Bank Regulation: Lessons Learned and a Framework for Monitoring Emerging Risks and Regulatory Response
Released: 2015-06-25T00:00:00

Letter

Background

Bank Supervision

Federal banking regulators supervise the activities of banks and require the banks to take corrective action when the banks’ activities and overall performance present supervisory concerns or could result in financial losses to the DIF or violations of law or regulation. See table 1 for an overview of their functions.

Federal banking regulators supervise the condition of most banks through off-site monitoring and on-site examinations. Regulators use off-site systems to monitor the financial condition of an individual bank; groups of banks with common products, portfolio or risk characteristics; and the banking system as a whole between on-site examinations. The off-site monitoring or surveillance activities rely on self-reported information from banks, filed through quarterly Reports of Condition and Income (Call Reports) to the banking regulators, supplemented with other market derived data, and in some cases, more detailed transaction level reporting on certain products or entities. The monitoring and surveillance activities help alert regulators to potentially problematic conditions arising in an individual bank, groups of banks with common products, portfolio or risks characteristics, and the banking system as a whole. Using these tools, each of the regulators identifies and flags banks with potential signs of financial distress and prepares lists or reports of such institutions (e.g., watch list, review list, high-risk profile list) requiring further follow up. These tools also help alert regulators to the need for other actions, such as a horizontal review of a group of banks, or broader policy guidance.

To oversee large, complex banks, including bank holding companies, federal banking regulators conduct on-site supervision by stationing examiners at specific institutions. This practice allows examiners to continuously analyze information provided by the financial institution, such as board meeting minutes, institution risk reports or management information system reports, and for holding company supervisors’ supervisory reports to be provided to other regulators, among other things. This type of supervision allows for timely adjustments to the supervisory strategy of the examiners as conditions change within the institution. Bank examiners do not conduct an annual point-in-time examination of the institution. Rather, they conduct ongoing examination activities that target specific functional areas or business lines at the institutions based on their examination strategy, the institution’s risk profile, and the extent of supervisory concern during the supervisory cycle. Such activities are discussed with bank management throughout the year and incorporated into the final full-scope examination report issued at the end of the supervisory cycle.

With respect to other individual banks, examiners use Call Report data to remotely assess the financial condition of banks and thrifts and plan the scope of on-site examinations. As part of on-site examinations, regulators also closely assess banks’ exposure to risk and assign ratings, under the CAMELS rating system. The ratings reflect a bank’s condition in six areas: capital, asset quality, management, earnings, liquidity, and sensitivity to market risk. Evaluations of CAMELS components consider the institution’s size and sophistication, the nature and complexity of its activities, and its risk profile. Each component is rated on a scale of 1 to 5, with 1 being the best and 5 the worst. The component ratings are then used to develop a composite rating, also ranging from 1 to 5. Banks with composite ratings of 1 or 2 are considered to be in satisfactory condition, while banks with composite ratings of 3, 4, or 5 exhibit varying levels of safety and soundness concerns. Banks with composite ratings of 4 or 5 are included on FDIC’s problem bank list, which designates banks with weaknesses that threaten their continued financial viability. The regulators supplement the CAMELS rating system with other risk assessment methodologies and frameworks. For example, OCC uses a Risk Assessment System that characterizes the level of risk, quality of risk management, or aggregate and direction of risk across eight risk categories. Also as part of the examination and general supervision process, regulators may direct a bank to address issues or deficiencies within specified time frames.

When regulators determine that a bank’s or thrift’s condition is less than satisfactory, they may take a variety of supervisory actions, including informal and formal enforcement actions, to address identified deficiencies. Regulators have some discretion in deciding which actions to take, but typically take progressively stricter actions against more serious weaknesses.

Informal actions generally are used to address less severe deficiencies or when the regulator has confidence the bank can and will make changes. Informal actions include supervisory letters detailing specific remedial measures for the bank to implement, safety and soundness plans, resolutions adopted by the bank’s board of directors at the request of its regulator, individual minimum capital ratio letters, and memorandums of understanding or agreements between the regulator and the bank’s board of directors. Informal actions are not public agreements (regulators do not make them public through their websites or other channels) and are not enforceable by sanctions.

The regulators use formal actions to address more severe deficiencies. Formal enforcement actions include PCA directives, safety and soundness orders, cease and desist orders, removal and prohibition orders, civil money penalties, formal agreements, and termination of a bank’s deposit insurance. Regulators publicly disclose formal enforcement actions.

1980s Thrift and Commercial Banking Crises

Thrift Crisis

A number of factors contributed to the severe crisis experienced by the thrift industry in the 1980s. Thrifts were regulated by the Federal Home Loan Bank Board (FHLBB) and insured by FSLIC within a legislative framework separate from the one that surrounded commercial banks. At the time, thrifts were largely restricted to making long-term, fixed-rate home mortgage loans. Because they issued short-term deposits to fund their long-term mortgage assets, thrifts were exposed to interest rate risk. When inflation resulted in rising interest rates in the mid-1970s and early 1980s, thrifts were unable to respond, losing many depositors to competitors such as money market funds because regulations prevented them from raising the interest they could pay on deposits. Inflation diminished the value of the long-term, fixed-rate mortgages they held, and virtually wiped out all the industry’s net worth, driving many institutions into insolvency.

Because the assets of FSLIC were inadequate to close all insolvent thrifts, FHLBB forestalled actual insolvency in the early 1980s by reducing capital standards and allowing the use of alternative accounting procedures to increase reported capital levels. At the same time, Congress deregulated thrifts with measures that included phasing out deposit interest-rate ceilings, broadening the lending and investment powers of thrifts, and more than doubling the limit of federal deposit insurance per thrift account holder. A 1997 FDIC study reviewing the 1980s crises in the thrift and banking industries found that as a result of these regulatory and legislative actions, the thrift industry grew rapidly, funded by an influx of deposits—often higher-risk brokered deposits.Loan portfolios at thrifts shifted from home mortgage financing into commercial real estate (CRE) loans—particularly into higher-risk acquisition, development, and construction (ADC) loans in areas of the country experiencing a real estate boom. The profitability of many of these activities depended heavily on continued inflation in real estate values. Tax legislation passed in 1981 further stimulated demand for CRE loans by increasing the rate of return. Our June 1989 report on failed thrifts found that in many cases, diversification was accompanied by inadequate internal controls and noncompliance with laws and regulations; thus, the risk of these activities was further increased. Consequently, many institutions experienced substantial losses on loans and investments, a condition that was made worse by an economic downturn in the later 1980s and by the repeal of the CRE tax incentives in 1986.

