Year 2000 Computing Crisis: Federal Depository Institution Regulators Are Making Progress, But Challenges Remain
Released: 1998-09-17T00:00:00

Letter

Background

The federal financial regulators are responsible for examining and monitoring the safety and soundness of approximately 22,000 financial institutions, which, together, manage more than $13 trillion in assets and hold over $7 trillion in deposits. Specifically:

The Federal Reserve System is responsible for overseeing the Year 2000 activities of 1,618 entities, including 990 state member banks, 349 bank holding companies, 221 foreign bank offices, and 9 Edge Act corporations. According to FRS, these organizations have assets totaling over $7.7 trillion and hold deposits of about $3.6 trillion. FRS’ oversight responsibilities also include 49 service providers, software vendors, and data centers.

The Office of the Comptroller of the Currency supervises about 2,600 federally-chartered, national banks and federal branches and agencies of foreign banks, which comprise about $3.5 trillion in assets. OCC is also responsible for monitoring the Year 2000 activities of 109 service providers, software vendors, and data centers.

The Federal Deposit Insurance Corporation supervises about 6,000 state-chartered, nonmember banks, which are responsible for about $1 trillion in assets. It is also the deposit insurer of approximately 11,000 banks and savings institutions that have insured deposits totaling upwards of $3.8 trillion. FDIC also oversees 146 service providers, software vendors, and data centers.

The Office of Thrift Supervision oversees about 1,200 savings and loan associations (thrifts), which primarily emphasize residential mortgage lending and are an important source of housing credit. These institutions hold approximately $737 billion in assets.

The National Credit Union Administration supervises about 7,000 federally-chartered credit unions. It is also the deposit insurer of more than 11,000 federally- and state-chartered credit unions whose assets total about $371 billion. Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services.

As part of their goal of maintaining safety and soundness, these regulators are responsible for assessing whether the institutions they supervise are adequately mitigating the risks associated with the century date change.

To ensure consistent and uniform supervision on the Year 2000 issue, the five regulators are coordinating their supervisory efforts through FFIEC. Additionally, under the auspices of the FFIEC, the regulators are jointly examining 28 major data service providers and software vendors that support the financial institutions. Each of the regulators, except NCUA, is responsible for a specified number of these joint examinations.

Year 2000 Risks Confronting Financial Institutions and Regulators

Addressing the Year 2000 problem in time has been, and will continue to be, a tremendous challenge for financial institutions and their regulators. Virtually every insured financial institution relies on computers—either their own or those of a contractor—to process and update records and for a variety of other functions. To complicate matters, most institutions have computer systems that interface with systems belonging to payment systems partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine (ATM) networks, electronic data interchange systems, and electronic benefits transfer systems. Because of these interdependencies, financial institutions systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems that are not Year 2000 compliant.

In addition, financial institutions depend on public infrastructure, such as telecommunications and power networks, to carry out critical business operations, such as making electronic fund transfers, verifying credit card transactions, and making ATM transactions. However, these networks are also susceptible to Year 2000 problems. Thus, financial institutions must also assess the Year 2000 readiness efforts of their local utilities and telecommunications providers.

Financial institutions and their regulators cannot afford to neglect any of these issues. If they do, the impact of Year 2000 failures could be potentially disruptive to vital bank operations and harmful to customers. For example, loan systems could make errors in calculating interest and amortization schedules. In turn, these miscalculations may expose institutions and data centers to financial liability and loss of customer confidence. Moreover, ATMs may malfunction, performing erroneous transactions or refusing to process transactions. Other supporting systems critical to the day-to-day business of financial institutions may be affected as well. For example, telephone systems, vaults, and security and alarm systems could malfunction.

