, policies and processes are consistent with the bank’s risk profile, systemic 

importance, risk appetite and capital strength, take into account market and macroeconomic conditions, and address 

all major aspects of operational risk prevalent in the businesses of the bank on a bank-wide basis (including periods 

when operational risk could increase).

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• In September 2014, the OCC issued its Heightened Standards Guidelines as Appendix D to 12 CFR part 30. 

See BCP 15, EC 1 for more information. The role of the Heightened Standards Guidelines in enhanced risk 

management of operational risk is described in ECs below. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• In 2016, the Federal Reserve issued SR Letter 16-11 setting out risk management expectations—including 

operational risk management expectations—for institutions with total consolidated assets of less than $50 

billion. These expectations were also incorporated into the BHC Supervision Manual section 4070.1.

As explained in the 2014 Self-Assessment, risk management activities—including operational risk management 

activities—are assessed by the FBAs through supervision. The FBAs have provided the below recent public 

examples of assessing operational risk management, as demonstrated by enforcement actions and publicly discussed 

horizontal examinations. For public examples of enforcement actions that evidence these expectations and the FBAs’ 

continued focus to direct adequate governance of operational risks at banking organizations, see the following:

• Citibank, N.A., civil money penalty of $25,000,000 for ineffective risk management and internal controls 

(Mar. 19, 2019 );

• Capital One, N.A., civil money penalty of $100,000,000 for deficiencies in its BSA/anti-money laundering 

compliance program (Oct. 23, 2018);

• Wells Fargo Bank, N.A., civil money penalty of $500,000,000 for deficiencies in its compliance risk 

management program (Apr. 20, 2018) and the Federal Reserve placed an asset growth cap on the holding 

company for deficiencies in risk management and corporate governance; and

• JP Morgan Chase & Co, civil money penalty of $342,000,000 for misconduct and deficiencies in compliance 

risk management.

Recent horizontal examinations to assess operational risks across the national banks also provide a public example of 

supervision practices in this area. In 2016-17, the OCC performed a review across all large and mid-size institutions 

to assess sales practices. As documented in the Testimony of Thomas J. Curry, Comptroller of the Currency before 
Page 153

Principle 25: Operational risk

the Committee on Banking, Housing, and Urban Affairs of the United States Senate on September 20, 2016, the 

Comptroller directed “examiners to review the sales practices of all the large and midsize banks the OCC supervises 

and assess the sufficiency of controls with respect to these practices.” These examinations served to address possible 

systemic weaknesses relating to governance in the selling of products and services and culminated in the above 

Congressional testimony and the issuance of supervisory letters to participating banks. For another example, 

annually, the OCC performs a horizontal review to assess systemic compliance with DFAST stress testing 

requirements. The Federal Reserve has also said publicly that it uses horizontal examinations to assess the strength of 

firms’ operational risk management. See p. 21 of the Federal Reserve’s May 2019 Supervision and Regulation 

Report.

EC 2 Principle 25: Operational risk

Criterion The supervisor requires that the bank’s strategies, policies and processes for the management of operational risk 

(including the banks’ risk appetite for operational risk) to be approved and regularly reviewed by the banks’ Boards. 

The supervisor also requires that the Board oversees management in ensuring that these policies and processes are 

implemented effectively.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The issuances discussed in EC 1 of this BCP are also relevant to EC 2 as they discuss board oversight of 

operational risk management.

• In July 2016, the OCC developed the Corporate and Risk Governance Handbook (issued July 2016, updated 

July 2019). The handbook addresses the strategic, reputation, compliance, and operational risks as they relate 

to governance. It provides examiners principles based guidance on the roles and responsibilities of the board 

of directors and senior management in overseeing corporate and risk governance activities.

• In October 2017, the OCC issued new guidance on new, modified, or expanded bank products and services

(OCC Bulletin 2017-43, New, Modified, or Expanded Bank Products and Services). The guidance served to 

significantly expand on previous guidance issued in 2004. The new guidance provides risk management 

principles that should inform bank management and boards of directors on the importance of considering the 

impact of new activities on banks’ financial performance, strategic planning process, risk profiles, business

models, and ability to remain competitive.
Page 154

Principle 25: Operational risk

• The FFIEC IT Examination Handbook Management Booklet explains how risk management is a component 

of governance and how IT risk management (ITRM) is a component of risk management. This booklet 

describes the interaction of these components. The examination procedures in this booklet assist examiners in 

evaluating IT governance as part of overall governance in financial institutions and processes for ITRM as 

part of risk management in financial institutions.

• The OCC routinely conducts outreach for directors and bank management. The OCC sponsors periodic 

forums for midsize and large banks to address current and emerging operational risks (e.g., workshops). 

These forums and the director outreach activities serve to enhance discussions and approaches to address 

operational risks across the industry. 

EC 3 Principle 25: Operational risk

Criterion The supervisor determines that the approved strategy and significant policies and processes for the management of 

operational risk are implemented effectively by management and fully integrated into the bank’s overall risk 

management process.

Legal 

Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 25: Operational risk

Criterion The supervisor reviews the quality and comprehensiveness of the bank’s disaster recovery and business continuity 

plans to assess their feasibility in scenarios of severe business disruption which might plausibly affect the bank. In so 

doing, the supervisor determines that the bank is able to operate as a going concern and minimize losses, including 

those that may arise from disturbances to payment and settlement systems, in the event of severe business disruption.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs actively support the BCBS’s current initiative to draft principles on operational resilience and to 

update the Principles for the Sound Management of Operational Risk (PSMOR).
Page 155

Principle 25: Operational risk

• In October 2015, the Federal Reserve issued SR Letter 15-10 / CA Letter 15-8 relating to the expansion of the 

Federal Reserve’s Emergency Communications System in case of cyber emergencies. 

EC 5 Principle 25: Operational risk

Criterion The supervisor determines that banks have established appropriate information technology policies and processes to 

identify, assess, monitor and manage technology risks, including cybersecurity. The supervisor also determines that 

banks have appropriate and sound information technology infrastructure to meet their current and projected business 

requirements (under normal circumstances and in periods of stress), which ensures data and system integrity, security 

and availability and supports integrated and comprehensive risk management.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• On June 30, 2015, the FFIEC, on behalf of its members, issued a Cybersecurity Assessment Tool

(Assessment) that financial institutions may use to evaluate their risks and cybersecurity preparedness. The 

OCC has implemented the Assessment as part of the bank examination process to benchmark and assess bank 

cybersecurity efforts. While use of the Assessment is optional for banks, OCC examiners continue to use the 

Assessment to supplement examination work to gain a more complete understanding of banks’ inherent risk, 

risk management practices, and controls related to cybersecurity. See the OCC Bulletin 2016-34 Frequently 

Asked Questions on the FFIEC Cybersecurity Assessment Tool. The FBAs perform cybersecurity 

examinations on the largest and most significant service providers for the banking industry. In July 2015, the 

Federal Reserve issued SR Letter 15-9 announcing the development of the Cybersecurity Assessment Tool 

and stating that the Federal Reserve would plan to utilize the assessment tool as part of the examination 

process. In addition, the FBAs include cybersecurity assessment in the scope of examinations at the largest 

and most significant service providers for the banking industry.

• The FFIEC members have published and continue to publish various statements to inform the industry of 

evolving cyber risks. For example:

o Joint Statement ― Cyber Attacks Compromising Credentials

o Joint Statement ― Cybersecurity of Interbank Messaging and Wholesale Payment Networks

o Joint Statement ― Cyber Attacks Involving Extortion
Page 156

Principle 25: Operational risk

• The FFIEC members recommend that banks participate in the Financial Services Information Sharing and 

Analysis Center (FS-ISAC). The FS-ISAC is a private-sector nonprofit information-sharing forum established 

by financial services industry participants in response to the federal government’s efforts to facilitate the 

public and private sectors’ sharing of physical and cybersecurity threat and vulnerability information 

(Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement). Additional interagency efforts 

supporting FBA supervision include Treasury-lead initiatives, such as the Hamilton Series which simulate a 

variety of plausible cybersecurity incidents or attacks to better prepare the financial sector and the public 

sector in responding to cyber-attacks. These cyber-exercises are developed in collaboration with the FBAs, 

the FS-ISAC, the Financial Services Sector Coordinating Council (FSSCC), U.S. Treasury Department and 

other U.S. government agencies.

