Year 2000 Computing Crisis: Federal Regulatory Efforts to Ensure Financial Institution Systems Are Year 2000 Compliant
Released: 1998-03-24T00:00:00

Letter

Background

The federal financial regulators are responsible for examining and monitoring the safety and soundness of approximately 22,000 financial institutions, which, together, manage more than $6 trillion in assets and hold over $3 trillion in deposits. Specifically,

The Federal Reserve System supervises about 992 state-chartered, member banks and bank holding companies, which are responsible for $1.2 trillion in assets.

The Office of the Comptroller of the Currency (OCC) supervises approximately 2,600 federally-chartered, national banks, which comprise about $2.9 trillion in assets—about 58 percent of the total $5 trillion assets of the FDIC-insured commercial banks. OCC also supervises federal branches and agencies of foreign banks.

FDIC supervises about 6,200 state-chartered, nonmember banks, which are responsible for $1 trillion in assets. It is also the deposit insurer of approximately 11,000 banks and savings institutions that have insured deposits totaling upwards of $2.7 trillion.

OTS oversees about 1,200 savings and loan associations (thrifts), which primarily emphasize residential mortgage lending and are an important source of housing credit. These institutions hold approximately $770 billion in assets.

NCUA supervises and insures more than 11,000 federally- and state-chartered credit unions whose assets total about $345 billion. Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services.

As part of their goal of maintaining safety and soundness, these regulators are responsible for assessing whether the institutions they supervise are adequately mitigating the risks associated with the century date change. To ensure consistent and uniform supervision on Year 2000 issues, the five regulators are coordinating their supervisory efforts through FFIEC. For example, they jointly prepared and issued Year 2000-related guidance and letters to banks, thrifts, and credit unions. They also worked together to develop and issue, in May 1997, Year 2000 examination procedures and guidance for all examiners to use in performing their work at the institutions. Additionally, the regulators—under the auspices of FFIEC—are jointly examining the major data service providers and software vendors that support the financial institutions.

The Year 2000 Poses a Serious Problem for Financial Institutions

According to the regulators, virtually every insured financial institution relies on computers—either their own or those of a third-party contractor—to provide for processing and updating of records and a variety of other functions. Because computers are essential to their survival, the regulators believe that all institutions are vulnerable to the problems associated with the year 2000. Failure to address Year 2000 computer issues could lead, for example, to errors in calculating interest and amortization schedules. Moreover, automated teller machines may malfunction, performing erroneous transactions or refusing to process transactions. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and loss of customer confidence. Other supporting systems critical to the day-to-day business of financial institutions may be affected as well. For example, telephone systems, vaults, and security and alarm systems could malfunction.

In addressing the Year 2000 problem, financial institutions must also consider the computer systems that interface with, or connect to, their own systems. These systems may belong to payment system partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because these systems are also vulnerable to the Year 2000 problem, they can introduce errors into bank, thrift, and credit union systems.

In addition to these computer system risks, many financial institutions also face business risks from the Year 2000: exposure from their corporate customers’ inability to manage their own Year 2000 compliance efforts successfully. Consequently, in addition to correcting their computer systems, these institutions have to periodically assess the Year 2000 efforts of large corporate customers to determine whether they are sufficient to avoid significant disruptions to operations. FFIEC established a working group to develop guidance on assessing the risk corporate customers pose to financial institutions and the group issued guidance on March 17, 1998.

Regulators Are Taking Steps to Ensure Institution Year 2000 Readiness

The Year 2000 efforts of the five regulators began in June 1996, when, through FFIEC, they formally alerted banks, thrifts, and credit unions to the potential dangers of the Year 2000 problem by issuing an awareness letter to chief executive officers. This letter described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. It also called on institutions to perform a risk assessment of how systems are affected and develop a detailed action plan to fix them.

In May 1997, the regulators issued a second, more detailed awareness letter that described the five-phase approach to planning and managing an effective Year 2000 program and highlighted external issues requiring management attention, such as reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers. The letter also related regulatory plans to facilitate Year 2000 evaluations by using uniform examination procedures. It directed institutions to inventory their core computer functions and set priorities for Year 2000 goals by September 30, 1997. It also directed them to complete programming changes and to have testing of mission-critical systems underway by December 31, 1998.