Commercial Bank Crisis

The competitive environment for the banking industry became increasingly demanding in the 1980s. As with thrifts, the development of money market funds and the deregulation of deposit interest rates, which removed the cap on the maximum amount of interest banks and thrifts were allowed to pay on deposits, spurred a competition to attract depositors with higher interest rates. This competition resulted in further squeezing what the banks could earn net of what they had to pay to acquire the deposits. Further, competition increased in the banking industry not only from within, but also from thrifts, foreign banks, and credit markets such as the commercial paper and bond markets.

The 1997 FDIC study noted that a series of regional and sectoral recessions had a severe impact on local banks and led to many bank failures, especially in areas that had been preceded by rapid regional expansions; that is, boom-and-bust patterns of economic activity. The magnitude of the banks’ losses was compounded because many banks active in these areas assumed excessive risks, with the result that they failed in disproportionate numbers. For example, many banks greatly increased their exposure to CRE as demand surged during the 1980s, particularly as deregulation, tax incentives, and other factors created an environment in which CRE lending became lucrative. To boost profits, some large banks assumed additional risk by, for example, increasing their off-balance-sheet activities.

The 1997 FDIC study identified four major regional and sectoral economic recessions that were associated with widespread bank failures during the 1980-1994 period. The first recession was related to a downturn in farmland prices in the early and middle 1980s and led to a number of failures of banks with heavy concentrations of agricultural loans, particularly in the Midwest. The second recession occurred in Texas and other oil producing southwestern states after oil prices began dropping in 1981. While initial bank failures in this region were primarily due to problems with energy-related loans, substantial losses on CRE and residential real estate loans were responsible for the rising number of bank failures in this region in the second half of the decade. The third and fourth recessions occurred in the northeastern United States and in California at the end of the 1980s, largely due to a sharp decline in real estate prices that resulted from an oversupply of CRE and residential real estate in these areas and led to defaulted real estate loans and bank failures.

2007-2009 Financial Crisis

In January 2010 testimony, the former FDIC Chairman commented that a number of the products and practices that led to the 2007-2009 financial crisis had their roots in mortgage market innovations that began in the 1980s.residential mortgage investments that precipitated the thrift crisis of the 1980s, banks and thrifts began selling a major share of their mortgage loans for securitization. The housing government-sponsored enterprises (GSEs) create a market for investors to purchase securities backed by loans originated by banks and thrifts. Through the 1990s, the GSEs increased in size as they purchased and retained the mortgage-backed securities (MBS) they issued.

She noted that following the large interest rate-losses from As interest rates declined in the early 2000s, mortgage originations surged, driven primarily by the refinancing of existing mortgages as borrowers sought to lower the interest rates on their home loans and as home price appreciation in the United States began accelerating rapidly in 2000. This wave of refinancing activity was originally dominated by prime, fixed-rate loans. However, declining affordability in high-priced housing markets as well as increased competition by mortgage originators for loan volume contributed to a shift towards nontraditional mortgage products, which allowed borrowers to defer repayment of principal or part of the interest for the first few years of the mortgage. Growth in the subprime market also increased. Many borrowers eventually faced large payment Many providers of these increases and had difficulty making payments. products—mortgage brokers, mortgage bankers, and mortgage affiliates of bank, thrift, and other financial holding companies—operated outside the traditional thrift and bank regulatory system.

We reported on the risks of nontraditional mortgage products to borrowers and lenders, the extent to which mortgage disclosures discussed the risks to borrowers, and federal and selected state regulatory responses to nontraditional mortgage product risks in 2006. See GAO, Alternative Mortgage Products: Impact on Defaults Remain Unclear, but Disclosure of Risks to Borrowers Could be Improved, GAO-06-1021 (Washington D.C.: Sept.19, 2006). or quality standards. Private-label MBS backed by lower-quality mortgage pools left investors exposed to greater risk of default. The market share of private-label MBS, which typically pool jumbo and nonprime mortgages, grew rapidly from 2004 to 2006. During this time, the market share of the GSEs, which pool eligible prime mortgages, decreased. Other investment structures such as collateralized debt obligations (CDO) were also instrumental to creating demand for these riskier, lower quality loans. In a basic CDO, a group of loans or debt securities are pooled and securities are then issued in different tranches that vary in risk and return depending on how the underlying cash flows produced by the pooled assets are allocated. If some of the underlying assets defaulted, the more junior tranches—and thus riskier ones—would absorb these losses first before the more senior, less-risky tranches. Purchasers of these CDO securities included insurance companies, mutual funds, commercial and investment banks, and pension funds. Many of these CDOs largely consisted of mortgage-backed securities, including subprime mortgage-backed securities. The growth of the mortgage-linked derivatives market further allowed investors to take on exposure to the subprime and Alt-A markets without actually owning the mortgages or the MBS or CDO on the entities that owned the mortgages. Through the use of such credit derivatives, investor exposure to losses in these markets was multiplied and became many times larger than the exposures generated by the mortgages alone.