• In October 2018, the FDIC introduced the cybersecurity preparedness resource (FIL-63-2018). As part of the 

FDIC’s Community Banking Initiative, the agency added to its cybersecurity resources for financial 

institutions. This includes two new vignettes for the Cyber Challenge, which consists of exercises that are 

intended to encourage discussions of operational risk issues and the potential impact of information 

technology distruptions on common banking functions. The Cyber Challenge facilitates discussion between 

financial institution management and staff about operational risk issues. The exercises are designed to 

provide valuable information about an institution’s current state of preparedness and identify opportunities to 

strengthen resilience to operational risk.

As a clarification to the 2014 Self-Assessment, FBA examiners continue to routinely assess bank compliance with 

GLBA and its implementing regulations (see the Overview) as part of ongoing supervision. The Information Security 

Guidelines implementing GLBA requires banks to protect customer information from foreseeable threats in security 

and data integrity. The GLBA’s title on Privacy (Title V, Subtitle A: Disclosure of Nonpublic Personal Information) 

further requires financial institutions to provide each consumer with a privacy notice at the time the consumer 

relationship is established and annually thereafter. See 15 U.S.C. §§ 6801–6809. 

EC 6 Principle 25: Operational risk

Criterion The supervisor determines that banks have appropriate and effective information systems to: 

(a) monitor operational risk;

(b) compile and analyse operational risk data; and 

(c) facilitate appropriate reporting mechanisms at the banks’ Boards, senior management and business line levels that 

support proactive management of operational risk.
Page 157

Principle 25: Operational risk

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• The OCC’s Heightened Standards Guidelines, discussed in BCP 15, EC 1, address Risk Data Aggregation 

and Reporting. The Standards require a risk governance framework includsive of a set of policies, supported 

by appropriate procedures and processes, designed to provide risk data aggregation and reporting capabilities 

appropriate for the size, complexity, and risk profile of the covered bank, and to support supervisory reporting 

requirements. Collectively, these policies, procedures, and processes should provide for: (1) the design, 

implementation, and maintenance of a data architecture and information technology infrastructure that 

support the covered bank's risk aggregation and reporting needs during normal times and during times of 

stress; (2) the capturing and aggregating of risk data and reporting of material risks, concentrations, and 

emerging risks in a timely manner to the board of directors and the OCC; and (3) the distribution of risk 

reports to all relevant parties at a frequency that meets their needs for decision-making purposes.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs continue to provide guidance on operational risk management directly to the supervised 

institutions. Recent examples include:

o Targeted communications to supervised banks reflecting operational risks recognized in the industry 

(e.g., the OCC issued supervisory letters to participating large banks to highlight the findings of the 

Large Bank Supervision’s horizontal examination of Independent Operational Risk Management in 

April 2018).

o The OCC continues to communicate to the industry by publishing the semi-annual risk perspective 

publication. See e.g., the Spring 2019 edition. The communications have addressed such topics as 

cyber, third party risk management, and concentrations in core processing providers.

o The OCC’s Office of Innovation provides a forum for FinTechs and banks to discuss enhancements 

and innovations to operational processes and product delivery.

EC 7 Principle 25: Operational risk

Criterion The supervisor requires that banks have appropriate reporting mechanisms to keep the supervisor apprised of 

developments affecting operational risk at banks in their jurisdictions.

Legal 

Framework/ 

No material changes have occurred since the 2014 Self-Assessment. 
Page 158

Principle 25: Operational risk

Practices and 

Procedures

EC 8 Principle 25: Operational risk

Criterion The supervisor determines that banks have established appropriate policies and processes to assess, manage and 

monitor outsourced activities. The outsourcing risk management program covers: 

(a) conducting appropriate due diligence for selecting potential service providers; 

(b) structuring the outsourcing arrangement; 

(c) managing and monitoring the risks associated with the outsourcing arrangement; 

(d) ensuring an effective control environment; and 

(e) establishing viable contingency planning. 

Outsourcing policies and processes require the bank to have comprehensive contracts and/or service level agreements 

with a clear allocation of responsibilities between the outsourcing provider and the bank. 

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• While FBA examiners continue to evaluate, through on-site exams, that a bank establishes appropriate 

policies and processes to assess, manage, and monitor outsourced activities, recent guidance reflects how the 

FBA is implementing a shift from “vendor management” to “third party risk management.” The term 

“vendor” is a limited term that traditionally was used to refer to suppliers. The term “third-party” is intended 

to include all of a bank’s traditional vendors, but also entities that enter into business arrangements with the 

bank. Examples include:

o Supplemental Examination Procedures for Third-Party Relationships (Jan. 2017) (OCC 2017-7)

o Frequently Asked Questions to Supplement OCC Bulletin 2013-29 (June 2017) (OCC 2017-21) 

EC 9 Principle 25: Operational risk

Additional 

Criterion

The supervisor regularly identifies any common points of exposure to operational risk or potential vulnerability (e.g., 

outsourcing of key operations by many banks to a common service provider or disruption to outsourcing providers of 

payment and settlement activities).

Legal Framework No material changes have occurred since the 2014 Self-Assessment.
Page 159

Principle 25: Operational risk

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• Deriving authority and jurisdiction from the Bank Service Company Act (12 U.S.C. §§ 1861 et seq.), the 

FBAs continue to cooperate in supervising large, complex or systemically important service providers that 

perform material services for financial institutions. These service providers are examined under the 

Significant Service Provider (SSP) program (restructured in 2018), which is the successor to the Multiregional Data Processing Servicers (MDPS) Program. To address the FBAs’ enhanced oversight efforts, the 

OCC, for example, has created a dedicated examination team comprised of senior examiners who are solely 

focused on addressing the risks inherent in the operation of these service providers through ongoing 

monitoring and periodic examinations. The FBAs continue to focus and strengthen processes, having a 

defined program for the identification and ongoing supervision of significant service providers to the banking 

industry.
Page 160

Principle 26: Internal control and audit

The supervisor determines that banks have adequate internal control frameworks to establish and maintain a properly controlled operating 

environment for the conduct of their business taking into account their risk profile. These include clear arrangements for delegating authority and 

responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; 

reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent52 internal audit and compliance functions to test 

adherence to these controls as well as applicable laws and regulations.

Overview

The 2014 Self-Assessment cited a number of regulatory issuances relevant to this core principle that remain applicable. Since that assessment 

was drafted, a number of other relevant agency issuances have been released, including: 

• OCC’s Heightened Standards Guidelines at Appendix D to 12 CFR part 30 (issued Sept. 2014). See BCP 15, EC 1 for more 

information.

• Updates to the OCC Comptroller’s Handbook series, including the Large Bank Supervision (issued in June 2018), Community Bank 

Supervision (issued in June 2018), Bank Supervision Process (issued in June 2018), Corporate and Risk Governance (issued July 2016

updated July 2019), Internal and External Audit, (issued Dec. 2016, updated 2019), and Compliance Management Systems (issued June 

2018) handbooks.

• OCC Bulletin 2019-37 - Fraud Risk Management Principles (issued July 2019).

• The Federal Reserve’s SR 16-11 – Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total 

Consolidated Assets Less than $50 billion (issued June 2016).

• Updates to the Federal Reserve’s BHC Supervision Manual, section 4070.1 (revised July 2016).

• The Federal Reserve’s new LFI Rating System (final rule issued Nov. 2018), which includes a “Governance and Controls” component 

rating to account for the effectiveness of a firm’s independent risk management and controls. See BCP 8, EC 1 for additional 

information.