As regulators alerted institutions to the Year 2000 problem, they began assessing whether banks, thrifts, and credit unions had established a structured process for correcting the problem; estimated the costs of remediation; prioritized systems for correction; and determined the Year 2000 impact on other internal systems important to day-to-day operations, such as vaults, security and alarm systems, elevators, and telephones. This initial assessment was completed during November and December 1997. Among other things, it revealed that most institutions were aware of Year 2000 and taking actions to correct their systems. However, the three regulators we reviewed reported—based on the initial assessment—that in total, over 5,000 institutions were not adequately addressing the problem. For example, OTS designated about 170 thrifts as being at high risk due to poor performance in conducting awareness and assessment phase activities. Additionally, FDIC identified over 200 banks that were not adequately addressing Year 2000 risks and 500 banks that were very reliant on third-party servicers and software providers but had not followed up with them to determine their Year 2000 readiness. Furthermore, NCUA reported that it had formal agreements for corrective action with 4,862 credit unions deemed not to be making sufficient progress in at least one awareness or assessment phase activity.

The regulators are now conducting a more detailed assessment of Year 2000 readiness. This assessment will involve on-site examinations of institutions and their major data processing services and software vendors. These visits are expected to be completed by the end of June 1998. The results of the servicer assessments will be provided to the banks, thrifts, and credit unions that use these services. Once the on-site assessments are completed, the regulators expect to have a better idea of where the industry stands, which institutions need close attention, and, thus, where to focus supervisory efforts.

Regulators Face Problems in Ensuring Institutions Are Ready

As noted in our summary, the regulators must successfully address a number of problems to provide adequate assurance that financial institutions will meet the Year 2000 challenge. First, all were behind in assessing individual institution’s readiness due to the fact that they got a late start. For example, the regulators did not complete their initial institution assessments until November and December 1997. According to OMB guidance and GAO’s Assessment Guide, these activities should have occurred by the summer of 1997. Because the regulators are behind the recommended timelines, the time available for assessing institutions’ progress during renovation, validation, and implementation phases and for taking needed corrective actions is compressed.

Second, we also found that the FFIEC-developed examination work program and guidance for the initial and follow-on assessments were not designed to collect all the data needed to determine where (i.e., in which phase) the institutions are in the Year 2000 correction process. For example, the guidance for the work program does not contain questions that ask whether specific phases have been completed. In addition, the work program used to perform the on-site assessments is not organized by the 5 phases of the Year 2000 correction process. Furthermore, the terms used in the guidance to describe progress are vague. For example, it notes that banks should be well into assessment by the end of the third quarter of 1997, that renovation for mission-critical systems should largely be completed, and testing should be well underway by December 31, 1998. Without defining any of these terms, it would be very hard to deliver uniform assessments on the status of institutions’ Year 2000 efforts.

At the time of our reviews, OTS had issued additional examination guidance and procedures to supplement those of FFIEC. This supplemental guidance, if implemented correctly, will address the FFIEC examination procedure’s shortcomings. However, although we reviewed FDIC and NCUA earlier in the process, we found that both were using or planning to use the FFIEC guidance for their initial and follow-on assessments. We were concerned at the time that by using the FFIEC guidance, FDIC and NCUA would not be able to develop an accurate picture of their institutions’ Year 2000 readiness. In the case of FDIC, this problem was compounded by the fact that the tracking questionnaire FDIC examiners were to complete after their on-site assessment also did not ask enough questions to determine whether the bank had fully addressed the phases. Since our work, FDIC and NCUA have responded to our findings by providing examiners with supplemental guidance, which we think is a positive development. FDIC officials told us that they are also in the process of going back to institutions and asking more detailed questions to provide added assurance that the corporation can tell precisely where each bank is in the Year 2000 correction process.

Third, FFIEC is still developing key Year 2000 guidance. For example, as of the time of our review, the regulators had not yet completed critical guidance related to (1) developing contingency plans to mitigate the risk of Year 2000-related disruptions and (2) ensuring that their data processing services, software vendors, and large corporate customers are making adequate Year 2000 progress. In May 1997, the regulators—through FFIEC—recommended that institutions begin these actions. FFIEC recently issued the servicer/vendor and corporate customer guidance on March 17, 1998, but does not plan to provide contingency planning guidance until the end of April 1998. This time lag has increased the risk that institutions have taken little or no action on contingency planning and dealing with servicers, vendors, and corporate customers in anticipation of pending regulator guidance. Moreover, in the absence of guidance, institutions may have initiated action that does not effectively mitigate risk of Year 2000 failures.

