216

The Meeting of the Advisory Committee on Community Banking

of the

Federal Deposit Insurance Corporation

Held in the Board Room

Federal Deposit Insurance Corporation Building

Washington, D.C.

Open to Public Observation

July 25, 2013 — 8:30 A.M.

The meeting of the Federal Deposit Insurance Corporation ("FDIC") Advisory

Committee on Community Banking ("Committee") was called to order by Martin J. Greenberg,

Chairman, FDIC Board of Directors.

The members of the Committee present at the meeting were: Robert F. Baronner, Jr.,

President and Chief Executive Officer ("CEO"), Bank of Charles Town, Charles Town, West

Virginia; Leonel Castillo, President and CEO, American Bank of Commerce, Provo, Utah;

Carolyn "Betsy" Flynn, President and CEO, Community Financial Services Bank, Benton,

Kentucky; Joseph G. Pierce, President and CEO, Farmers State Bank, Lagrange, Indiana; Jane

Haskin, President and CEO, First Bethany Bank &Trust, Bethany, Oklahoma; Mark Hesser,

President, Pinnacle Bank, Lincoln, Nebraska; James Lundy, CEO, Western Alliance Bank,

Phoenix, Arizona; Ann Marie Mehlum, President and CEO, Summit Bank, Eugene, Oregon;

Kim D. Saunders, President, CEO and Director, Mechanics &Farmers Bank, Durham, North

Carolina; Dorothy A. Savarese, President and CEO, Cape Cod Five Cents Savings Bank,

Orleans, Massachusetts; David Seleski, President, CEO and Director, Stonegate Bank, Fort

Lauderdale, Florida; and Derek Williams, President and CEO, First Peoples Bank, Pine

Mountain, Georgia.

Cynthia L. Blankenship, Vice President and Chief Operating Officer, Bank of the West,

Grapevine, Texas, Walter E. Grady, President and CEO, Seaway Bank and Trust Company,

Chicago, Illinois, and Alan Thian, President and CEO, Royal Business Bank, Los Angeles,

California were absent from the meeting.

Members of the FDIC Board of Directors present at the meeting were: Martin J.

Greenberg, Chairman, Thomas M. Hoenig, Vice Chairman, and Jeremiah O. Norton, Director

(Appointive).

Corporation staff who attended the meeting included: Willa M. Allen, Michael B.

Benardo, Valerie J. Best, Michelle Borzillo, Michael W. Briggs, Liliana Burnett, Kymberly K.

July 25, 2013
217

Copa, Carolyn Curran, Christine M. Davis, Patricia B. Devoti, Doreen R. Eberley, Bret D.

Edwards, Robert E. Feldman, George French, Daniel E. Frye, Tiffani A. Garner, Shannon N.

Greco, Marianne Hatheway, William H. Henley, Jr., Martin D. Henning, James D. LaPierre,

Alan W. Levy, Christopher Lucas, Sally J. Kearney, Elizabeth A. Khalil, Ira W. Kitmacher,

Roberta K. McInerney, Jonathan N. Miller, Mark S. Moylan, Robert W. Mooney, Sumaya A.

Muraywid, Thomas E. Nixon, Jessica H. Nye, Richard Osterman, Mark E. Pearce, Kevin E.

Pearson, Sylvia H. Plunkett, Stephen A. Quick, Paul Robin, Claude A. Rollin, Barbara A. Ryan,

David E. Sanders, Donald R. Saxinger, Philip A. Shively, Martha Solt, Eric J. Spitler, Cottrell L.

Webster, and Mindy West.

William A. Rowe, III, Deputy to the Chief of Staff and Liaison to the FDIC, Office of the

Comptroller of the Currency was also present at the meeting.

Chairman Greenberg welcomed the Committee and provided an overview of the day's

program. He said the agenda would focus on information technology ("IT") and cybersecurity

issues affecting community banks, in response to members' previous expression of interest in

those subjects. Chairman Greenberg said the first panel would update the Committee on the

FDIC's community banking initiatives including communications and technical assistance to

banks, as well as pre-examination process improvements. Next, he said there would be a

discussion of developments in payment systems and their impact and, after lunch there would be

a panel focused on IT examination issues. The Chairman said the last panel would discuss

current policy issues, including the recently released Basel III and leveraged capital rulemakings,

as well as recent mortgage rules issued by the Consumer Financial Protection Bureau ("CFPB").

Chairman Greenberg noted that this would be the last meeting of Member Mehlum and thanked

her for her service. He then introduced Chief of Staff Barbara Ryan who moderated the rest of

the day's proceedings.

Ms. Ryan introduced Doreen Eberley, Director, Division of Risk Management Supervision

("RMS") and Mark Pearce, Director, Division of Depositor and Consumer Protection ("DCP")

who provided the Committee with a status report on the FDIC's community banking initiatives.

Ms. Eberley spoke about the FDIC's technical assistance video program which has three types:

1) the six part "New Director Education" series that had been previewed at the previous

Committee meeting (all of which have been released); 2) the six part "Virtual Directors College"

curriculum that had been previewed (all of which have been released); and 3) this day's focus,

the six part "Virtual Technical Assistance Program" which would be released in the coming year

starting the next week. She said the Virtual Technical Assistance Videos were aimed at

providing technical training for bankers and each was about an hour long. The first six topics

include: fair lending; appraisals and evaluations; interest rate risk ("IRR"); troubled debt

restructuring ("TDR") and allowance for loan and lease losses; evaluation of municipal

securities; and flood insurance.