EC 1 Principle 26: Internal control and audit

Criterion Laws, regulations or the supervisor require banks to have internal control frameworks that are adequate to establish a 

properly controlled operating environment for the conduct of their business, taking into account their risk profile. These 

52 In assessing independence, supervisors give due regard to the control systems designed to avoid conflicts of interest in the performance 

measurement of staff in the compliance, control and internal audit functions. For example, the remuneration of such staff should be determined 

independently of the business lines that they oversee.
Page 161

Principle 26: Internal control and audit

controls are the responsibility of the bank’s Board and/or senior management and deal with organisational structure, 

accounting policies and processes, checks and balances, and the safeguarding of assets and investments (including 

measures for the prevention and early detection and reporting of misuse such as fraud, embezzlement, unauthorised 

trading and computer intrusion). More specifically, these controls address:

(a) organisational structure: definitions of duties and responsibilities, including clear delegation of authority (e.g., clear 

loan approval limits), decision-making policies and processes, separation of critical functions (e.g., business origination, 

payments, reconciliation, risk management, accounting, audit and compliance); 

(b) accounting policies and processes: reconciliation of accounts, control lists, information for management; 

(c) checks and balances (or “four eyes principle”): segregation of duties, cross-checking, dual control of assets, double 

signatures; and 

(d) safeguarding assets and investments: including physical control and computer access.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• In September 2014, the OCC issued final Heightened Standards Guidelines as Appendix D to 12 CFR part 30. 

See BCP 15, EC 1 for more information.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The OCC issued new handbooks in 2016 and 2018 to further address the roles and responsibilities of those 

organizational units that are fundamental to the design and implementation of the risk governance framework. 

See the OCC’s Large Bank, Community Bank, Corporate and Risk Governance, Internal and External Audit, and 

Compliance Management Systems handbooks. 

• In 2019, the OCC issued Bulletin 2019-37 - Fraud Risk Management Principles that supplements other OCC 

and interagency issuances on corporate and risk governance.

• In 2016, the Federal Reserve issued SR 16-11 setting out expectations for institutions with total consolidated 

assets of less than $50 billion with respect to oversight by boards of directors; the development adequate policies 

and procedures; and risk monitoring. These expectations were also incorporated into the BHC Supervision 

Manual section 4070.1. 

• The 2014 Self-Assessment lists SSAE 16 reports among those that supervisors review to determine where 

control weaknesses exist and whether management is addressing these deficiencies in a timely manner. These 

reports, also known as System and Organizational Control (SOC) reports, are issued in accordance with SSAE 

18 guidance, which superseded SSAE 16 effective May 2017. SSAE 18 expanded on SSAE 16 by requiring 
Page 162

Principle 26: Internal control and audit

auditors to obtain an understanding of the subject matter and to identify and assess risk of material misstatement 

and perform procedures in response to risks.

EC 2 Principle 26: Internal control and audit

Criterion The supervisor determines if there is an appropriate balance in the skills and resources of the back office, control 

functions and operational management relative to the business origination units. The supervisor also determines if the 

staff of the back office and control functions have sufficient expertise and authority within the organisation (and, where 

appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an effective check and balance 

to the business origination units.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• The OCC’s Heightened Standards Guidelines (Appendix D to 12 CFR part 30), which are discussed in BCP 15, 

EC 1, set out a framework for providing independent risk management and internal audit functions with stature 

and authority through direct reporting lines to a bank’s board of directors. The Guidelines also set expectations 

with respect to staffing levels and developing, attracting, and retaining talent to conduct control functions.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FBAs have issued guidance to clarify expectations regarding staffing at and the stature and authority of 

control functions. See the OCC’s Corporate and Risk Governance (issued July 2016, updated July 2019) and

Internal and External Audit handbooks (issued Dec. 2016); the Federal Reserve’s SR 16-11 – Supervisory 

Guidance for Assessing Risk Management at Supervised Institutions with Total Consolidated Assets Less than 

$50 billion (issued June 2016) and related updates to the BHC Supervision Manual section 4070.1 (revised 

July 2016). These issuances provide examiners and the management and boards of institutions with principlesbased, concrete guidance on the roles and responsibilities of the board of directors and senior management in 

overseeing corporate and risk governance activities. 

• The FBAs continue to hold supervised institutions accountable for having adequate risk management functions 

through supervisory activities and, where appropriate enforcement orders. For example, Figures 15-16 of the 

Federal Reserve’s May 2019 Supervision and Regulation Report indicate that most outstanding supervisory 

findings for large institutions relate to weaknesses in corporate governance and controls. As an example of 

enforcement, the Federal Reserve required remedial actions to improve the staffing and stature/authority of one 
Page 163

Principle 26: Internal control and audit

supervised firm’s risk management and control functions in a cease and desist order. See paragraphs 2(b), 

2(d)(i)(B), 2(d)(i)(C) of In the Matter of Wells Fargo & Company (Feb. 2018).

EC 3 Principle 26: Internal control and audit

Criterion The supervisor determines if banks have an adequately staffed, permanent and independent compliance function53 that 

assists senior management in managing effectively the compliance risks faced by the bank. The supervisor determines if 

staffs within the compliance function are suitably trained, have relevant experience and have sufficient authority within 

the bank to perform their role effectively. The supervisor determines if the bank’s Board exercises oversight of the 

management of the compliance function.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The various issuances discussed in EC 2 of this BCP are also relevant to EC 3 as they discuss compliance risk 

management. 

• In 2015, the FFIEC updated the compliance program section of its BSA/AML Examination Manual, which sets 

forth expectations for, among other things, the level of authority and responsibility of BSA/AML compliance 

officers, as well as training for personnel.

• In 2018, the OCC updated the Compliance Management Systems booklet of the Comptroller’s Handbook, which 

provides examiners guidance regarding, among other things, staffing and training for compliance professionals 

and the stature and authority of the BSA/AML officer. OCC also updated the Large Bank Supervision, 

Community Bank Supervision and Bank Supervision Process handbooks, which contain relevant information on 

OCC’s risk-based supervision approach.

• The FBAs continue to hold supervised institutions accountable for having adequate compliance risk 

management functions through supervisory activities and, where appropriate enforcement orders. For example, 

the Federal Reserve required one institution to remediate its BSA/AML compliance program with respect to 

talent/staffing. See paragraphs 1(c), 9(h) and 9(g) of In the Matter of Deutsche Bank AG (May 2017).

53 The term “compliance function” does not necessarily denote an organisational unit. Compliance staff may reside in operating business units or 

local subsidiaries and report up to operating business line management or local management, provided such staff also have a reporting line through 

to the head of compliance who should be independent from business lines.
Page 164

Principle 26: Internal control and audit

EC 4 Principle 26: Internal control and audit

Criterion The supervisor determines if banks have an independent, permanent and effective internal audit function54

charged with:

(a) assessing whether existing policies, processes and internal controls (including risk management, compliance and 

corporate governance processes) are effective, appropriate and remain sufficient for the bank’s business; and

(b) ensuring that policies and processes are complied with.

Legal Framework The following material change has occurred since the 2014 Self-Assessment:

• The OCC’s Heightened Standards Guidelines (Appendix D to 12 CFR part 30), address, among other things, 

standards for a bank’s internal audit system, including standards for internal audit’s oversight and structure, role 

and responsibilities, internal audit independence and competence, and the establishment of an internal audit 

QAIP department.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The FBAs continue to hold supervised institutions accountable for having adequate internal audit functions 

through supervisory activities and, where appropriate enforcement orders. For example, the Federal Reserve 

required several institutions to remediate their internal audit functions in connection with broader reviews of 

certain market activities. See e.g., paragraphs 4(a)-(c) of In the Matter of Goldman Sachs Group, Inc. (May 

2018).