The dramatic decline in the U.S. housing market that began in 2006 precipitated a decline in 2007 in the price of mortgage-related assets, particularly mortgage assets based on nonprime loans. Some financial institutions were so exposed that they were threatened with failure, and some failed because they were unable to raise capital or sell assets to generate liquidity as the value of their portfolios declined. Other institutions, ranging from the GSEs to large securities firms, were left holding “toxic” mortgages or mortgage-related assets that became increasingly difficult to value, were illiquid, and potentially had little worth. Moreover, investors not only stopped buying private-label MBS but also became reluctant to buy securities backed by other types of assets. Because of uncertainty about the liquidity and solvency of financial entities, particularly among large, financially interconnected firms, the prices banks charged each other for borrowing funds rose dramatically, and interbank lending conditions deteriorated sharply. The resulting liquidity and credit shortage made the financing on which businesses and individuals depend increasingly difficult to obtain. By the late summer of 2008, the ramifications of the financial crisis ranged from the continued failure of financial institutions to increased losses of individual wealth, reduced corporate investments, and further tightening of credit that would exacerbate the emerging global economic slowdown.

Bank failures associated with the financial crisis were concentrated in areas where the housing markets experienced strong growth. In response to the demand for housing stock in the years prior to the crisis, residential development activity increased. Many banks exhibited rapid growth in their ADC portfolios, resulting in significant concentrations in ADC and CRE loans. Strong competition for higher yielding assets contributed to a decline in underwriting standards. Our prior work found that losses on higher-risk residential mortgages drove the failure of large banks (those Failures of the small with more than $10 billion in assets) in these areas.and medium banks (those with less than $1 billion in assets, and between $1 billion and $10 billion in assets, respectively) in these areas were largely driven by losses on CRE and ADC loans.

Past Crises Highlight Continued Need for Early and Strong Regulatory Response to Identified Problems

Early intervention is a key lesson learned for successfully resolving the problems of troubled institutions. In the 1980s thrift and banking crises and the 2007-2009 financial crisis, regulators could have provided earlier and more forceful supervisory attention to troubled institutions. In addition, the crises revealed limitations in regulatory tools for identifying and addressing emerging risks. The 2007-2009 financial crisis also highlighted the need for federal banking regulators to consider the impact of emerging risks in the broader financial system on individual banks.

Regulators Did Not Always Provide Sufficiently Timely and Robust Supervisory Attention to Troubled Institutions

Although the relative causes, scope, and duration of the 1980s thrift and commercial bank crises and the 2007-2009 financial crisis were distinct, our past reviews of the banks that failed during these crises found similar contributing factors, particularly weak management practices that involved banks engaged in higher-risk activities. Although regulators often identified these risky practices early on in each crisis, the regulatory process was not always effective in correcting the underlying problems before the banks became undercapitalized and failed.

For example, in our June 1989 report, examiners for 26 failed thrifts cited management weaknesses as a leading factor in the failures. In virtually all of these cases, the thrifts shifted their focus from traditional home mortgage lending to higher-risk activities. Moreover, management at these thrifts often pursued business decisions and strategies that increased their risks, such as a heavy reliance on brokered deposits to fund rapid growth, poor underwriting and credit administration practices, and concentrations in ADC lending. These management problems consequently made them more vulnerable to poor regional economic conditions. We found that thrift management was often unresponsive to supervisory concerns the examiners raised in these cases and that thrift management did not always act on problems examiners identified or implement promised corrective actions. In our April1989 testimony, we analyzed the supervisory history of an additional 47 thrifts that were near failing. For more than half, no formal enforcement actions were taken and many had no history of formal actions. Where enforcement actions were taken, they were often not effective in correcting problems. Further, the length of time that elapsed between identification of a need for formal action and implementation of the action was often unduly lengthy.

Similarly, in our April 1991 report, examiners of 72 troubled banks identified similar management weaknesses as the most common reason for assets and earnings problems, including heavy concentrations in specific types of assets, industries, or local economies, and excessive growth combined with poor lending practices or controls. frequently cited asset problems involved problem real estate loans and the most frequently cited reasons for the asset problems involved lax underwriting practices. Losses on these problem assets resulted in earnings problems and eventually capital problems for the banks. In about half of the 72 failed banks, we concluded the banking regulators should have been more aggressive and used stronger measures than they did (e.g., some formal enforcement action instead of only an informal enforcement action).underlying causes for problems were known but remained uncorrected or the bank had a history of noncompliance with enforcement actions or of violating banking regulations. We also found that better outcomes were associated with the most forceful actions taken, and worse outcomes were associated with not taking the most forceful action available.

In 1991, we reported on a random sample of 72 banks that as of January 1, 1988, regulators identified as having difficulty meeting minimal capital standards. GAO, Bank Supervision: Prompt and Forceful Regulatory Actions Needed, GAO/GGD-91-69 (Washington D.C.: Apr. 15, 1991). choosing among enforcement actions of varying severity, they preferred to work with bank management to resolve problems during the 1980s thrift and commercial bank crises over taking enforcement actions. For example, we identified 37 cases from our sample of 72 banks where regulators decided not to use available enforcement actions. In 26 cases, the unsafe and unsound practices that caused the capital depletion remained uncorrected.

FDIC’s 1997 study noted the ability of regulators to curb excessive risk taking on the part of healthy banks was limited by the problem of identifying risky activities before they produced serious losses. The study found that bank regulators were reasonably successful in curbing risk- taking on the part of officially designated problem banks. However, in dealing with ostensibly healthy banks, regulators had difficulty restricting risky behavior while the banks were still solvent and the risky behavior was widely practiced and profitable. The study found it was challenging for regulators to distinguish such behavior from acceptable risk/return trade-offs, innovation, and other appropriate activity, or to modify the behavior of banks while they were still apparently healthy.

We concluded in our 1991 report outlining our strategy for reforming the deposit insurance system in the wake of the thrift and commercial banks crises that meaningful reform would not succeed without an enforcement process that was less discretionary than the approach used at the time.

GAO, Deposit Insurance: A Strategy for Reform, GAO/GGD-91-26 (Washington, D.C.: Apr. 15, 1991). we proposed that the first tripwire address unsafe activities that indicate management inadequacies that could lead to further financial problems; that is, unsafe practices in seemingly healthy institutions. We proposed that a second tripwire address poor asset quality and earnings, as our prior work showed that serious asset deterioration and earnings problems are leading indicators of bank financial problems. Our third and fourth tripwires addressed capital deterioration.