Ms. Eberley said the first release among these would be the IRR video and demonstrated

where the video could be found on the "Directors' Resource Page" of the FDIC website. She

noted that the IRR video had been broken into parts to be more user-friendly and described the

eight subject area segments. Ms. Eberley said the plan had been for the Committee to watch the

sixth IRR segment "Risk Limits &Mitigation," but noted that because of technical difficulties it

would not be shown. Ms. Eberley introduced Daniel Frye, Area Director, Boston Office, RMS,

July 25, 2013
who had spoken about IRR at the previous meeting. Mr. Frye provided the Committee with an

overview of the video's sixth segment, making reference to the "Risk Limits &Mitigation"

handout that corresponded to the video's contents. Mr. Frye said that banks first need to identify

the IRR that is already on their balance sheets by using appropriate evaluation models. The

purpose of evaluating IRR, he indicated, is so bank boards and management can set appropriate

risk limits. These risk limits should reflect the institution's risk tolerance, the complexity of its

balance sheet and earnings, the risk limits should change as the institution's risk profile and

conditions change, and they should encourage discussion and implementing appropriate risk

mitigation strategies.

Mr. Frye discussed types of risk limits and the importance of quantifying the risk. He said

that most institutions focused on net interest income volatility in the next couple of years, but

emphasized that it may be important to have a longer focus if their asset structures warranted it.

Referring to two slides titled "Evaluation of Risk Limits," he illustrated the different effects on

banks' net interest margins of different IRR risk limits from 1997 through 2012 and their

different impacts on a bank's earnings. Mr. Frye emphasized it is important for a bank to

evaluate the appropriateness of its risk limits given the risk to its earnings stream. He said the

video then discussed various risk mitigation techniques including: asset sales and purchases;

changing the bank's product mix and structure; malting strategic growth steps; and hedging

strategies. Mr. Frye said that new strategic plans can take substantial time to implement and

should have an IRR focus in place. Regarding hedging strategies, he said there was significant

growth in the percentage of banks that used them but the number remains low (seven percent),

and that it is important that banks have a correct understanding of their risk profile before

engaging in hedging. In summary, Mr. Frye said it was important for banks to control their IRR

exposure, to be focused on the long-term as well as short-term, and to reevaluate their risks on a

continuous basis.

Ms. Eberley noted that RMS was distributing compact disks of the technical assistance

videos since some bank employees cannot access YouTube from work. She invited feedback on

the program's usefulness and additional topics to be addressed.

Mr. Pearce said that DCP and RMS had been reviewing their supervisory processes to make

them more efficient, consistent and transparent and discussed steps that DCP had taken pursuant

to those reviews. Those steps included, he said: technical assistance videos on fair lending and

flood insurance; quarterly newsletters from each of the FDIC Regional Offices concerning

emerging compliance issues in their region; information about regulatory changes through

national banker teleconferences and the regulatory calendar on the FDIC website; and guidance

about how the FDIC classifies violations in Examination Reports to help bankers focus their

attention on the FDIC's areas of greatest concern.

Mr. Pearce then discussed steps DCP had taken to improve the pre-examination process

which bankers had earlier reported was sometimes unnecessarily burdensome. First, he

described the contents of an information packet that DCP sends to banks which have an

upcoming exam. Each packet contains, he said: 1) an entry letter which provides an overview of

the process and lists reference resources; 2) a set of pre-exam interview questions that would

assist bankers to prepare for apre-exam interview with the FDIC examiner-in-charge ("EIC"); 3)

a brochure that describes various technical assistance resources the FDIC offers to banks; and 4)

July 25, 2013
219

a series of brochures describing how banks may contact various persons within the FDIC to

respond to their questions.

Mr. Pearce then described DCP's efforts to streamline the preparation ofpre-examination

documents, called "C-Prep," so that examiners requests for documents from a bank are tailored

to the bank's business and operations. He said that examiners using C-Prep would be able to use

certain information the FDIC already maintains to pre-populate certain pre-examination

questions. Then, he said, examiners would use the results of the pre-exam interview with the

bank to narrow the pre-exam information the examiners need to request. For example, if the

interview indicated that a bank did not engage in mortgage lending, the examiner would not

request information about mortgage loans. Finally, Mr. Pearce said, C-Prep automated the

generation of the document request packages which could be available to the bank through the

FDIConnect system. He said the new program would be implemented in September 2013.

Members Pierce, Mehlum, Savarese and Haskin complimented the various technical

assistance videos and described how their banks were using them for director and management

training. Member Savarese said that she appreciated how the FDIC had done an encyclopedic

review and focused first on the issues that needed addressing most urgently. She added that the

video approach was effective because it enabled learning to occur on an all year basis whereas

the Directors College was only periodic. Member Savarese said that compliance examination

issues had been a significant banker concern and that DCP's response showed an extraordinary

commitment to addressing those issues. Members Mehlum, Williams and Hesser suggested that

hedging would be a valuable subject for a future training video because relatively few banks do it

but need to understand it.

In response to questions from Member Savarese, Mr. Pearce said that the technology element

of C-Prep was already in place and DCP was training examiners for the September rollout. Mr.

Pearce and Ms. Eberley said that an emphasis of the pre-examination process changes were to

give examiners sufficient time to review bank information before arriving at an examination, an

issue which had been a banker and FDIC concern. In response to a question from Member

Savarese, Ms. Eberley described how pre-exam information received from the bank is distributed

by the EIC and Mr. Pearce noted that those processes were being automated to improve their

timely flow. Member Haskin complimented the training video on the Basel III capital rule and

asked if the FDIC was developing a calculator template so that banks could better understand

how they would be impacted. Ms. Eberley said that such a calculator was being developed and

that it would be consistent with the Call Report changes being made with Basel III. Member

Baronner inquired about how the FDIC examines for CFPB rules. Mr. Pearce said that most

CFPB directives have been consistent with FDIC examination procedures already in place, but

that if CFPB changes a rule, the FDIC works with other agencies to develop consistent exam

procedures and communicate them to banks.