EC 5 Principle 26: Internal control and audit

Criterion The supervisor determines that the internal audit function: 

(a) has sufficient resources, and staff that are suitably trained and have relevant experience to understand and evaluate 

the business they are auditing; 

(b) has appropriate independence with reporting lines to the bank’s Board or to an audit committee of the Board, and has 

status within the bank to ensure that senior management reacts to and acts upon its recommendations; 

(c) is kept informed in a timely manner of any material changes made to the bank’s risk management strategy, policies or 

processes; 

54 The term “internal audit function” does not necessarily denote an organisational unit. Some countries allow small banks to implement a system 

of independent reviews (e.g., conducted by external experts) of key internal controls as an alternative. 
Page 165

Principle 26: Internal control and audit

(d) has full access to and communication with any member of staff as well as full access to records, files or data of the 

bank and its affiliates, whenever relevant to the performance of its duties; 

(e) employs a methodology that identifies the material risks run by the bank; 

(f) prepares an audit plan, which is reviewed regularly, based on its own risk assessment and allocates its resources 

accordingly; and 

(g) has the authority to assess any outsourced functions.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

See the response to EC 4 of this BCP.
Page 166

Principle 27: Financial reporting and external audit

The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance 

with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial 

condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies 

of banking groups have adequate governance and oversight of the external audit function.

Overview

The following material change has been made since the 2014 Self-Assessment:

• In 2016, the FBAs issued Interagency Advisory on External Audits of Internationally Active U.S. Financial Institutions, which 

discusses BCBS Guidance on “External Audits of Banks.” The guidance sets out expectations for the relationship between supervisors 

and external auditors.

• In January 2017, 12 CFR 162.4 was rescinded. That rule required savings associations with composite ratings of 3, 4, or 5 to conduct 

an audit by a qualified independent public accountant. Savings associations with assets greater than $500 million are still required to 

conduct an audit by a qualified independent public accountant under other law. The rescission of 12 CFR 162.4 does not affect the 

OCC’s authority to require reports, including financial statements audited by a qualified independent public accountant, from savings 

associations with composite ratings of 3, 4, or 5. 

In addition, the FBAs would like to clarify that, pursuant to 12 U.S.C. § 1831m(d)(1), an independent public accountant must audit a bank’s 

financial statements in accordance with U.S. Generally Accepted Auditing Standards (GAAS) or the Public Company Accounting Oversight 

Board’s (PCOAB) auditing standards, if applicable.

EC 1 Principle 27: Financial reporting and external audit

Criterion The supervisor55 holds the bank’s Board and management responsible for ensuring that financial statements are prepared 

in accordance with accounting policies and practices that are widely accepted internationally and that these are 

supported by recordkeeping systems in order to produce adequate and reliable data.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

55 In this Essential Criterion, the supervisor is not necessarily limited to the banking supervisor. The responsibility for ensuring that financial 

statements are prepared in accordance with accounting policies and practices may also be vested with securities and market supervisors.
Page 167

Principle 27: Financial reporting and external audit

EC 2 Principle 27: Financial reporting and external audit

Criterion The supervisor holds the bank’s Board and management responsible for ensuring that the financial statements issued 

annually to the public bear an independent external auditor’s opinion as a result of an audit conducted in accordance 

with internationally accepted auditing practices and standards.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 3 Principle 27: Financial reporting and external audit

Criterion The supervisor determines that banks use valuation practices consistent with accounting standards widely accepted 

internationally. The supervisor also determines that the framework, structure and processes for fair value estimation are 

subject to independent verification and validation, and that banks document any significant differences between the 

valuations used for financial reporting purposes and for regulatory purposes.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 4 Principle 27: Financial reporting and external audit

Criterion Laws or regulations set, or the supervisor has the power to establish the scope of external audits of banks and the 

standards to be followed in performing such audits. These require the use of a risk and materiality based approach in 

planning and performing the external audit.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 27: Financial reporting and external audit

Criterion Supervisory guidelines or local auditing standards determine that audits cover areas such as the loan portfolio, loan loss 

provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset 

securitisations, consolidation of and other involvement with off-balance sheet vehicles and the adequacy of internal 

control over financial reporting.
Page 168

Principle 27: Financial reporting and external audit

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The American Institute of Certified Public Accountants issued AU-C section 940, An Audit of Internal Control 

over Financial Reporting that Is Integrated with an Audit of Financial Statements, which is effective for periods

ending after December 15, 2016. AU-C section 940 requires an internal control over financial reporting (ICFR) 

audit to be integrated with an audit of the financial statements. An auditor may no longer issue a stand-alone 

opinion on ICFR. Thus, ICFR audits performed for FDICIA (as described in the Overview of the 2014 SelfAssessment) or other purposes must now be integrated with an audit of financial statements.

EC 6 Principle 27: Financial reporting and external audit

Criterion The supervisor has the power to reject and rescind the appointment of an external auditor who is deemed to have 

inadequate expertise or independence, or is not subject to or does not adhere to established professional standards.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. However, the FDIC would like to clarify that an

institution’s board or audit committee should determine that an audit firm is independent.

EC 7 Principle 27: Financial reporting and external audit

Criterion The supervisor determines that banks rotate their external auditors (either the firm or individuals within the firm) from 

time to time.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 8 Principle 27: Financial reporting and external audit

Criterion The supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank 

operations.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 169

Principle 27: Financial reporting and external audit

EC 9 Principle 27: Financial reporting and external audit

Criterion The supervisor requires the external auditor, directly or through the bank, to report to the supervisor matters of material 

significance, for example failure to comply with the licensing criteria or breaches of banking or other laws, significant 

deficiencies and control weaknesses in the bank’s financial reporting process or other matters that they believe are likely 

to be of material significance to the functions of the supervisor. Laws or regulations provide that auditors who make any 

such reports in good faith cannot be held liable for breach of a duty of confidentiality.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 10 Principle 27: Financial reporting and external audit

Additional 

Criterion

The supervisor has the power to access external auditors’ working papers, where necessary.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 170

Principle 28: Disclosure and transparency

The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that 

is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate 

governance policies and processes.

EC 1 Principle 28: Disclosure and transparency

Criterion Laws, regulations or the supervisor require periodic public disclosures56 of information by banks on a consolidated and, 

where appropriate, solo basis that adequately reflect the bank’s true financial condition and performance, and adhere to 

standards promoting comparability, relevance, reliability and timeliness of the information disclosed.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment: 

• On June 1, 2016, the Federal Reserve published a final notice in the Federal Register that requires IHCs of 

FBOs to (1) file regulatory reports applicable to BHCs; and (2) comply with the reporting requirements

associated with regulatory capital requirements. The revisions to the reporting became effective July 1, 2016. 

See 81 Fed. Reg. 35016.

• Pursuant to section 207 of EGRRCPA (Pub. L. 115-174, § 207), the threshold for reporting financial data on a 

consolidated basis was raised such that only BHCs with more than $3 billion in assets are requiring to submit 

such reports. See the Federal Reserve’s interim final rule changing such reporting requirements at 83 Fed. Reg. 

44195 (Aug. 2018). Regulatory reports include information about balance sheet items, off-balance-sheet 

exposures, profit and loss, capital adequacy, asset quality, and loan loss provisioning as well as some 

information on interest rate risk sensitivity and market risk. See 12 U.S.C. §§ 161, 1464(v), and 1817(a).

• The Federal Reserve implemented additional Pillar 3 disclosure standards applicable to certain U.S. BHCs

subject to TLAC began on March 27, 2017. See 82 Fed. Reg. 8266 (Jan. 24, 2017). The implementation of the 

Pillar 3 disclosure standards is expected to continue as part of the adoption of the final Basel III standards 

scheduled for implementation by the BCBS in 2022. 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

56 For the purposes of this Essential Criterion, the disclosure requirement may be found in applicable accounting, stock exchange listing, or other 

similar rules, instead of or in addition to directives issued by the supervisor.
Page 171

Principle 28: Disclosure and transparency

EC 2 Principle 28: Disclosure and transparency

Criterion The supervisor determines that the required disclosures include both qualitative and quantitative information on a bank’s 

financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures 

to related parties, transactions with related parties, accounting policies, and basic business, management, governance and 

remuneration. The scope and content of information provided and the level of disaggregation and detail is commensurate 

with the risk profile and systemic importance of the bank.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 3 Principle 28: Disclosure and transparency

Criterion Laws, regulations or the supervisor require banks to disclose all material entities in the group structure.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 28: Disclosure and transparency

Criterion The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards.

