133

VII.

APPENDICES
THIS PAGE INTENTIONALLY LEFT BLANK
135 135

2017

A. KEY STATISTICS

APPENDICES

FDIC ACTIONS ON FINANCIAL INSTITUTIONS APPLICATIONS 

2015–2017

2017 2016 2015

Deposit Insurance 12 7 5

Approved1 12 7 5

Denied 0 0 0

New Branches 500 507 548

Approved 500 507 548

Denied 0 0 0

Mergers 218 245 270

Approved 218 245 270

Denied 0 0 0

Requests for Consent to Serve2 104 167 240

Approved 104 164 239

Section 19 1 9 7

Section 32 103 155 232

Denied 0 3 1

Section 19 0 0 0

Section 32 0 3 1

Notices of Change in Control 17 14 20

Letters of Intent Not to Disapprove 17 14 20

Disapproved 0 0 0

Brokered Deposit Waivers 12 14 20

Approved 11 13 20

Denied 1 1 0

Savings Association Activities 1 0 1

Approved 1 0 1

Denied 0 0 0

State Bank Activities/Investments3 2 5 10

Approved 2 5 10

Denied 0 0 0

Conversion of Mutual Institutions 5 5 4

Non-Objection 5 5 4

Objection 0 0 0

1 Includes deposit insurance application filed on behalf of (1) newly organized institutions, (2) existing uninsured financial services companies seeking 

establishment as an insured institution, and (3) interim institutions established to facilitate merger or conversion transactions, and applications to 

facilitate the establishment of thrift holding companies.

2 Under Section 19 of the Federal Deposit Insurance (FDI) Act, an insured institution must receive FDIC approval before employing a person convicted 

of dishonesty or breach of trust. Under Section 32, the FDIC must approve any change of directors or senior executive officers at a state nonmember 

bank that is not in compliance with capital requirements or is otherwise in troubled condition. 

3

 Section 24 of the FDI Act, in general, prohibits a federally-insured state bank from engaging in an activity not permissible for a national bank and 

requires notices to be filed with the FDIC.
ANNUAL REPORT

136 APPENDICES

COMBINED RISK AND CONSUMER ENFORCEMENT ACTIONS 

2015–2017

2017 2016 2015

Total Number of Actions Initiated by the FDIC 231 259 268

Termination of Insurance 9 5 11

Involuntary Termination 0 0 0

Sec. 8a For Violations, Unsafe/Unsound Practices or Conditions 0 0 0

Voluntary Termination 9 5 11

Sec. 8a By Order Upon Request 0 0 0

Sec. 8p No Deposits 8 5 6

Sec. 8q Deposits Assumed 1 0 5

Sec. 8b Cease-and-Desist Actions 26 30 48

Notices of Charges Issued 0 2 3

Orders to Pay Restitution 4 0 9

Consent Orders 14 26 36

Personal Cease and Desist Orders 8 2 0

Sec. 8e Removal/Prohibition of Director or Officer 65 97 88

Notices of Intention to Remove/Prohibit 7 8 4

Consent Orders 58 89 84

Sec. 8g Suspension/Removal When Charged With Crime 0 0 0

Civil Money Penalties Issued 47 37 45

Sec. 7a Call Report Penalties 0 0 0

Sec. 8i Civil Money Penalties 42 34 36

Sec. 8i Civil Money Penalty Notices of Assessment 5 3 9

Sec. 10c Orders of Investigation 9 10 19

Sec. 19 Waiver Orders 71 72 51

Approved Section 19 Waiver Orders 71 72 51

Denied Section 19 Waiver Orders 0 0 0

Sec. 32 Notices Disapproving Officer/Director’s Request for Review 0 1 0

Truth-in-Lending Act Reimbursement Actions 135 83 64

Denials of Requests for Relief 0 0 0

Grants of Relief 0 0 0

Banks Making Reimbursement* 135 83 64

Suspicious Activity Reports (Open and closed institutions)* 182,647 222,836 189,505

Other Actions Not Listed 4 7 6

* These actions do not constitute the initiation of a formal enforcement action and, therefore, are not included in the total number of actions initiated.
2017

APPENDICES 137

ESTIMATED INSURED DEPOSITS AND THE DEPOSIT INSURANCE FUND, 

DECEMBER 31, 1934, THROUGH SEPTEMBER 30, 20171

Dollars in Millions (except Insurance Coverage)

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total 

Domestic 

Deposits

Est. Insured

Deposits

2017 $250,000 $11,963,382 $7,091,993 59.3 $90,505.9 0.76 1.28 

2016 250,000 11,691,575 6,914,305 59.1 83,161.5 0.71 1.20 

2015 250,000 10,950,122 6,522,388 59.6 72,600.2 0.66 1.11 

2014 250,000 10,408,187 6,196,472 59.5 62,780.2 0.60 1.01 

2013 250,000 9,825,479 5,998,238 61.0 47,190.8 0.48 0.79 

2012 250,000 9,474,720 7,402,053 78.1 32,957.8 0.35 0.45 

2011 250,000 8,782,291 6,973,483 79.4 11,826.5 0.13 0.17 

2010 250,000 7,887,858 6,301,542 79.9 (7,352.2) (0.09) (0.12)

2009 250,000 7,705,354 5,407,773 70.2 (20,861.8) (0.27) (0.39)

2008 100,000 7,505,408 4,750,783 63.3 17,276.3 0.23 0.36 

2007 100,000 6,921,678 4,292,211 62.0 52,413.0 0.76 1.22 

2006 100,000 6,640,097 4,153,808 62.6 50,165.3 0.76 1.21 

2005 100,000 6,229,753 3,890,930 62.5 48,596.6 0.78 1.25 

2004 100,000 5,724,621 3,622,059 63.3 47,506.8 0.83 1.31 

2003 100,000 5,223,922 3,452,497 66.1 46,022.3 0.88 1.33 

2002 100,000 4,916,078 3,383,598 68.8 43,797.0 0.89 1.29 

2001 100,000 4,564,064 3,215,581 70.5 41,373.8 0.91 1.29 

2000 100,000 4,211,895 3,055,108 72.5 41,733.8 0.99 1.37 

1999 100,000 3,885,826 2,869,208 73.8 39,694.9 1.02 1.38 

1998 100,000 3,817,150 2,850,452 74.7 39,452.1 1.03 1.38 

1997 100,000 3,602,189 2,746,477 76.2 37,660.8 1.05 1.37 

1996 100,000 3,454,556 2,690,439 77.9 35,742.8 1.03 1.33 

1995 100,000 3,318,595 2,663,873 80.3 28,811.5 0.87 1.08 

1994 100,000 3,184,410 2,588,619 81.3 23,784.5 0.75 0.92 

1993 100,000 3,220,302 2,602,781 80.8 14,277.3 0.44 0.55 

1992 100,000 3,275,530 2,677,709 81.7 178.4 0.01 0.01 

1991 100,000 3,331,312 2,733,387 82.1 (6,934.0) (0.21) (0.25)

1990 100,000 3,415,464 2,784,838 81.5 4,062.7 0.12 0.15 

1989 100,000 3,412,503 2,755,471 80.7 13,209.5 0.39 0.48 

1988 100,000 2,337,080 1,756,771 75.2 14,061.1 0.60 0.80 

1987 100,000 2,198,648 1,657,291 75.4 18,301.8 0.83 1.10 

1986 100,000 2,162,687 1,636,915 75.7 18,253.3 0.84 1.12 

1985 100,000 1,975,030 1,510,496 76.5 17,956.9 0.91 1.19 
ANNUAL REPORT

138 APPENDICES

ESTIMATED INSURED DEPOSITS AND THE DEPOSIT INSURANCE FUND, 

DECEMBER 31, 1934, THROUGH SEPTEMBER 30, 20171

 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1984 100,000 1,805,334 1,393,421 77.2 16,529.4 0.92 1.19 

1983 100,000 1,690,576 1,268,332 75.0 15,429.1 0.91 1.22 

1982 100,000 1,544,697 1,134,221 73.4 13,770.9 0.89 1.21 

1981 100,000 1,409,322 988,898 70.2 12,246.1 0.87 1.24 

1980 100,000 1,324,463 948,717 71.6 11,019.5 0.83 1.16 

1979 40,000 1,226,943 808,555 65.9 9,792.7 0.80 1.21 

1978 40,000 1,145,835 760,706 66.4 8,796.0 0.77 1.16 

1977 40,000 1,050,435 692,533 65.9 7,992.8 0.76 1.15 

1976 40,000 941,923 628,263 66.7 7,268.8 0.77 1.16 

1975 40,000 875,985 569,101 65.0 6,716.0 0.77 1.18 

1974 40,000 833,277 520,309 62.4 6,124.2 0.73 1.18 

1973 20,000 766,509 465,600 60.7 5,615.3 0.73 1.21 

1972 20,000 697,480 419,756 60.2 5,158.7 0.74 1.23 

1971 20,000 610,685 374,568 61.3 4,739.9 0.78 1.27 

1970 20,000 545,198 349,581 64.1 4,379.6 0.80 1.25 

1969 20,000 495,858 313,085 63.1 4,051.1 0.82 1.29 

1968 15,000 491,513 296,701 60.4 3,749.2 0.76 1.26 

1967 15,000 448,709 261,149 58.2 3,485.5 0.78 1.33 

1966 15,000 401,096 234,150 58.4 3,252.0 0.81 1.39 

1965 10,000 377,400 209,690 55.6 3,036.3 0.80 1.45 

1964 10,000 348,981 191,787 55.0 2,844.7 0.82 1.48 

1963 10,000 313,304 177,381 56.6 2,667.9 0.85 1.50 

1962 10,000 297,548 170,210 57.2 2,502.0 0.84 1.47 

1961 10,000 281,304 160,309 57.0 2,353.8 0.84 1.47 

1960 10,000 260,495 149,684 57.5 2,222.2 0.85 1.48 

1959 10,000 247,589 142,131 57.4 2,089.8 0.84 1.47 

1958 10,000 242,445 137,698 56.8 1,965.4 0.81 1.43 

1957 10,000 225,507 127,055 56.3 1,850.5 0.82 1.46 

1956 10,000 219,393 121,008 55.2 1,742.1 0.79 1.44 

1955 10,000 212,226 116,380 54.8 1,639.6 0.77 1.41 

1954 10,000 203,195 110,973 54.6 1,542.7 0.76 1.39 

1953 10,000 193,466 105,610 54.6 1,450.7 0.75 1.37 

1952 10,000 188,142 101,841 54.1 1,363.5 0.72 1.34 
2017

APPENDICES 139

ESTIMATED INSURED DEPOSITS AND THE DEPOSIT INSURANCE FUND, 

DECEMBER 31, 1934, THROUGH SEPTEMBER 30, 20171

 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1951 10,000 178,540 96,713 54.2 1,282.2 0.72 1.33 

1950 10,000 167,818 91,359 54.4 1,243.9 0.74 1.36 

1949 5,000 156,786 76,589 48.8 1,203.9 0.77 1.57 

1948 5,000 153,454 75,320 49.1 1,065.9 0.69 1.42 

1947 5,000 154,096 76,254 49.5 1,006.1 0.65 1.32 

1946 5,000 148,458 73,759 49.7 1,058.5 0.71 1.44 

1945 5,000 157,174 67,021 42.6 929.2 0.59 1.39 

1944 5,000 134,662 56,398 41.9 804.3 0.60 1.43 

1943 5,000 111,650 48,440 43.4 703.1 0.63 1.45 

1942 5,000 89,869 32,837 36.5 616.9 0.69 1.88 

1941 5,000 71,209 28,249 39.7 553.5 0.78 1.96 

1940 5,000 65,288 26,638 40.8 496.0 0.76 1.86 

1939 5,000 57,485 24,650 42.9 452.7 0.79 1.84 

1938 5,000 50,791 23,121 45.5 420.5 0.83 1.82 

1937 5,000 48,228 22,557 46.8 383.1 0.79 1.70 

1936 5,000 50,281 22,330 44.4 343.4 0.68 1.54 

1935 5,000 45,125 20,158 44.7 306.0 0.68 1.52 

1934 5,000 40,060 18,075 45.1 291.7 0.73 1.61 

1 For 2017, figures are as of September 30; all other prior years are as of December 31. Prior to 1989, figures are for the Bank Insurance Fund (BIF) 

only and exclude insured branches of foreign banks. For 1989 to 2005, figures represent the sum of the BIF and Savings Association Insurance Fund 

(SAIF) amounts; for 2006 to 2017, figures are for DIF. Amounts for 1989-2017 include insured branches of foreign banks. Prior to year-end 1991, 

insured deposits were estimated using percentages determined from June Call and Thrift Financial Reports.

2 The year-end 2008 coverage limit and estimated insured deposits do not reflect the temporary increase to $250,000 then in effect under the 

Emergency Economic Stabilization Act of 2008. The Dodd-Frank Wall Street Reform and Consumer Protection (Dodd-Frank) Act made this coverage 

limit permanent. The year-end 2009 coverage limit and estimated insured deposits reflect the $250,000 coverage limit. The Dodd-Frank Act also 

temporarily provided unlimited coverage for non-interest bearing transaction accounts for two years beginning December 31, 2010. Coverage for 

certain retirement accounts increased to $250,000 in 2006. Initial coverage limit was $2,500 from January 1 to June 30, 1934.
ANNUAL REPORT

140 APPENDICES

INCOME AND EXPENSES, DEPOSIT INSURANCE FUND, FROM BEGINNING OF OPERATIONS, 

SEPTEMBER 11, 1933, THROUGH DECEMBER 31, 2017 

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other 

Ins. 

Expenses

Funding 

Transfer

from the 

FSLIC 

Resolution Fund

Net 

Income/

(Loss)

TOTAL $242,293.1 $175,595.0 $11,392.9 $78,091.0 $149,306.1 $108,291.2 $31,549.0 $9,466.0 $139.5 $93,126.5 

2017 11,663.7 10,594.8 0.0 1,068.9 0.0717% 1,558.2 (183.1) 1,739.4 2.0 0 10,105.5 

2016 10,674.1 9,986.6 0.0 687.5 0.0699% 150.6 (1,567.9) 1,715.0 3.5 0 10,523.5 

2015 9,303.5 8,846.8 0.0 456.7 0.0647% (553.2) (2,251.3) 1,687.2 10.9 0 9,856.7 

2014 8,965.1 8,656.1 0.0 309.0 0.0663% (6,634.7) (8,305.5) 1,664.3 6.5 0 15,599.8 

2013 10,458.9 9,734.2 0.0 724.7 0.0775% (4,045.9) (5,659.4) 1,608.7 4.8 0 14,504.8 

2012 18,522.3 12,397.2 0.2 6,125.3 0.1012% (2,599.0) (4,222.6) 1,777.5 (153.9) 0 21,121.3 

2011 16,342.0 13,499.5 0.9 2,843.4 0.1115% (2,915.4) (4,413.6) 1,625.4 (127.2) 0 19,257.4 

2010 13,379.9 13,611.2 0.8 (230.5) 0.1772% 75.0 (847.8) 1,592.6 (669.8) 0 13,304.9 

2009 24,706.4 17,865.4 148.0 6,989.0 0.2330% 60,709.0 57,711.8 1,271.1 1,726.1 0 (36,002.6)

2008 7,306.3 4,410.4 1,445.9 4,341.8 0.0418% 44,339.5 41,838.8 1,033.5 1,467.2 0 (37,033.2)

2007 3,196.2 3,730.9 3,088.0 2,553.3 0.0093% 1,090.9 95.0 992.6 3.3 0 2,105.3 

2006 2,643.5 31.9 0.0 2,611.6 0.0005% 904.3 (52.1) 950.6 5.8 0 1,739.2 

2005 2,420.5 60.9 0.0 2,359.6 0.0010% 809.3 (160.2) 965.7 3.8 0 1,611.2 

2004 2,240.3 104.2 0.0 2,136.1 0.0019% 607.6 (353.4) 941.3 19.7 0 1,632.7 

2003 2,173.6 94.8 0.0 2,078.8 0.0019% (67.7) (1,010.5) 935.5 7.3 0 2,241.3 

2002 2,384.7 107.8 0.0 2,276.9 0.0023% 719.6 (243.0) 945.1 17.5 0 1,665.1 

2001 2,730.1 83.2 0.0 2,646.9 0.0019% 3,123.4 2,199.3 887.9 36.2 0 (393.3)

2000 2,570.1 64.3 0.0 2,505.8 0.0016% 945.2 28.0 883.9 33.3 0 1,624.9 

1999 2,416.7 48.4 0.0 2,368.3 0.0013% 2,047.0 1,199.7 823.4 23.9 0 369.7 

1998 2,584.6 37.0 0.0 2,547.6 0.0010% 817.5 (5.7) 782.6 40.6 0 1,767.1 

1997 2,165.5 38.6 0.0 2,126.9 0.0011% 247.3 (505.7) 677.2 75.8 0 1,918.2 

1996 7,156.8 5,294.2 0.0 1,862.6 0.1622% 353.6 (417.2) 568.3 202.5 0 6,803.2 

1995 5,229.2 3,877.0 0.0 1,352.2 0.1238% 202.2 (354.2) 510.6 45.8 0 5,027.0 

1994 7,682.1 6,722.7 0.0 959.4 0.2192% (1,825.1) (2,459.4) 443.2 191.1 0 9,507.2 

1993 7,354.5 6,682.0 0.0 672.5 0.2157% (6,744.4) (7,660.4) 418.5 497.5 0 14,098.9 

1992 6,479.3 5,758.6 0.0 720.7 0.1815% (596.8) (2,274.7) 614.83 1,063.1 35.4 7,111.5 

1991 5,886.5 5,254.0 0.0 632.5 0.1613% 16,925.3 15,496.2 326.1 1,103.0 42.4 (10,996.4)

1990 3,855.3 2,872.3 0.0 983.0 0.0868% 13,059.3 12,133.1 275.6 650.6 56.1 (9,147.9)

1989 3,494.8 1,885.0 0.0 1,609.8 0.0816% 4,352.2 3,811.3 219.9 321.0 5.6 (851.8)

1988 3,347.7 1,773.0 0.0 1,574.7 0.0825% 7,588.4 6,298.3 223.9 1,066.2 0 (4,240.7)

1987 3,319.4 1,696.0 0.0 1,623.4 0.0833% 3,270.9 2,996.9 204.9 69.1 0 48.5 

1986 3,260.1 1,516.9 0.0 1,743.2 0.0787% 2,963.7 2,827.7 180.3 (44.3) 0 296.4 

1985 3,385.5 1,433.5 0.0 1,952.0 0.0815% 1,957.9 1,569.0 179.2 209.7 0 1,427.6 

1984 3,099.5 1,321.5 0.0 1,778.0 0.0800% 1,999.2 1,633.4 151.2 214.6 0 1,100.3 

1983 2,628.1 1,214.9 164.0 1,577.2 0.0714% 969.9 675.1 135.7 159.1 0 1,658.2 

1982 2,524.6 1,108.9 96.2 1,511.9 0.0769% 999.8 126.4 129.9 743.5 0 1,524.8 
2017

APPENDICES 141

INCOME AND EXPENSES, DEPOSIT INSURANCE FUND, FROM BEGINNING OF OPERATIONS, 

SEPTEMBER 11, 1933, THROUGH DECEMBER 31, 2017 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other 

Ins. 