Member Castillo complimented the helpfulness of the instructional videos and the C-Prep

process changes. He inquired to what extent examiners could assist banks to evaluate whether

the specific circumstances of a bank's actions meet regulatory muster. Member Castillo said that

discussions at the time a product is being developed would be more helpful for the bank to

achieve compliance than waiting for an exam and then being in a reactive mode if the bank had

misunderstood the regulatory requirements. Mr. Pearce said that, while the FDIC cannot provide

July 25, 2013
220

the specific level of counsel that would provide a "safe harbor" in advance, the hope was that

examiners could communicate what the relevant rules are and what specific ones the bank

needed to consider carefully. Mr. Pearce said that examiners could share their observations

about how other banks had dealt with a topic (both best practices and unsuccessful ones) to the

extent they had knowledge related to the specific question. Member Castillo recognized that the

FDIC could not "bless" a particular product but observed that the examiner insights would be

helpful to an individual bank, given the FDIC's broader perspective gained from examining

multiple banks that were attempting to comply with the same rules. He said that some examiners

apparently felt constrained in their discussions with banks and encouraged the FDIC to allow

examiners the freedom to share examples of what has and has not worked.

Member Savarese said that the regional office quarterly reports on emerging issues were

helpful and had the ancillary benefit to the FDIC of limiting the opportunity for divergent

interpretations for the application of various rules. Member Lundy agreed and noted that his

staff and FDIC staff had recently attended FDIC TDR training which helped make the

subsequent examination much smoother on the subject. He said that TDRs are subject to

competing opinions and issues but the training provided a common basis for discussion and

understanding. Member Mehlum said that the pre-exam process improvements appeared to be

working in her geographic area where bankers report examiners are arriving much more prepared

than in the previous several years. Member Savarese added that examiners are also consistently

interested in finding out from bankers ways to make the exam process more effective and less

onerous. Mr. Pearce and Ms. Eberley noted that, while examiners can gather substantial

information and engage in exam preparation off-site, there is no substitute for on-site

examinations which allow examiners to interact with the banker and more fully understand its

situation.

The Committee stood in recess at 9:29 a.m. and reconvened at 9:45 a.m. that same day.

Ms. Ryan introduced Barbara Pacheco, Senior Vice President, Federal Reserve Bank of

Kansas City; Michael Benardo, Chief, Cyber-Fraud and Financial Crimes Section, RMS; and

Elizabeth Khalil, Acting Special Assistant to the Deputy Director, DCP, who spoke about

"Payment Systems Developments and Initiatives." After giving an overview of her talk, Ms.

Pacheco said that there had been substantial change in the check clearing system over the last ten

years and that virtually all bank-to-bank check clearing is now done electronically, with

substantial cost saving to banks. She said that a new phase of payment systems change was

likely to occur, and much of it would be driven by new technological capabilities provided by

non-banks that consumers and businesses were using. Ms. Pacheco said that banks would likely

play an important role as the access point to the payment system and that the Federal Reserve

would take a leadership role in setting the course for the payment system in the future as well as

continuing to provide its services (such as ACH, Fedwire, check-clearing, currency and coin).

She said that the trend of the move from paper to electronic handling was clear; she described the

Federal Reserve's substantial infrastructure reductions for paper check handling; she said that an

ACH payments growth area was for customer debits of their accounts to online merchants; and

she noted that a recent rule change would allow for ACH to be used for person-to-person

payments.

July 25, 2013
221

Referring to a handout, "U.S. Payments Systems Developments and Implications," Ms.

Pacheco discussed drivers of changes in the U.S. payments landscape, including: the

interconnectedness of mobile devices, particularly smartphones; technological innovation,

mostly by non-banks, that affects the payments process; and end-user preferences. Other drivers

of change included, she said: economic growth; regulation; the global economy, including the

growth in international remittances; and the changing threat landscape, such as cyber-terrorism

and fraud. Ms. Pacheco noted that cyber-attacks are more sophisticated and intentional, have a

criminal intent and business purpose behind them, and impose risk because of their potential

impact on public confidence in the payment system.

Ms. Pacheco noted that an increasingly large percentage of the adult population had

smartphones, but that only about 15 percent used them for making mobile payments. While this

percentage is relatively low, she noted that the environment was poised for increased mobile

payment activity in the future. Ms. Pacheco discussed research about consumer demand and

preferences for payment systems. She said that the current system of credit card, check and

ACH payments met today's needs very well, but that expectations and demographics change.

Ms. Pacheco said that consumers showed preferences for having more information about (and

control over) their payments on an immediate basis, rather than waiting for monthly statements.

She said that consumers seriously consider security when adopting a new payment method but,

after they adopt, convenience becomes increasingly important, as do rewards and incentives.

Ms. Pacheco said that merchant preferences were more important today than ten years ago.

She indicated that merchants were motivated to increase the ease of the shopping experience

rather than to make a profit in the payments system. Ms. Pacheco said that merchants are cost

driven, and the cost of fraud and charge-backs are important to them. She discussed a variety of

mobile payment activities including accepting credit cards through smartphones, various pointof-sale payment systems, person-to-person payment systems, and the use of smartphones to

deposit checks via remote deposit capture ("RDC"). Ms. Pacheco noted that smartphone RDC

provides great convenience to consumers and that bank interest in it had increased significantly

in the last year, mostly to remain competitive with other banks who offered it rather than as a

separate profit center. She said that banks managed their risks with smartphone RDC by setting

low limits on the number and dollar value of deposits per day (or week or month), but eased

those limits as they became comfortable managing the risk.

Ms. Pacheco said there had been significant innovation regarding person-to-person payments

in the last five years and discussed a variety of the current methods that were bank-focused; nonbank focused; and credit card focused. She said the biggest problem for current person-to-person

payment systems was the need for both sender and receiver to be members of the same system

for the payments to be smooth and real-time (or else for the receiver to provide their banking

information to a third party in order to receive payment). Ms. Pacheco said that banks were well

positioned to be competitive inperson-to-person payment systems because consumers have often

already provided them with their credentials and trust banks to manage the information

appropriately.