Regulators Have Taken Positive Actions to Mitigate Year 2000 Risks

Since June 1996, when their Year 2000 oversight efforts began, the five financial institution regulators have taken a number of important steps to alert financial institutions of the risks associated with the Year 2000 problem and to assess what these institutions are doing to mitigate the risks. To raise awareness, the regulators issued letters to financial institutions that described the Year 2000 problem and special risks facing financial institutions and recommended approaches to planning and managing effective Year 2000 programs. In addition, the regulators provided extensive guidance to assist financial institutions in critical Year 2000 tasks, including guidance on (1) contingency planning, (2) mitigating risks associated with critical bank customers (e.g., large borrowers and capital providers), (3) mitigating risks of using data processing servicers and software vendors to perform financial institution operations, (4) testing to demonstrate Year 2000 compliance, (5) establishing effective Year 2000 customer awareness programs, and (6) addressing Year 2000 risks associated with fiduciary services. The regulators have also undertaken extensive outreach efforts—such as establishing Internet sites and conducting seminars nationwide—to raise the Year 2000 awareness of banking industry personnel and the public.

To assess what institutions are doing to mitigate Year 2000 risks, the regulators performed a high-level and detailed assessment of bank, thrift, and credit union efforts. The high-level assessment consisted primarily of administering FFIEC’s Year 2000 questionnaire via telephone and on-site visits and was completed during November and December 1997. During this assessment, the regulators examined whether institutions had established a structured process for correcting the problem; estimated the costs of remediation; prioritized systems for correction; and determined the Year 2000 impact on other internal systems important to day-to-day operations, such as vaults, security and alarm systems, elevators, and telephones. The more detailed Year 2000 assessment involved on-site visits to the institutions and was completed in June 1998. These examinations focused on whether institutions were appropriately planning for the Year 2000 effort and addressing risks posed by service providers, software vendors, and large customers. They also began to assess whether institutions had effective customer awareness programs.

These exams found the majority of financial institutions are doing an adequate job in addressing the Year 2000 issue. Specifically, according to the regulators, they found that of the over 22,000 institutions with examinations completed by June 30, 1998, almost 93 percent were doing a satisfactory job of addressing their Year 2000 problems, about 7 percent needed improvement, and 0.3 percent were performing unsatisfactorily.

The regulators plan to follow up with additional on-site visits that will address the unique—and more difficult—challenges that the testing and implementation phases will present. These exams, which the regulators plan to complete by March 31, 1999, are expected to identify institutions that are experiencing difficulties completing their testing and implementation programs or have not developed sufficient contingency plans.

Regulators Have Also Taken Positive Steps to Remediate Internal Systems

In addition to overseeing the efforts of financial institutions to address the Year 2000 problem, the federal regulators must also ensure that their internal computer systems are Year 2000 compliant. This is especially critical for FRS which operates systems on which the financial institutions heavily rely. For example, according to FRS, the Fedwire system was used by financial institutions in 1997 to make about 89 million funds transfers valued at $288 trillion. While systems belonging to the other regulators are not critical to the day-to-day operation of the banking industry, they support the essential business functions of the regulators, such as personnel management, accounting, budget, travel, and program tracking.

As noted earlier, we are currently reviewing FRS’ efforts to remediate its internal systems and plan to report the results of our review separately. However, we have reviewed the efforts of the four other regulators to remediate their systems and found that they have taken many actions that are crucial to successfully dealing with the Year 2000 problem. For example, they have established a good foundation for managing their remediation efforts by developing Year 2000 strategies, designating Year 2000 program managers, inventorying systems, and developing tracking systems to monitor progress and prepare status reports. They are acting or have acted to ensure that core business operations are not disrupted by identifying core business operations, assessing the potential impact of Year 2000-induced failures (including public infrastructure failures) on those operations, prioritizing conversion efforts, and developing contingency plans. The regulators also have identified their data exchanges and are working with their data exchange partners to prevent noncompliant systems from introducing Year 2000 errors into compliant systems. Finally, to ensure that their systems are adequately tested, the regulators have developed Year 2000 testing guidance and have begun or are well underway in testing their systems.