Subsequently, Congress established the PCA framework in 1991.The framework is set forth in sections 38 and 39 of the Federal Deposit Insurance Act, as amended by FDICIA. Section 38 requires regulators to classify banks into one of five capital categories and take increasingly severe actions as a bank’s capital deteriorates. Section 39 requires the banking regulators to prescribe safety and soundness standards related to noncapital criteria, including operations and management; compensation; and asset quality, earnings, and stock valuation. Section 39 was intended to allow regulators to take action against seemingly healthy banks that were engaging in risky practices before losses occurred. Initially, the standards for asset quality and earnings were to be quantitative and intended to increase the likelihood that regulators would address safety and soundness problems before capital deteriorated. However, later legislative changes gave regulators considerable flexibility to implement these standards, and regulators determined instead to issue guidance in 1995 setting out broad standards addressing these areas. Section 39 allows the regulators to take action for non-problem institutions in which inadequate practices and policies could result in a material loss to the institution or in cases where management has not responded effectively to prior criticisms.

Despite this new regulatory framework, regulators continued to face challenges in restricting risky bank behavior in the years leading up to the 2007-2009 financial crisis. As we will discuss later, PCA was not effective in resolving underlying problems at failed banks and preventing widespread losses to the deposit insurance fund during the financial crisis. Our more recent work and that of the federal banking regulator IGs found that many of the banks that failed during the financial crisis were susceptible to the same risks that gave rise to the bank failures of the 1980s and 1990s. For example, in our January 2013 report, we found management weaknesses also contributed to many failures, including poor underwriting and credit administration practices, rapid growth funded by brokered deposits, and high concentrations—in particular, high CRE and ADC concentrations for small and medium-sized banks and high concentrations of higher risk residential mortgage products at large banks. With the downturn in the housing market and the onset of the financial crisis, asset problems manifested. The rising level of nonperforming loans, particularly ADC loans, was a key factor driving a decline in capital for many failed banks. As another example, an April 2013 report by the Treasury IG noted that many of the OCC-supervised banks that failed from 2008 to 2012 evidenced weaknesses with bank boards of directors or management and high concentrations in CRE loans. The Federal Reserve IG also found similar factors in its review of failed banks supervised by the Federal Reserve, in particular, that many bank failures involved the board and management making strategic decisions to pursue aggressive growth that increased the bank’s risk profile and ultimately contributed to the failure. And, in its 2010 report, the FDIC IG found that risky bank behaviors associated with bank failures included pursuit of aggressive growth in CRE and ADC loans, excessive levels of asset concentration with little risk mitigation, and inadequate loan underwriting.

We and the federal banking regulator IGs also found that regulators had identified underlying risks of banks that failed during the 2007-2009 financial crisis well before their failure, but did not always take timely supervisory action. For example, of the 136 failed banks we reviewed for our 2011 PCA report, we found that most had received an informal or formal enforcement action before undergoing the PCA process, although the timeliness of enforcement actions was inconsistent. Specifically, among 60 banks that failed between January 2008 and June 2009, approximately 28 percent did not have an initial informal or formal non- PCA enforcement action until 90 days or less before bank failure. Further, 50 percent of these failed banks did not have an enforcement action until 180 days or less prior to failure. After June 2009, these percentages improved, with approximately 8 percent not having an enforcement action until 90 days or less before failure, and approximately 22 percent not having an action until 180 days or less before failure.

Similarly, a September 2011 report by the Federal Reserve IG analyzing the failure of 20 state member banks noted that examiners identified key safety and soundness risks but did not take sufficient supervisory action in a timely manner to compel the boards and management to mitigate those risks. In many instances, the IG found the examiners eventually concluded that a supervisory action was necessary, but that conclusion came too late to reverse the bank’s deteriorating condition. Further, a December 2010 report by the FDIC IG found that in many cases, examiners identified significant risks but did not take timely and effective action to address those risks until the bank had started to experience significant financial deterioration in the loan or investment portfolios.

Staff from one regulator told us that when they have a bank failure, they always look back at that failure and assess what they could have done differently in terms of supervision. They found that generally, examiners had identified the underlying issues that eventually led to the failures but did not press management hard enough to deal with those issues. These staff explained that it can be difficult for examiners to make the case to bank management that they need to ratchet down a profitable line of business because at the time the examiners see risk building up, the bank’s performance may not yet have been impacted. These staff also said that if the agency decides to take an enforcement action when the bank is still in good financial shape, and the bank refuses to sign it, a lengthy and resource-intensive legal process could ensue. Staff from another regulator acknowledged that examiners had often uncovered problems at the banks long before they failed, yet bank management did not take action to address their recommendations. These staff noted that part of the role of the examiner is to be skeptical, and it is difficult to be skeptical when loans are paying as agreed. These staff recognized that in the past they have not always been effective in getting bank management to take action to address potential problems before their effect hits the balance sheet.

Banking regulators also received considerable feedback in response to proposed actions to address emerging risks that resulted in delays. The regulators issued draft guidance in January 2006 on CRE concentrations and risk management, based partly on the trends they observed in CRE concentrations and risks, but the guidance was not finalized until December 2006. Staff from one regulator told us the guidance was issued too late to allow for corrective actions to be taken across the banking system before the crisis ensued. The draft guidance elicited about 4,400 comments letters from bankers, industry trade groups, state financial regulatory agencies, appraisers and real estate industry representatives. The vast majority of the commenters expressed strong resistance to the proposed guidance, and the staff told us that working through the comment process resulted in delays to final issuance. In its September 2011 report summarizing state member bank failures, the Federal Reserve IG reported that examiners they spoke with perceived the guidance to be “too little, too late” and that examiners mentioned that many institutions did not quickly adopt the risk management practices outlined in the guidance prior to the onset of the financial crisis.