Expenses

Funding 

Transfer

from the 

FSLIC 

Resolution Fund

Net 

Income/

(Loss)

1981 2,074.7 1,039.0 117.1 1,152.8 0.0714% 848.1 320.4 127.2 400.5 0 1,226.6 

1980 1,310.4 951.9 521.1 879.6 0.0370% 83.6 (38.1) 118.2 3.5 0 1,226.8 

1979 1,090.4 881.0 524.6 734.0 0.0333% 93.7 (17.2) 106.8 4.1 0 996.7 

1978 952.1 810.1 443.1 585.1 0.0385% 148.9 36.5 103.3 9.1 0 803.2 

1977 837.8 731.3 411.9 518.4 0.0370% 113.6 20.8 89.3 3.5 0 724.2 

1976 764.9 676.1 379.6 468.4 0.0370% 212.3 28.0 180.44 3.9 0 552.6 

1975 689.3 641.3 362.4 410.4 0.0357% 97.5 27.6 67.7 2.2 0 591.8 

1974 668.1 587.4 285.4 366.1 0.0435% 159.2 97.9 59.2 2.1 0 508.9 

1973 561.0 529.4 283.4 315.0 0.0385% 108.2 52.5 54.4 1.3 0 452.8 

1972 467.0 468.8 280.3 278.5 0.0333% 65.7 10.1 49.6 6.0 5 0 401.3 

1971 415.3 417.2 241.4 239.5 0.0345% 60.3 13.4 46.9 0.0 0 355.0 

1970 382.7 369.3 210.0 223.4 0.0357% 46.0 3.8 42.2 0.0 0 336.7 

1969 335.8 364.2 220.2 191.8 0.0333% 34.5 1.0 33.5 0.0 0 301.3 

1968 295.0 334.5 202.1 162.6 0.0333% 29.1 0.1 29.0 0.0 0 265.9 

1967 263.0 303.1 182.4 142.3 0.0333% 27.3 2.9 24.4 0.0 0 235.7 

1966 241.0 284.3 172.6 129.3 0.0323% 19.9 0.1 19.8 0.0 0 221.1 

1965 214.6 260.5 158.3 112.4 0.0323% 22.9 5.2 17.7 0.0 0 191.7 

1964 197.1 238.2 145.2 104.1 0.0323% 18.4 2.9 15.5 0.0 0 178.7 

1963 181.9 220.6 136.4 97.7 0.0313% 15.1 0.7 14.4 0.0 0 166.8 

1962 161.1 203.4 126.9 84.6 0.0313% 13.8 0.1 13.7 0.0 0 147.3 

1961 147.3 188.9 115.5 73.9 0.0323% 14.8 1.6 13.2 0.0 0 132.5 

1960 144.6 180.4 100.8 65.0 0.0370% 12.5 0.1 12.4 0.0 0 132.1 

1959 136.5 178.2 99.6 57.9 0.0370% 12.1 0.2 11.9 0.0 0 124.4 

1958 126.8 166.8 93.0 53.0 0.0370% 11.6 0.0 11.6 0.0 0 115.2 

1957 117.3 159.3 90.2 48.2 0.0357% 9.7 0.1 9.6 0.0 0 107.6 

1956 111.9 155.5 87.3 43.7 0.0370% 9.4 0.3 9.1 0.0 0 102.5 

1955 105.8 151.5 85.4 39.7 0.0370% 9.0 0.3 8.7 0.0 0 96.8 

1954 99.7 144.2 81.8 37.3 0.0357% 7.8 0.1 7.7 0.0 0 91.9 

1953 94.2 138.7 78.5 34.0 0.0357% 7.3 0.1 7.2 0.0 0 86.9 

1952 88.6 131.0 73.7 31.3 0.0370% 7.8 0.8 7.0 0.0 0 80.8 

1951 83.5 124.3 70.0 29.2 0.0370% 6.6 0.0 6.6 0.0 0 76.9 

1950 84.8 122.9 68.7 30.6 0.0370% 7.8 1.4 6.4 0.0 0 77.0 

1949 151.1 122.7 0.0 28.4 0.0833% 6.4 0.3 6.1 0.0 0 144.7 

1948 145.6 119.3 0.0 26.3 0.0833% 7.0 0.7 6.36 0.0 0 138.6 

1947 157.5 114.4 0.0 43.1 0.0833% 9.9 0.1 9.8 0.0 0 147.6 

1946 130.7 107.0 0.0 23.7 0.0833% 10.0 0.1 9.9 0.0 0 120.7 

1945 121.0 93.7 0.0 27.3 0.0833% 9.4 0.1 9.3 0.0 0 111.6 
ANNUAL REPORT

142 APPENDICES

INCOME AND EXPENSES, DEPOSIT INSURANCE FUND, FROM BEGINNING OF OPERATIONS, 

SEPTEMBER 11, 1933, THROUGH DECEMBER 31, 2017 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other 

Ins. 

Expenses

Funding 

Transfer

from the 

FSLIC 

Resolution Fund

Net 

Income/

(Loss)

1944 99.3 80.9 0.0 18.4 0.0833% 9.3 0.1 9.2 0.0 0 90.0 

1943 86.6 70.0 0.0 16.6 0.0833% 9.8 0.2 9.6 0.0 0 76.8 

1942 69.1 56.5 0.0 12.6 0.0833% 10.1 0.5 9.6 0.0 0 59.0 

1941 62.0 51.4 0.0 10.6 0.0833% 10.1 0.6 9.5 0.0 0 51.9 

1940 55.9 46.2 0.0 9.7 0.0833% 12.9 3.5 9.4 0.0 0 43.0 

1939 51.2 40.7 0.0 10.5 0.0833% 16.4 7.2 9.2 0.0 0 34.8 

1938 47.7 38.3 0.0 9.4 0.0833% 11.3 2.5 8.8 0.0 0 36.4 

1937 48.2 38.8 0.0 9.4 0.0833% 12.2 3.7 8.5 0.0 0 36.0 

1936 43.8 35.6 0.0 8.2 0.0833% 10.9 2.6 8.3 0.0 0 32.9 

1935 20.8 11.5 0.0 9.3 0.0833% 11.3 2.8 8.5 0.0 0 9.5 

1933-34 7.0 0.0 0.0 7.0 N/A 10.0 0.2 9.8 0.0 0 (3.0)

1 The effective assessment rate is calculated from annual assessment income (net of assessment credits), excluding transfers to the Financing 

Corporation (FICO), Resolution Funding Corporation (REFCORP) and FSLIC Resolution Fund, divided by the average assessment base. Figures 

represent only BIF-insured institutions prior to 1990, and BIF- and SAIF-insured institutions from 1990 through 2005. After 1995, all thrift closings 

became the responsibility of the FDIC and amounts are reflected in the SAIF. Beginning in 2006, figures are for the DIF.

The annualized assessment rate for 2017 is based on full year assessment income divided by a four quarter average of 2017 quarterly assessment base 

amounts. The assessment base for fourth quarter 2017 was estimated using the third quarter 2017 assessment base and an assumed quarterly growth 

rate of one percent.

Historical Assessment Rates:

1934 – 1949 The statutory assessment rate was 0.0833 percent.

1950 – 1984 The effective assessment rates varied from the statutory 

rate of 0.0833 percent due to assessment credits 

provided in those years.

1985 – 1989 The statutory assessment rate was 0.0833 percent (no 

credits were given).

1990 The statutory rate increased to 0.12 percent.

1991 – 1992 The statutory rate increased to a minimum of 0.15 

percent. The effective rates in 1991 and 1992 varied 

because the FDIC exercised new authority to increase 

assessments above the statutory minimum rate when 

needed.

1993 – 2006 Beginning in 1993, the effective rate was based on a 

risk-related premium system under which institutions 

paid assessments in the range of 0.23 percent to 0.31 

percent. In May 1995, the BIF reached the mandatory 

recapitalization level of 1.25 percent. As a result, BIF 

assessment rates were reduced to a range of 0.04 

percent to 0.31 percent of assessable deposits, effective 

June 1995, and assessments totaling $1.5 billion were 

refunded in September 1995. Assessment rates for the 

BIF were lowered again to a range of 0 to 0.27 percent 

of assessable deposits, effective the start of 1996. In 

1996, the SAIF collected a one-time special assessment 

of $4.5 billion. Subsequently, assessment rates for the 

SAIF were lowered to the same range as the BIF, effective 

October 1996. This range of rates remained unchanged 

for both funds through 2006.

2007 – 2008 As part of the implementation of the Federal Deposit 

Insurance Reform Act of 2005, assessment rates were 

increased to a range of 0.05 percent to 0.43 percent of 

assessable deposits effective at the start of 2007, but 

many institutions received a one-time assessment credit 

($4.7 billion in total) to offset the new assessments.

2009 – 2011 For the first quarter of 2009, assessment rates were 

increased to a range of 0.12 percent to 0.50 percent 

of assessable deposits. On June 30, 2009, a special 

assessment was imposed on all insured banks and 

thrifts, which amounted in aggregate to approximately 

$5.4 billion. For 8,106 institutions, with $9.3 trillion in 

assets, the special assessment was 5 basis points of 

each insured institution’s assets minus tier one capital; 

89 other institutions, with assets of $4.0 trillion, had their 

special assessment capped at 10 basis points of their 

second quarter assessment base. From the second 

quarter of 2009 through the first quarter of 2011, initial 

assessment rates ranged between 0.12 percent and 0.45 

percent of assessable deposits. Initial rates are subject 

to further adjustments.
2017

APPENDICES 143

2011 – 2016 Beginning in the second quarter of 2011, the assessment 

base changed to average total consolidated assets 

less average tangible equity (with certain adjustments 

for banker’s banks and custodial banks), as required 

by the Dodd-Frank Act. The FDIC implemented a new 

assessment rate schedule at the same time to conform 

to the larger assessment base. Initial assessment 

rates were lowered to a range of 0.05 percent to 0.35 

percent of the new base. The annualized assessment 

rates averaged approximately 17.6 cents per $100 of 

assessable deposits for the first quarter of 2011 and 

11.1 cents per $100 of the new base for the last three 

quarters of 2011 (which is shown in the table).

2016 Beginning July 1, 2016, initial assessment rates were 

lowered from a range of 5 basis points to 35 basis points 

to a range of 3 basis points to 30 basis points, and 

an additional surcharge was imposed on large banks 

(generally institutions with $10 billion or more in assets) of 

4.5 basis points of their assessment base (after making 

adjustments).

2 These expenses, which are presented as operating expenses in the Statement of Income and Fund Balance, pertain to the FDIC in its corporate 

capacity only and do not include costs that are charged to the failed bank receiverships that are managed by the FDIC. The receivership expenses are 

presented as part of the “Receivables from Resolutions, net” line on the Balance Sheet. The narrative and graph presented on page 91 of this report 

shows the aggregate (corporate and receivership) expenditures of the FDIC.

3 Includes $210 million for the cumulative effect of an accounting change for certain postretirement benefits (1992).

4 Includes a $106 million net loss on government securities (1976).

5 This amount represents interest and other insurance expenses from 1933 to 1972.

6 Includes the aggregate amount of $81 million of interest paid on capital stock between 1933 and 1948.
ANNUAL REPORT

144 APPENDICES

FDIC INSURED INSTITUTIONS CLOSED DURING 2017

Dollars in Thousands

Codes for Bank Class:

NM = State-chartered bank that is not a 

 member of the Federal Reserve System

N = National Bank

SB = Savings Bank

SI = Stock and Mutual 

Savings Bank

SM= State-chartered bank that is a 

member of the Federal Reserve System

SA = Savings Association

Name and Location

Bank 

Class

Number

of 

Deposit 

Accounts

Total 

Assets1

Total 

Deposits1

Insured 

Deposit 

Funding and 

Other 

Disbursements

Estimated 

Loss to 

the DIF2

Date of 

Closing 

or Acquisition

Receiver/Assuming 

Bank and Location

Purchase and Assumption - All Deposits

First NBC Bank

New Orleans, LA

NM 53,549 $3,325,870 $3,032,208 $2,966,960 $826,903 04/28/17 Whitney Bank

Gulfport, MS

Guaranty Bank

Milwaukee, WI

SA 287,742 $1,031,900 $1,002,026 $988,104 $143,423 05/05/17 First-Citizens Bank 

& Trust Company

Raleigh, NC

Fayette County Bank

Saint Elmo, IL

SM 1,257 $34,370 $33,972 $32,625 $9,015 05/26/17 United Fidelity 

Bank, FSB

Evansville, IN

Insured Deposit Transfer

Washington Federal 

Bank for Savings

Chicago, IL

SA 2,593 $166,345 $143,964 $137,509 $60,511 12/15/17 Royal 

Savings Bank

Chicago, IL

Whole Bank Purchase and Assumption - All Deposits

Harvest 

Community Bank

Pennsville, NJ

NM 7,083 $124,223 $122,177 $122,425 $22,689 01/13/17 First-Citizens Bank 

& Trust Company

Raleigh, NC

Seaway Bank and 

Trust Company

Chicago, IL

NM 19,239 $297,809 $256,505 $244,633 $55,465 01/27/17 State Bank 

of Texas

Dallas, TX

Proficio Bank

Cottonwood 

Heights, UT

NM 253 $68,208 $65,042 $57,157 $11,763 03/03/17 Cache Valley Bank

Logan, UT

The Farmers and 

Merchants State 

Bank of Argonia

Argonia, KS

NM 1,407 $33,012 $27,466 $27,411 $2,595 10/13/17 Conway Bank

Conway 

Springs, KS

1 Total Assets and Total Deposits data are based upon the last Call Report filed by the institution prior to failure.

2 Estimated losses are as of December 31, 2017. Estimated losses are routinely adjusted with updated information from new appraisals and asset 

sales, which ultimately affect the asset values and projected recoveries. Represents the estimated loss to the DIF from deposit insurance obligations. 
2017

APPENDICES 145

RECOVERIES AND LOSSES BY THE DEPOSIT INSURANCE FUND ON DISBURSEMENTS 

FOR THE PROTECTION OF DEPOSITORS, 1934 - 2017

Dollars in Thousands

Bank and Thrift Failures1

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3 Funding4 Recoveries5

Estimated 

Additional 

Recoveries

Final and 

Estimated 

Losses6

2,623 $946,643,412 $713,234,800 $586,955,906 $415,743,180 $64,090,944 $107,121,782 

2017 8 5,081,737 4,683,360 4,576,824 1,372,516 2,071,944 1,132,364 

2016 5 277,182 268,516 261,476 0 214,362 47,114 

2015 8 6,706,038 4,870,464 4,561,973 743,513 2,951,918 866,542 

2014 18 2,913,503 2,691,485 2,681,159 455,889 1,833,025 392,245 

2013 24 6,044,051 5,132,246 5,020,975 273,511 3,499,492 1,247,972 

2012 51 11,617,348 11,009,630 11,039,374 1,722,978 6,854,792 2,461,604 

2011 92 34,922,997 31,071,862 30,710,664 3,217,179 20,989,325 6,504,160 

20107 157 92,084,988 78,290,185 82,305,089 55,641,718 10,307,410 16,355,961 

20097 140 169,709,160 137,835,121 136,081,390 95,397,606 13,759,165 26,924,619 

20087 25 371,945,480 234,321,715 205,833,992 184,490,213 3,182,784 18,160,995 

2007 3 2,614,928 2,424,187 1,920,667 1,461,932 296,884 161,851 

2006 0 0 0 0 0 0 0 

2005 0 0 0 0 0 0 0 

2004 4 170,099 156,733 139,236 134,978 341 3,917 

2003 3 947,317 901,978 883,772 812,933 8,192 62,647 

2002 11 2,872,720 2,512,834 1,567,805 1,711,173 (493,685) 350,317 

2001 4 1,821,760 1,661,214 21,131 1,138,677 (1,410,011) 292,465 

2000 7 410,160 342,584 297,313 265,175 0 32,138 

1999 8 1,592,189 1,320,573 1,308,274 711,758 10,035 586,481 

1998 3 290,238 260,675 293,091 58,248 12,486 222,357 

1997 1 27,923 27,511 25,546 20,520 0 5,026 

1996 6 232,634 230,390 201,533 140,918 0 60,615 

1995 6 802,124 776,387 609,043 524,571 0 84,472 

1994 13 1,463,874 1,397,018 1,224,769 1,045,718 0 179,051 

1993 41 3,828,939 3,509,341 3,841,658 3,209,012 0 632,646 

1992 120 45,357,237 39,921,310 14,541,476 10,866,760 567 3,674,149 

1991 124 64,556,512 52,972,034 21,501,674 15,496,730 1,918 6,003,026 

1990 168 16,923,462 15,124,454 10,812,484 8,040,995 0 2,771,489 

1989 206 28,930,572 24,152,468 11,443,281 5,247,995 0 6,195,286 

1988 200 38,402,475 26,524,014 10,432,655 5,055,158 0 5,377,497 

1987 184 6,928,889 6,599,180 4,876,994 3,014,502 0 1,862,492 

1986 138 7,356,544 6,638,903 4,632,121 2,949,583 0 1,682,538 

1985 116 3,090,897 2,889,801 2,154,955 1,506,776 0 648,179 

1984 78 2,962,179 2,665,797 2,165,036 1,641,157 0 523,879 

1983 44 3,580,132 2,832,184 3,042,392 1,973,037 0 1,069,355 

1982 32 1,213,316 1,056,483 545,612 419,825 0 125,787 

1981 7 108,749 100,154 114,944 105,956 0 8,988 

1980 10 239,316 219,890 152,355 121,675 0 30,680 

1934 - 1979 558 8,615,743 5,842,119 5,133,173 4,752,295 0 380,878
ANNUAL REPORT

146 APPENDICES

RECOVERIES AND LOSSES BY THE DEPOSIT INSURANCE FUND ON DISBURSEMENTS 

FOR THE PROTECTION OF DEPOSITORS, 1934 - 2017

Dollars in Thousands

Assistance Transactions1

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3 Funding4 Recoveries5

Estimated 

Additional 

Recoveries

Final and 

Estimated 

Losses6

154 $3,317,099,253 $1,442,173,417 $11,630,356 $6,199,875 $0 $5,430,481 

2017 0 0 0 0 0 0 0 

2016 0 0 0 0 0 0 0 

2015 0 0 0 0 0 0 0 

2014 0 0 0 0 0 0 0 

2013 0 0 0 0 0 0 0 

2012 0 0 0 0 0 0 0 

2011 0 0 0 0 0 0 0 

2010 0 0 0 0 0 0 0 

20098 8 1,917,482,183 1,090,318,282 0 0 0 0 

20088 5 1,306,041,994 280,806,966 0 0 0 0 

2007 0 0 0 0 0 0 0 

2006 0 0 0 0 0 0 0 

2005 0 0 0 0 0 0 0 

2004 0 0 0 0 0 0 0 

2003 0 0 0 0 0 0 0 

2002 0 0 0 0 0 0 0 

2001 0 0 0 0 0 0 0 

2000 0 0 0 0 0 0 0 

1999 0 0 0 0 0 0 0 

1998 0 0 0 0 0 0 0 

1997 0 0 0 0 0 0 0 

1996 0 0 0 0 0 0 0 

1995 0 0 0 0 0 0 0 

1994 0 0 0 0 0 0 0 

1993 0 0 0 0 0 0 0 

1992 2 33,831 33,117 1,486 1,236 0 250 

1991 3 78,524 75,720 6,117 3,093 0 3,024 

1990 1 14,206 14,628 4,935 2,597 0 2,338 

1989 1 4,438 6,396 2,548 252 0 2,296 

1988 80 15,493,939 11,793,702 1,730,351 189,709 0 1,540,642 

1987 19 2,478,124 2,275,642 160,877 713 0 160,164 

1986 7 712,558 585,248 158,848 65,669 0 93,179 
2017

APPENDICES 147

RECOVERIES AND LOSSES BY THE DEPOSIT INSURANCE FUND ON DISBURSEMENTS 

FOR THE PROTECTION OF DEPOSITORS, 1934 - 2017 (continued)

Dollars in Thousands

Assistance Transactions1

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3 Funding4 Recoveries5

Estimated 

Additional 

Recoveries

Final and 

Estimated 

Losses6

1985 4 5,886,381 5,580,359 765,732 406,676 0 359,056 

1984 2 40,470,332 29,088,247 5,531,179 4,414,904 0 1,116,275 

1983 4 3,611,549 3,011,406 764,690 427,007 0 337,683 

1982 10 10,509,286 9,118,382 1,729,538 686,754 0 1,042,784 

1981 3 4,838,612 3,914,268 774,055 1,265 0 772,790 

1980 1 7,953,042 5,001,755 0 0 0 0 

1934-1979 4 1,490,254 549,299 0 0 0 0

1 Institutions for which the FDIC is appointed receiver, including deposit payoff, insured deposit transfer, and deposit assumption cases.