In September 1998, each of the regulators reported to the Congress that they are on schedule to meet the Office of Management and Budget’s March 1999 implementation date for their mission-critical systems. Their data indicate that, with continued good management, the regulators should be able to meet this milestone.

Regulators Have Responded Quickly to GAO Findings and Recommendations

While the regulators have been working hard to achieve industrywide compliance and remediate their own systems, we have identified concerns and problems with their efforts during the course of our reviews. Specifically, we found that all the regulators were late in initiating their Year 2000 oversight of institutions and in issuing key guidance on business continuity and contingency planning, corporate borrowers, and service providers and software vendors. We also found that the regulators had not assessed whether they had enough information system examiners to adequately oversee the Year 2000 efforts of the institutions they supervise. In addition to these general concerns, we also found problems specific to each agency.

However, the regulators have been quick to respond to our recommendations and to implement corrective actions. For example, in October 1997, we made recommendations to NCUA to help it ensure that credit unions were adequately mitigating Year 2000 risks. Among other things, NCUA responded by (1) implementing a quarterly reporting process whereby credit unions would communicate the status of their remediation efforts between examinations, (2) developing a formal, detailed plan for contingencies, (3) instructing credit union management to have their auditors address Year 2000 issues in the scope of their work, and (4) hiring additional contractor support to assist with exams of credit unions and service providers. We also made specific recommendations to FDIC to (1) work with the other FFIEC members to enhance the content of their assessment work program, (2) ensure that adequate resources are allocated to complete the corporation’s internal systems’ assessment by the end of March 1998, and (3) develop contingency plans for each of FDIC’s mission-critical systems and core business processes. Similarly, we recommended that OTS develop contingency plans for each of its mission-critical systems and core business processes. Again, both agencies agreed with our recommendations and took immediate steps to implement them.

Significant Year 2000 Challenges Ahead for Financial Institutions and Regulators

Despite the regulators’ strong efforts to assess industrywide compliance and remediate their own systems, several complex and difficult challenges remain in achieving Year 2000 compliance.

First: the challenge of time. Regardless of good practices and good progress, less than 16 months remain to the century date change. With over 22,000 institutions, vendors, and service providers to examine and monitor, the regulators face a formidable task in continuing to provide adequate coverage.

Second: the challenge to provide effective oversight during the later and more complicated stages of the remediation effort. By December 1998, FFIEC expects financial institutions to be well into the testing phase. As noted in our Year 2000 Test Guide, because Year 2000 conversions often involve numerous, large interconnecting systems with many external interfaces and extensive supporting technology infrastructures, testing needs to be approached in a structured and disciplined fashion. According to OCC, for many banks, testing will consume upwards of 60 percent of the cost and time spent to correct Year 2000 problems. Nevertheless, the regulators have a small window of opportunity for assessing institutions during this critical phase: they generally expect to complete on-site exams of service providers, software vendors, and institutions with in-house or complex systems by December 31, 1998, and plan to complete on-site exams for the remaining institutions by March 31, 1999. At the same time, however, they have a limited number of technical examiners to conduct these reviews. OCC, for example, has 79 full-time bank information system examiners responsible for providing assistance to 575 safety and soundness examiners and for examining institutions with complex systems. FRS currently has 73 such examiners—31 full time and 42 part time—that conduct complex examinations while supporting 106 other examiners during their exams. Because of the limited number of technical examiners and the large number of entities to be examined, we have recommended to the regulators that they (1) determine how many technical examiners are needed to adequately oversee the Year 2000 efforts of the institutions, data processing servicers, and software vendors and (2) develop a strategy for obtaining these resources and maintaining their availability.