Ms. Pacheco said that non-banks have played an integral role in the payments system for a

long time but their role was changing and that many were partnering with financial institutions to

play a more direct role. She noted that emerging payments methods challenged the regulatory

July 25, 2013
222

framework which needed to respond to clarify the roles of banks and non-banks. Ms. Pacheco

said that consumers are used to and expect zero liability regarding their credit card and banking

relationships and that these expectations were translating into the non-bank systems. She

discussed various studies and opinions about whether payments law needed to be adjusted or

fully reconsidered.

Ms. Pacheco provided ahigh-level view of the Federal Reserve's future strategic direction

which involves maintaining its mission of fostering payments system integrity, efficiency and

accessibility while expanding its perspective. She said that enhancing the speed of payment

from sender to receiver was an important goal. Another was to promote the system's efficiency

by considering end-user preferences (including consumers, businesses and governments). A

third goal, she said, was to maintain and enhance payment system safety and security.

Ms. Pacheco discussed the roles of payment system participants, including payments users,

payments industry stakeholders and Federal Reserve Banks. She said that, in moving toward a

new payment system, it was important to focus on industry coordination and collaboration

because many of the system's advancements have been led by industry with relatively few

regulatory mandates. Ms. Pacheco also gave the Committee an overview of research on the

payment system with a focus on gaps and barriers to speed and efficiency, including: 1) the lack

of an all-electronic alternative to checks that are universally accepted; 2) the failure to meet end

user expectations for real-time balance and alert information and the masking of account

information; 3) the lack of clarity of the roles of banks and non-banks; 4) the perception that the

U.S. payment system's speed is falling behind those of other countries; and 5) the inconvenience

and slowness of international payments. Ms. Pacheco said that the speed and efficiency of the

future payments system always has to be balanced against the system's safety and the security.

She said that she looked forward the Committee's questions, comments and advice on how to

address the issues raised in moving toward a new payments system.

Mr. Benardo, of RMS, said the FDIC had established an interdivisional working group to

consider how the evolving payment systems marketplace would impact insured institutions,

especially community banks, in the next few years. Among the subjects being considered, he

said, were: effective regulatory oversight, when electronic payments were covered by deposit

insurance, and other consumer protection issues. Mr. Benardo said that the FDIC working

group's goals is to better understand what the issues are, what role the FDIC could play and to

develop recommended FDIC actions. He said the group was meeting with various stakeholders,

including banks, payment system networks, industry trade associations, law firms, consultants,

and other government agencies. He said he was particularly interested in hearing the members'

observations on the issues.

Ms. Khalil said that innovations in payments systems presented new opportunities for

consumer choice and convenience and could help consumers develop relationships with insured

institutions. She said the FDIC was interested in what affects consumer choices and what

barriers banks, especially community banks, face in providing the new services. Ms. Khalil said

the FDIC, and DCP in particular, was focused on consumer protection and recognized that the

legal and regulatory framework, which was some years old, did not specifically address recent

innovations. At present, she said, the law pierced through the mobile aspect of the payment to

focus on the underlying payment source; thus a mobile payment that drew on a credit card would

July 25, 2013
223

be subject to Regulation Z, while a general purpose, reloadable prepaid card might not have

Regulation E protection. Ms. Khalil said that it was important that consumers understand what

protections do and do not apply and that they may be confused when a payment mechanism

operates like one that has certain consumer protections but does not, in fact, carry those

protections. She said that the FDIC was keeping an eye on where regulatory gaps occurred and

was considering what role it had to play in responding to them.

At Ms. Ryan's invitation, Committee members asked a variety of questions and provided

their perspectives on the issues raised. Member Savarese inquired about the number of payments

(and their magnitude) that occurred inside and outside the regulated banking system and the

fraud costs associated with them. Mr. Benardo and Ms. Pacheco indicated that they were not

aware of good data on the subject. Mr. Benardo observed that players that intend to commit

fraud tend to prefer payment mechanisms that are more ambiguous and anonymous, so that fraud

levels were hard to measure. Ms. Pacheco agreed that there was limited data on fraud trends and

noted that some other countries that had adopted EMV chip cards had better data. In response to

a question from Ms. Ryan about who collected the information in other countries, Ms. Pacheco

indicated it was likely a coordinated effort of public authorities and the banking industry. She

noted that gathering data was somewhat easier in countries whose banking systems were more

concentrated than the U.S. system.

Member Haskin raised a concern that the regulated banking system had made consumers feel

so secure about the payment system that they were not always aware that they were not using an

insured product. She also expressed concern that that many of the non-bank providers were not

regulated and could have a default that would harm consumers. Members Haskin and Mehlum

expressed an interest in insured institutions using the efficient check clearing system as a basis to

develop an exchange for person-to-person payments and suggested that regulators or others

could develop a national exchange to facilitate payments. In response, Ms. Pacheco described

two concepts that the Federal Reserve was working with the industry to develop; one leveraged

the existing check clearing system (but would require a change in the legal definition of

"check"); the other was to support credit initiated electronic transfers using a "directory service."

Member Seleski inquired if any developments were seen on the horizon for wiring money

internationally; he said that it was difficult for consumers to do because of Bank Secrecy Act

limitations, a CFPB tracking rule, and the general inefficiency of the U.S. system. Ms. Pacheco

said that the international funds transfer market was very concentrated and there were definite

gaps in the system that provided improvement opportunities; she noted that a "directories"

approach might help in that area also.

Member Pierce expressed the concern that consumer desire for convenience would cause

them to choose less secure payment mechanisms offered by non-banks over the multi-factor

authentication systems that regulations required banks to use. He indicated that consumers have

come to assume that all systems have the same security and consumer protection when they do

not and that banks would bear the burden of those incorrect expectations. Member Saunders said

that it would be helpful if there was a consumer education primer that banks could offer to

consumers to help them distinguish between different payment systems and their protections.