Finally, although the regulators have been working hard to assess industrywide compliance, it is not clear all have an adequate level of technical resources needed to adequately evaluate the Year 2000 conversion efforts of the institutions and the service providers and software vendors that service them. As institutions and vendors progress in their Year 2000 efforts, we are concerned that the evaluations of the examiners will increase in length and technical complexity, and put a strain on an already small pool of technical resources. Without sufficient resources, the regulators could be forced to slip their schedules for completing the current on-site exams or, worse, reduce the scope of their exams in order to meet deadlines. In the first case, institutions would be left with less time to remediate any deficiencies. In the second, regulators might overlook issues that could lead to failures. In either case, the risk of noncompliance by institutions and service bureaus—and the government’s exposure to losses—is significantly increased. OTS and NCUA have responded to this concern by adding more technical staff or augmenting it with contractors.

Serious Year 2000 Challenges Ahead for Regulators

It will be important for regulators to quickly address problems associated with their late start since the challenge for them is certain to grow as banks progress into the later and more complex stages of their Year 2000 efforts. For example, regulators will soon have to pinpoint which, if any, of the thousands of banks, thrifts, and credit unions are not going to meet their Year 2000 deadline. In doing so, they will have to weigh a range of factors, including the financial condition of the institution, the resources it has to address the problem, how far behind it is in correcting its systems, whether its service provider’s systems are Year 2000 compliant, etc. Once these decisions are made, regulators will have to then determine which enforcement actions—which include increased on-site supervision, directives to institution boards of directors, written supervisory agreements, cease-and-desist orders, civil monetary penalties—are appropriate. All of this needs to be done before the Year 2000 deadline, which is less than 21 months away.

In addition, as institutions and vendors progress in their Year 2000 efforts, regulatory evaluations will increase in length and technical complexity and put a strain on an already small pool of technical resources. Thus, the regulators will need to ensure that they have the technical capacity to complete their Year 2000 examinations as well as their routine safety and soundness examinations. Already, some are finding this to be a difficult task. OTS officials, for example, expressed the concern that even if they could hire more technical examiners, it is very hard to find and hire staff with these skills.

The regulators will be better prepared to handle these challenges once the on-site assessments are completed. This information should provide good definition as to the size and magnitude of the problem, that is, how many institutions are at high risk of not being ready for the millennium and require immediate attention and which service providers are likely to be problematic. Further, by carefully analyzing available data, the regulators should be able to identify common problems or issues that are generic to institutions that are of similar size, use specific service providers, etc. This in turn will allow regulators to develop a much better understanding of which areas require attention and where to focus limited resources. In short, regulators have an opportunity to regroup, develop specific strategies, and have a more defined sense of the risks and the actions required to mitigate those risks.

In conclusion, Mr. Chairman, we believe that the financial regulators have a good appreciation for the Year 2000 problem and have made significant progress in assessing the readiness of banks, thrifts, and credit unions. However, the regulators are facing a finite deadline that offers no flexibility. They need to take several actions to improve their ability to enhance the ability of financial institutions to meet the century deadline with minimal problems and to enhance their own ability to monitor the industry’s efforts and to take appropriate and swift measures against institutions that are neglecting their Year 2000 responsibilities.

Accordingly, we have made recommendations to the regulators individually, and collectively via FFIEC, to work together to, among other things, (1) improve their Year 2000 examination and reporting processes, (2) provide additional guidance to the institutions on contingency planning and the latter phases of the Year 2000 correction process, (3) develop a tactical plan that details the results of their on-site assessments, provides a more explicit road map of the actions to be taken based on those results, and includes an assessment of the adequacy of technical resources to evaluate the Year 2000 efforts of institutions and the servicers and vendors that support them, and (4) improve the regulators’ internal system mitigation programs. So far, we have been generally pleased with the regulators’ responsiveness to implementing our recommendations.

Mr. Chairman, that concludes my statement. We welcome any questions that you or Members of the Committee may have.

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.