2 For 1990 through 2005, amounts represent the sum of BIF and SAIF failures (excluding those handled by the RTC); prior to 1990, figures are only 

for the BIF. After 1995, all thrift closings became the responsibility of the FDIC and amounts are reflected in the SAIF. For 2006 to 2017, figures are 

for the DIF.

3 Assets and deposit data are based on the last Call Report or TFR filed before failure.

4 Funding represents the amounts provided by the DIF to receiverships for subrogated claims, advances for working capital, and administrative 

expenses paid on their behalf. Beginning in 2008, the DIF resolves failures using whole-bank purchase and assumption transactions, most with an 

accompanying shared-loss agreement (SLA). The DIF satisfies any resulting liabilities by offsetting receivables from resolutions when receiverships 

declare a dividend and/or sending cash directly to receiverships to fund an SLA and other expenses.

5 Recoveries represent cash received and dividends (cash and non-cash) declared by receiverships.

6 Final losses represent actual losses for unreimbursed subrogated claims of inactivated receiverships. Estimated losses represent the difference 

between the amount paid by the DIF to cover obligations to insured depositors and the estimated recoveries from the liquidation of receivership 

assets.

7 Includes amounts related to transaction account coverage under the Transaction Account Guarantee Program (TAG). The estimated losses as of 

December 31, 2017, for TAG accounts in 2010, 2009, and 2008 are $378 million, $1.1 billion, and $13 million, respectively.

8 Includes institutions where assistance was provided under a systemic risk determination.
ANNUAL REPORT

148 APPENDICES

NUMBER, ASSETS, DEPOSITS, LOSSES, AND LOSS TO FUNDS OF INSURED 

THRIFTS TAKEN OVER OR CLOSED BECAUSE OF FINANCIAL DIFFICULTIES, 

1989 THROUGH 19951

Dollars in Thousands

Year

Number of 

Institutions Assets Deposits

Final 

Receivership 

Loss2

Loss to 

Fund3

Total 748 $393,986,574 $318,328,770 $75,977,846 $81,581,231

1995 2 423,819 414,692 28,192 27,750 

1994 2 136,815 127,508 11,472 14,599 

1993 10 6,147,962 5,708,253 267,595 65,212 

1992 59 44,196,946 34,773,224 3,286,908 3,832,145 

1991 144 78,898,904 65,173,122 9,235,967 9,734,263 

1990 213 129,662,498 98,963,962 16,062,685 19,257,578 

19894 318 134,519,630 113,168,009 47,085,027 48,649,684

1

 Beginning in 1989 through July 1, 1995, all thrift closings were the responsibility of the Resolution Trust Corporation (RTC). Since the RTC was 

terminated on December 31, 1995, and all assets and liabilities transferred to the FSLIC Resolution Fund (FRF), all the results of the thrift closing activity 

from 1989 through 1995 are now reflected on the FRF’s books. Year is the year of failure, not the year of resolution.

2

 The Final Receivership Loss represents the loss at the fund level from receiverships for unreimbursed subrogated claims of the FRF and unpaid 

advances to receiverships from the FRF.

3

 The Loss to Fund represents the total resolution cost of the failed thrifts in the FRF-RTC fund. In addition to the receivership losses, this includes 

corporate revenue and expense items such as interest expense on Federal Financing Bank debt, interest expense on escrowed funds, administrative 

expenses, and interest revenue on advances to receiverships.

4

 Total for 1989 excludes nine failures of the former FSLIC.
2017

APPENDICES 149

B. MORE ABOUT THE FDIC

FDIC Board of Directors

Martin J. Gruenberg 

Martin J. Gruenberg is the 

20th Chairman of the FDIC, 

receiving Senate confirmation 

on November 15, 2012, for a 

five-year term. Mr. Gruenberg 

served as Vice Chairman and 

Member of the FDIC Board 

of Directors from August 22, 

2005, until his confirmation as Chairman. He served 

as Acting Chairman from July 9, 2011, to November 

15, 2012, and also from November 16, 2005, to 

June 26, 2006.

Mr. Gruenberg joined the FDIC Board after broad 

congressional experience in the financial services and 

regulatory areas. He served as Senior Counsel to 

Senator Paul S. Sarbanes (D-MD) on the staff of the 

Senate Committee on Banking, Housing, and Urban 

Affairs from 1993 to 2005. Mr. Gruenberg advised 

the Senator on issues of domestic and international 

financial regulation, monetary policy, and trade. 

He also served as Staff Director of the Banking 

Committee’s Subcommittee on International Finance 

and Monetary Policy from 1987 to 1992. Major 

legislation in which Mr. Gruenberg played an active 

role during his service on the Committee includes 

the Financial Institutions Reform, Recovery, and 

Enforcement Act of 1989 (FIRREA); the Federal 

Deposit Insurance Corporation Improvement Act of 

1991 (FDICIA); the Gramm-Leach-Bliley Act; and 

the Sarbanes-Oxley Act of 2002.

Mr. Gruenberg served as Chairman of the Executive 

Council and President of the International Association 

of Deposit Insurers (IADI) from November 2007 to 

November 2012.

Mr. Gruenberg holds a J.D. from Case Western 

Reserve Law School and an A.B. from Princeton 

University, Woodrow Wilson School of Public and 

International Affairs.

Thomas M. Hoenig

Thomas M. Hoenig was 

confirmed by the Senate as 

Vice Chairman of the FDIC 

on November 15, 2012. He 

joined the FDIC on April 

16, 2012, as a member of 

the Board of Directors of the 

FDIC for a six-year term. 

Prior to serving on the FDIC Board, Mr. Hoenig was 

the President of the Federal Reserve Bank of Kansas 

City and a member of the Federal Reserve System’s 

Federal Open Market Committee from 1991 to 2011.

Mr. Hoenig was with the Federal Reserve for 38 

years, beginning as an economist, and then as a 

senior officer in banking supervision during the U.S. 

banking crisis of the 1980s. In 1986, he led the 

Kansas City Federal Reserve Bank’s Division of Bank 

Supervision and Structure, directing the oversight of 

more than 1,000 banks and bank holding companies 

with assets ranging from less than $100 million to 

$20 billion. He became President of the Kansas City 

Federal Reserve Bank on October 1, 1991.

Mr. Hoenig is a native of Fort Madison, Iowa, and 

received a doctorate in economics from Iowa State 

University.
ANNUAL REPORT

150 APPENDICES

Mick Mulvaney 

Mick Mulvaney is Acting 

Director of the Consumer 

Financial Protection Bureau.

Mick Mulvaney is the current 

Director of the Office of 

Management and Budget and 

the Acting Director of the 

Consumer Financial Protection Bureau.

Prior to his appointments, he served the people of the 

5th District of South Carolina as their Congressman 

where he was first elected in 2010, he is the first 

Republican member to hold the seat in 128 years.

A lifelong Carolinas resident, he attended Georgetown 

University, graduating with honors in International 

Economics, Commerce, and Finance. He completed 

his formal education at Harvard Business School’s 

OPM program in 2006.

While in the private sector, he was a lawyer, a real 

estate developer, a home builder, and a restaurant 

franchiser and franchisee.

While in Congress, he served on the Budget 

Committee, Joint Economic Committee, Small 

Business Committee, Financial Services Committee, 

and the Oversight and Government Reform 

Committee.

He is a regular spokesperson for the Administration, 

having appeared on major network shows, including: 

Meet the Press, Face the Nation, This Week, and Fox 

News Sunday. He also makes regular appearances 

on cable television news, national radio, and online 

media.

Mick and Pam were married in 1998, and are the 

proud parents of triplets: James, Caroline, and 

Finnegan, and two great Danes: Guiness and Harper. 

Joseph M. Otting

Joseph M. Otting was sworn 

in as the 31st Comptroller of 

the Currency on November 

27, 2017.

The Comptroller of the 

Currency is the administrator 

of the federal banking system 

and chief officer of the Office of the Comptroller of 

the Currency (OCC). The OCC supervises nearly 

1,400 national banks, federal savings associations, 

and federal branches and agencies of foreign banks 

operating in the United States. The mission of the 

OCC is to ensure that national banks and federal 

savings associations operate in a safe and sound 

manner, provide fair access to financial services, treat 

customers fairly, and comply with applicable laws and 

regulations.

The Comptroller also serves as a director of the 

Federal Deposit Insurance Corporation and member 

of the Financial Stability Oversight Council and the 

Federal Financial Institutions Examination Council.

Prior to becoming Comptroller of the Currency, Mr. 

Otting was an executive in the banking industry. He 

served as President of CIT Bank and Co-President of 

CIT Group from August 2015 to December 2015.

Mr. Otting previously was President, Chief Executive 

Officer, and a member of the Board of Directors 

of OneWest Bank, N.A. Prior to joining OneWest 

Bank, he served as Vice Chairman of U.S. Bancorp, 

where he managed the Commercial Banking Group 

and served on the Bancorp’s executive management 

committee. He also served as a member of U.S. 

Bank’s main subsidiary banks’ Board of Directors.

From 1994 to 2001, Mr. Otting was with Union 

Bank of California, where he was Executive Vice 

President and Group Head of Commercial Banking. 

Before joining Union Bank, he was with Bank of 

America and held positions in branch management, 

preferred banking, and commercial lending.
2017

APPENDICES 151

Mr. Otting has played significant roles in charitable 

and community development organizations. He has 

served as a board member for the California Chamber 

of Commerce, the Killebrew-Thompson Memorial 

foundation, the Associated Oregon Industries, the 

Oregon Business Council, the Portland Business 

Alliance, the Minnesota Chamber of Commerce, and 

Blue Cross Blue Shield of Oregon. He was also a 

member of the Financial Services Roundtable, the Los 

Angeles Chamber of Commerce, and the Board and 

Executive Committee of the Los Angeles Economic 

Development Corporation.

Mr. Otting holds a bachelor of arts in management 

from the University of Northern Iowa and is a 

graduate of the School of Credit and Financial 

Management, which was held at Dartmouth College 

in Hanover, New Hampshire.

Thomas J. Curry

Thomas J. Curry, former Comptroller of the 

Currency, resigned from the FDIC Board of Directors 

as of May 5, 2017. Mr. Curry served as a director 

of the FDIC beginning in 2004 and was the secondlongest serving Board member in FDIC history. 

Richard Cordray

Richard Cordray, former Director of the Consumer 

Financial Protection Bureau, resigned on November 

24, 2017. Mr. Cordray served as the first Director of 

the Consumer Financial Protection Bureau.
ANNUAL REPORT

152 APPENDICES

DIVISION OF INFORMATION 

TECHOLOGY

Russell G. Pittman

Director

OFFICE OF CHIEF INFORMATION 

SECURITY OFFICER

Noreen Padilla

 Acting Chief Information 

Security Ofcer

DEPUTY TO THE CHAIRMAN 

AND CHIEF OPERATING OFFICER,

CHIEF OF STAFF

Barbara A. Ryan

SPECIAL ADVISOR FOR

SUPERVISORY MATTERS

Jason C. Cave

SPECIAL ADVISOR FOR

INFORMATION TECHOLOGY

Lawrence Gross

DEPUTY TO THE CHAIRMAN

Kymberly K. Copa

CHIEF INFORMATION OFFICER 

AND CHIEF PRIVACY OFFICER

Howard Whyte

DEPUTY TO THE CHAIRMAN 

AND CHIEF FINANCIAL OFFICER

Steven O. App

INTERNAL OMBUDSMAN

Robert D. Harris

OFFICE OF INSPECTOR GENERAL

Jay N. Lerner

Inspector General

DEPUTY TO THE CHAIRMAN

FOR COMMUNICATIONS

Barbara Hagenbaugh

SPECIAL ADVISOR

Arthur Murton

WRITER-EDITOR

Michele A. Heller

OFFICE OF 

COMMUNICATIONS

DIVISION OF RESOLUTIONS 

AND RECEIVERSHIPS

Bret D. Edwards

Director

LEGAL DIVISION

Charles Yi

General Counsel

DIVISION OF INSURANCE 

AND RESEARCH

Diane Ellis

Director

DIVISION OF DEPOSITOR 

AND CONSUMER PROTECTION

Mark E. Pearce

Director

OFFICE OF COMPLEX

FINANCIAL INSTITUTIONS

Ricardo (Rick) Deln

Director

DIVISION OF RISK 

MANAGEMENT SUPERVISION

Doreen R. Eberley

Director

DIVISION OF 

ADMINISTRATION

Arleas Upton Kea

Director

DIVISION OF FINANCE

Craig R. Jarvill

Director

CORPORATE UNIVERSITY

Suzannah L. Susser

Chief Learning Ofcer and Director

OFFICE OF 

LEGISLATIVE AFFAIRS

Andy Jiminez

Director

OFFICE OF 

THE OMBUDSMAN

M. Anthony Lowe

Ombudsman

OFFICE OF MINORITY AND 

WOMEN INCLUSION

Saul Schwartz

 Acting Director 

OFFICE OF FINANCIAL 

INSTITUTION ADJUDICATION

C. Richard Miserendino

 Administrative Law Judge

BOARD OF DIRECTORS

Martin J. Gruenberg

FDIC

Chairman

Vacant

FDIC

Board Member

Thomas M. Hoenig

FDIC

Vice Chairman, Board Member

Joseph Otting

OCC

Board Member

Mick Mulvaney

CFPB (Acting Director)

Board Member

FDIC ORGANIZATION CHART/OFFICIALS
2017

APPENDICES 153

Notes: 2008-2017 staffing totals reflect year-end full time equivalent staff. 

2008 2009 2010 2011 2012 2013 2014 2015 2016 2017

9,000

6,000

3,000

0

4,988 6,557 8,150 7,973 7,476

FDIC Year–End On-Board Stafng

7,254 6,631 6,385 6,096 5,880

CORPORATE STAFFING 

STAFFING TRENDS 2008-2017
ANNUAL REPORT

154 APPENDICES

NUMBER OF EMPLOYEES BY DIVISION/OFFICE 2016 AND 2017 (YEAR-END)1

Total Washington Regional/

Division or Office: 2017 2016 2017 2016 2017 2016

Division of Risk Management Supervision 2,558 2,627 197 204 2,361 2,423

Division of Depositor and Consumer Protection 831 838 120 116 711 722

Division of Resolutions and Receiverships 457 537 134 138 323 399

Legal Division 506 531 326 340 180 191

Division of Administration 358 370 246 256 112 114

Division of Information Technology 276 301 219 237 57 64

Corporate University 217 210 211 202 6 8

Division of Insurance and Research 194 193 157 153 37 40

Division of Finance 166 167 162 164 4 3

Office of the Chief Information Security Officer2 36 34 36 34 0 0

Office of Inspector General 126 122 78 76 48 47

Office of Complex Financial Institutions 62 67 48 50 14 17

Executive Offices3 26 22 26 22 0 0

Executive Support Offices4 68 79 60 72 8 7

TOTAL 5,880 6,096 2,019 2,062 3,861 4,034

1 The FDIC reports staffing totals using a full-time equivalent methodology, which is based on an employee’s scheduled work hours. Division/Office 

staffing has been rounded to the nearest whole FTE. Totals may not foot due to rounding.

2

 Formerly known as the Information Security and Privacy Staff.

3

 Includes the Offices of the Chairman, Vice Chairman, Director (Appointive), Chief Operating Officer, Chief Financial Officer, and Chief lnformation Officer.

4

 Includes the Offices of Legislative Affairs, Communications, Ombudsman, Minority and Women Inclusion, and Corporate Risk Management 

(the functions of which were absorbed by the Division of Finance in 2017).
2017

APPENDICES 155

FDIC Website

www.fdic.gov

A wide range of banking, consumer, and financial 

information is available on the FDIC’s website. This 

includes the FDIC’s Electronic Deposit Insurance 

Estimator (EDIE), which estimates an individual’s 

deposit insurance coverage; the Institution Directory, 

which contains financial profiles of FDIC-insured 

institutions; Community Reinvestment Act 

evaluations and ratings for institutions supervised by 

the FDIC; Call Reports, which are bank reports of 

condition and income; and Money Smart, a training 

program to help individuals outside the financial 

mainstream enhance their money management skills 

and create positive banking relationships. Readers 

also can access a variety of consumer pamphlets, 

FDIC press releases, speeches, and other updates on 

the agency’s activities, as well as corporate databases 

and customized reports of FDIC and banking 

industry information. 

FDIC Call Center

Phone: 877-275-3342 (877-ASK-FDIC) 

703-562-2222 

Hearing Impaired: 800-925-4618 

703-562-2289 

The FDIC Call Center in Washington, DC, is the 

primary telephone point of contact for general 

questions from the banking community, the public, 

and FDIC employees. The Call Center directly, or 

with other FDIC subject-matter experts, responds to 

questions about deposit insurance and other consumer 

issues and concerns, as well as questions about FDIC 

programs and activities. The Call Center also refers 

callers to other federal and state agencies as needed. 

Hours of operation are 8:00 a.m. to 8:00 p.m., 

Eastern Time, Monday – Friday, and 9:00 a.m. to 

5:00 p.m., Saturday – Sunday. Recorded information 

about deposit insurance and other topics is available 

24 hours a day at the same telephone number.

As a customer service, the FDIC Call Center has 

many bilingual Spanish agents on staff and has access 

to a translation service, which is able to assist with 

over 40 different languages.

Public Information Center 

3501 Fairfax Drive

Room E-1021

Arlington, VA 22226

Phone: 877-275-3342 (877-ASK-FDIC),

703-562-2200

Fax: 703-562-2296

FDIC Online Catalog: https://catalog.fdic.gov

E-mail: publicinfo@fdic.gov

Publications such as FDIC Quarterly and Consumer 

News and a variety of deposit insurance and 

consumer pamphlets are available at www.fdic.gov

or may be ordered in hard copy through the FDIC 

online catalog. Other information, press releases, 

speeches and congressional testimony, directives to 

financial institutions, policy manuals, and FDIC 

documents are available on request through the Public 

Information Center. Hours of operation are 9:00 

a.m. to 4:00 p.m., Eastern Time, Monday – Friday.

Office of the Ombudsman

3501 Fairfax Drive

Room E-2022

Arlington, VA 22226

Phone: 877-275-3342 (877-ASK-FDIC) 

Fax: 703-562-6057

E-mail: ombudsman@fdic.gov

The Office of the Ombudsman (OO) is an 

independent, neutral, and confidential resource and 

liaison for the banking industry and the general 

public. The OO responds to inquiries about the 

FDIC in a fair, impartial, and timely manner. It 

researches questions and fields complaints from 

bankers and bank customers. OO representatives 

are present at all bank closings to provide accurate 

information to bank customers, the media, bank 

employees, and the general public. The OO also 

recommends ways to improve FDIC operations, 

regulations, and customer service.