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 5 Principle 28: Disclosure and transparency

Criterion The supervisor or other relevant bodies regularly publishes information on the banking system in aggregate to facilitate 

public understanding of the banking system and the exercise of market discipline. Such information includes aggregate 

data on balance sheet indicators and statistical parameters that reflect the principal aspects of banks’ operations (balance 

sheet structure, capital ratios, income earning capacity, and risk profiles).

Legal Framework/

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.
Page 172

Principle 29: Abuse of financial services

The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high 

ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal 

activities.57

Overview

The following material change has occurred since the 2014 Self-Assessment:

• The cornerstone of a strong AML/CFT compliance program is the adoption and implementation of comprehensive customer due diligence 

(CDD / know-your-customer) policies, procedures, and processes for all customers. The comprehensive CDD program now includes 

written procedures reasonably designed to identify and verify beneficial owner(s) of legal entity customers. See 31 CFR 1010.230.

Although not a change since 2014 Self-Assessment, the FBAs provide the following additional information to clarify the 2014 Self-Assessment:

• State savings associations are required to establish and maintain procedures to ensure and monitor compliance with the BSA and to 

implement risk-based procedures for verifying the identity of each customer. 12 CFR 390.354.

• The FBAs and Treasury may take enforcement actions against banks and holding companies not only to address significant failures to 

comply with suspicious activity reporting and other recordkeeping and reporting requirements, but also in cases where noncompliance 

indicates possible fraudulent criminal activity. There are many criminal statutes, United States Code Title 18, which are applicable to 

many criminal or fraudulent acts relating to financial institutions:

o 18 U.S.C. § 4 - Misprision of Felony 

o 18 U.S.C. § 20 - Financial Institution Defined 

o 18 U.S.C. § 201 - Bribery of Public Officials 

o 18 U.S.C. § 215 - Bank Bribery 

o 18 U.S.C. § 371 - Conspiracy to Defraud 

o 18 U.S.C. § 471 - Counterfeiting and Forgery (Counterfeit Deterrence Act of 1992). This statute applies to persons who falsely make, 

forge, counterfeit, or alter any obligation or other security of the United States with intent to defraud. 

57 The Committee is aware that, in some jurisdictions, other authorities, such as a financial intelligence unit (FIU), rather than a banking 

supervisor, may have primary responsibility for assessing compliance with laws and regulations regarding criminal activities in banks, such as 

fraud, money laundering and the financing of terrorism. Thus, in the context of this Principle, “the supervisor” might refer to such other 

authorities, in particular in Essential Criteria 7, 8 and 10. In such jurisdictions, the banking supervisor cooperates with such authorities to achieve 

adherence with the criteria mentioned in this Principle. 
Page 173

Principle 29: Abuse of financial services

o 18 U.S.C. § 472 - Counterfeiting and Forgery. This statute applies to persons who intentionally defraud, pass, utter, publish, or sell the 

items contained in § 471 above. It also includes those persons who attempt to do so, or those who keep in their possession or conceal 

any such items. 

o 18 U.S.C § 500 - Counterfeiting and Forgery - Money Orders This statute applies to persons who intentionally defraud, falsely make, 

forge, counterfeit, engrave, or print any order in imitation of, or purporting to be, a blank money order. It also applies to those who 

receive or possess any such money order with the intent to convert it for their own use or gain, knowing that it had been embezzled, 

stolen, or converted. 

o 18 U.S.C. § 656 - Theft, Embezzlement, and Misapplication by Bank Officer or Employee 

o 18 U.S.C. § 657 - Theft, Embezzlement, and Misapplication of Funds 

o 18 U.S.C. § 658 - Property Mortgaged or Pledged to Farm Credit Agencies 

o 18 U.S.C. § 664 - Theft or Embezzlement from Employee Benefit Plans 

o 18 U.S.C. § 667 - Theft of Livestock 

o 18 U.S.C. § 709 - False Advertising or Misuse of FDIC Name 

o 18 U.S.C. § 1001 - False Statements or Entries 

o 18 U.S.C. § 1005 - False Bank Entries, Reports, and Transactions 

o 18 U.S.C. § 1007 - False statements made for the purpose of influencing an action of the FDIC in any way. 

o 18 U.S.C. § 1010 - Department of Housing and Urban Development (HUD) Transactions 

o 18 U.S.C. § 1014 - False Statements on a Loan or Credit Application 

o 18 U.S.C. § 1028 - Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and 

Information. 

o 18 U.S.C. § 1028A - Aggravated Identity Theft 

o 18 U.S.C. § 1029 - Fraud and Related Activity in Connection with Access Devices 

o 18 U.S.C. § 1030 - Computer Fraud 

o 18 U.S.C. § 1032 - Concealment of Assets from FDIC 

o 18 U.S.C. § 1037 - Fraud and Related Activity in Connection with Electronic Mail also known as the “CanSpam Act of 2003” 
Page 174

Principle 29: Abuse of financial services

o 18 U.S.C. § 1341 - Frauds and Swindles, also known as the Mail Fraud Statute 

o 18 U.S.C. § 1342 - Fictitious Name or Address 

o 18 U.S.C. § 1343 - Fraud by Wire, Radio, and Television also known as the Wire Fraud 

o 18 U.S.C. § 1344 - Bank Fraud. The intent to defraud must be shown, although the scheme does not have to be successful. Examples: 

check kiting; diverting loan proceeds for purposes other than stated, including repayment of other debt; out-of-trust in floor plan 

lending. 

o 18 U.S.C. § 1349 - Attempt and Conspiracy 

o 18 U.S.C. § 1517 - Obstructing Examination of a Financial Institution 

o 18 U.S.C. § 1519 - Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy 

o 18 U.S.C. § 1708 - Theft or Receipt of Stolen Mail 

o 18 U.S.C. § 1952 - Interstate and Foreign Travel or Transportation in Aid of Racketeering Enterprises 

o 18 U.S.C. § 1956 - Laundering of Monetary Instruments 

o 18 U.S.C. § 1957 - Engaging in Monetary Transactions in Property Derived from Specified Unlawful Activity 

o 18 U.S.C. § 2113 - Bank Robbery and Incidental Crimes 

o 18 U.S.C. § 2314 - Transportation of Stolen Goods, Securities, Moneys, Fraudulent State Tax Stamps, or Articles Used in 

Counterfeiting

o 18 U.S.C. § 2315 - Sale or Receipt of Stolen Goods, Securities, Moneys, of Fraudulent State Tax Stamps

EC 1 Principle 29: Abuse of financial services

Criterion Laws or regulations establish the duties, responsibilities, and powers of the supervisor related to the supervision of banks’ 

internal controls and enforcement of the relevant laws and regulations regarding criminal activities.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The National Bank Fraud Working Group was disbanded.
Page 175

Principle 29: Abuse of financial services

EC 2 Principle 29: Abuse of financial services

Criterion The supervisor determines banks have adequate policies and processes that promote high ethical and professional 

standards and prevent the bank from being used, intentionally or unintentionally, for criminal activities. This includes the

prevention and detection of criminal activity, and reporting of such suspected activities to the appropriate authorities.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. The following additional information is provided to 

clarify the 2014 Self-Assessment:

• State savings associations are required to establish and maintain BSA/AML compliance programs, 12 CFR 

390.354, including a customer identification program. 12 CFR 390.354(b)(2).

• State savings associations are required to file a suspicious activity report with FinCEN no later than 30-calendar 

days (extended to no later than 60 days, if a subject cannot be identified) of the initial detection of certain facts.