Past Crises Revealed Limitations in Existing Tools for Monitoring and Addressing Emerging Risks

PCA Reliance on Capital Triggers Limited Its Effectiveness

As discussed earlier, in the aftermath of the thrift and commercial bank crises regulators were criticized for failing to take timely and forceful action to address the causes of thrift and bank failures and prevent losses to taxpayers and the deposit insurance fund. The PCA framework was intended to improve regulators’ ability to identify and promptly address deficiencies at banks by, in part, limiting their discretion and mandating them to take corrective actions under certain circumstances. Staff from one regulator told us that PCA likely prompts bank management to address problems earlier than is the case without PCA and that failure costs are likely lower with PCA than without it. However, the PCA framework did not prevent widespread losses to the deposit insurance fund—a key goal of PCA. In June 2011, we reported on the effectiveness of the PCA framework for addressing financial deterioration of banks during the financial crisis and concluded that PCA’s reliance on capital triggers limited its ability to promptly address bank problems.

Before 2007, PCA was largely untested by a financial crisis that resulted in a large number of bank failures. After the passage of FDICIA, sustained growth in the U.S. economy meant that the financial condition of banks was generally strong. For instance, as a result of positive economic conditions, the number of bank failures declined from 180 in 1992 to 4 in 2004. Furthermore, from June 2004 through January 2007, no banks failed. regulator IGs found that regulators, with the exception of OCC, made limited use of their section 39 authorities, consistent with our prior findings.

As part of our June 2011 work, we tested financial indicators other than capital and found that there were important predictors of future bank failure that could be used in developing non-capital triggers for PCA. For example, indicators of earnings, liquidity, asset quality, and sector loan concentration contain information about the condition of the bank that can To provide warning of bank distress up to 1 to 2 years in advance. improve the effectiveness of the PCA framework, we recommended, among other things, that the banking regulators consider additional, non- capital triggers that would require early and forceful regulatory actions In written comments, FDIC, tied to specific unsafe banking practices.the Federal Reserve, and OCC agreed with our recommendation to consider options to make PCA more effective. As of June 2015, federal banking regulators were still considering the pros and cons of modifying the PCA framework, such as the use of additional noncapital-based triggers. For instance, FDIC staff noted that non-capital triggers could strengthen the supervisory process and help banks avoid mistakes leading to crisis, address GAO and FDIC IG recommendations, and involve low implementation costs since the infrastructure is already in place. However, FDIC staff said that the additional hard-wired PCA triggers, which would likely require interagency rulemaking, could encourage banks to operate just below a given threshold to avoid scrutiny, and banks tripping PCA non-capital triggers could be perceived in the capital markets as being on a path toward regulatory intervention. In addition, FDIC staff noted that while additional tripwires would result in greater stringency of supervision, there could also be unintended consequences resulting in constraints on well-managed banks performing their financial intermediation function.

CAMELS Ratings Did Not Systematically Reflect Long- Term Risk Factors

CAMELS ratings have not always reflected long-term risk factors, particularly with respect to poor management practices. The CAMELS rating system contains explicit language in each of the components emphasizing the importance of management’s ability to identify, measure, monitor, and control risks. For example, a poor management component rating (M) may indicate that the bank suffers from weak internal controls or management information systems or other deficiencies that could Thus, threaten the safe, sound, and efficient operation of the bank.deterioration of the management component may yield future information about risk.

However, in prior crises, regulators did not always assign management component ratings that were reflective of weaknesses in management, and staff from one regulator said that there was a tendency to use the rating more as a point in-time snapshot of a bank’s condition, rather than a reflection of long-term risk factors that may cause losses several years later. In its 1997 study, FDIC analyzed the management component ratings for the 1,564 banks that failed between 1980 and 1994 (excluding banks that received FDIC assistance) during the commercial bank crisis. The results showed that 2 years before failure, in only 6 percent of the cases was the management rating one full number worse than the average of the other four components. The FDIC IG noted in a 2010 report that examiners did not always place sufficient emphasis on risk mitigation when assigning ratings to banks that later failed. The IG noted that bank management’s lack of responsiveness to examiners’ concerns was not always reflected in assigned CAMELS ratings until significant financial deterioration occurred. In its 2011 report, the Federal Reserve IG said its work highlighted the need for supervisors to ensure that CAMELS composite and component ratings are consistent with narrative examination comments to clearly convey the need for urgent action when appropriate.

Staff from one regulator told us that although the management component of the CAMELS is stand-alone, in some instances, examiners found it difficult to rate management low (i.e., 4 or 5) if capital and earnings were strong, even if they had noted concerns with management practices. As a result, in some cases, composite CAMELS ratings remained relatively high (i.e., 1 or 2) until capital and earnings began to decline. Because capital and earnings tend to be lagging indicators, such ratings decreases were not reflected in some cases until before the bank failed. In our 2011 PCA report, we found that most banks that failed degraded from a CAMELS composite rating of 2 to a 4 in one quarter, though they generally had at least one component rating of a 3 prior to failure.

Bank Supervision Did Not Consider the Impact of Risks from the Broader Financial System on Banks

The financial crisis also highlighted the need for regulators to consider the impact of risks in the broader financial system on individual banks. Before the 2007-2009 financial crisis, banking supervision was microprudential; that is, generally focused on the activities of individual institutions or groups of insitutions. Staff from two federal banking regulators underscored that financial stability requires looking beyond the safety and soundness of individual banks to across the financial system with a macroprudential approach that focuses on assessing systemic risks. Staff from one regulator said that the problem with focusing solely on the activities of individual banks could be seen in the “originate to distribute” model that banks used to originate mortgages in the years leading to the financial crisis. That is, banks were originating mortgages with the intent to sell them in the secondary market as mortgage-backed securities, and not keep them in portfolio as held-for-investment. These staff also said that although the underwriting risk of these mortgages was significant, they believed that there was little risk to the bank’s capital because the bank was making fees but was not retaining the credit risk of the mortgages.