SOURCES OF INFORMATION
ANNUAL REPORT

156 APPENDICES

REGIONAL AND AREA OFFICES

Atlanta Regional Office Chicago Regional Office

Michael J. Dean, Regional Director John P. Conneely, Regional Director

10 Tenth Street, NE 300 South Riverside Plaza

Suite 800 Suite 1700

Atlanta, Georgia 30309 Chicago, Illinois 60606

(678) 916-2200 (312) 382-6000

Alabama Illinois

Florida Indiana

Georgia Kentucky

North Carolina Michigan

South Carolina Ohio

Virginia Wisconsin

West Virginia

Dallas Regional Office Memphis Area Office

Kristie K. Elmquist, Regional Director Kristie K. Elmquist, Director

1601 Bryan Street 6060 Primacy Parkway

Dallas, Texas 75201 Suite 300

(214) 754-0098 Memphis, Tennessee 38119

(901) 685-1603

Colorado

New Mexico Arkansas

Oklahoma Louisiana

Texas Mississippi

Tennessee

Kansas City Regional Office New York Regional Office

James D. LaPierre, Regional Director John F. Vogel, Regional Director

1100 Walnut Street 350 Fifth Avenue

Suite 2100 Suite 1200

Kansas City, Missouri 64106 New York, New York 10118

(816) 234-8000 (917) 320-2500

Iowa Delaware

Kansas District of Columbia

Minnesota Maryland

Missouri New Jersey

Nebraska New York

North Dakota Pennsylvania

South Dakota Puerto Rico

Virgin Islands
2017

APPENDICES 157

Boston Area Office San Francisco Regional Office

John F. Vogel, Director Kathy L. Moe, Regional Director

15 Braintree Hill Office Park 25 Jessie Street at Ecker Square

Suite 100 Suite 2300

Braintree, Massachusetts 02184 San Francisco, California 94105

(781) 794-5500 (415) 546-0160

Connecticut Alaska

Maine American Samoa

Massachusetts Arizona

New Hampshire California

Rhode Island Federated States of Micronesia

Vermont Guam

Hawaii

Idaho

Montana

Nevada

Oregon

Utah

Washington

Wyoming
ANNUAL REPORT

158 APPENDICES

C. IMPLEMENTATION 

OF KEY REGULATIONS 

During 2017, the FDIC undertook a number 

of initiatives to implement regulations or clarify 

supervisory expectations. 

Swap Margin Guidance 

In February 2017, the FDIC, the Federal Reserve 

Board (FRB), and the Office of the Comptroller of 

the Currency (OCC) issued a joint release explaining 

how supervisors should examine for compliance with 

the swap margin rule, which requires the prudent 

posting of collateral for swaps that are not cleared 

through a clearinghouse. The guidance explains 

that swap entities covered by the rule were expected 

to prioritize their compliance efforts surrounding 

the March 1, 2017 variation margin deadline 

according to the size and risk of their counterparties. 

Furthermore, the guidance clarifies that swap 

entities’ compliance with counterparties that present 

significant credit and market risk exposures is 

expected to be in place on the due date, as laid out 

in the final rule. For other counterparties that do 

not present significant credit and market risks, swap 

entities were expected to make good faith efforts to 

comply with the final rule in a timely manner, but 

not later than September 1, 2017. At this time, a 

number of FDIC-supervised institutions are affected 

by the rule in their capacity as swaps counterparties, 

but none are “covered swaps entities” as defined by 

the rule. 

Qualified Financial Contracts

Recordkeeping 

In July 2017, the FDIC approved a final rule 

amending its regulations regarding Recordkeeping 

Requirements for Qualified Financial Contracts 

(QFCs). The final rule enhances and updates 

recordkeeping requirements relating to the QFCs of 

insured depository institutions (IDIs) in a troubled 

condition. Among other things, the final rule ensures 

that the FDIC has access to expanded QFC data to 

facilitate the orderly resolution of IDIs with more 

complex QFC portfolios. The changes to both the 

formatting and the quantity of information will 

enable the FDIC, as receiver, to make better informed 

and efficient decisions during the one business day 

stay period for the transfer of QFCs. The effective 

date of the final rule is October 1, 2017. 

Restrictions on Certain 

FDIC-Supervised Institutions

During 2017, the FDIC, FRB, and OCC coordinated 

on the issuance of rules applying to QFCs of 

systemically important U.S. banking organizations 

and systemically important foreign banking 

organizations in order to improve their resolvability 

and protect the financial stability of the United States. 

Together the agencies’ final rules promote orderly 

resolution by preventing large-scale early terminations 

of derivatives portfolios of an institution in resolution. 

Early terminations of QFCs, as illustrated by the 

failure of Lehman Brothers in September 2008, 

contribute to financial instability by promoting fire 

sales of assets and spreading contagion within the 

financial system.

In October 2017, the FDIC approved its final rule, 

which also enhances the resilience and the safety 

and soundness of certain state savings associations 

and state-chartered nonmember banks for which 

the FDIC is the primary federal regulator (FDICSupervised Institutions). This final rule requires 

FDIC supervised institutions that are affiliated with a 

systemically important financial institution (SIFI) to 

ensure that covered QFCs to which they are a party 

provide that any default rights and restrictions on the 

transfer of the QFCs are limited to the same extent 

as they would be under the Dodd-Frank Wall Street 

Reform and Consumer Protection Act (Dodd-Frank 

Act) and the Federal Deposit Insurance (FDI) Act. In 

addition, SIFIs are generally prohibited from being 

party to QFCs that would allow a QFC counterparty 

to exercise default rights against the SIFI based on the 

entry into a resolution proceeding under the FDI Act 
2017

APPENDICES 159

or any other resolution proceeding of an affiliate of 

the SIFI. The final rule also amends the definition of 

‘‘qualifying master netting agreement’’ in the FDIC’s 

capital and liquidity rules and certain related terms 

in the FDIC’s capital rules. These amendments are 

intended to ensure that the regulatory capital and 

liquidity treatment of QFCs to which a SIFI is 

party would not be affected by the implementation 

of the rule.

Guidelines for Appeals of Material 

Supervisory Determinations

In July 2017, the FDIC adopted revised Guidelines 

for Appeals of Material Supervisory Determinations. 

The revised guidelines expand the circumstances 

under which banks may appeal a material supervisory 

determination and improves the consistency of the 

appeals processes among the FDIC, FRB, and OCC. 

Specifically, the revised guidelines:

♦ Permit the appeal of the level of compliance 

with an existing formal enforcement action, the 

initiation of an informal enforcement action, and 

matters requiring board attention;

♦ Specify that formal enforcement-related actions 

or decisions do not affect a pending appeal, and 

expand the opportunities for appeal available in 

certain circumstances; and

♦ Require annual reports of Division Directors’ 

decisions with respect to material supervisory 

determinations.

In September 2017, the FDIC issued financial 

institution letter (FIL) 42-2017 to distribute the 

revised guidelines to the industry. 

Current Expected Credit Losses Accounting 

Standard Frequently Asked Questions

In September 2017, the FDIC, FRB, OCC, and 

National Credit Union Administration (NCUA) 

issued a second set of frequently asked questions 

(FAQs) on the application of the Financial 

Accounting Standards Board’s new accounting 

standard on credit losses and related supervisory 

expectations. This accounting standard, which 

will apply to all institutions, introduces the current 

expected credit losses (CECL) methodology for 

estimating credit loss allowances on loans and certain 

other exposures. The second set of FAQs address a 

variety of technical issues and questions related to the 

implementation of the new accounting standard. The 

second set of FAQs was combined with those issued 

in December 2016 to form a single self-contained 

document to assist institutions and examiners. 

Securities Transaction Settlement Cycle

In September 2017, the FDIC and OCC jointly 

issued a Notice of Proposed Rulemaking (NPR) 

titled Securities Transaction Settlement Cycle that 

was published in the Federal Register for a 30-day 

comment period, with comments due October 

11, 2017. The NPR would shorten the standard 

settlement cycle from three to two days for securities 

purchased or sold by FDIC-supervised institutions, 

national banks, and federal savings associations, 

thereby aligning the FDIC’s and OCC’s regulations 

with the new industry standard settlement cycle as 

implemented by the U.S. Securities and Exchange 

Commission (SEC). The three-day settlement cycle 

is referred to as the “trade date plus three days”, 

or “T+3”, and is the current standard for the U.S. 

securities industry. The NPR is part of an industrywide shift to a T+2 days settlement cycle. For many 

FDIC-supervised institutions, the majority of the 

changes needed to implement T+2 will be completed 

by third-party industry custodians, systems and 

service providers, and broker-dealers through which 

institutions trade for themselves or on behalf of 

their fiduciary.

Net Stable Funding Ratio

During the financial crisis, a number of large banking 

organizations failed, or experienced serious difficulties, 

in part because of severe liquidity problems. In May 

2016, the FDIC and other banking agencies proposed 

a rule that would reduce the vulnerability of large 
ANNUAL REPORT

160 APPENDICES

banking organizations to liquidity risk. The Net 

Stable Funding Ratio (NSFR) Rule would require 

certain large banks to maintain sufficient levels of 

stable funding, including capital, long-term debt, 

and other stable sources over a one-year window, 

to account for the liquidity risks arising from their 

assets, derivatives, and off-balance sheet activities. 

Comments received and reviewed about the 

proposed NSFR rule concerned the stable funding 

requirements for assets, liabilities and off-balance 

sheet exposures, as well as the estimated costs 

and benefits and the empirical foundation and 

underpinnings supporting the proposal. The federal 

banking agencies are reviewing these comments and 

considering how to proceed with the proposed rule.
2017

APPENDICES 161

D. OFFICE OF INSPECTOR GENERAL’S ASSESSMENT 

OF THE MANAGEMENT AND PERFORMANCE 

CHALLENGES FACING THE FDIC TOP MANAGEMENT AND PERFORMANCE CHALLENGES FACING THE 

FEDERAL DEPOSIT INSURANCE CORPORATION

Emerging Cybersecurity 

Risks at Insured Financial Institutions 

In August 2017, the President’s National Infrastructure Advisory Council (“NIAC”)1 highlighted

significant cybersecurity risks to the financial services sector and concluded that the country had 

“a narrow and fleeting window of opportunity before a watershed, 9/11-level cyber attack to 

organize effectively and take bold action.” The Federal Deposit Insurance Corporation (“FDIC”), 

in its Annual Performance Plan for 2017, recognized that cybersecurity was a ”significant concern 

for the banking industry because of the 

industry’s use of and reliance on technology, 

not only in bank operations, but also as an 

interface with customers.” The FDIC 

Performance Plan further stated that 

“[c]ybersecurity has become one of the most 

critical challenges facing the financial services 

sector due to the frequency and increasing 

sophistication of cyber attacks.” 

The Financial Stability Oversight Council 

(“FSOC”) also underscored cybersecurity risks 

to the banking sector in its Annual Report 

(2017), stating that, “[i]f severe enough, a 

cybersecurity failure could have systemic 

implications for the financial sector and the U.S. economy more broadly.”2

 The Department of 

the Treasury’s Office of Financial Research (“OFR”) Annual Report to Congress 2017 added that 

“[t]he financial system is an attractive target for cyber thieves and other hackers because 

financial companies manage the nation’s wealth and handle trillions of dollars in transactions 

every day that underlie the U.S. economy.” The International Monetary Fund Working Paper, 

Cyber Risk, Market Failures, and Financial Stability (2017), also recognized that the financial 

sector experienced the most cybersecurity incidents across all industries with confirmed data 

 

1 The NIAC was established on October 16, 2001 and advises the President, through the Secretary of Homeland Security, on security and 

resilience of the Nation’s critical infrastructure sectors and their functional systems, physical assets, and cyber networks.

2 The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 established the FSOC, which has accountability for identifying 

risks and responding to emerging threats to financial stability. The FSOC is a collaborative body that brings together the expertise of federal 

financial regulators (including the FDIC), an independent insurance expert appointed by the President, and state regulators. The Office of 

Financial Research is a bureau within the Department of the Treasury that provides support to the FSOC, the Council’s member organizations, 

and the public. 

Common Cyber-Criminal Strategies

• Distributed denial-of-service – prevents customer 

access to bank websites and is also used as a 

diversionary tactic by criminals attempting to 

commit fraud using stolen credentials to initiate wire 

transfers.

• Malicious software – a broad class of attack that 

is generally delivered by email and lures the 

recipient into reading the email, opening an 

attachment, and providing sensitive information. 

• Compound attack – deploys more than one 

method of attack simultaneously.

• Ransomware – limits users from accessing their 

system, either by locking the system's screen or by 

locking the users' files unless a ransom is paid.

Sources: FDIC Supervisory Insights, A Framework for 

Cybersecurity and FFIEC Joint Statement-Cyber Attacks 

Involving Extortion
ANNUAL REPORT

162 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

losses in 2015, and by a substantial margin. 

In addition, on December 1, 2017, the 

Federal Reserve Vice Chair for Supervision, 

Randal Quarles, described cybersecurity as 

the biggest risk facing the financial sector 

and encouraged that federal banking 

regulators should be “bringing more of the 

resources of the government to bear” to 

boost digital defenses.3

The FDIC plays an important role as a 

financial regulator to ensure the stability of 

the financial system, and as the primary 

federal regulator of approximately 

3,700 financial institutions. In addition, as of the third quarter of 2017, the FDIC provided

deposit insurance coverage for 5,738 institutions with total assets of $17.2 trillion and deposits 

of $7.1 trillion. Therefore, the FDIC has a significant financial interest in mitigating cybersecurity 

risks at insured banks. If a bank fails, the FDIC will need to step in and may have to fund the 

losses from its Deposit Insurance Fund. 

Given the significance of cybersecurity risk to U.S. financial institutions, FDIC information 

technology (“IT”) examinations are an important tool to identify weaknesses and vulnerabilities 

in FDIC-supervised institutions. According to the Federal Financial Institutions Examination 

Council4

 (“FFIEC”) Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement, 

“[f]inancial institution management is expected to monitor and maintain sufficient awareness of 

cybersecurity threats and vulnerability information so they may evaluate risk and respond 

accordingly.” 

FDIC IT examinations assess the management of IT risks, including cybersecurity, at FDICsupervised institutions and at select third-party technology service providers (“TSP”). When 

examinations identify undue risks and weak risk management practices at institutions, the FDIC 

may use informal or formal enforcement procedures to address those risks and practices as well 

as deteriorating financial conditions, or violations of laws or regulations.5

 Many financial 

 

3 American Banker, Regulators Have Bigger Role to Play in Cybersecurity (December 1, 2017). 4 The Federal Financial Institutions Examination Council is an interagency body empowered to prescribe uniform principles, standards, and 

report forms for the federal examination of financial institutions by the Board of Governors of the Federal Reserve System, FDIC, National 

Credit Union Administration, Office of the Comptroller of the Currency, and Consumer Financial Protection Bureau and to make 

recommendations to promote uniformity in the supervision of financial institutions.

5 Risk Management Manual of Examination Policies, Part I 1.1 Basic Examination Concepts and Guidelines and Part IV Administrative and 

Enforcement Actions.
2017

APPENDICES 163

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

institutions maintain contracts with TSPs to outsource certain bank functions such as IT 

operations or business or product lines. As recognized in the Office of the Comptroller of the 

Currency’s (“OCC”) Semiannual Risk Perspectives (Spring 2017),6 TSPs are also targets for 

cybercrime and may provide a back door into bank operations through the supply of IT 

products and services that allow remote access and management of bank operations or 

applications. In addition, the OCC identified concerns with large numbers of banks relying on a 

small number of TSPs. For example, OCC examiners identified third-party services for merchant 

card processing, denial of service mitigation, and trust account systems as instances of 

concentration among providers. As such, if a TSP has its systems or information compromised, 

it may significantly impact a large segment of the banking industry. 

In our OIG evaluation, Case Study of a Computer Security Incident Involving a Technology Service 

Provider (2016), we reviewed allegations about a computer security incident potentially involving 

unauthorized access to unencrypted Personally Identifiable Information (“PII”)7 from multiple 

client financial institutions residing on a TSP’s computer server. We concluded that a poor 

internal control environment and a vague incident response policy limited the TSP’s ability to 

protect against the incident and hampered incident response efforts. The TSP did not collect or 

retain forensics information such as an image of the server, and it lacked a computer activity log 

to identify data access and exfiltration.

Further, in our OIG evaluation, Technology Service Provider Contracts with FDIC-Supervised 

Institutions (February 2017), we assessed how FDIC-supervised institutions’ contracts with TSPs 

addressed the TSP’s responsibilities related to business continuity planning and responding to 

and reporting on cybersecurity incidents. Based on our sample of 48 contracts with 

19 institutions, we did not see evidence that most financial institutions reviewed fully considered

and assessed the potential impact that TSPs may have on the institution’s business continuity 

planning and cybersecurity incident response and reporting operations. 

In 2015, we issued an OIG evaluation report, The FDIC’s Supervisory Approach to Cyberattack 

Risks, which found inconsistencies in the quality and depth of IT examination assessments and 

documentation of findings among examiners, because examiners had discretion in conducting 

and documenting IT work. We also found a few situations where IT examinations of complex 

financial institutions were led by individuals that either did not have sufficient IT expertise or 

 

6 These risks were recently reiterated in the OCC’s Semiannual Risk Perspective (Fall 2017) released on January 18, 2018.

7 According to OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, the term 

PII refers to information that can be used to distinguish or trace an individual's identity, such as their name, Social Security Number, biometric 

records, etc. alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as 

date and place of birth, mother’s maiden name, etc.
ANNUAL REPORT

164 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

required on-the-job training. The FDIC has taken steps described in the paragraphs below to 

address issues identified in these reports. 

In July 2015, the Government Accountability Office (“GAO”) issued a report, Cybersecurity: Banks

and Other Depository Regulators Need Better Data Analytics and Depository Institutions Want

More Usable Threat Information. GAO examined how the bank regulators – the FDIC, the OCC, 

and the Federal Reserve Board – oversee financial institutions’ efforts to mitigate cyber risk. The 

GAO found that the regulators were not routinely aggregating and analyzing data on IT 

deficiencies found in individual financial institutions in order to analyze trends in specific security

problems across institutions and use that information to better target future examinations. 

In the last 2 years, the FDIC modified its IT examination process, in part in response to concerns

identified. In July 2016, the FDIC implemented a new Information Technology Risk Examination 

(“InTREx”) program for financial institutions. InTREx provides baseline work programs 

supplemented by FFIEC Information Technology Examination Handbook (IT Handbook) 

programs for more complex or high-risk areas. A work program provides a series of questions

and steps to guide examiners. The IT Handbook also provides examination procedures for TSPs. 

According to the FDIC, InTREx enhances identification, assessment, and validation of IT and 

operations risks in financial institutions. InTREx contains both structured and unstructured

information that should facilitate supervisory tasks and horizontal analysis across institutions. 

We will be conducting an audit that will assess the InTREx program. 

A key challenge associated with IT examinations is ensuring that the FDIC has the right number

of examiners with appropriate skills, training, and experience to match institution IT complexity. 

According to the FDIC’s InTREx Program Examination Procedures, examiner staffing is based on 

a financial institution’s Information Technology Profile (“ITP”) questionnaire score. Upon receipt

of the completed ITP information, the FDIC validates the profile, makes qualitative adjustments,

and determines the net technology score that translates into a complexity level of high, medium,

or low. The FDIC then attempts to match the examiner’s IT training to the complexity of the

institution’s IT systems. Thus, a highly complex bank requires an examiner trained in advanced

IT skills. 