12 CFR 390.355(d)(5),

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 3 Principle 29: Abuse of financial services

Criterion In addition to reporting to the financial intelligence unit or other designated authorities, banks report to the banking 

supervisor suspicious activities and incidents of fraud when such activities/incidents are material to the safety, soundness, 

or reputation of the bank.58

Legal Framework No material changes have occurred since the 2014 Self-Assessment. The following additional information is provided to 

clarify the 2014 Self-Assessment:

• Where a SAR involves continuing activity, the bank is expected to review the SAR after 90 days and file a 

follow-up SAR no later than 120 days after the date of the previously related SAR filing.

• State savings associations are required to file a SAR whenever it detects any known or suspected federal criminal 

violation, or pattern of criminal violations, committed or attempted against the institution or involving a 

transaction or transactions conducted through the institution, where the filer believes that it was either an actual 

58 Consistent with international standards, banks are to report suspicious activities involving cases of potential money laundering and the financing 

of terrorism to the relevant national centre, established either as an independent governmental authority or within an existing authority or 

authorities serving as an FIU.
Page 176

Principle 29: Abuse of financial services

or potential victim of a criminal violation, or series of criminal violations, or that the filer was used to facilitate a 

criminal transaction, and (1) an insider was involved; or (2) over $5,000 was involved, and the filer can identify a 

suspect; or (3) over $25,000 was involved, but the institution cannot identify a suspect; or alternatively, that the 

transaction involves $5,000 or more and involves potential money laundering or violations of the BSA. 12 CFR 

390.355(d)(3),

• State savings associations are required to promptly notify the board of directors or board committee upon the 

filing of a SAR. 12 CFR 390.355(d)(9),

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 4 Principle 29: Abuse of financial services

Criterion If the supervisor becomes aware of any additional suspicious transactions, it informs the financial intelligence unit and, if

applicable, other designated authority of such transactions. In addition, the supervisor, directly or indirectly, shares 

information related to suspected or actual criminal activities with relevant authorities.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 5 Principle 29: Abuse of financial services

Criterion The supervisor determines that banks establish CDD policies and processes that are well documented and communicated 

to all relevant staff. The supervisor also determines that such policies and processes are integrated into the bank’s overall 

risk management and there are appropriate steps to identify, assess, monitor, manage, and mitigate risks of money 

laundering and the financing of terrorism with respect to customers, countries, and regions, as well as to products, 

services, transactions, and delivery channels on an ongoing basis. The CDD management programme, on a group-wide 

basis, has as its essential elements:

(a) a customer acceptance policy that identifies business relationships that the bank will not accept based on identified 

risks; 

(b) a customer identification, verification, and due diligence programme on an ongoing basis; this encompasses 

verification of beneficial ownership (as necessary), understanding the purpose and nature of the business relationship, and 

risk-based reviews to ensure that records are updated and relevant;

(c) policies and processes to monitor and recognise unusual or potentially suspicious transactions; 
Page 177

Principle 29: Abuse of financial services

(d) enhanced due diligence on high-risk accounts (e.g., escalation to the bank’s senior management level of decisions on 

entering into business relationships with these accounts or maintaining such relationships when an existing relationship 

becomes high-risk); 

(e) enhanced due diligence on politically exposed persons (including, among other things, escalation to the bank’s senior 

management level of decisions on entering into business relationships with these persons); and 

(f) clear rules on what records must be kept on CDD and individual transactions and their retention period. Such records 

have at least a five year retention period.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

o Pursuant to 31 CFR 1020.210 (issued in May 2016, with a compliance date of May 11, 2018), all banks must 

develop and implement appropriate risk-based procedures for conducting ongoing CDD, including, but not 

limited to: (i) obtaining and analyzing sufficient customer information to understand the nature and purpose of 

customer relationships for the purpose of developing a customer risk profile; and (ii) conducting ongoing 

monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer 

information, including information regarding the beneficial owner(s) of legal entity customers. CDD is a longstanding expectation as specified in the FFIEC BSA/AML Examination Manual dating back to its original 

publication in 2005. The CDD Rule codified this existing supervisory expectation for a bank’s BSA/AML 

compliance program to include appropriate risk-based procedures for ongoing CDD. See 81 Fed. Reg. 29397.

• Pursuant to 31 CFR 1010.230 (issued in May 2016, with a compliance date of May 11, 2018), all banks must 

establish and maintain written procedures that are reasonably designed to identify and verify beneficial owner(s) 

of legal entity customers and to include such procedures in its anti-money laundering compliance program.

These procedures must detail the identifying information that must be obtained for each beneficial owner of a 

legal entity customer opening a new account after May 11, 2018. At a minimum, the bank must obtain the 

beneficial owner(s) name, date of birth, address, and identification number for each legal entity customer and the 

bank must verify the information obtained on a risk basis. 

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FFIEC BSA/AML Examination Manual was updated in 2018 to specifically address the CDD and beneficial 

ownership regulatory requirements. The FBAs evaluate whether banks have developed and implemented 

appropriate risk-based policies, procedures, and processes for conducting ongoing CDD. 

Updated examples of enforcement actions: 

o FDIC
Page 178

Principle 29: Abuse of financial services

o In the Matter of Fulton Bank of New Jersey, Mount Laurel, NJ, FDIC-14-0406b (Feb. 25, 2015)

o In the Matter of Bank of Hydro, Hydro, OK, FDIC-17-0072b (Apr. 24, 2017)

o In the Matter of Mountain Valley Bank, Dunlap, TN, FDIC-18-0114b (Oct. 2, 2018)

o In the Matter of Lakeside State Bank, Oologah, OK, FDIC-18-0172b (Jan. 30, 2019)

o Federal Reserve

o Cease and Desist Order, In the Matter of The Bank and Trust, S.S.B., Del Rio, Texas, 17-023-B-SM 

(Aug. 18, 2017)

o Written Agreement, In the Matter of AllNations Bank, Calumet, Oklahoma, 18-030-WA/RB-SM (Oct. 

22, 2018)

o OCC

o In the Matter of Capital One, N.A., McLean, Virginia, AA-EC-2015-48 (OCC – 2015)

o In the Matter of Business Bank of Texas, N.A., Austin, Texas, AA-EC-2016-62 (2016)

o In the Matter of Continental National bank, Miami, Florida, AA-SO-2017-28 (2017)

o In the Matter of UBS AG, New York Branch, UBS AG, Stamford Branch and UBS AG Miami Branch, 

AA-EC-2018-30 (2018)

EC 6 Principle 29: Abuse of financial services

Criterion The supervisor determines that banks have in addition to normal due diligence, specific policies and processes regarding 

correspondent banking. Such policies and processes include: 

(a) gathering sufficient information about their respondent banks to understand fully the nature of their business and 

customer base, and how they are supervised; and 

(b) not establishing or continuing correspondent relationships with those that do not have adequate controls against 

criminal activities or that are not effectively supervised by the relevant authorities, or with those banks that are 

considered to be shell banks.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:
Page 179

Principle 29: Abuse of financial services

• When the FFIEC BSA/AML Examination Manual was updated in 2014, new risk mitigation items were added to 

the chapter on Correspondent Accounts (Foreign) and a new section on reporting requirements deriving from the 

Comprehensive Iran Sanctions, Accountability and Divestment Act of 2010 was added to the chapter on Foreign 

Correspondent Account Recordkeeping, Reporting, and Due Diligence).

• In August 2016, the U.S. Department of the Treasury and the FBAs issued a joint fact sheet on Foreign 

Correspondent Banking: Approach to BSA/AML and OFAC Sanctions Supervision and Enforcement. In October 

2016, the OCC issued Risk Management Guidance on Foreign Correspondent Banking, which outlines OCC’s 

supervisory expectations for banks' consideration when conducting periodic evaluations of risk related to 

correspondent accounts for foreign financial institutions. 