These staff said they incorrectly assumed that investors were paying attention to the underwriting risk embedded in the securitized mortgages, because investors were buying the securities and not putting pressure on the banks to increase their underwriting standards for the underlying mortgages. When the real estate bubble burst and homeowners began to default on their mortgages, these investors suffered heavy losses. As a result, staff said they learned that financial stability oversight requires a different perspective and a different, more global approach that considers, among other things, the interconnectedness of financial institutions and their activities. In retrospect, staff noted that stronger bank capital standards—notably those relating to the quality of capital and the amount of capital required for banks’ trading book assets—and more attention to the liquidity risks faced by the largest, most interconnected firms would have made the financial system as a whole more resilient.

Although the activities of large, interconnected financial institutions often crossed traditional sector boundaries, banking regulators did not always have sufficient tools and capabilities to adequately oversee the risks that these financial institutions pose to themselves and other institutions. In June 2008 testimony, a former Federal Reserve Vice Chairman noted that under the current U.S. regulatory structure, challenges can arise in assessing risk profiles of large, complex financial institutions operating across financial sectors, particularly given the growth in the use of sophisticated financial products that can generate risks across various legal entities. He also said that the financial crisis highlighted the importance of enterprise wide risk management, particularly that supervisors need to understand risks across a consolidated entity and assess the risk management tools being applied across the financial institutions. For example, the former Federal Reserve Chairman said that stress tests of the 19 largest bank holding companies, conducted by federal banking regulators in 2009 as part of the Supervisory Capital Assessment Program, demonstrated that many of these institutions’ information systems could not provide timely, accurate information about bank exposures to counterparties or complete information about the aggregate risks posed by different positions and portfolios.

Staff from another regulator said that fragmented databases and otherwise insufficient processes at large banks to identify similar risks within and across various lines of businesses and legal entities both on and off the balance sheet resulted in the failure to identify and therefore measure, monitor, and control exposure to concentrations. Further, accounting rules in effect at the time permitted special-purpose entities— legal entities often used by banks to facilitate the securitization of real- estate loans—to remain off the banks’ balance sheets, thus obfuscating regulators’ ability to fully understand the extent of the banks’ business activities and risk exposures. Our own work had raised concerns over the adequacy of supervision of large financial conglomerates. For example, one of the large entities that OTS oversaw was the insurance conglomerate American International Group, Inc. (AIG), which was subject to a government takeover necessitated by financial difficulties the firm experienced as the result of OTC derivatives activities related to mortgages. In a March 2007 report, we expressed concerns over the appropriateness of having OTS oversee diverse global financial institutions given the size of the agency relative to the institutions for which it was responsible.

Staff from one regulator said that another lesson learned was that an enormous amount of systemic risk had been concentrated in the shadow banking system before the onset of the 2007-2009 financial crisis in several nonbank financial firms, such as large investment firms. However, the regulators did not perceive the buildup of risk and leverage across the financial system because of a gap in the regulation of the shadow banking system. Staff said that the increase in system-wide leverage during the years leading up to the financial crisis distinguished the impact that real estate problems of the 1980s had on thrifts and commercial banks from the impact that real estate problems of the 2000s had on the banking sector and larger financial system. That is, losses from real estate-related loans, while primary factors in the failures of banks and thrifts during the 1980s, did not have a systemic impact on the larger financial system because these institutions had originated the loans and retained the associated credit risk.

In contrast, they said that losses from real estate-related loans during the 2007-2009 financial crisis had a systemic impact because the risks associated with these loans were spread and amplified throughout the financial system. Contributing to the buildup of risk and leverage across the financial system was the fact that shadow banking activities were, for the most part, not subject to consistent and effective regulatory oversight. The former Federal Reserve Chairman noted that much shadow banking, including various special-purpose entities and many nonbank mortgage- origination companies, lacked meaningful prudential regulation. In our January 2009 report, we noted that the role of nonbank lenders in the recent financial collapse provided an example of a gap in our financial regulatory system resulting from the activities of institutions that were generally subject to little or no direct oversight by federal regulators. The significant participation by these nonbank lenders in the subprime mortgage market—which targeted products with riskier features to borrowers with limited or poor credit history—contributed to a dramatic loosening of underwriting standards leading up to the crisis. Staff from one regulator noted that, at the large investment firms, broker-dealers arranged for investors to fund these long-term mortgage assets with short-term financial instruments, typically with original maturities of less than nine months, which allowed leverage in the whole financial system to build to unprecedented levels and distribute risk throughout the system.

However, some of the top investment banks were subject to voluntary and limited oversight at the holding company level—the level of the institution that generally managed its overall risks. holding companies faced serious losses and funding problems during the crisis, and their instability severely damaged the financial system. The financial crisis demonstrated that the failure of large interconnected financial institutions, such as the failure of Lehman Brothers Holdings, Inc. in the fall of 2008, could trigger systemic events through a rise in the price of risk (that is, the risk-adjusted return on investments) and deleveraging in the broader financial system.

The Securities and Exchange Commission terminated its program for overseeing these large broker-dealer holding companies in September 2008 but continues to oversee these firms’ registered broker-dealer subsidiaries.

Regulators Have Taken Steps Intended to Improve Their Ability to Identify and Respond to Emerging Risks

Federal banking regulators have taken steps to incorporate the lessons learned from the 2007-2009 financial crisis and improve their ability to identify and respond to emerging risks. First, regulators told us that they recognize bank supervision needs to be less historically focused and more forward-looking. As such, they have been working to include more forward-looking elements into examinations, such as bank-performed stress test processes and results, and to reflect such forward-looking information in the CAMELS ratings and other risk assessment tools. Second, to improve their ability to respond earlier and more forcefully to banks’ risky behavior, the three regulators have initiated more granular tracking of supervisory issues that surface during examinations, referred to as matters requiring attention (MRA). Third, through their participation in FSOC and their own surveillance activities, they also have been monitoring the financial system more broadly for risks that could affect their regulated institutions. We and others have begun to review some of these regulatory initiatives, but further work is needed to fully evaluate their effectiveness in improving regulators’ ability to identify and respond to emerging risks in a timely manner.