During 2016, the FDIC trained 1,594 field examiners in InTREx low-complexity IT examination

processes and completed a reorganization that established a new Operational Risk Branch led

by a Deputy Director. In addition, the FDIC advised that it had established a new IT supervision 

group, updated its core IT training for examiners, added an IT examination requirement for

examiners, increased the pace of IT subject-matter expert training, and hired term IT specialists. 
2017

APPENDICES 165

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

We are planning to conduct an evaluation of the FDIC’s approach to examiner staffing, including 

IT examination resources. 

In addition to examinations, the FDIC provides cybersecurity awareness resources to financial 

institutions. For example, the FDIC, through the FFIEC website, provides bankers with access to 

technical assistance videos, articles, exercises, and Financial Institution Letters (“FIL”)8 that 

address cybersecurity risks. According to OIG analysis, the FDIC issued 21 FILs related to 

cybersecurity to Chief Executive Officers at financial institutions between January 2008 and 

December 2017. These FILs included information such as cybersecurity awareness webinars 

(October 25, 2016), introduction of cybersecurity assessment tools (July 2, 2015), and statements 

on malware (March 30, 2015). The FFIEC also issues statements and alerts to financial 

institutions regarding threats and vulnerabilities. Between October 2013 and May 2017, the 

FFIEC issued 15 statements and alerts related to cybersecurity. To illustrate, in June 2016, the 

FFIEC issued a statement advising financial institutions to review risk management practices and 

controls over payment networks. 

The FDIC must continue its efforts to mitigate cybersecurity risks at financial institutions and 

TSPs in order to protect the Deposit Insurance Fund and consumers. In this regard, the FDIC 

should continue building its capabilities to assess IT risks and trends and deploy IT examination 

staff commensurate with risks at FDIC-supervised institutions. Further, the FDIC should take 

prompt supervisory action when banks do not have effective information security programs. 

 

8 FILs are addressed to the Chief Executive Officers of financial institutions and are used by the FDIC to announce new regulations and 

policies, new FDIC publications, and a variety of other matters of principal interest to those responsible for operating a bank or savings 

association.
ANNUAL REPORT

166 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Management of 

Information Security and Privacy Programs

According to the United States Computer Emergency Readiness Team (“US-CERT”), from 2014 

through 2016, federal government agencies reported more than 177,000 cybersecurity incidents, 

with more than 50,000 involving PII.9

 GAO’s report, High Risk Series: Progress on Many High-Risk 

Areas, While Substantial Efforts Needed on Others (2017), recognized that safeguarding

computer systems from cyber threats is a high risk across the Federal government and has been 

a long-standing concern for over 20 years. Without proper safeguards, computer systems are 

vulnerable to individuals and groups with malicious intentions who can intrude and use their 

access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or 

launch attacks against other computer systems and networks. 

In 2015, the records of the Office of Personnel Management were compromised. The computer 

hack resulted in the theft of records containing the PII of more than 21 million prospective, 

current, and former Federal employees. This breach alone is estimated to cost $350 million for 

credit and identity monitoring services, identity theft protection, and identity restoration services

for affected individuals. This data breach brought into focus the need for strong management 

of information security and privacy protection programs within the FDIC. 

Recent guidance from the Office of Management and Budget (“OMB”), OMB Memorandum 

M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information

(January 3, 2017), further describes the gravity of cybersecurity breaches: “Identity theft 

represented 16 percent (490,220) of the over 3 million complaints received by the Federal Trade 

Commission (“FTC”) in 2015. In 2014, the Department of Justice reported that 17.6 million 

individuals or 7 percent of all U.S. residents age 16 or older, were victims of one or more 

occurrences of identity theft.” 

The FDIC uses IT systems and applications to perform its several mission goals regarding safety 

and soundness for financial institutions, consumer protection, managing the Deposit Insurance

Fund, and resolution and receivership of failed institutions. These systems and applications hold 

significant amounts of sensitive data.10 For example, the FDIC’s Failed Bank Data System 

contains more than 2,500 terabytes of sensitive information from more than 500 bank failures. 

 

9 US-CERT is an organization within the Department of Homeland Security that assists federal civilian agencies with their data breach incident 

handling efforts. The Federal Information Security Modernization Act of 2014 (“FISMA 2014”) requires federal agencies to report security 

incidents to US-CERT, which analyzes the information to identify trends and indicators of attack across the federal government. 10 FDIC Circular 1360.9, Protecting Sensitive Information, defines sensitive information as “information that contains an element of 

confidentiality. It includes information that is exempt from disclosure by the Freedom of Information Act and information whose disclosure is 

governed by the Privacy Act of 1974. Sensitive information requires a high level of protection from loss, misuse, and unauthorized access or 

modification.” 
2017

APPENDICES 167

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

In addition, FDIC systems contain substantial amounts of PII, including, for example, names, 

Social Security Numbers, and addresses related to bank officials, depositors, and borrowers at

FDIC-insured institutions and failed banks, and FDIC employees. Of the FDIC’s 261 system 

applications, 151 applications required Privacy Impact Assessments because they collect, 

maintain, or disseminate PII. 

Over time, the FDIC has experienced a number of cybersecurity incidents. In August 2011, the 

FDIC began to experience a sophisticated, targeted attack on its network known as an Advanced 

Persistent Threat (“APT”).11 The attacker behind the APT penetrated more than 90 workstations 

or servers within the FDIC’s network over a significant period of time, including computers used 

by the former Chairman and other senior FDIC officials. The attacker further gained 

unauthorized access to a significant quantity of sensitive data. The FDIC’s Division of 

Information Technology failed to fully inform senior FDIC executives of the severity and 

magnitude of the intrusion. In response to this incident, the FDIC hired a cybersecurity firm to 

perform additional analysis and realigned its IT functions. 

In late 2015 and early 2016, the FDIC was again impacted by significant cybersecurity 

incidents. In this case, the FDIC detected eight data breaches as departing employees 

improperly took sensitive information shortly before leaving the FDIC. The FDIC initially 

estimated that this sensitive information included the PII of approximately 200,000 individual 

bank customers associated with approximately 380 financial institutions, as well as the 

proprietary and sensitive data of financial institutions; however, the FDIC later revised the 

number of affected individuals to 121,633. 

In our OIG report, The FDIC’s Controls for Mitigating the Risk of an Unauthorized Release of 

Sensitive Resolution Plans (July 2016), we reviewed the September 2015 breach in which a former 

employee copied, without authorization, highly confidential components of three sensitive 

resolution plans onto an unencrypted Universal Serial Bus (“USB”) storage device and took the 

information upon abruptly resigning. OIG law enforcement officials subsequently recovered the 

USB device containing all of the exfiltrated data as well as a sensitive Executive Summary for a 

fourth resolution plan in hard copy. Based on the OIG criminal investigation, the employee was 

subsequently charged in the Federal District Court for the Eastern District of New York with theft 

of government property (18 U.S.C. Section 641).

In another OIG report, The FDIC’s Process for Identifying and Reporting Major Information 

Security Incidents (July 2016), we reviewed the FDIC’s process to address the breach involving 

 

11 An advanced persistent threat may occur when an entity gains unauthorized access to a computer network, escalates its privileges, and

develops an ongoing presence within the network to compromise the network data and component-level security. 
ANNUAL REPORT

168 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

an employee’s use of a USB storage device to copy more than 10,000 documents, including

more than 10,000 unique Social Security Numbers upon the employee’s departure from the 

FDIC. We found that over 4 weeks elapsed between the discovery of the incident and a 

determination that the incident involved a data breach. We concluded the FDIC had not 

devoted sufficient resources to review potential violations. 

 

In a recent OIG report, The FDIC’s Processes for Responding to Breaches of Personally Identifiable 

Information (September 2017), we assessed the adequacy of the FDIC’s processes to evaluate 

the risk of harm to individuals affected by a breach of PII and to notify and provide services to 

those individuals when appropriate. We reviewed a sample of suspected or confirmed breaches 

occurring between January 1, 2015 and December 1, 2016, potentially affecting 13,000

individuals. We found that the FDIC did not notify affected individuals until more than 9 months 

had elapsed from the date of discovery of the breaches. Further, we noted that the FDIC had 

not devoted sufficient resources to address a dramatic increase in breach investigation activities. 

We also determined that the individuals responsible for examining the data breaches did not 

always have the necessary skills and training to ensure proper performance of their duties.

In another recent OIG report, Audit of the FDIC’s Information Security Program – 2017

(October 2017), we identified FDIC security control weaknesses that limited the effectiveness of 

the FDIC’s information security program and practices and placed the confidentiality, integrity, 

and availability of the FDIC’s information systems and data at risk. Security control weaknesses 

included, for example: 

• Contingency Planning. The FDIC’s IT restoration capabilities were limited, and the 

agency had not taken timely action to address known limitations with respect to its 

ability to maintain or restore critical IT systems and applications during a disaster. 

• Information Security Risk Management. The FDIC established the Information 

Security Risk Advisory Council (“the Council”) in 2015. However, the Council did not 

fulfill several of its key responsibilities as defined in FDIC policy. 

• Enterprise Security Architecture. The FDIC had not established an enterprise security 

architecture that (i) describes the FDIC’s current and desired state of security and 

(ii) defines a plan for transitioning between the two. The lack of an enterprise security 

architecture increased the risk that the FDIC’s information systems would be developed 

with inconsistent security controls that are costly to maintain.

• Technology Obsolescence. The FDIC was using certain software in its server operating 

environment that was at the end of its useful life and for which the vendor was not 

providing support to the FDIC. 

• Information Security Strategic Plan. The FDIC had drafted, but not yet finalized, an 

information security strategic plan. 
2017

APPENDICES 169

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

• Patch Management. We noted instances in which patches addressing high-risk 

vulnerabilities were not installed on servers, desktop computers, and laptop computers 

within the timeframes established by FDIC policy. 

• Credentialed Scanning. We found instances in which network IT devices were not 

subject to a “credentialed” scan—a thorough type of scan that involves logging into the 

IT device to inspect for vulnerabilities. 

• Security Information and Event Management (“SIEM”) Tool. The FDIC had not 

developed a process to ensure that all servers on the FDIC’s network routed log data to 

the FDIC’s SIEM tool. 

We determined that, according to the FISMA Reporting Metrics, the FDIC was rated as 

“Defined,” which indicated that policies and procedures were formalized and documented, but 

not consistently implemented.

GAO also assessed information security controls over key financial systems, data, and networks

as part of its audit of the FDIC’s financial statements. In its report, Information Security: FDIC 

Needs to Improve Controls over Financial Systems and Information (May 2017), GAO identified 

information security deficiencies at the FDIC. For example, GAO found that the FDIC did not 

implement sufficient controls to isolate financial systems from other parts of its network to 

prevent unauthorized users and systems from communicating with the financial systems. 

Further, GAO reported that the FDIC did not implement sufficient controls over a privileged 

account used by systems engineers to manage the FDIC’s virtual environment. As a result, the 

FDIC had diminished ability to distinguish between authorized and unauthorized activity in the 

systems. According to GAO, those information system control issues “represented a significant 

deficiency in the FDIC’s internal control over financial reporting systems as of 

December 31, 2016.”

12 

Weaknesses in Management of Contractor Personnel. Our OIG report, Controls over 

Separating Personnel’s Access to Sensitive Information (September 2017), identified weaknesses

in the management of contractor access to FDIC systems, data, and facilities. We found that 

separating contractor employees may present greater risks than FDIC employees, because the 

FDIC may not know as much about an individual contractor’s personnel history and the 

contractor may depart without advanced notice. Further, we found that the priority review of 

network activity using the Data Loss Prevention (“DLP”)13 tool was not conducted in the pre-exit 

clearance process for many contractors. We estimated that at least 43 percent of FDIC 

 

12 At the time of issuance of this report, we were advised by the FDIC that the GAO had not identified a significant deficiency in the FDIC’s 

internal control over financial reporting as of December 31, 2017.

13 The DLP operates as a guard around the digital perimeter of the FDIC and monitors various electronic ways sensitive information could leave 

the FDIC. For example, the DLP monitors outgoing emails, documents sent to network printers, website uploads, and downloads to external

media.
ANNUAL REPORT

170 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

contractors who separated between October 1, 2015 and September 30, 2016 were not subject 

to such DLP priority review. In addition, the FDIC could not locate clearance records for 46 

percent of the contractors we sampled, and records management liaisons did not review data 

questionnaires before contractors separated in 94 percent of the cases we reviewed.

Further our OIG report, Follow-on Audit of the FDIC’s Identity, Credential, and Access 

Management Program (June 2017), found that the FDIC did not maintain current, accurate, and 

complete contractor personnel data to ensure Personal Identity Verification (“PIV”) card (i.e., a 

badge) credential issuance to authorized FDIC contractors. Absent reliable contractor 

information, PIV cards may not be issued and revoked in a timely manner, presenting an 

increased risk of unauthorized access to FDIC facilities and networks. 

Contracts for IT goods and services also pose risks because there are often multiple tiers of 

outsourcing, as well as numerous actors such as suppliers, acquirers, systems integrators, and 

service providers that interact to design, manufacture, and deploy products and services. The 

National Institute of Standards and Technology described the vulnerabilities in the “supply 

chain” for U.S. Government agencies to include the influence of foreign governments, 

counterfeit products, unauthorized production, tampering, and insertion of malicious software 

and hardware. For example, on December 12, 2017, legislation was enacted that banned the 

U.S. Government’s use of Kaspersky Labs, a supplier of antivirus products, due to concerns of 

foreign government influence. The FDIC contracts for the purchase of laptops, servers, and 

other IT products in support of its mission and should maintain awareness of supply chain risks. 

Change in Cyber Management at FDIC. Turnover in key leadership positions affected the 

management of the FDIC’s cybersecurity and privacy programs. Between 2010 and 2017, the 

FDIC had seven acting or permanent Chief Information Officers (“CIO”) who also held the role of 

Chief Privacy Officer (“CPO”). During this same period of time, the FDIC also had seven Chief 

Information Security Officers. These senior management changes impact the direction of an 

organization because turnover affects management strategy, planning, budgets, and staffing. 

As noted by GAO in Federal Chief Information Officers: Responsibilities, Reporting Relationships, 

Tenure, and Challenges (2004), a high turnover rate in CIOs negatively impacts their effectiveness 

because there is limited time to put their agenda in place or form close working relationships 

with agency leadership. In the case of the FDIC, the turnover hindered progress in establishing 

and implementing an IT governance framework, such as an Enterprise Architecture, IT Strategic 

Plan, and Information Security Plan—all of which are fundamental to a successful IT program.

A recent example highlights how turnover experienced by the FDIC contributed to the 

underlying challenge of managing information security. The former CIO at the FDIC 
2017

APPENDICES 171

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

(November 2015 to October 2017) began an initiative to move FDIC IT operations to cloudbased solutions. Adopting a cloud-based IT approach reflected a significant change not 

contemplated in the governance documents referenced above, as it moved IT procurement, 

development, and maintenance from on-site services to off-site services. Such a move involved

migrating the FDIC’s data center to a contractor owned and operated facility and a shift in FDIC 

IT personnel skills, governance, and policies and procedures towards oversight, management, 

and monitoring of cloud contracts. However, the FDIC’s current CIO decided to take a more 

measured approach by moving some IT operations to the cloud in October 2017. FDIC 

resources devoted to cloud strategy planning from March to October 2017 could have been 

deployed to other IT initiatives.

The FDIC’s Privacy Program. The FDIC has designated its CIO as the CPO, also referred to as 

the Senior Agency Official for Privacy (“SAOP”). Notably, however, OMB Memorandum M-16-24, 

Role and Designation of Senior Agency Officials for Privacy, states that “agencies should 

recognize that privacy and security are independent and separate disciplines. While privacy and 

security require coordination, they often raise distinct concerns and require different expertise 

and different approaches. The distinction between privacy and security is one of the reasons 

that the Executive Branch has established a Federal Privacy Council independent from the Chief 

Information Officers Council.” 

In light of the updated requirements and responsibilities for the SAOP/CPO, the FDIC may wish 

to consider whether the CIO should continue to serve as SAOP/CPO. The perspectives of the 

SAOP/CPO are different from those of the CIO. The CIO has responsibility for maintaining a 

broad, strategic orientation focused on enterprise issues and concerns and protecting the 

agency’s IT resources. These issues relate to the management of the FDIC’s IT systems, 

enterprise architecture, governance of programs and resources, acquisition of hardware, backup 

systems, personnel, security systems, and processes to keep the IT systems running efficiently 

and effectively. In contrast, the CPO’s (and SAOP’s) role is oriented towards protecting the 

privacy of individuals, including FDIC programs, policies, and procedures that affect bank 

customers and FDIC personnel, and reducing the risk of harm to potentially affected individuals 

in the event of a breach. 

Also, the SAOP/CPO has responsibility for privacy issues and concerns that extend beyond IT 

issues. For example, the SAOP/CPO has responsibilities for privacy implications related to FDIC 

materials that are not in electronic form. In addition, the SAOP/CPO is responsible for the 

privacy implications of internal FDIC programs that might affect FDIC personnel. The SAOP/CPO 

is further responsible for the privacy implications of disclosures of information outside of the 

FDIC, and this official may need to make decisions about the laws and regulations governing 
ANNUAL REPORT

172 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

privacy law, discovery productions in litigation, Freedom of Information Act requests, and other 

disclosure laws and regulations.

The FDIC’s Performance Plan for 2017 indicated that it would prioritize efforts “to protect its 

networks and data from unauthorized access, data breaches, and intrusions.” The Plan further 

stated that the FDIC intends to implement technologies to improve its ability to classify and 

protect sensitive data. Also, in 2017, the FDIC updated its IT strategic plan, revised its Breach 

Response Plan, and established a new Office of the Chief Information Security Officer. The FDIC 

also issued PIV cards to all employees and contractors and began requiring use of the cards to 

access FDIC computers. Looking ahead, the FDIC also plans to integrate cybersecurity into the 

FDIC-wide enterprise architecture and update its policies and procedures for expiring and 

outdated software and patch management. In addition, the FDIC is working to improve 

contingency planning in order to maintain or restore critical IT systems and applications during 

a disaster. 

As global cyber intrusions continue to increase, the FDIC must continue to safeguard its own 

computer systems and data. The FDIC should ensure that IT and privacy program managers 

address weaknesses and build capabilities to prevent cybersecurity attacks, and minimize the 

risks associated with breaches, including the compromise of sensitive and PII data. 
2017

APPENDICES 173

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Utilizing Threat Information to Mitigate 

Risk in the Banking Sector 

On February 12, 2013, the President issued Presidential Policy Directive 21 entitled, Critical 

Infrastructure Security and Resilience. This directive identified the banking sector as one of 

16 critical infrastructure sectors that are vital to public confidence and the nation’s safety, 

prosperity, and well-being. The President’s National Infrastructure Advisory Council 

recommended and encouraged public and private sectors “to move actionable information to 

the right people at the speed required by cyber threats.”14 The FSOC, in its Annual Report 

(2017), also highlighted the importance of sharing threat information among the public and 

private sector as a “key priority” to reduce the risk of cybersecurity incidents and mitigate their 

impact if they occur. 

The financial sector is diverse and interconnected, and spans from the largest institutions (assets 

greater than $2 trillion) to the smallest community banks. The International Monetary Fund in 

its Working Paper, Cyber Risk, Market Failures, and Financial Stability (2017), stated that “given 

the financial system’s dependence on a relatively small set of technical systems, knock-on effects 

from downtimes and service disruptions due to successful attacks have the potential to be 

widespread and systemic.” As identified by the FDIC in Crisis and Response, An FDIC History 

2008-2013, financial system interconnectedness played a role in the financial crisis, “[e]ven 

financial institutions without large exposures to mortgage assets or derivatives were affected 

because they were deeply interconnected with the financial system in which these exposures 

played so significant a role.” 