Mr. Benardo and Ms. Khalil said that such information was available from various FDIC

July 25, 2013
224

sources, but that it had not been gathered into a single place. Ms. Pacheco agreed that consumer

education on the trade-off between convenience and security was important.

Member Savarese said that banks had significant reputational risk related to developing

payment systems. In her view, consumers expected banks to be responsible for losses when

payment system problems occurred even though banks often provided only the back-end support

of a transaction through a checking account while the front-end of the transaction was provided

by non-community banks. Member Flynn said that the possibility of fraud was the primary

barrier to community banks offering payments mechanisms that would be attractive to

customers. She said her bank was introducing person-to-person payments and remote deposit,

but was concerned that customers expected the bank to compensate them for fraud even though

the customers did not take basic steps to ensure their own security. Member Baronner agreed

that some retailers did not ensure their security was up-to-date because the fraudulent charge

would be paid for by the bank. Ms. Pacheco said a focus of the Federal Reserve was to put the

risk of loss on the party that is in the best position to avoid the loss but noted that there were gaps

in information in the fast changing payment systems arena. Member Savarese said the

magnitude of the financial and reputational costs to banks of fraud were enormous.

Member Savarese said another barrier to community banks being able to initiate person-topersonpayments was that there are too few trusted partners to work with who had sufficient

scale and security to meet consumer expectations. She added that the great difference in size

between potential partners and community banks was so great that it created a disproportionate

bargaining situation. Member Savarese said that if a centralized, trusted exchange was

developed, it would help level the field for community banks, especially if the distinguishing

feature of the system was security and regulatory compliance. Member Mehlum agreed that

community banks had too few options and relied heavily on their core processors and related

vendors. She asked if the Federal Reserve was meeting with such vendors in its task force. Ms.

Pacheco said that said that such vendors were key to community banks having access to the

necessary functionality for competitive products. She said that community banks consistently

supported having the Federal Reserve provide enough direction so that community bank vendors

could develop competitive products. Member Haskin noted that vendors often have multiple

platforms and the community bank platform often receives innovative products after large banks.

She also said that it can take substantial time to integrate a mobile platform with a core

processor's products; she said her bank experienced a six to nine month period from making a

decision to implementation.

Member Hesser remarked that there was an inconsistency between customer expectations of

speed in the payment system and the slowness of the ACH clearing system. He said the speed of

the ACH system should be increased. Ms. Pacheco said that one reason the speed of the ACH

system had not already increased was that some banks were resistant to the costs and time

required to change the current approach of processing ACH as a batch once a day. She

suggested that this was an area where the Federal Reserve could provide leadership and

described how the transition in approach had occurred in the United Kingdom.

Member Savarese inquired whether the current regulatory framework was sufficient to

provide effective oversight of non-banks that were conducting bank-like activities. Mr. Benardo

said that issue was a focus of the working group he had described. He noted that the current

July 25, 2013
225

banking regulatory framework was based on bank charter types and that the Federal Trade

Commission worked on a complaint-based model rather than a continuous oversight model. Mr.

Benardo said that the CFPB had authority to bring additional industry participants within its

rules, but it was not clear how they would exercise that authority.

Committee members discussed general purpose reloadable prepaid cards and the extent to

which they are covered by Regulation E, deposit insurance and other regulatory requirements

imposed on bank products. Ms. Khalil noted that the CFPB had requested public comment about

numerous issues related to prepaid cards. Some Committee members' banks offered prepaid

products; others were considering them but viewed the uncertainty about the applicable

regulations as a barrier to entering the market. Member Castillo contrasted the limited rules that

PayPal and other competitors had to deal withand those banks had to comply with. He said it

might require Congressional action to level the regulatory playing field. Member Castillo said

that the main barrier for his institution was wisely choosing what service provider it would use

and suggested the market might develop so that there were a few very large providers.

Member Saunders said that she was excited about the expanded economic inclusion

possibilities of cell phone based banking. She noted that most people have a cell phone so that

banking services can be delivered with less investment in brick and mortar branches. Member

Saunders noted that there was a cost for providing cell phone based services for every account,

for example, an initial face-to-face meeting to set up and explain the account; but she thought the

new systems generally would be a much more efficient, inexpensive way to deliver banking

services to a broader footprint.

In response to a question from Member Castillo, Ms. Pacheco described steps that the

Federal Reserve was taking to speed up the ACH process. Member Flynn noted that steps taken

to increase the ease of using the payment system also tended to increase the risk of fraud, which

would be the biggest expense to financial institutions. She noted that her bank had three fulltime employees watching online transactions and questioned how many would be required in the

future. Ms. Pacheco agreed that the importance of authenticating a payment sender increased as

the speed of the payment network increased and that both issues had to be addressed

simultaneously. Member Haskin said that banks accept two-day risk on check clearing, and that

same-day notification of insufficient funds and other subjects might actually enhance the system.

Member Savarese noted that when two parts of the payment system operated at different speeds,

there was risk for the institution that got its information slower. Mr. Benardo noted that fraud

monitoring algorithms for credit card networks were often fast and effective and provided a

possible model to use. Member Flynn agreed but said that such systems also required humans to

monitor them. Chairman Greenberg thanked the participants for the presentation and discussion

and indicated that the topic was likely to remain important.

The Committee stood in recess at 11:26 a.m. and reconvened at 1:32 p.m. that same day.

Ms. Ryan introduced James LaPierre, Kansas City Regional Director, who led the

"Information Technology Examination Issues" panel along with Donald Saxinger, Senior

Examination Specialist, RMS, Kevin Pearson, IT Examiner, RMS, and David Sanders, IT Exam

Specialist, RMS. Mr. LaPierre gave an overview of the panel's prepared remarks including the

history and current operation of the FDIC IT examination program, emerging IT threats and the

July 25, 2013
226

importance of IT security and operation controls. He introduced Mr. Saxinger who spoke about

the history of the IT examination program, including the 19781aw which created the Federal

Financial Institution Examination Council ("FFIEC") and expanded the banking agencies'

examination authority over banks' third-party service providers. Mr. Saxinger described the

criteria FFIEC agencies use to decide whether to place service providers into their examination

program, including a risk ranking that helps ensure that limited examiner resources are focused

appropriately. He noted that not all service providers are examined.