• Updated examples of enforcement actions related to correspondent banking: 

o FDIC

 In the Matter of Louisa Community Bank, Louisa, KY, FDIC-17-0006b (May 4, 2017)

 In the Matter of Maryland Financial Bank, Towson, MD, FDIC-18-0061b (Apr. 26, 2018)

o Federal Reserve

 Cease and Desist Order, In the Matter of Habib Bank Ltd., Karachi, Pakistan, 15-038-B-FB (Dec. 11, 

2015)

 Cease and Desist Order, In the Matter of Industrial and Commercial Bank of China Ltd., Beijing, China, 

18-013-B-FB (Mar. 12, 2018)

 Cease and Desist Order and Assessment of Civil Money Penalty, In the Matter of Deutsche Bank AG, 

Frankfurt, Germany, 17-009-B-FB (May 26, 2017)

o OCC

 In the Matter of NBAD Americas, N.V., Washington, DC, AA-EC-2017-10 (2017)

 In the Matter of Bank of China, New York Branch, New York, New York, AA-EC-2018-19 (2018)

 In the Matter of UBS AG, New York Branch, UBS AG, Stamford Branch and UBS AG Miami Branch, 

AA-EC-2018-30 (2018)
Page 180

Principle 29: Abuse of financial services

EC 7 Principle 29: Abuse of financial services

Criterion The supervisor determines that banks have sufficient controls and systems to prevent, identify, and report potential abuses 

of financial services, including money laundering and the financing of terrorism.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. The following additional information is provided to 

clarify the 2014 Self-Assessment:

• State savings associations are required to establish and maintain a BSA/AML compliance program reasonably 

designed to ensure compliance with the requirements of the BSA including sufficient internal controls for 

monitoring suspicious activity, a qualified BSA compliance officer to oversee the program, independent testing 

to identify any vulnerabilities to the program, and regular BSA/AML compliance training for all relevant 

personnel. 12 CFR 390.354

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. Below are examples of recent enforcement actions 

related to the identification of non-AML financial crime:

• On April 15, 2019, the Federal Reserve announced a $158 million civil money penalty against UniCredit, S.p.A., 

and two of its subsidiaries, for the firm’s unsafe and unsound practices related to inadequate sanctions controls 

and supervision of its subsidiary banks. See Cease and Desist Order, In the Matter of UniCredit, S.p.A., Milan, 

Italy, No. 19-017-B-FB (Apr. 15, 2019).

• On February 17, 2016, the FDIC issued orders of prohibition against a former senior vice president at American 

Enterprise Bank, Buffalo Grove, Illinois (bank acquired December 2018) for unsafe and unsound banking 

practices. See In the Matter of Akash V. Brahmbhatt, an institution-affiliated party of American Enterprise 

Bank, Buffalo Grove, Illinois (Feb. 17, 2016)

• In 2017 and 2018, the FDIC issued orders of prohibition and orders to pay civil money penalties against the 

former senior executive officers of Edgebrook Bank, Chicago, Illinois. These officers engaged in violations of 

law and of an FDIC cease and desist order and engaged in unsafe and unsound banking practices. Their 

misconduct contributed to the bank’s failure. See In the Matter of Helen Popovic, an institution-affiliated party 

of Edgebrook Bank, Chicago, Illinois (May 5, 2017); In the Matter of James G. Ouper, an institution-affiliated 

party of Edgebrook Bank, Chicago, Illinois (May 11, 2017); In the Matter of John Gambacorta, an institutionaffiliated party of Edgebrook Bank, Chicago, Illinois (June 2, 2017); and In the Matter of Bernard W. Glavin, Jr., 

an institution-affiliated party of Edgebrook Bank, Chicago, Illinois (Nov. 9, 2017).
Page 181

Principle 29: Abuse of financial services

• On February 7, 2018, the OCC announced a $50 million civil money penalty against Rabobank, N.A., of 

Roseville, California, for the Bank’s failure to maintain an effective BSA program and the concealment of 

requested documentation from the OCC in violation of 12 U.S.C. § 481. See In the Matter of Rabobank, N.A., 

Roseville, California, No. AA-WE-2017-82 (Feb. 7, 2018)

• In 2018, the OCC issued orders of prohibition and orders to pay civil money penalties against the former senior 

executive officers/directors of Merchants Bank of California, Carson, California. These officers engaged in 

unsafe or unsound banking practices and caused, brought about, or participated in violations of law and the 

OCC’s cease and desist orders. See In the Matter of Susan Cavano, AA-EC-2017-77 (Mar. 7, 2018); In the 

Matter of Jane Chu, AA-EC-2017-76 (Mar. 2018); In the Matter of Rodrigo Garza, AA-EC-2017-75 (Apr. 2018); 

In the Matter of Daniel Roberts, AA-EC-2017-74 (June 2018).

EC 8 Principle 29: Abuse of financial services

Criterion The supervisor has adequate powers to take action against a bank that does not comply with its obligations related to 

relevant laws and regulations regarding criminal activities.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. Below are examples of cease and desist orders the 

FBAs have issued to address noncompliance with the BSA/AML compliance program requirements:

• FDIC Consent Orders:

o In the Matter of Crest Savings Bank, Wildwood, NJ, FDIC-15-0173b (Aug. 12, 2015)

o In the Matter of Carter Bank & Trust, Martinsville, VA, FDIC-16-0055b (Aug. 2, 2016)

o In the Matter of Shinhan Bank America, New York, NY, FDIC-16-0237b (June 17, 2017)

o In the Matter of Southwest Capital Bank , Albuquerque, NM, FDIC-18-0179b (Dec. 6, 2018)

• The OCC Consent Orders:

o In the Matter of Banco Bradesco S.A., New York, New York, AA-EC-2014-116 (Jan. 26, 2015)

o In the Matter of Neighborhood National Bank, San Diego, California, AA-EC-2016-24 (Mar. 24, 2016)

o In the Matter of NBAD Americas, N.V., Washington, D.C., AA-EC-2017-10 (Feb. 12, 2017) 
Page 182

Principle 29: Abuse of financial services

o In the Matter of Midsouth Bank, N.A., Lafayette, Louisiana, AA-SO-2018-62 (Oct. 25, 2018)

• Federal Reserve Cease and Desist orders:

o In the Matter of Bank of the Orient, San Francisco, California, 14-025-B-SM (June 17, 2015)

o In the Matter of Habib Bank Limited New York Branch, New York, New York, 15-038-B-FBR (Dec. 11, 

2015)

o In the Matter of CommerceWest Bank, Irvine, California, 16-005-B-SM (Apr. 12, 2016)

o In the Matter of Hua Nan Commercial Bank Limited New York Agency, New York, New York, 18-021-

B-FBR (Apr. 19, 2018)

EC 9 Principle 29: Abuse of financial services

Criterion The supervisor determines that banks have: 

(a) requirements for internal audit and/or external experts59 to independently evaluate the relevant risk management 

policies, processes, and controls. The supervisor has access to their reports; 

(b) established policies and processes to designate compliance officers at the banks’ management level, and appointed a 

relevant dedicated officer to whom potential abuses of the banks’ financial services (including suspicious transactions) 

are reported; 

(c) adequate screening policies and processes to ensure high ethical and professional standards when hiring staff; or when 

entering into an agency or outsourcing relationship; and

(d) ongoing training programmes for their staff, including CDD and methods to monitor and detect criminal and 

suspicious activities.

Legal Framework The following material changes have occurred since the 2014 Self-Assessment:

• FinCEN issued final rules that, among other things, require banks to develop and implement appropriate riskbased policies, procedures, and processes for conducting ongoing CDD to enable the bank (i) to understand the 

nature and purpose of the customer relationship in order to develop a customer risk profile; and (ii) to conduct 

ongoing monitoring for the purpose of identifying suspicious transactions and, on a risk basis, to maintain and 

update customer information, including information regarding the beneficial owner(s) of legal entity customer. 