Third: the challenge to develop an effective strategy for dealing with institutions that by all indications will not be viable by the Year 2000. The regulators have not yet (1) defined the criteria for finding that a financial institution will not be viable due to Year 2000 problems or (2) developed a strategy for when and how they will handle such troubled institutions. The regulators have been working on these issues. For example, they are querying data centers and service providers on their capacity to service new clients due to Year 2000 problems and putting together a “bidders list” for Year 2000 purposes that will include institutions that have demonstrated, well-managed Year 2000 programs and are capable of processing acquisitions of other institutions. However, none of these efforts have been finalized. Developing these plans promptly is paramount to minimizing the risk of not having enough time to implement a viable plan for dealing with institutions that cannot successfully complete their efforts.

Fourth: the challenge to protect U.S. banks from international Year 2000 risks. U.S. banks have many external links to financial institutions and markets around the world. For example, overseas financial institutions and markets depend on our electronic funds transfer systems and clearinghouses. Unfortunately, it has been reported that many countries are well behind their U.S. counterparts in Year 2000 remediation. For example, a survey of 15,000 companies in 87 countries by the Gartner Group found that nations including Germany, India, Japan, and Russia were 12 months or more behind the United States. Given the fact that many countries are behind schedule in addressing the Year 2000 problem, it will be essential for regulators to (1) ensure that financial institutions have adequately identified and mitigated their international risks and (2) prepare contingency plans for handling disruptions caused by problems abroad.

Fifth: the challenge to protect financial institutions from Year 2000 disruptions caused by their telecommunications and power service providers. The most vital business operations of financial institutions—ATM transactions, fund transfers, and credit card authorizations, for example—are dependent on telecommunications and power networks. In fact, according to the President’s National Security Telecommunications Advisory Committee, the financial services industry may be the telecommunications industry’s most demanding customer: over $2 trillion is sent by international wire transfers every day.

In June 1998 testimony on the Year 2000 readiness of the telecommunications sector, we reported that most major telecommunications carriers expect to achieve Year 2000 network compliance by December 1998. For a few though, the planned date for compliance is either later than December 1998, or we were unable to obtain this information. The carriers are working to test their networks but until the tests are completed and the results made public, it is not clear to what degree—if any—financial institutions and the public will be subject to telecommunications disruptions.

The situation for electric power companies is similar. At the request of the Department of Energy, the North American Electric Reliability Council (NERC) is assessing the readiness of the critical systems within the nation’s electric infrastructure. The Secretary of Energy requested that NERC provide written assurances by July 1, 1999, that critical power systems have been tested, and that such systems will be ready to operate in the year 2000. Until such assessments are completed and results made public, the precise status of this sector is not completely clear. Because of the uncertain nature of electric power and telecommunications Year 2000 readiness, it is essential for regulators and institutions to plan for contingencies should there be service disruptions due to the Year 2000 date change.

In conclusion, the regulators have made significant progress in assessing the readiness of member institutions; raising awareness on important issues such as contingency planning, testing, and dealing with service providers, software vendors, and large customers; and remediating their own systems. Looking forward, the challenge is for the regulators to make the best use of limited resources in the time remaining and to ensure that they are ready to take swift actions to address those institutions that falter in the later phases of correction and to address disruptions caused by international and public infrastructure Year 2000 failures. To their credit, the regulators have spent the last year developing a picture of how their industry stands, including which institutions are at high risk of not being ready for the millennium and require immediate attention, which service providers and vendors are likely to be problematic, and the extent of problems remaining. In addition, they have undertaken efforts to determine what conditions will constitute Year 2000 failures and what actions can be taken to quickly address failures. Nevertheless, more needs to be done to prepare for major potential disruptions caused by domestic and international financial institutions, as well as power and telecommunications companies, experiencing processing problems at the century date rollover.

Accordingly, we are now recommending that the regulators, working through the FFIEC, (1) finalize by December 1, 1998, their plans for dealing with institutions that will be not be viable due to Year 2000 problems and (2) develop contingency plans that address international and public infrastructure Year 2000 risks.

Mr. Chairman, this concludes my statement. We welcome any questions that you or Members of the Committee may have.

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.