According to Presidential Policy Directive 21, the national preparedness systems must be 

integrated to secure critical infrastructure, withstand all hazards, and rapidly recover from 

disasters. Federal departments and agencies must collaborate with private sector critical 

infrastructure owners and operators. Both the Departments of the Treasury and Homeland 

Security recognized that sharing timely and actionable information is critical to managing risk. 

In 2007, the Department of Homeland Security issued the National Infrastructure Protection Plan

(“NIPP”); one portion of the NIPP relates to the financial sector – the Banking and Finance 

Critical Infrastructure and Key Resources Sector-Specific Plan. This Sector-Specific Plan described 

that financial regulators, including the FDIC, and the private sector are responsible for securing

critical infrastructure, under the leadership of the Treasury Department. This relationship is 

addressed through several working groups and committees, including the Financial and Banking 

 

14 The President’s National Infrastructure Advisory Council, Securing Cyber Assets – Addressing Urgent Cyber Threats to Critical Infrastructure

(August 2017).
ANNUAL REPORT

174 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Information Infrastructure Committee (“FBIIC”),15 the Financial Services Sector Coordinating 

Council (“FSSCC”),16 and the Financial Services Information Sharing and Analysis Center (“FSISAC”).17 These organizations provide structures through which financial sector participants 

share information at the national and local levels, assess and mitigate sector-wide risks, develop 

and maintain key relationships, and conduct periodic testing of emergency protocols. The FDIC 

participates in these organizations to monitor cybersecurity, share information, and coordinate 

responses.

The U.S. Government gathers threat information about U.S. financial institutions and the 

financial system. For example, in its report entitled, Cybersecurity: Bank and Other Depository 

Regulators Need Better Data Analytics and Depository Institutions Want More Usable Threat 

Information (2015), the GAO identified numerous sources of threat information that is provided 

to financial institutions.

 

15 The FBIIC was created in 2001 to improve the reliability and security of the financial sector infrastructure and consists of 18 federal and state 

member organizations across the financial regulatory community.

16 The FSSCC was established in 2002 to work collaboratively with key government agencies to protect the nation’s critical infrastructure from 

cyber and physical threats and consists of 70 private sector members, including trade associations, financial utilities, and critical financial firms. 17 The FS-ISAC was established in 1999 as a member-owned non-profit entity to share timely, relevant, and actionable physical and cyber 

security threat and incident information. FS-ISAC has 7,000 members across 39 countries. 
2017

APPENDICES 175

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

As part of its review, GAO discussed the receipt of cyber threat information from the 

government with representatives from more than 50 depository institutions. The participants 

said that the information received from government sources was repetitive, not timely, and 

could not always be acted upon, because the information lacked sufficient details. Financial 

institutions said they rarely obtained cyber threat information from the government that they 

had not already received from other sources and that in some cases, smaller banks struggled 

with the volume of information from government agencies. 

The GAO report also identified barriers to sharing threat information and reporting incidents in a 

timely manner. For example, institutions stated that information received from the government

about cyber threats and actual attacks lacked sufficient context or details to allow institutions to 

take appropriate protective actions. In addition, some institutions were often reluctant or 

unable to share information with government agencies or other institutions, and expressed 

concern that the information shared could negatively impact their competitive advantages 

because reported information may become public. GAO also reported that classified 

information could not be shared with bank officials who did not have access to such 

information. As a result, intelligence community and law enforcement representatives were 

often cautious about declassifying certain information based on their concern that sensitive

sources and methods used might be divulged. 

In its Annual Report for 2017, the FSOC also recognized that there was a body of relevant 

information held by the government that was classified as national security information and 

must maintain its classification restrictions. Nevertheless, the FSOC encouraged agencies to 

“balance the need to keep information secure with efforts to share information with industry to 

enhance cybersecurity resilience.” Therefore, the FSOC called on government agencies to 

“consider how to share information appropriately and, where possible, continue efforts to 

declassify (or downgrade classification) to the extent practicable, consistent with national 

security needs.” Further, Federal Reserve Vice Chair for Supervision, Randal Quarles, recently 

stated that bank regulators have a bigger role to play in preventing cybercrime and should focus 

more on connecting financial institutions with national security agencies.18 The former 

Comptroller of the Currency, Thomas Curry, also warned in his statement accompanying the 

agency’s Semiannual Risk Perspective (Fall 2015) that “[w]e can’t allow the federal banking 

system to be compromised by hackers or used by criminals or terrorists.” 

The financial sector also faces threats based on new technology; one worth noting in particular

is the rapid growth of the virtual currency markets. According to Forbes, there are more than

 

18 American Banker, Regulators Have Bigger Role to Play in Cybersecurity (December 1, 2017).
ANNUAL REPORT

176 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

1,000 different virtual currencies with a total market value of $650 billion.19 In addition, there 

has been widespread volatility in the marketplace. For example, CNN reported on 

December 9, 2017, that Bitcoin value soared from just under $10,000 per coin to more than 

$18,000 within one week. Clearinghouses and brokerages expressed concern about liability due 

to Bitcoin’s high volatility and risk of manipulation because of the lack of transparency and 

regulation underlying Bitcoin futures products. 20

Moreover, virtual currencies do not require the disclosure of information about a user’s identity 

and therefore give participants some degree of anonymity. In the GAO’s Virtual Currencies: 

Emerging Regulatory, Law Enforcement, and Consumer Protection Challenges (2014) report, it 

noted that “[b]ecause some virtual currency transactions provide greater anonymity than 

transactions using traditional payment systems, law enforcement and financial regulators have 

raised concerns about the use of virtual currencies for illegal activities.” The GAO further 

identified concerns about the use of virtual currencies in money laundering, financial and other 

crimes including cross-border criminal activities, and consumer protection issues related to the 

loss of funds on virtual currency exchanges.21 

At present, the United States does not have a direct and comprehensive program to conduct 

oversight of the virtual currency markets. However, some government regulators and agencies 

have issued guidance to address concerns about virtual currencies, including the Financial 

Crimes Enforcement Network (“FinCEN”), Internal Revenue Service, Commodity Futures Trading 

Commission (CFTC), and Securities and Exchange Commission (SEC).

22 The FDIC has analyzed 

the potential impact that virtual currencies pose to financial institutions and formed a Financial 

Technology Working Group to monitor virtual currencies and other financial technology 

innovations. Among the challenges identified by the FDIC are the potential for illicit use and 

connection to criminal activity, legal and supervisory challenges, and integration with and risk to 

financial institutions. The FDIC should continue to monitor issues surrounding virtual currencies, 

to ensure that examiners and institutions are aware of the threats posed by these evolving 

technologies and markets.

 

Further, the Financial Services Sector-Specific Plan of the NIPP also described physical threats, 

such as natural disasters, terrorist attacks, and floods that have significant potential to disrupt 

the financial system. For example, CNN reported on November 10, 2017, Hurricanes Could Bring 

 

19 2018 Will See Many More Cryptocurrencies Double In Value (January 2, 2018). 20 Bitcoin to start futures trading, stoking Wild West worries, Reuters (December 7, 2017). 21 In the Statement of GAO’s Director, Financial Markets and Community Investment before the Senate Committee on Banking, Housing, and 

Urban Affairs (September 12, 2017), GAO also identified data and privacy risks in the use of blockchain technology.

22 FinCEN’s Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime (FIN-2016-A005 October 25, 2016); CFTC 

Backgrounder on Oversight of and Approach to Virtual Currency Futures Markets (January 4, 2018); SEC Chairman Jay Clayton Statement on 

Cryptocurrencies and Initial Coin Offerings (December 11, 2017).
2017

APPENDICES 177

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Another Disaster: Foreclosure, that approximately 4.8 million mortgaged properties were in the 

paths of Hurricanes Harvey, Irma, and Maria, representing nearly $746 billion in unpaid 

mortgage principal balances. Threats to financial institutions also may come from, or be 

exacerbated by, their dependence on other critical infrastructure services, such as energy, 

electricity, communication, and transportation. The recent hurricanes in Puerto Rico provide an 

example of the effect of the loss of electricity and transportation to the banking industry. 

During Hurricane Maria, banks lost electrical power to run their operations, and armored cars 

could not reach branches to stock ATMs due to road conditions. 

Threat Information Critical to Financial Institutions and Their Service Providers. Threat 

information held by the U.S. Government is critical to financial institutions and their service 

providers. As discussed in FDIC’s Supervisory Insights, A Framework for Cybersecurity, “financial 

institutions should have a program for gathering, analyzing, understanding, and sharing 

information about vulnerabilities to arrive at ‘actionable intelligence.’” The Supervisory Insights 

article further stated that actionable intelligence can be gathered through a number of public 

and private resources, including FS-ISAC and the Department of Homeland Security’s U.S. 

Computer Emergency Readiness Team. The FDIC, along with the FFIEC, has encouraged 

financial institutions to participate in FS-ISAC. Also, FDIC IT examiners assess an institution’s 

process to gather threat information. 

As noted in GAO’s 2015 report referenced above, financial institutions are required to quickly 

respond to and mitigate the impact of data breaches. In order to secure their systems, 

institutions must have timely and actionable threat information. The 2015 Financial Services 

Sector-Specific Plan explained that “an incident impacting one firm has the potential to have 

cascading impacts that quickly affect other firms or sectors.” The financial crisis provided an 

example of how the default of poorly underwritten mortgages at one bank rippled through the 

financial system to other banks, brokerages, and insurance companies through asset-backed 

securities and collateralized debt obligations backed by those mortgages. 

Threat Information Critical to FDIC Examiners. Threat information held by the U.S. 

Government is also critical to FDIC examiners. Examiners should have access to relevant threat 

information and an understanding of the current threat level and types of threats, in order to 

focus examinations and prioritize areas for supervisory attention. 

FDIC examiners use standard work programs to assess safety and soundness risk; however, they 

also have discretion to modify the scope of an examination and assess whether certain areas 

require greater scrutiny or expanded examination procedures. Therefore, understanding 

common threats across all institutions, even those not supervised by the FDIC, is important to 
ANNUAL REPORT

178 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

examiners. This information can be used by an examiner to test risk management programs at 

financial institutions. FDIC examiners should have relevant information concerning current

threats and risks relating to an institution or a geographic region, which allows them to tailor 

examination procedures accordingly. 

In addition, if examiners identify weaknesses in an institution’s risk assessment process, 

including components related to gathering threat intelligence, they are instructed to identify 

such weaknesses in the Report of Examination. If the weaknesses are significant, an 

enforcement action may be used to specify and monitor the required corrective action. Further, 

FDIC examiners may initiate limited-scope examinations and visitations to investigate adverse or 

unusual situations based on up-to-date threat and risk information. These examinations and 

visitations have flexible formats. Examiners must assess whether bank staff have adequate 

threat information, and whether they take appropriate remediation action. Without relevant 

threat information, examiners may not be able to direct examination efforts effectively. 

The FDIC, along with its government partners, collects and queries threat information contained 

within U.S. Government databases and repositories. The FDIC should continue to ensure that 

relevant threat information is disseminated to its examiner personnel to target risk areas at 

institutions and focus the FDIC’s resources. The FDIC should also continue to assess whether 

financial institutions have access to and receive relevant threat information to mitigate risks. 

When institutions and examiners have threat information, they can more effectively take action

to mitigate threats. 
2017

APPENDICES 179

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Readiness for Banking Crises 

According to the Financial Crisis Inquiry Commission (2011),23 nearly $11 trillion in household 

wealth vanished during the financial crisis that began in 2008. During the financial crisis, 

4 million families lost their homes to foreclosure, and another 4-1/2 million slipped into the 

foreclosure process or were seriously behind on mortgage payments, and 26 million Americans 

were out of work, could not find full-time jobs, or gave up looking for work.24 As reported in the 

FDIC’s Crisis and Response, An FDIC History, 2008-2013, the net cost of the crisis was up to 

“roughly 80 percent of an entire year’s gross domestic product.”25 The financial crisis resulted in 

489 bank failures from 2008 through 2013. These failures cost the Deposit Insurance Fund 

(“DIF”) approximately $72 billion, and it fell to the lowest level in history, a negative $20.9 billion 

by the end of 2009.26 In addition, the number of problem banks peaked in early 2011 at almost 

900, constituting nearly 12 percent of all FDIC-insured institutions.27

As this crisis unfolded, it challenged every aspect of the FDIC’s operations, not only because of 

its severity, but also because of the speed with which problems unfolded. According to FDIC 

analysis, failure rates increased much faster during the 2008–2013 crisis than during the 1980s 

and early 1990s banking and thrift crises. For example, by 2009 almost 2 percent of banks had 

failed—a rate that was not reached in the previous crisis until the eighth year. In November 

2017, the FDIC Chairman stated that “[i]t is also worth keeping in mind that the evolution of the 

global financial system towards greater interconnectedness and complexity may tend to 

increase the frequency, severity, and speed with which the financial crises occur.” 

The FDIC Chairman further remarked that “regulators must guard against the temptation to 

become complacent about the risk facing the financial system.” The OFR noted in its Annual 

Report for 2017 that new vulnerabilities have emerged since the previous financial crisis and 

highlighted key threats to the financial system. There have been several changes in the financial 

markets since the crisis – for example: the increased use of automated trading systems, 

increased speed of executing financial transactions, and a wider variety of trading venues and 

 

23 The Financial Crisis Inquiry Commission was established by statute, Financial Enforcement and Recovery Act (2009), to “examine the 

causes of the current financial and economic crisis in the United States.” The Commission was independent and composed of a 10-member 

panel of experienced financial experts knowledgeable in housing, economics, finance, market regulation, banking, and consumer protection. 

These members were selected by the leadership in Congress at the time. 

24 The Commission and staff reviewed millions of pages of documents, interviewed more than 700 witnesses, and held 19 days of public 

hearings. See also, U.S. Government Accountability Office, Financial Regulatory Reform: Financial Crisis Losses and Potential Impact of the 

Dodd-Frank Act, (February 2013). 25 The FDIC conducted a study of the financial crisis entitled Crisis and Response, An FDIC History, 2008-2013, published in December 2017. 26 Since the end of 2009, the DIF has grown every quarter and became positive in the second quarter of 2011. The DIF balance as of 

December 31, 2017 was $92.7 billion. 27 The FDIC identifies “problem banks” as those with examination ratings of 4 or 5 (the two lowest ratings), which refers to institutions that 

exhibit deficiencies in practice or performance so severe that failure is either a distinct possibility (4 rating) or likely (5 rating) unless deficiencies 

are corrected.
ANNUAL REPORT

180 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

liquidity providers. Vice Chair Quarles of the Federal Reserve Board stated that “the banking 

industry and technology firms have been seeking innovations in financial services that mirror 

and complement changes that have been made in other industries. Innovation is coming to 

finance with changes to consumer lending, financial advice, and retail payments, to name 

a few. . . . With a steady diet of news about the effect of electronic networks, personal devices, 

apps, and more on U.S. industries, many question the effect of these technologies on the 

payment system.”28 

The financial system continues to evolve with new risks and complexities, and such changes 

have the potential to create unanticipated risks. To carry out its program activities and meet its 

mission – and to prepare for the next banking crisis – the FDIC should ensure that its personnel 

and examiners have the proper skillsets. The FDIC has an effort underway to address succession 

planning and develop advanced subject-matter expertise. 

The FDIC must continue to ensure that it has adequate plans in place to address disruptions to 

the banking system, irrespective of their cause, nature, magnitude, or scope. Further, its plans 

should be current and up-to-date, and incorporate lessons learned from past crises and the 

related bank failures. In addition, the plans should contemplate the present and foreseeable 

state of the banking and financial services sector, as banking industry practices and technologies 

continue to evolve. Also, the FDIC plans should continue efforts aimed at ensuring seamless 

coordination with and among other federal agencies and financial regulators, as well as with its 

international partners. The FDIC also should be able to react and respond quickly to a crisis. It 

should exercise and test its plans periodically to ensure that it is capable of fulfilling its mission, 

and ensure that its personnel and examiners have the proper skillsets to carry out program 

activities and meet the mission of the agency. 

Authorities and Mechanisms. The FDIC must also continue to evaluate whether it has the 

proper authorities and tools in place for the next financial crisis. Since the previous crisis, the 

FDIC has been granted authority, pursuant to the Dodd-Frank Wall Street Reform and Consumer 

Protection Act (“Dodd-Frank Act”), to resolve the failure of systemically important financial 

institutions (“SIFI”)29 through orderly liquidation authority.30 The FDIC must continue to ensure 

that it can execute these authorities effectively, especially with respect to the orderly liquidation 

authority. The FDIC continues to build upon its capabilities through monitoring of resolution 

 

28 Vice Chairman for Supervision Randal K. Quarles speech, Thoughts on Prudent Innovation in the Payment System (November 30, 2017). 29 In Resolution Plans: Regulators Have Refined Their Review Process but Could Improve Transparency and Timeliness (April 2016), GAO 

defines a SIFI as a term “commonly used by academics and other experts to refer to bank holding companies with $50 billion or more in total 

consolidated assets and nonbank financial companies designated by the Financial Stability Oversight Council for Federal Reserve supervision 

and enhanced prudential standards, but the Dodd-Frank Wall Street Reform and Consumer Protection Act does not use the term.” 30 Orderly liquidation authority acts as a backstop where SIFIs cannot otherwise be resolved through Bankruptcy Code processes.
2017

APPENDICES 181

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

plans and pre-planning exercises with key stakeholders and international partners. However, 

planning for these activities is complex, and the processes remain untested.

The Dodd-Frank Act also gave the FDIC greater discretion to manage the DIF, including where 

to set the designated reserve ratio.31 Consistent with the Act, the FDIC implemented a plan for 

the DIF by amending FDIC regulations to set the designated reserve ratio at 2 percent.32 

The FDIC should also continue evaluating whether it has the proper mechanisms to address 

failing institutions in the next crisis. For example, the FDIC has used Shared-Loss Agreements 

(“SLA”) to resolve failed institutions. In an SLA, a healthy acquiring institution agrees to 

purchase a failing institution, whereby the FDIC also agrees to absorb a significant portion of the 

losses experienced by the acquiring institution. According to the FDIC study on the financial 

crisis, SLAs were used by the FDIC for 62 percent of the failed banks and 82 percent of failed 

bank assets.33 The FDIC study identifies a number of issues in its analysis of lessons learned – 

including exploring options for maintaining readiness in a low-failure environment, considering 

broadening its options for funding resolutions, and implementing the necessary back-office 

operations and infrastructure to oversee the loss share program. We have work planned to 

evaluate whether the SLAs utilized by the FDIC achieved its program goals effectively. The FDIC 

should explore whether there are other mechanisms that should be considered for the next 

financial crisis and ensure that such tools are ready to be implemented should they be needed. 

When resolving a failing or failed bank, the FDIC uses an automated tool called the Claims 

Administration System (“CAS”) to identify a depositor’s insured and uninsured funds. When 

planning for the development of the CAS program, the FDIC expected that CAS could make 

insurance determinations for an institution of any size, up to 5 million deposit accounts; 

however, over time, the FDIC recognized the challenges of inconsistent and incomplete data at 

institutions. To mitigate these challenges, the FDIC issued a final rule on April 1, 2017 that 

required large institutions with greater than 2 million accounts to develop the capability to 

calculate deposit insurance coverage for their customers.34 As of December 2016, this rule 

would cover 38 financial institutions that maintain between 2 million and 87 million deposit 

accounts, at an expected cost of approximately $478 million. The FDIC has used CAS to make 

insurance determinations for a failing bank with greater than 2 million accounts during preclosing resolution planning but has not yet tested the system for institutions with greater than 

 

31 The reserve ratio is the DIF balance divided by estimated insured deposits. 32 The FDIC stated in the background of the Final Rule on the Designated Reserve Ratio that “a fund that is sufficiently large is a necessary 

precondition to maintaining a positive fund balance during a banking crisis and allowing for long-term, steady assessment rates. 75 Fed. Reg. 