59 These could be external auditors or other qualified parties, commissioned with an appropriate mandate, and subject to appropriate confidentiality 

restrictions.
Page 183

Principle 29: Abuse of financial services

The CDD Rule was issued in May 2016 with an implementation date of May 11, 2018. See 81 Fed. Reg. 29397; 

31 CFR 1020.210(b)(5). 

• In 2016 and 2017, FinCEN and Treasury issued rules requiring banks to have adequate written procedures for 

gathering and verifying information to be obtained, and retained (including name, address, taxpayer identification 

number, and date of birth) for beneficial owner(s) of legal entity customers; and (ii) whether the banks’ have 

adequate risk-based procedures for updating customer information, including beneficial owner information, and 

maintaining the current customer information. The Beneficial Ownership Rule was issued in May 2016 with an 

implementation date of May 11, 2018. See 81 Fed. Reg. 29397 and 82 Fed. Reg. 45182; 31 CFR 1010.230.

• See also discussion in BCPs 15, 26, and 27 for further background on general audit and risk management 

requirements.

Although not a change since the 2014 Self-Assessment, the following additional information is provided to clarify the 

2014 Self-Assessment: state savings associations are required to establish and maintain a BSA/AML compliance 

program. 12 CFR 390.354.

Practices and 

Procedures

The following material changes have occurred since the 2014 Self-Assessment:

• The FFIEC BSA/AML Examination Manual was updated in 2018 to specifically address the CDD and beneficial 

ownership regulatory requirements. 

• The FBAs have issued risk management guidance in a number of areas related to BSA/AML compliance. 

Examples include:

o For large banks (OCC Bulletin 2014-45), banking money service businesses (OCC Bulletin 2014-58), tax 

refund products (OCC Bulletin 2015-36), new and modified products (OCC Bulletin 2017-43), third 

party relationships (OCC Bulletins 2017-21). 

o FDIC Payment Processor Relationship Revised Guidance (Revised July 2014) (FIL-3-2012), FDIC 

Supervisory Approach to Payment Processing Relationships With Merchant Customers That Engage in 

Higher-Risk Activities (Revised July 2014) (FIL-43-2013), and FDIC Clarifying Supervisory Approach 

to Institutions Establishing Account Relationships with Third-Party Payment Processors (FIL-41-2014)
Page 184

Principle 29: Abuse of financial services

EC 10 Principle 29: Abuse of financial services

Criterion The supervisor determines that banks have and follow clear policies and processes for staff to report any problems related 

to the abuse of the banks’ financial services to either local management or the relevant dedicated officer or to both. The 

supervisor also determines that banks have and utilise adequate management information systems to provide the banks’ 

Boards, management, and the dedicated officers with timely and appropriate information on such activities.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 

EC 11 Principle 29: Abuse of financial services

Criterion Laws provide that a member of a bank’s staff who reports suspicious activity in good faith either internally or directly to 

the relevant authority cannot be held liable.

Legal Framework No material changes have occurred since the 2014 Self-Assessment. The following additional information is provided to 

clarify the 2014 Self-Assessment:

• State savings associations are subject to a safe harbor provision for filing SARs. 12 CFR 390.355(d)(13),

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment.

EC 12 Principle 29: Abuse of financial services

Criterion The supervisor, directly or indirectly, cooperates with the relevant domestic and foreign financial sector supervisory 

authorities or shares with them information related to suspected or actual criminal activities where this information is for 

supervisory purposes.

Legal Framework/ 

Practices and 

Procedures

No material changes have occurred since the 2014 Self-Assessment. 
Page 185

Principle 29: Abuse of financial services

EC 13 Principle 29: Abuse of financial services

Criterion Unless done by another authority, the supervisor has in-house resources with specialist expertise for addressing criminal 

activities. In this case, the supervisor regularly provides information on risks of money laundering and the financing of 

terrorism to the banks.

Legal Framework No material changes have occurred since the 2014 Self-Assessment.

Practices and 

Procedures

The following material change has occurred since the 2014 Self-Assessment:

• The FBAs organize outreach events and participate in industry events, such as conferences and workshops, to 

raise awareness, share information, and provide training on current topics and items of interest.
Page 186

Glossary of U.S. Banking Terminology 

Acronym Full Term

ABS

AfS

ALLL

ASC

ASU 

BCBS

BHC

BCP

BETR

CBLR

CCAR

CCyB

CCP

CDD

CET1

CFPB

CFTC

CLAR

CRE

CRO

DFA

DFAST

DIMIA

EGRRCPA

EPS

EVE

Asset Backed Securities

Available for sale

Allowance for Loan and Lease Losses

Accounting Standards Codification

Accounting Standards Update

Basel Committee on Banking Supervision

Bank Holding Company

Basel Core Principles

Bank Exams Tailored to Risk

Community Bank Leverage Ratio

Comprehensive Capital Analysis and Review

Counter Cyclical Capital Buffer

Central Clearing Counterparty

Customer Due Diligence

Common equity tier 1

Consumer Financial Protection Bureau

Commodity Futures Trading Commission

Comprehensive Liquidity Analysis and Review

Commercial Real Estate

Chief Risk Officer

Dodd-Frank Wall Street Reform and Consumer Protection Act

Dodd-Frank Act Stress Test

Depository Institution Management Interlocks Act 

Economic Growth, Regulatory Relief, and Consumer Protection Act

Enhanced Prudential Standards

Economic Value of Equity
Page 187

Glossary of U.S. Banking Terminology 

Acronym Full Term

FASB 

FASTA

FBA

FBO

FCA

FDIA

FDIC 

FHFA

FINRA 

FRB

FSA 

FSAP

FSOC 

FS-ISAC

FSSA

FSSCC

FTP

FX

GAAP 

GAAS

GAO

GPRA

GSE

GSIB

HCR

HLR

Financial Accounting Standards Board

Fixing America’s Surface Transportation Act

Federal Banking Agency

Foreign Bank Organization

Farm Credit Association

Federal Deposit Insurance Act

Federal Deposit Insurance Corporation

Federal Housing Finance Agency

Financial Industry Regulatory Authority

Federal Reserve Board

Federal Savings Association

Financial Sector Assessment Program

Financial Stability Oversight Council

Financial Services Information Sharing and Analysis Center

Financial System Stability Assessment

Financial Services Sector Coordinating Council

Funds Transfer Pricing

Foreign Exchange

Governance and Controls Program

Generally Acceptable Auditing Standards

Government Accountability Office

Government Performance Results Act of 1993, as amended

Government-Sponsored Enterprises

Global Systemically Important BHCs

Horizontal Capital Review

Horizontal Liquidity Review
Page 188

Glossary of U.S. Banking Terminology 

Acronym Full Term

HQLA

HVCRE

IBA 

ICFR

IDI

IHC

LCR

LFBO

LFI

LFR

LISCC

MAP

MBS

MDPS

MRBA

OCC

OCE

OIG

OMB 

PCA

PCAOB 

PRA

PSMOR

PWG

QFC

SCCL

High quality liquid assets

High volatility commercial real estate

International Banking Act

Internal Control over Financial Reporting

Insured Depository Institution 

Intermediate Holding Company

Liquidity Coverage Ratio

Large and Foreign Banking Organization

Large Financial Institution

Liquidity Focus Report 

Large Institution Supervision Coordinating Committee 

Monitoring and Analysis Program

Mortgage Backed Securities

Multi-Regional Data Processing Services

Matters Requiring Board Attention

Office of the Comptroller of the Currency

Office of the Chief Economist

Office of the Inspector General

Office of Management and Budget

Prompt Corrective Action

Public Company Accounting Oversight Board

Paperwork Reduction Act

Principles for the Sound Management of Operational Risk

President’s Working Group on Financial Markets

Qualified Financial Contracts

Single-Counterparty Credit Limits 
Page 189

Glossary of U.S. Banking Terminology 

Acronym Full Term

SIFI

SLHC

SOC

SOSA

SOX

SSP

TLAC

Systemically Important Financial Institution

Savings and Loan Holding Company

Statement of Cooperation

Strength of Support Assessment

Sarbanes-Oxley Act of 2002

Significant Service Provider

Total Loss Absorbing Capital