Mr. Pearson then discussed the current state of IT examinations which evaluate risk

management practices designed to protect the confidentiality, integrity and availability of

sensitive and critical records. He described three primary categories of IT exams, the first being

exams ofmulti-regional data processing servicers ("MDPS"), which are typically the largest and

most complex subset of technology service providers ("TSP") that pose a high degree of

systemic risk (there are 15 TSPs designated as MDPSs). The second category, he said, are

regional TSPs, all non-bank service providers who are not designated MDPSs (there are about

215 regional data centers that are subject to recurring IT exams). Mr. Pearson then said the third

category was IT examinations of financial institutions.

Mr. Pearson described how MDPS and TSP examinations are coordinated and conducted

jointly by the FFIEC agencies consistent with FFIEC guidance contained in 11 booklets on

various topics. He said that TSP examination frequency is determined by arisk-based

examination priority ranking system which considers the TSP's financial and operational

condition, the number of its financial institution clients and the type of services it provides; he

said exam cycles range from 24 to 48 months. Mr. Pearson said one FFIEC agency is designated

to be in charge of each TSP and this role rotates after two examination cycles; he said each

agency also designates an examiner to be its contact for each MDPS with the expectation that the

designated examiner would develop appreciable knowledge about the MDPS. Mr. Pearson said

examinations are conducted by interagency teams and, at the end of the onsite part of an exam,

there is a management exit meeting where tentative component and composite ratings are given

pursuant to the Uniform Rating System for Information Technology. He said the agency in

charge generates a report of examination which can be requested by client financial institutions

of the TSP. Mr. Pearson then invited questions from the Committee.

In response to a question from Member Flynn, Mr. Pearson said that, upon the request of

a TSP's client, the FDIC would send a bank the latest final exam report of a TSP but that the

agencies did not generally reveal a TSP's examination schedule. He added that, if a TSP was

experiencing severe problems, the agency would send notification to clients. Mr. LaPierre noted

it would be administratively difficult for the FDIC to keep current on which TSP each bank had

contracted with so the FDIC responded to requests instead; he added that any provider that was

an MDPS or TSP was examined on a regular basis and examination concerns usually occurred

only on an exception basis. Member Baronner inquired about service provider responses to

security breaches. [Service providers should notify their client banks (consistent with their

contracts) of security breaches, who, in turn should notify their primary federal regulator.] Mr.

Saxinger clarified that notifications stemming from the Gramm-Leach-Bliley Act are meant to

notify the customer when customer information is compromised. He also noted that some

July 25, 2013
227

service providers do not have direct access to customer data to make the contact and the

regulation allows them sufficient time to perform an investigation.

In response to a query from Chairman Greenberg, Mr. LaPierre confirmed that the FDIC

would provide the latest examination report to a financial institution after confirming that it was

a current client of the IT provider. Member Savarese suggested that exam information would be

helpful to financial institutions who were not clients but who were conducting pre-contract due

diligence, a process that is expensive and time-consuming. Mr. Saxinger noted that IT

examinations were subject to the same non-disclosure rules that protected bank exam

information from disclosure to third parties (12 C.F.R. Part 309); he also noted that IT exam

reports are point-in-time exams conducted on a cycle of up to four years and thus, might be stale

in the fast-changing technology environment. Mr. Saxinger noted that another source of

comparable information are the American Institute of Certified Public Accountant's Statement

on Standards for Attestation Engagement No. 16 ("SSAE 16") audits which are done more

frequently and are readily available from service providers. He also noted that the agencies do

not examine all service providers and sharing exams with non-clients could cause all providers to

want to be examined (for which there are not sufficient agency resources) and which might tend

to limit the market or limit innovation. Member Savarese acknowledged the validity of the

concerns, but noted sharing the information could help community banks avoid engaging a

provider subject to regulatory criticism. Mr. Saxinger clarified that a service provider's problem

does not necessarily translate into a criticism of financial institutions that engage them.

Chairman Greenberg said that Member Savarese's suggestion was worth considering and the

FDIC would look into legal constraints. Member Flynn observed that banks could negotiate

vendor contract clauses that required the service provider to cure problems identified by

regulators or risk having the contract cancelled.

Member Saunders said that the current IT examination cycles seemed to allow for long

gaps between visits and asked if the cycle lengths were under review. Mr. LaPierre said a

project was underway to evaluate the TSP and MDPS review program for improvements. He

added that the degree of agency interaction with an IT provider increases with the number of

institutions it works with so, for the 15 MDPSs, there is continuous oversight and frequent

interaction with the designated agency contact. In response to an additional question from

Member Saunders, Mr. Pearson said the MDPS with whom he works has about ten examinations

per year and there is essentially continual contact between the provider's senior staff and the

agency liaison. He also said the examination program is focused on the provider's development

of an acceptable information security program which would include risk assessment policies

which should cause the provider to respond to changes in its environment. Chairman Greenberg

said Member Saunders raised a good point and that the FDIC would follow up with her about it.

Member Lundy provided an example of how regulatory criticism of a service provider

negatively affected his bank's decision about entering into a contract with a subsidiary of the

provider; he suggested that the FDIC could better communicate how the regulatory criticism

about a provider affects (or does not affect) financial institutions that contract with the provider.

Member Savarese agreed that the FDIC's communications about the responsibilities of a

financial institution in such a situation were unclear. Mr. Sanders said that, when there is an

adverse exam or audit report, the financial institution should follow up with the vendor to

confirm that the underlying issue is resolved; he noted vendors can provide periodic reports that

July 25, 2013
have been validated by an auditor to provide issue updates. Member Savarese indicated that,

when a regulatory agency was involved, there was some question about where the roles of the

agency and the financial institution began and ended. Chairman Greenberg said it would be

helpful to know what assistance the agencies can provide to a financial institution in determining

whether a vendor has addressed its problems.