Stress Testing

Federal Reserve, FDIC, and OCC staff have been using banks’ stress tests as a way to incorporate forward-looking elements into the examiners’ considerations of risk in individual institutions. Stress testing is a forward-looking, quantitative evaluation of the potential effects of stress scenarios that could impact a banking institution’s financial condition and capital adequacy. These risk assessments are based on assumptions about potential adverse external events, such as changes in real estate or capital markets prices, or unanticipated deterioration in a borrower’s repayment capacity. In supervisory guidance for stress testing practices of large banks issued in May 2012, the regulators noted that the financial crisis underscored the need for banks to incorporate stress testing into their risk-management practices and demonstrated that banking organizations unprepared for particularly adverse events and circumstances can suffer acute threats to their financial condition and viability.

Section 165(i) of the Dodd-Frank Act requires two types of stress tests on large banks. Section 165(i)(1) requires the Federal Reserve to conduct annual stress tests of bank holding companies with $50 billion or more in total consolidated assets and nonbank financial companies supervised by the Federal Reserve, while Section 165(i)(2) requires companies with more than $10 billion in total consolidated assets to conduct annual stress tests themselves, in addition to requiring companies with $50 billion or more in total consolidated assets and nonbank financial companies supervised by the Federal Reserve to conduct their own stress tests semi-annually. In October 2012, the Federal Reserve issued final rules for the tests of holding companies with $50 billion or more in total consolidated assets and also required the companies to conduct and disclose annual company-run stress tests. Also in October 2012, FDIC, OCC, and the Federal Reserve issued final rules requiring annual company-run stress tests for bank holding companies with total consolidated assets between $10 billion and $50 billion and for national banks and state member banks, state nonmember banks, state and federal thrifts and thrift holding companies with $10 billion or more in total consolidated assets. The results of the stress tests provide the regulators with more forward-looking information that they plan to use in bank supervision and to assist them in assessing the company’s risk profile and capital adequacy. In March 2014, FDIC, OCC, and the Federal Reserve issued final guidance describing supervisory expectations for stress tests conducted by financial companies with total consolidated assets between $10 billion and $50 billion.

Banks with less than $10 billion in assets are not required or expected to conduct the types of stress testing specifically articulated in the initiatives which are directed at larger organizations. However, the three regulators continue to emphasize that all banks, regardless of size, should have the capacity to analyze the potential impact of adverse outcomes on their financial condition. Banks in this range also remain subject to the stress testing guidance contained in prior interagency issuances. OCC issued guidance specifically designed for community banks on how they can effectively use simple stress testing concepts and methods to help identify and quantify risk in loan portfolios and help establish effective strategic and capital planning processes. For example, OCC staff said that their examiners and economists developed stress testing tools for analyzing commercial real estate, agriculture, and other loan portfolios that are also available to community banks. And, FDIC published an article illustrating approaches to assist community banks with credit stress testing in an edition of Supervisory Insights.

The former Federal Reserve Chairman said that one of the most important aspects of regular stress testing is that it forces banks and their supervisors to develop the capacity to quickly and accurately assess the enterprise-wide exposures of their institutions to diverse risks, and to use that information routinely to help ensure that they maintain adequate capital and liquidity. risk-management capacity is itself critical for protecting individual banks and the banking system. Federal Reserve staff also noted that the stress test is the best way to communicate to bank management that risks have built up and need attention, because it is data driven. Without such data, they said it is difficult to make a convincing case to management because bank managers do not want to hear that they should act more cautiously when their banks are profitable.

Ben Bernanke, Chairman of the Board of Governors of the Federal Reserve System, Stress Testing Banks: What Have We Learned? Conference on “Maintaining Financial Stability: Holding a Tiger by the Tail”, Presented by the Federal Reserve Bank of Atlanta (Stone Mountain: Apr. 8, 2013).

As a complement to stress testing, federal banking regulators have also emphasized the importance of forward-looking capital planning to evaluate and assess a bank’s capital needs relative to its current and planned business strategies. For example, OCC issued guidance that discusses the OCC’s processes for evaluating a bank’s capital planning and the various actions OCC may take to ensure a bank’s process and capital levels remain adequate for its complexity and overall risks. As another example, the Federal Reserve issued guidance describing its expectations for internal capital planning at the large, complex bank holding companies subject to its capital plan rule.

CAMELS Ratings and Other Risk Assessment Tools

As part of their efforts to engage in more forward-looking supervision, federal banking regulators have been directing examiners to use the management component of the CAMELS ratings to reflect underlying risks, and have also been focusing on other ways to build more forward- looking risk-based elements into the CAMELS ratings.

FDIC officials said they have been trying to look at underlying risks in a forward-looking fashion rather than relying on absolute earnings, problem assets, and delinquencies. In June 2009, FDIC’s Division of Supervision and Consumer Protection announced the “Forward- Looking Supervision” approach, which was delivered as a training program and reinforced in subsequent guidance. The training emphasized a forward-looking approach to examination analysis and ratings based on the lessons learned that were identified in the material loss reviews for those FDIC-regulated banks that failed during the financial crisis. In an audit that reviewed the training, the FDIC IG noted that it directed examiners to consider bank management practices as well as current and prospective financial performance and conditions or trends when assigning CAMELS ratings. FDIC dedicated an issue of Supervisory Insights to discussing interest rates risk and issued examiner guidance about addressing risk management deficiencies surrounding interest rate risk early.

In September 2011, OCC issued a supervisory memorandum to examiners, drawing upon lessons learned from the financial crisis. The guidance was intended to enhance examiners’ use and communication of the Risk Assessment System (RAS). Examiners use RAS to identify, communicate, and affect appropriate responses to the buildup of risks or deficiencies in risk-management systems at OCC-supervised institutions. The memorandum stated that examiners should use RAS in conjunction with CAMELS ratings to identify current and prospective risks and that the RAS assessments should help inform CAMELS ratings. The memorandum noted that the CAMELS management component rating too often reflected banks’ cooperation and commitment to correct deficiencies without demonstrated performance. It stated that the management component rating should focus on actions and results, rather than commitments. Finally, the memorandum stressed that assigning an adverse rating to the management component based on poor or missing practices, before problems were evident in a bank’s financial condition, was one of the tenets of sound and forward-looking supervision and an important lesson learned from the recent financial crisis. More recently, in response to recommendations included in a 2013 international peer review report, OCC staff said they had formed a working group to determine what additional changes may be needed to enhance the application of CAMELS and its integration with OCC’s RAS to ensure that examiners use the RAS and CAMELS to identify, assess, and document current and emerging risks.