79,286 (December 20, 2010).

33 The failure of the Washington Mutual financial institution was not included in these figures, because of its size and unique characteristics. 34 12 C.F.R. Part 370.
ANNUAL REPORT

182 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

2 million deposit accounts during a closing weekend. Accordingly, the FDIC is continuing to 

upgrade CAS capacity and timeliness. We have ongoing work to assess to what extent CAS has 

achieved expectations for accuracy, timeliness, and capacity in making insurance 

determinations. 

Staffing Plans. Determining the right number and skillsets of permanent staff needed to carry 

out and support the FDIC’s program areas is a fundamental challenge. At the peak of the 

financial crisis in 2011, the FDIC maintained approximately 9,250 permanent, term, and 

temporary positions, whereas it’s proposed staffing level for 2018 is 6,076 positions – a 34-

percent reduction. The FDIC’s annual budget is formulated primarily on the basis of an analysis 

of projected workload for each of the FDIC’s business lines35 and its program support functions. 

Risk Management Supervision (“RMS”). With respect to RMS, the FDIC viewed its 

corps of experienced examiners as a great asset during the last financial crisis. However, much 

of the current FDIC workforce will transition into retirement over the next decade. According to 

FDIC data, more than 25 percent of the FDIC’s current permanent workforce is projected to 

retire over the next 10 years, and many others are eligible to retire. While the FDIC has initiated 

a multi-year Workforce Development Initiative, it must maintain a steady flow of new examiners 

to step into the roles currently filled by seasoned examiners. In addition, the FDIC should ensure 

that there is a “knowledge transfer” from the more experienced personnel to the newer staff. To 

that end, RMS’s strategic plan includes a goal to ensure that the knowledge, expertise, and 

experiences of its most tenured workforce are shared with and transferred to a less tenured 

workforce.

RMS uses a staffing model to forecast a range for the appropriate number of examiners and its 

overall staffing size. This staffing model has been validated on two prior occasions. However, as 

noted earlier, in periods of crisis, the number of problem banks typically increases. For example, 

in March 2011, the number of problem banks was 888, whereas it currently stands at 

approximately 100 (as of September 2017). These problem banks required additional attention 

from FDIC RMS examiners, because they had elevated safety and soundness risks. As a result, 

the risk management examination staff was 2,237 positions in 2011, and has now been reduced 

to 1,549 in 2018 — a 31-percent reduction. During the financial crisis of 2008-2013, the FDIC 

reduced specialty examinations, examiner training, and temporary assignments, and 

repurchased employees’ annual leave, and hired temporary staff to address the increased 

workload. The FDIC also prioritized examination activities, increased staffing levels, and made 

greater use of off-site monitoring and on-site visitations between examinations. 

 

35 The FDIC has three major business lines: The Division of Risk Management Supervision (“RMS”) for safety and soundness and IT 

examinations; the Division of Resolutions and Receiverships (“DRR”) for failed bank resolutions and receivership activities; and the Division of 

Depositor and Consumer Protection (“DCP”) to ensure financial institutions treat customers and depositors fairly.
2017

APPENDICES 183

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Resolutions and Receiverships (“DRR”). DRR staffing requirements during the financial 

crisis were significantly higher than current staffing because of the bank failure workload. In 

2010, there were 157 financial institutions that failed, as compared to only 5 failures in 2016 and 

8 in 2017. As a result, DRR authorized staffing fell from 2,460 positions in 2010 to 409 positions 

in 2018 — an 83-percent reduction.

DRR has developed an operational readiness framework. The framework is composed of several 

elements, including resource management, operation training, knowledge management, 

contract management, operational governance (i.e., delegated authorities, budget, and other 

organizational issues to address readiness), and technology support. The framework outlines a 

rapid hiring strategy through the use of contractors, retirees, and temporary employees. DRR

has established number of contracts to support an increase in workload. The FDIC has 

determined that having the contracts in place minimizes the time to ramp up the acquisition 

process. 

At the peak of the previous financial crisis, more than 80 percent of DRR staffing consisted of 

term and temporary employees. In 2005, the FDIC implemented a Corporate Employee Program 

(“CEP”) that was designed to train new and experienced FDIC employees in a variety of 

functions, with the goal of creating a flexible workforce that could be re-allocated depending 

upon economic conditions and level of resolution activity. Subsequently, the FDIC determined 

that the CEP did not work as designed for augmenting DRR staffing needs, because it assumed 

that many of the employees who would be shifted to resolution tasks would come from the 

supervision division. However, as resolution activity began to increase, the workload of other 

divisions—including supervision—also increased, so that the realignment of resources could not 

be achieved as intended.

Other Challenges to FDIC Staffing Issues. The staffing challenges identified above are 

difficult to address quickly within a compressed timeframe, because the FDIC requires 

background investigations before hiring new employees. The FDIC requires that employees, 

appointees, and applicants for employment undergo a National Agency Check and Inquiry with 

Credit or other appropriate background investigation according to the positions they hold. 

Background investigations are critical to ensure that the FDIC employs and retains only those 

persons who meet all federal requirements for suitability (i.e., character, reputation, honesty, 

integrity, trustworthiness) and whose employment or conduct would not jeopardize the 

accomplishment of the FDIC’s duties or responsibilities. A high-quality suitability program is 

essential to minimizing the risk of unauthorized disclosures of sensitive information and to 

helping ensure that information about individuals with criminal backgrounds or other 

questionable behavior is identified and assessed as part of the process for granting or retaining 
ANNUAL REPORT

184 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

clearances. Our OIG evaluation, The FDIC’s Personnel Security and Suitability Program, examined 

the timeliness of background checks for FDIC personnel. We found that during the period of 

2011 to 2013, the submissions from the FDIC to investigate the background of employees and 

contractors exceeded OPM’s 14-day requirement, and that the average delays extended nearly 

2 months. 

According to the Division of Administration’s (“DOA”) Acquisition Services Branch (“ASB”), ASB

initially had difficulty recruiting and hiring term employees at the beginning of the most recent 

financial crisis. It appeared that prospective candidates were not interested in such term-limited 

appointments. However, as the crisis persisted, ASB expanded the number of permanent 

positions, reorganized, and was able to attract candidates for term appointments and complete 

contracting requirements. 

In addition, the current Administration has requested that government agencies develop reform 

plans aimed at reducing staffing levels. In June 2017, the FDIC submitted its multi-year strategy 

used to reduce operating and staffing on an annual basis to the OMB. The FDIC indicated in its 

submission that from 2010 through 2017, it had reduced its annual budget by approximately 

46 percent and it’s staffing by 30 percent. The FDIC anticipates a permanent workforce of no 

more than 6,000 in the near term but noted that adjustments may be necessary. 

Readiness of Support Functions. In addition to staffing models, the FDIC should also ensure 

that it has the proper infrastructure in place, in order to address the administrative functions of 

the agency in a timely manner during the next banking crisis. For example, the FDIC must 

ensure that it has the proper contracting services in place. During the recent financial crisis, the 

FDIC issued over 6,000 awards totaling more than $8 billion. The vast majority of these awards 

went to support resolution and receivership activity at FDIC headquarters and in the Dallas 

Regional Office. In addition to the contracting activity, the FDIC should also ensure that it has 

the proper support services for such contracts, including legal support (Legal Division), as well as 

oversight managers and technical monitors. In addition the FDIC should ensure that it has the 

proper level of human resources personnel to hire new employees and annuitants. The agency 

should continue to ensure that there is sufficient IT equipment (including computers, servers, 

peripheral devices, software licenses, and communications devices) in preparation for the next 

financial crisis, and a robust infrastructure so that these computer systems may operate in a 

secure environment.

The FDIC must continue to maintain and update its readiness strategies, and test and exercise its 

plans to ensure they keep pace with an ever-changing financial environment and incorporate 

important lessons from the past. 
2017

APPENDICES 185

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Enterprise Risk Management Practices

Enterprise Risk Management (“ERM”) is a decision-making tool that assists federal leaders in 

anticipating and managing risks at an agency, and helps to consider and compare multiple risks 

and how they present challenges and opportunities when viewed across the organization. 

According to OMB guidance, ERM is beneficial because it addresses a fundamental 

organizational issue: the need for information about major risks to flow both vertically (i.e., up 

and down the organization) and horizontally (i.e., across its organizational units) to improve the 

quality of decision-making. When implemented effectively, ERM seeks to open channels of 

communication, so that managers have access to the information they need to make sound 

decisions. ERM can also help executives recognize how risks interact (i.e., how one risk can 

exacerbate or offset another risk). Further, ERM examines the interaction of risk treatments 

(actions taken to address a risk), such as acceptance or avoidance. ERM encompasses many risk 

areas, including financial risk, operational risk, reporting risk, compliance risk, governance risk, 

strategic risk, and reputational risk. 

In July 2016, OMB issued an updated Circular A-123, Management’s Responsibility for Enterprise 

Risk Management and Internal Control, to ensure that federal officials effectively manage risks

that could affect the achievement of 

agency strategic objectives.36 OMB 

Circular A-123 requires agencies to 

integrate risk management and 

internal control functions and guides 

agencies’ processes to integrate 

organizational performance and ERM. 

The Circular emphasizes the need for 

agencies to coordinate risk 

management and strong and 

effective internal controls into 

existing business activities as an 

integral part of governing and 

managing an agency. 

OMB Circular A-123 encouraged agencies to establish a Risk Management Council (“RMC”); 

develop “Risk Profiles”, which identify risks arising from mission and mission-support operations; 

 

36 The FDIC has determined that while Circular A-123 is not binding on the FDIC, the Circular provides “good government” principles that may 

be useful to the FDIC’s own ERM program.

OMB defines the following terms:

• Risk. The effect of uncertainty on objectives. 

• Risk management. A series of coordinated activities 

to direct and control challenges or threats to 

achieving an organization’s goals and objectives. 

• Enterprise Risk Management. An effective agencywide approach to addressing the full spectrum of 

the organization’s significant internal and external 

risks by understanding the combined impact of risks 

as an interrelated portfolio, rather than addressing 

risks only within silos.

Source: OMB Circular A-123 
ANNUAL REPORT

186 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

and consider those risks as part of the annual strategic review process. An effective RMC 

includes senior officials from program operations and mission-support functions to ensure the 

identification of risks that have the most significant impact on the mission outcomes. The Chief 

Operating Officer (“COO”) or a senior official with responsibility for the enterprise should serve 

as RMC chairperson.

OMB Circular A-123 complements OMB Circular A-11, Preparation, Submission, and Execution of 

the Budget, Section 270, which discusses agency responsibilities for identifying and managing 

strategic and programmatic risk as part of agency strategic planning, performance management, 

and performance reporting practices. Together, these two OMB Circulars constitute the ERM 

policy framework for the federal government. OMB views ERM as part of the overall governance 

process, and internal controls as an integral part of risk management and ERM. 

The Relationship Between Internal Controls and ERM

Source: OMB Circular A-123.

OMB Circular A-123 specifies elements that federal agencies’ ERM frameworks should include 

and steps agencies should take to develop these frameworks. These include a planned risk 

management governance structure, a process for considering risk appetite and risk tolerance 

levels, a methodology for developing a risk profile, a general implementation timeline, and a 

plan for developing the depth and quality of the risk profiles over time. The organization’s 

senior leadership should establish a risk appetite (i.e., amount of risk an organization is willing to 

accept), which serves as a guidepost to establish strategy and select objectives, and a risk 

Governance

Enterprise Risk 

Management

Risk 

Management

Internal 

Controls
2017

APPENDICES 187

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

tolerance (i.e., an acceptable level of variance in performance relative to the achievement of 

objectives).

GAO reported that effective ERM implementation starts with an agency establishing a 

customized ERM program that fits its specific organizational mission, culture, operating 

environment, and business processes.37 GAO identified six essential elements to assist federal 

agencies as they move forward with ERM implementation. 

Source: GAO-17-63.

In our 2008 report, The FDIC’s Internal Risk Management Program, we evaluated the extent to 

which the FDIC’s implementation of an ERM program complied with applicable governmentwide guidance. We found that the FDIC should institutionalize how the various FDIC 

committees interrelate and support ERM, and ensure the continuity of risk management efforts 

as changes in leadership and/or senior management occur. Since that report, the FDIC has 

taken steps described below to develop an ERM framework, but in light of recent organizational 

 

37 Enterprise Risk Management: Selected Agencies’ Experiences Illustrate Good Practices in Managing Risk (December 2016).
ANNUAL REPORT

188 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

changes to the program, the FDIC must continue to enhance and develop its ERM infrastructure 

to achieve an effective and efficient ERM program. 

ERM is especially important for the FDIC at this time since it is experiencing significant changes 

at its senior levels, including the Board of Directors38 and its governance bodies. The FDIC has a 

Board with five members: the FDIC Chairman, the FDIC Vice Chairman, the Director of the 

Consumer Financial Protection Bureau (“CFPB”), the Comptroller of the Currency, and an internal 

FDIC board member. The FDIC Chairman’s term expired in November 2017, but he continues to 

serve as Chairman until a nominee is confirmed. The Vice-Chairman’s term expires in April 2018. 

The Comptroller of the Currency was appointed in November 2017, and the CFPB Director is 

currently in an acting role. In addition, the FDIC internal board member position has been 

vacant since June 4, 2015. 

In 2010, the FDIC engaged a consulting firm to evaluate its existing risk management practices 

and recommend improvements. The consulting firm identified several gaps in the FDIC’s risk 

management structure. For example, most risks at the FDIC were addressed within existing 

hierarchical organizational structures, with limited communication across the agency 

organizational units. Further, while the FDIC had a network of internal committees to address 

various risks, governance over those committees was ambiguous. The consultant recommended 

the establishment of a centralized, independent risk management organization headed by a 

Chief Risk Officer (“CRO”) that should report directly to the FDIC Chairman. 

In January 2011, the FDIC Board of Directors established the CRO position and subsequently, in 

December 2011, the FDIC Board approved the creation of an Office of Corporate Risk 

Management (“OCRM”) with staffing of 15 employees. The CRO reported operationally to the 

FDIC Chairman and functionally to the Board of Directors. The OCRM provided an organization 

within the FDIC to review external and internal risks with a system-wide perspective and instill 

risk governance as part of the FDIC’s culture. In addition, the FDIC established an Enterprise Risk 

Committee (“ERC”) chaired by the CRO. The newly established ERC evaluated significant 

external business risks facing the FDIC and banking industry. 

The first CRO assumed his position in August 2011 and the OCRM staffing was authorized at 

15 positions. The initial CRO retired in May 2016 and the then-Deputy CRO became the Acting 

CRO until his retirement in June 2017. Further, due to other staff departures, there were only 

five professional staff in OCRM by September 2017. 

 

38 According to the Federal Deposit Insurance Act, the management of the FDIC is vested in a Board of Directors consisting of five members 

who each serve 6-year terms – the Comptroller of the Currency, the Director of the Consumer Financial Protection Bureau, and three members 

appointed by the President with advice and consent of the Senate. 12 U.S.C. §1821(a) and (b). The three members are the Chairman of the 

FDIC, the FDIC Vice Chairman, and an internal FDIC Director.
2017

APPENDICES 189

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

In September 2017, the FDIC transferred OCRM functions into the Division of Finance (“DOF”). 

The reorganization combined the OCRM and the Corporate Management Control (“CMC”) 

Branch into a newly-constituted Risk Management and Internal Controls Branch (“RMIC”) within 

DOF. The title of CRO will now be held by a Deputy Director in DOF. Currently, the Acting 

Deputy Director heads RMIC. The FDIC plans to select a permanent CRO in early 2018. As part 

of the 2017 reorganization, the FDIC also decided to use the existing Operating Committee as 

the focal point for the coordination of risk management at the FDIC, thus disbanding and 

replacing the ERC. The FDIC also maintains a framework to enhance awareness of external 

threats that may impact FDIC operations. The framework consists of Regional Risk Committees 

that review regional economic and banking trends; the Management Risk Roundtable that 

examines risks to the banking industry and the Deposit Insurance Fund; and the External Risk 

Forum that facilitates information sharing and awareness of risks facing the banking industry 

and the FDIC. We intend to conduct an evaluation of the effectiveness of the FDIC ERM 

Program.

The FDIC should continue institutionalizing ERM and best practices outlined in OMB guidance. 

The FDIC Board of Directors, senior management, and individuals at every level throughout the 

FDIC should acknowledge, understand, and take ownership of current and emerging risks to the 

FDIC mission and be prepared to take steps to mitigate these risks. 
ANNUAL REPORT

190 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Acquisition Management and Oversight

According to the GAO’s Framework for Assessing the Acquisition Function at Federal Agencies

(2005), agencies should effectively manage their acquisition process in order to ensure that

contract requirements are defined clearly and all aspects of contracts are fulfilled.

39 GAO noted 

that clear descriptions of contract requirements lead to the acquisition of goods and services at 

a fair price. Vague statements of work, however, can lead to miscommunication, uncertainty, 

delays, and increased costs. Agencies must properly oversee contractor performance and 

identify any deficiencies, as well ensure appropriate verification of expenditures. 

Over the last 10 years (2008 through 2017), the FDIC awarded more than 12,600 contracts 

totaling nearly $11.2 billion. The DOA ASB provides a wide range of contracting programs and 

services to support day-to-day operations at the FDIC. As shown in the chart below, the FDIC 

awarded $2.6 billion in contracts from January 2014 to December 2017. In addition, the FDIC 

budget for 2018 includes more than $457 million in contracting expenses for outside services. 

FDIC Contract Awards January 2014-December 2017

Source: FDIC Division of Administration

Three divisions, DOA, the Division of Information Technology (“DIT”), and DRR, accounted for 

96 percent ($2.5 billion) of all contract awards through DOA’s ASB between January 2014 and 

December 2017. DOA contracts for services such as security, facilities, and records 

management. DIT procures contracts for technology services, such as help desk personnel, 

 

39 GAO, Framework for Assessing the Acquisition Function at Federal Agencies (2005); See also, Testimony of GAO Assistant Comptroller 

General before the Subcommittee on Oversight and Investigations, U.S. House of Representatives (December 3, 1992).

 $-

 $100,000,000

 $200,000,000

 $300,000,000

 $400,000,000

 $500,000,000

 $600,000,000

 $700,000,000

 $800,000,000

 $900,000,000

 $1,000,000,000

2014 2015 2016 2017

Total Value of Contract Awards
2017

APPENDICES 191

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

computer systems design, and telecommunications. DRR is responsible for managing the 

resolution process, which involves a range of contracts to support the closing functions at failed 

institutions, and management and disposition of receivership assets. For example, DRR 

contracts include appraisal management services, credit card consulting, commercial loan 

servicing, and data management. 

Contracting Officers are responsible for ensuring the performance of all actions necessary for 

efficient and effective contracting, compliance with contract terms, and protection of the FDIC’s 

interests in all of its contractual relationships. In addition, FDIC program offices develop 

contract requirements, and program office Oversight Managers and Technical Monitors oversee 

the contractor’s performance and technical work. Oversight management involves monitoring 

contract expenses and ensuring that the contractor delivers the required goods or performs the 

work according to the delivery schedule in the contract. In Crisis and Response, An FDIC History, 

2008-2013, the FDIC explained that contracting was an essential part of the FDIC’s failure 

resolution process during the financial crisis, but it was overtaxed early in the crisis. Specifically, 

staffing was thin, contract timeframes to approve new contracts or modify existing contracts 

were too long to support the volume of failures, and the FDIC had to rapidly hire and train 

Oversight Managers. We are initiating an evaluation to review FDIC’s current contract oversight 

program. 