Mr. Saxinger said that when a problem is found with a service provider, the agency's

goal is to identify the problem in a report so the financial institution can receive it and act upon

it. He said the agency may publish a report once every year or two but, once a problem is

identified, the agency provides continuous monitoring of the problem. Mr. LaPierre said that the

continuous agency oversight increases with the severity of the problem identified. Ms. Eberley

said it is in the service provider's interest to communicate information about their corrections

with their clients, especially when there are a large number of clients. Accordingly, the agencies

notify clients about a vendor's problem to give the provider an incentive to respond to the

problem and share information about the response with their clients.

Mr. Sanders then discussed IT examinations of financial institutions consistent with the

Gramm-Leach-Bliley Act which required institutions to establish information security programs.

He said an effective information security program possesses several key elements for which the

agencies examine, including: a risk assessment process; the control environment and policy

formation; an audit program; business continuity planning; vendor management; and board and

management oversight. NIr. Sanders said all IT examinations have certain minimum

requirements but exams are also scoped based on a risk assessment which includes consideration

of the size and complexity of the institution's IT operations; management responses to the IT

officer's questionnaire; prior examination exceptions; and any security incidents or

correspondence since the prior exam. He said some of the risk factors that might expand a

review included: high or excessive levels of merchant processing; significant ACH origination

activities; use of untested or emerging software products; a history of fraud or other operational

weaknesses; or providing IT services to other institutions. Mr. Sanders said about 95 percent of

banks achieve a satisfactory or strong examination rating for IT and described the most common

reasons for downgrades in the last year. He said information security programs cannot be static

but must evolve with changes in the bank's operating environment, including emerging IT

threats which can harm customers and reduce confidence in electronic banking activities.

Mr. Saxinger said the FDIC conducts continuous analysis of emerging technologies to

determine their potential impacts on banking and to identify possible gaps in risk management

practices. Currently, he said, the FDIC is reviewing issues related to mobile banking, mobile

payments, cloud computing and the implementation of banking authentication guidance. Mr.

Saxinger said the FFIEC agencies continueto develop IT guidance, standards, ratings and

examinations. Mr. LaPierre noted that risk scoping an IT exam saved bank resources and helped

ensure that examiner time was focused on critical areas and emphasized that the IT officer's preexamination questionnaire was a crucial part of the scoping process.

Member Hesser said that community banks appreciated the assistance of the FDIC and

other government agencies when they were targeted for distributed denial of service attacks.

Member Saunders expressed concern that consolidation among service providers could create

July 25, 2013
systemic risks (if there was a significant problem with one) and inquired to what extent the

agencies could prevent a service provider with such a problem from contracting with new

financial institutions. Mr. Saxinger said agency enforcement authority is primarily through the

institution affiliated party approach, but that the FDIC Legal Division was also exploring a

contract enforcement avenue. Mr. LaPierre observed that, in 27 years of experience, he was not

aware of a service provider ever being in such a situation, but said that an agency's moral

suasion in that case might be more effective in the short run than legal measures. Member

Castillo encouraged the FDIC to help reduce the duplication that banks experience in their due

diligence efforts regarding new IT vendors by exploring ways to collaborate and share

information with banks.

Ms. Ryan then introduced the panelists for the "Policy Update" discussion, George

French, Deputy Director, Policy, RMS, Jonathan Miller, Deputy Director, DCP, Daniel Frye,

Area Director, RMS, and Mark Moylan, Deputy Regional Director, Kansas City, RMS. Mr.

French noted that the FDIC had recently approved an interim final rule (on an interagency basis)

that implemented three earlier notices of proposed rulemaking ("NPR"). He then highlighted

what community banks would be doing differently in the March 31, 2015 Call Report, the first

one in which the new rules would be applicable. (Mr. French noted that the revised Call Report

and instructions had not been published yet but that the public would have an opportunity to

comment on them when they were published.)

Referring to the document, "Regulatory Capital Interim Final Rule," Mr. French said the

first important change pursuant to the interim final rule would be that banks would be using new

definitions in calculating how much capital they have. First, he said, they would need to

compute common equity Tier 1 capital, which is a more conservative version of the current Tier

1 capital. Mr. French observed that, under the Basel III NPR, common equity Tier 1 would have

included accumulated other comprehensive income ("AOCI"). However, he said, this AOCI

proposal received significant public criticism and that, in response, the interim final rule provides

all but the largest banks ("advanced approaches banks") aone-time opportunity to opt out of

those requirements. Mr. French said the public comment about AOCI and the regulators'

response to it reaffirmed the importance of the public comment process.

Mr. French said a second important aspect of the interim final rule affected the treatment

of preexisting trust preferred securities issued by bank holding companies with assets less than

$15 billion as of the end of 2009. The NPR would have phased those out over ten years, he

said. However, again in response to public comment, the interim final rule allows them to be

"grandfathered" consistent with Section 171 of the Dodd-Frank Wall Street Reform and

Consumer Protection Act.

Mr. French highlighted other important features of the rule's new definition of capital.

He said that the existing deductions for intangible assets and deferred tax assets, and the

calculation of allowable minority interest had been made considerably more stringent. Mr.

French also described a new set of deductions concerning capital instruments of other banks. He

noted that, in the recent financial crisis, the previous treatment of pooled trust-preferred

securities allowed problems in one bank to ripple through the system and the new rule was

July 25, 2013
230

designed to mitigate that problem. After describing how the changed treatment would work, Mr.

French said that the rules would be phased in through 2018 to allow banks time to plan.