The FDIC also must continue to ensure that its contractors and contracting personnel meet 

security and suitability standards for employment and access to sensitive information. In 

addition, contractors must meet criteria for integrity and fitness such as conflicts of interest,

ethical responsibilities, and use of confidential information.40 These security protections are 

important since the contractors have access to FDIC space and information and use FDIC 

equipment. Such information includes sensitive information related to bank closings as well as 

personally identifiable information for private citizens and FDIC employees. DOA’s Security and 

Emergency Preparedness Section, Personnel Security Unit, is responsible for establishing and 

implementing contractor personnel security policy, including evaluations, adjudications, 

approvals, and clearances, and ensuring appropriate background investigations are conducted 

on contractor personnel.41 

With regard to contracting for legal services, for the 4 years from 2014 through 2017, the FDIC’s 

Legal Division spent $364 million on outside counsel. The Legal Division has independent 

contracting authority and is excluded from FDIC procurement policies executed by ASB. The 

Legal Division contracts for services of outside counsel in areas such as bankruptcy and 

creditor’s rights; collections; environmental law; federal, state, and local taxation; foreclosures; 

 

40 12 C.F.R. Part 366.

41 FDIC Circular 1610.2, Personnel Security Policy and Procedures for FDIC Contractors.
ANNUAL REPORT

192 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

real estate; and financial transactions. The Legal Division retains outside counsel through Legal 

Services Agreements that contain terms and conditions applicable to referrals of FDIC legal 

matters. The Legal Division assigns an Oversight Attorney (“OA”) responsible for all strategic 

and major tactical decisions associated with a matter. The OA also monitors progress against a 

case plan and budgets. 

The FDIC characterizes “large contracts” as those with award amounts exceeding $20 million or 

that require greater oversight based on the complex nature of the contract. As of January 2018, 

the FDIC had 11 large contracts between $20 and $112 million in value. Over the past 2 years, 

DRR and DIT oversaw a total of 540 contracts, each with a value of $1 million or more.

In our OIG work, we have noted several shortcomings in contractor oversight, which can lead to 

delays and cost overruns. In our report, The FDIC’s Failed Bank Data Services Project (March 

2017), we reviewed a 10-year, $295 million project related to the transition of the management 

of failed financial institution data from one contractor to another. Our review focused on 

transition costs of approximately $24.4 million. The audit concluded that transition milestones 

were not met, resulting in a one year delay. Further, transition costs, while less than projected 

in the approval, were greater than the initial estimates at contract inception, by $14.5 million. 

We concluded that the reasons for the increase were that the FDIC faced challenges related to 

defining contract requirements, coordinating contracting and program office personnel, and 

establishing implementation milestones. We reported that FDIC personnel did not fully 

understand the requirements for transitioning failed financial institution data and services to a 

new contractor, or communicate these requirements to bidders in a comprehensive transition 

plan as part the solicitation. Further, the FDIC did not establish clear expectations in the 

contract documents and did not implement a project management framework and plans.

In addition, our OIG report on the FDIC’s Identity, Credential, and Access Management Program

(2015), reviewed the FDIC’s Identity, Credential, and Access Management Program (“ICAM”) and 

identified significant issues or program risks. We found that the FDIC had not achieved its goal 

of issuing identity credentials (known as personal identity verification (PIV) cards) to all eligible 

employees and contractor personnel. The FDIC had not established appropriate governance to 

ensure the ICAM program’s success. The FDIC awarded an initial contract for $3.4 million to 

procure expertise and support for planning and implementing the credential program. We 

reported that the milestone goals for this project slipped by more than 2 years (from 

August 2014 to December 2016) and that the contract cost ceiling needed to be increased by 

$1.5 million — a 44 percent increase. We determined that these delays and cost overruns were 

the result of technical hurdles as well as unclear roles and responsibilities of the parties involved 

in governing the ICAM program. 
2017

APPENDICES 193

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

In 2017, we conducted a Follow-on Audit of the FDIC’s Identity, Credential, and Access 

Management Program (June 2017) and found that the FDIC addressed the issues from the 2015 

report but experienced considerable challenges that warranted management’s attention. For 

example, the FDIC had not established policies and procedures governing the management and 

use of PIV cards for physical and logical access. We also concluded that the FDIC did not 

maintain current, accurate, and complete contractor personnel data needed to manage PIV 

cards, and management had not finalized and approved a plan for retiring the FDIC’s legacy PIV 

card system. 

In response to recommendations made in OIG reports, the FDIC is taking actions to improve 

contract management and oversight. For example, 346 Oversight Managers and Technical 

Monitors received training, and ASB was developing an Oversight Manager refresher course 

during 2017.

In a time of reduced budget and staff, the FDIC should continue efforts aimed at optimizing its 

use of contract resources by clearly defining work and deliverables, managing contract 

milestones, and overseeing contract expenditures. Taking those steps helps to ensure that the 

FDIC receives goods and services at a fair price and without undue delays and costly 

inefficiencies.
ANNUAL REPORT

194 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

Measuring Costs and Benefits of FDIC Regulations

GAO’s report, Dodd-Frank Act Regulations: Implementation Could Benefit from Additional 

Analyses and Coordination (2011), recognizes that, while not required, many Federal financial 

regulators generally perform cost-benefit analysis when they propose a new rule. The 

Congressional Research Service (“CRS”) has recognized that the use of cost-benefit analysis may 

improve the quality and effectiveness of federal rules and minimize burden in its Cost-Benefit 

and Other Analysis Requirements in the Rulemaking Process (2014). 

On February 3, 2017, the President issued Executive Order 13772 that set forth seven core 

principles for Federal regulations governing U.S. financial institutions, including “make 

regulation[s] efficient, effective, and appropriately tailored.” As required by this Executive Order, 

the Department of the Treasury issued a report, A Financial System That Creates Economic 

Opportunities (June 2017), examining costs relating to compliance with regulations imposed on 

banks. This report recommended that financial regulatory agencies should conduct rigorous 

cost-benefit analysis and make greater use of proposed rulemaking to solicit public comment. 

While there is no formal requirement for financial regulators to conduct cost-benefits analysis

for rulemaking, the FDIC generally conducts this analysis on its own initiative for proposed rules. 

In addition, the FDIC routinely solicits comments from the public for Notice of Proposed 

Rulemakings in accordance with the provisions of the Administrative Procedures Act , and 

because of the difficulty in obtaining quantitative data measuring regulatory costs and benefits, 

it considers such comments to be an important source of information. 

The FDIC has developed a framework for conducting analysis of regulations. According to the 

FDIC’s Statement of Policy on Development and Review of FDIC Regulations and Policies (updated 

December 2017), the agency “evaluate[s] benefits and costs based on available information, and 

consider[s] reasonable possible alternatives; the main alternatives should be described and 

analyzed for consistency with statutory or regulatory objectives, effectiveness, and burden on 

the public or industry.” Also, in 2015, the FDIC organized an Office of the Chief Economist and 

Regulatory Analysis within the Division of Insurance and Research, which, according to the FDIC, 

aims to provide consistency and rigor in its regulatory analysis.42 

The CRS report, Cost Benefit Analysis and Financial Regulator Rulemaking (2017), recognized that 

performing cost benefit analysis “can be useful in determining whether or not a regulation is 

beneficial. However, performing CBA [Cost Benefit Analysis] can be a difficult and timeconsuming process, and it produces uncertain results because it involves making assumptions 

 

42 The Federal Reserve also recently established a new office to analyze the impact of its regulations. (See Fed adds staff for new office 

dedicated to gauging economic impact of regulations, Politico Pro, January 18, 2018).
2017

APPENDICES 195

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

about future outcomes.” The CRS report also noted that cost benefit analysis, “for financial 

regulation is particularly challenging, due largely to the high degree of uncertainty over precise 

regulatory costs and outcomes.” The report identified three challenges to making accurate cost 

benefit analysis: (1) behavioral changes of people as they adapt to a new regulation, 

(2) quantification that must overcome uncertainty over the causal relationship between the 

regulation and outcomes, and (3) monetization, which is difficult for outcomes that do not have 

easily discernable monetary values. 

In addition, the Yale Law Journal published a review entitled Cost-Benefit Analysis of Financial 

Regulations Case Studies and Implications (2015), which examined select financial regulations. 

This review determined “that the capacity of anyone . . . to conduct qualified [Cost Benefit 

Analysis on Financial Regulations] with any real precision or confidence does not exist for 

important, representative types of financial regulation.” The review concluded that, “[t]oo many 

contestable assumptions are required for anyone producing or consuming guesstimate [Cost 

Benefit Analysis on Financial Regulations] to have any confidence in any specific estimate of 

costs or benefits, even if expressed in ranges or bounds.” 

Another CRS report, An Analysis of the Regulatory Burden on Small Banks (2015), noted that 

bank regulators, including the FDIC, generally did not quantify overall costs or benefits for 

14 major rules issued in accordance with the Dodd-Frank Act requirements, although regulators 

did assess some costs associated with individual rules. The bank regulators quantified some 

costs for two rules and qualitatively discussed costs and benefits for three rules. The CRS did 

not identify any cost-benefit analysis for the other remaining rules. 

Similarly, GAO’s report, Dodd-Frank Regulations: Agencies’ Efforts to Analyze and Coordinate 

Their Recent Final Rules (2016), reviewed five major rules, one of which was issued by the FDIC, 

and found that regulators quantified some costs in all five rules. The FDIC rule was one of the 

two where some benefits were quantified. GAO cited earlier work that noted that bank 

regulators faced difficulties in quantifying benefits because financial regulatory concepts are 

complex and challenging to define and model; research methodologies do not necessarily 

address economic values and the distribution of risk; and flows of future costs and benefits can 

be uncertain and difficult to project.43 For these reasons, the FDIC faces challenges with proper 

data collection and lack of available information with respect to measuring costs and identifying 

benefits for a particular rule. 

In responses to the GAO report, regulators advised GAO that there are industry concerns about 

the potential for unintended consequences from Dodd-Frank Act rulemaking and 

 

43 Dodd-Frank Regulations: Regulators’ Analytical and Coordination Efforts (2014).
ANNUAL REPORT

196 APPENDICES

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

implementation and were undertaking retrospective reviews of rules. For example, in February 

2016, the FDIC issued a proposed rule on Recordkeeping for Timely Deposit Insurance 

Determination. The FDIC experienced challenges in quantifying the costs and benefits of this 

rule. The FDIC had engaged an independent contracting firm to estimate the expected costs 

that 36 large banks would incur as a result of the proposed rule requiring such banks to 

calculate insured deposits within 24 hours of failure. The contractor estimated that the cost to 

the industry was $328 million (80 cents per deposit account). The FDIC found, however, that the 

benefits of the rule were difficult to determine, explaining that “[b]ecause there is no market in 

which the value of these public benefits can be determined, it is not possible to monetize these 

benefits.” 

During the comment period for this rule, the American Bankers Association, Clearinghouse 

Association, Consumer Bankers Association, and Securities Industry and Financial Markets 

Association provided comments that outlined numerous concerns about the proposed rule. 

One such concern was that the FDIC had not adequately considered the costs the rule would 

place on financial intermediaries, the disruption that it would cause in deposit markets, and the 

risk that it would place on the security of depositors’ personal information. The associations

further stated that the FDIC contractor had underestimated the actual implementation costs of 

the rule and did not contemplate ongoing costs to the institutions. In addition, the associations

asserted that the FDIC did not fully consider that the increased costs would likely be passed on 

to customers at the institutions. They also noted that “the FDIC has a responsibility to provide 

concrete evidence to support the purported benefits” of the rule and “conduct a full-fledged 

cost-benefit analysis.” 

After evaluating public comments on the proposed rule, the FDIC issued a final rule with a 

revised total cost of $478 million in which the cost to the covered institutions was estimated at 

$368 million with the remaining costs accrued to depositors and the FDIC. In the final rule, the 

FDIC stated that the rule would ensure “prompt and efficient deposit insurance determinations 

by the FDIC and thus the liquidity of deposit funds; enabl[e] the FDIC to more readily resolve a 

failed [Insured Depository Institution]; reduc[e] the costs of failure of a covered institution by 

increasing the FDIC’s resolution options; and promot[e] long term stability in the banking 

system by reducing moral hazard.” The FDIC further advised us that the estimated costs of 

implementation would amount to less than one seventh of one percent of 2015 total 

noninterest expenses for institutions required to implement the rule.

The FDIC engages in a regulatory review process at least every 10 years, in accordance with the 

Economic Growth and Regulatory Paperwork Reduction Act. This process considers whether any 

of the FDIC’s regulations are outdated, unnecessary, or unduly burdensome. In addition, in
2017

APPENDICES 197

OFFICE OF INSPECTOR GENERAL’S 

ASSESSMENT (continued)

2009, the FDIC established an Advisory Committee on Community Banking to provide advice 

and guidance on policy issues impacting small community banks, including current examination 

policies and procedures, credit and lending practices, deposit insurance assessments, insurance 

coverage, and regulatory compliance, including the cost and benefit of regulations. Community 

banks include rural and urban institutions supervised by the FDIC. Further, in 2012, the FDIC 

conducted a Community Banking Study to identify and explore issues and questions about 

community banks. The Study found a number of areas warranting additional FDIC research, 

including how regulatory costs for community banks have changed. As part of its Annual 

Performance Plan for 2017, the FDIC committed to follow up on issues identified in the Study 

relating to efficiency, consistency, and transparency of its supervisory processes. 

While the FDIC aims to conduct cost-benefit analyses for proposed rules, it faces challenges in

collecting the necessary data and information, and estimating the costs and benefits of its 

regulations with a degree of precision. The FDIC should continue efforts to make meaningful 

cost-benefit determinations because regulations have lasting effects on institutions and 

consumers.
ANNUAL REPORT

198 APPENDICES

E. ACRONYMS

AEI Alliance for Economic Inclusion

AFS Available-For-Sale

AIG American International Group, Inc.

AML Anti-Money Laundering

AML/CFT Anti-Money Laundering and Countering the 

Financing of Terrorism

ASBA Association of Supervisors of Banks of the 

Americas

ASC Accounting Standards Codification

ASU Accounting Standards Update

BCBS Basel Committee on Banking Supervision

BoA Bank of America

BSA Bank Secrecy Act

Call Report Consolidated Reports of Condition and 

Income

CAMELS 

rating scale Capital adequacy; Asset quality; Management 

quality; Earnings; Liquidity; Sensitivity to 

market risks

CAT Cybersecurity Assessment Tool

CCP Central Counterparties

CDFI Community Development Financial 

Institution

CECL Current Expected Credit Losses

CEO Chief Executive Officer

CEP Corporate Employee Program

CFI Complex Financial Institution

CFO Act Chief Financial Officers’ Act

CFPB Consumer Financial Protection Bureau

CFR Center for Financial Research

CFTC Commodity Futures Trading Commission

CIO Chief Information Officer

CMG Crisis Management Group

CMP Civil Money Penalty

ComE-IN Advisory Committee on Economic Inclusion

CPI-U Consumer Price Index for All Urban 

Consumers

CRA Community Reinvestment Act

CRE Commercial Real Estate

CSF Cybersecurity Framework

CSRS Civil Service Retirement System

DCP Division of Consumer Protection

DFA Dodd-Frank Act

DIF Deposit Insurance Fund

DIR Division of Insurance and Research

DIT Division of Information Technology

DOA Division of Administration

DRR Designated Reserve Ratio

DRR (FDIC) Division of Resolutions and Receiverships

EC European Commission

EDIE Electronic Deposit Insurance Estimator

EGRPRA Economic Growth and Regulatory Paperwork 

Reduction Act of 1996

ERM Enterprise Risk Management

FASB Financial Accounting Standards Board

FBIIC Financial and Banking Information 

Infrastructure Committee 

FBO Foreign Bank Organization

FDI Act Federal Deposit Insurance Act

FDIC Federal Deposit Insurance Corporation

FEHB Federal Employees Health Benefits

FERS Federal Employees Retirement System

FFB Federal Financing Bank

FFIEC Federal Financial Institutions Examination 

Council

FFMIA Federal Financial Management Improvement 

Act

FHLB Federal Home Loan Banks

FICO Financing Corporation

FIL Financial Institution Letter

Fintech Financial Technology

FIRREA Financial Institutions Reform, Recovery 

Enforcement Act

FIS Financial Institution Specialists

FISMA Federal Information Security Management Act

FMFIA Federal Managers’ Financial Integrity Act

FMSP Financial Management Scholars Program

FRB Board of Governors of the Federal Reserve 

System

FRF FSLIC Resolution Fund

FSB Financial Stability Board

FS-ISAC Financial Services Information Sharing and 

Analysis Center
2017

APPENDICES 199

FSLIC Federal Savings and Loan Insurance 

Corporation

FSOC Financial Stability Oversight Council

FTE Full-Time Employee

GAAP Generally Accepted Accounting Principles

GAO U.S. Government Accountability Office

GDP Gross Domestic Product

GECC General Electric Capital Corporation, Inc.

GPRA Government Performance and Results Act

G-SIBs Global Systemically Important Banks

G-SIFI Global SIFIs

HMDA Home Mortgage Disclosure Act

IADI International Association of Deposit Insurers

IDI Insured Depository Institution

IMF International Monetary Fund

IMFB IndyMac Federal Bank

InTREx Information Technology Risk Examination 

Program

IT Information Technology

ITCIP Insider Threat and Counterintelligence 

Program

ITSP Information Technology Strategic Plan

LIDI Large Insured Depository Institution

LLC Limited Liability Company

MDI Minority Depository Institutions

MOL Maximum Obligation Limitation

MOU Memoranda of Understanding

MRM Model Risk Management

MRBA Matters Requiring Board Attention

MWOB Minority- and Women-Owned Business

NCUA National Credit Union Administration

NPR Notice of Proposed Rulemaking

NSFR Net Stable Funding Ratio

OCC Office of the Comptroller of the Currency

OCRM Office of Corporate Risk Management

OIG Office of the Inspector General

OLA Orderly Liquidation Authority

OLF Orderly Liquidation Fund

OMB U.S. Office of Management and Budget

OMWI Office of Minority and Women Inclusion

OO Office of the Ombudsmen

OPM Office of Personnel Management

ORE Owned Real Estate

OTS Office of Thrift Supervision

P&A Purchase and Assumption

PIV Personal Identity Verification

PRU Prudential Incorporation

QBP Quarterly Banking Profile

QFC Qualified Financial Contracts

REMA Reasonably Expected Market Area

ReSG FSB’s Resolution Steering Committee

RMIC Risk Management and Internal Controls

RMS Division of Risk Management Supervision

RTC Resolution Trust Corporation

SBA Small Business Administration

SEC Securities and Exchange Commission

SIFI Systemically Important Financial Institution 

SLA Shared-Loss Agreement

SME Subject Matter Expert

SMS Systemic Monitoring System

SNC Shared National Credit Program

SRAC Systemic Resolution Advisory Committee

SRR SIFI Risk Report

SRB Single Resolution Board

SSGN Structured Sale of Guaranteed Note

TIPS Treasury Inflation-Protected

TSP Federal Thrift Savings Plan

TSP (IT-related) Technology Service Providers

UBPR Uniform Bank Performance Report

URSIT Uniform Rating System for Information 

Technology

VIEs Variable Interest Entities

WE Workplace Excellence

WIOA Workforce Investment Opportunity Act

YSP Youth Savings Program
NOTES