Mr. French said that, after calculating common equity Tier 1, banks would compute their

Tier 1 capital by adding certain items and then calculate their risk-weighted assets. He said that

the interim final rule represented significant change from what had been proposed; specifically,

banks could continue to use the same risk weights for 1-4 family mortgages as had been used in

the past. Mr. French said that there were some changes in asset risk weights and he described

several of them for the Committee. The final step, he said, would be for banks to compute their

capital requirements, which will be increased by the interim final rule: common equity Tier 1

will need to be at least 4.5 percent of risk weighted assets; Tier 1 will have to be 6 percent; and

total capital, 8 percent (the percentage requirements would also be increased for a bank to be

considered "well-capitalized"). Mr. French said that, by 2019, banks will need to exceed each of

their minimum risk based ratios by 2.5 percentage points in order to avoid restrictions on capital

distributions. Mr. French said that, for the largest banks and holding companies, the levels he

had just described serve as the floor for the capital requirements.

Mr. French then described an interagency NPR that would apply to the very largest banks

and holding companies (about eight organizations would meet the threshold). Under the NPR,

he said, the insured banks in these organizations would need to meet a six percent supplementary

leverage ratio to be well-capitalized and the bank holding companies would be subject to a five

percent supplementary leverage requirement. Mr. French said that these organizations had

received extraordinary assistance during the crisis; there was a perception that some institutions

remained "too big to fail;" and the current three percent requirement would have been

insufficient to constrain the buildup of leverage in the years leading up to the crisis. He said the

agencies thought it was important to strengthen the capital base of systemically important banks

to make them better able to withstand adverse periods.

Mr. Miller then provided an update on the CFPB's Qualified Mortgage ("QM") rule and

its impact on community banks (or "small lenders," the term used in the QM rule). He said that

Congress had directed the CFPB and prudential regulators to be conscious of the differences in

types of banks and he felt the QM rule reflected a serious response to that directive, as well as to

consumer protection. Referring to the document, "Update on the Qualified Mortgage Rule and

Community Banks," Mr. Miller reviewed the definition of small lender/community bank that he

had discussed in the previous Committee meeting. He then reviewed the QM definition by its

product characteristics: no negative amortization, no interest-only loans, no balloons for large

lenders, no term longer than 30 years, and no more than three percent in points and fees charged.

Mr. Miller said that the final QM rule allowed small lenders to continue to make certain balloon

mortgages and have them designated as qualified for the next two years, without regard to their

geographic location or if they served underserved or rural areas; he noted that this represented a

significant change from the NPR treatment, which had been a friction point for community

banks. He said that the CFPB had created the two-year extension in order to continue to discuss

the definition of "rural" with community banks.

Mr. Miller also reviewed the QM definition by its underwriting characteristics. To be

qualified, a QM must include fully documented and verified borrower income, adjustable rate

July 25, 2013
231

mortgages must be underwritten to the maximum contract rate within the first five years; and a

QM must have a maximum 43 percent debt-to-income standard (with exceptions that he

described). One exception, he said, was that there is no binding debt-to-income ratio applicable

to small lenders, although small lenders must still take into account a borrower's ability to pay.

Mr. Miller then described the legal protections that exist for banks that originate QM

loans. He said the CFPB distinguished between "prime" QM (those with rates up to 150 basis

points above the average prime offer rate, "APOR") and higher-priced mortgage loan ("HPML")

QMs. Prime QMs receive a safe harbor determination that the borrower has the ability to repay

the loan, he said, while a HPML QM receives a rebuttable presumption that the borrower has the

ability to repay the loan. Mr. Miller said that the final rule expanded the safe harbor for

community banks, allowing them to include HPML with interest rates up to 350 basis points

above APOR. Mr. Miller said that, in his view, the CFPB had been responsive to community

bank concerns on many issues, and said that the new rules reduced some requirements that exist

in the previous rules.

Mr. Miller described FDIC outreach to bankers about the QM rule including the hosting

of three national banker conference calls with a total of over 44,000 participants. He said the

CFPB had developed various compliance and readiness guides and that an interagency effort to

establish QM examination procedures was well underway.

In response to an invitation for Committee member comments, Member Williams

indicated that the definition of banks serving rural and underserved communities was still

inadequate and that community banks should remain engaged with the CFPB about the issue. He

also expressed concern that banks that made a business decision to engage in only QM mortgage

lending would risk being questioned about their compliance with fair lending rules. Mr. Miller

said that, although fair lending compliance was always a fact specific determination, he did not

expect that such a business decision would indicate a violation in itself Member Williams said

that the QM rule's freeing community banks from the strict 43 percent debt to income ratio

requirement would help banks meet their communities' credit needs.

Member Castillo inquired whether there had been any developments on the use of Call

Reports for gathering information about the types of deposit products banks offered, as had been

discussed in the previous meeting. Mr. French said those data collection proposals remained

under study. Member Castillo recommended that Call Reports remain focused on safety and

soundness matters and not be expanded for other purposes. He also indicated his appreciation

for the FDIC's banker outreach efforts, which helped build stronger relationships that would be

beneficial to everyone.

July 25, 2013
232

Chairman Greenberg thanked the Committee Members for their participation in the

meeting. Ms. Ryan noted that the next meeting was scheduled for November 19, 2013.

There being no further business, the meeting was adjourned at 3:26 p.m.

Robert E. Feldman

Executive Secretary

Federal Deposit Insurance Corporation

And Committee Management Officer

FDIC Advisory Committee on Community Banking

July 25, 2013
Minutes

of the

Meeting of the FDIC Advisory Committee on Community Banking

of the

Federal Deposit Insurance Corporation

Held in the hoard Room

Federal Deposit Insurance Corporation Building

Washington, D. C.

Open to Public Observation

July 25, 2013 — 8:30 A.M..

I hereby certify that, to the best of my knowledge, the attached minutes are accurate and

complete.

Martin J. Greenberg

Chairman

Board of Directors

Federal Deposit Insurance Corporation