Federal Reserve staff said that they are in the process of updating prior guidance to examiners for evaluating the adequacy of banks’ risk management processes. In 1995, the Federal Reserve issued guidance directing examiners to assign separate supervisory ratings for banks’ risk management practices, including internal controls, and to give this rating significant weight when determining the rating of management under CAMELS. Federal Reserve staff said that they tracked CAMELS downgrades both before and during the crisis and believe the guidance was instrumental in helping examiners identify and rate poor management practices. They said they are reviewing the guidance to incorporate lessons learned from the crisis and update where appropriate.

Matters Requiring Attention

MRA describes bank practices that deviate from sound governance, internal control, and risk management principles, and have the potential to adversely affect the bank’s condition, including its financial performance or risk profile, if not addressed. MRAs also describe bank practices that result in substantive noncompliance with laws and regulations, enforcement actions, supervisory guidance, or conditions imposed in writing. To improve the utility of MRA as a tool for getting banks to address supervisory concerns in a timely manner, the Federal Reserve, OCC, and FDIC have issued updated guidance on policy and procedures related to the use of MRA.

In June 2013, the Federal Reserve updated and clarified existing examiner guidance on communicating supervisory findings to banks.

Board of Governors of the Federal Reserve System, Rating the Adequacy of Risk Management Processes and Internal Controls at State Member banks and Bank Holding Companies, SR95-51 (Nov. 14, 1995).

In particular, the guidance addresses requirements for MRA and matters requiring immediate attention (MRIA)—those matters that pose potentially significant safety and soundness concerns, represent significant noncompliance with applicable laws or regulations, or repeat criticisms that have escalated in importance due to a bank’s insufficient attention or inaction included in examination or inspection reports or other supervisory communication. The guidance stipulates that MRA and MRIA concerning safety and soundness or consumer compliance must specify a time frame within which the banking organization must complete the corrective action. Examiners are expected to follow up and assess bank progress and verify satisfactory completion. If the follow-up indicates the organization’s corrective action has not been satisfactory, the guidance notes that additional formal or informal investigation or enforcement action might be necessary. Federal Reserve staff said they intended to rigorously track MRA and MRIA and their status across banks.

OCC’s September 2011 examiner guidance stressed that early intervention, such as MRA or formal or informal enforcement action, is essential to resolving problems successfully. In determining the appropriate level and type of intervention, the guidance stated that examiners must consider the ongoing ability to correct problems and demonstrated performance of management and boards, and cautioned examiners not to mistake management or board’s cooperation and willingness with their ability to remediate problems, reduce risk, and improve the bank’s condition. In October 2014, OCC updated its policy and procedures on MRA in response to recommendations in the 2013 international peer review report that OCC enhance MRA communication, tracking, and resolution processes. The new MRA guidance emphasizes effective communication and prompt identification and correction of deficient practices (including those that are unsafe and unsound) before they affect the bank’s condition. The guidance requires that examiners track the supervisory concerns identified in the MRA. For example, for concerns that are open, examiners must categorize them as either new, repeat (if the same or substantially similar concern has recurred), self-identified (by the bank), past due (when the corrective action is not implemented in the expected time frame), escalated (when subsequent to the MRA OCC addressed the uncorrected action in an enforcement action), or pending validation (when the bank implemented the corrective action, but insufficient time has passed for it to demonstrate sustained performance). Examiners may categorize an MRA as closed if the bank implements and OCC verifies and validates the corrective action, or if the banks’ practices are no longer a concern because of a change in the bank’s circumstances. These new agency-wide tracking requirements of individual concerns within an MRA are intended to help improve macro-prudential metrics, which OCC staff stated will be useful for further sharpening supervisory tools and practices.

In January 2010, FDIC issued examination guidance that outlined procedures for including matters requiring board attention—the FDIC equivalent of MRA—in examination reports and the tracking of such matters for follow-up purposes. In the guidance, FDIC recognized the significance of ensuring timely communication of identified deficiencies that require attention by the bank’s board and management and timely and effective follow-up by examiners to determine the institution’s progress in addressing those concerns. FDIC began conducting additional training for examiners on the effective use of the guidance in 2010, and followed with further training in 2014 and 2015. FDIC tracks matters requiring board attention and related issues and identifies those actions that are outstanding and requires examiner followup with bank management.

Systemic Risk Monitoring

Federal banking regulators told us that through FSOC they share and receive information on potential systemic risks, some of which may affect banks. FSOC’s three primary purposes under the Dodd-Frank Act are to identify risks to the financial stability of the United States that could arise from the material financial distress or failure, or ongoing activities, of large, interconnected bank holding companies and nonbank financial companies, as well as risks that could arise outside the financial services marketplace; promote market discipline by eliminating expectations on the part of shareholders, creditors, and counterparties of these large companies that the U.S. government will shield them from losses in the event of failure; and respond to emerging threats to the stability of the U.S. financial system.

To achieve these purposes, the Dodd-Frank Act gave FSOC a number of important authorities that allow it to, among other things, collect information across the financial system so that regulators will be better prepared to address emerging threats and designate as systemically important certain nonbank financial companies and subject them to enhanced supervision by the Federal Reserve.

The Dodd-Frank Act also established the Office of Financial Research (OFR) to serve FSOC and its member agencies by improving the quality, transparency, and accessibility of financial data and information, conducting and sponsoring research related to financial stability, and In September 2012, we promoting best practices in risk management.reported on challenges FSOC and OFR faced in fulfilling their missions, FSOC’s and OFR’s efforts to establish management structures and mechanisms to carry out their missions, and FSOC’s and OFR’s activities for supporting collaboration among members and external stakeholders. We made a number of recommendations to improve FSOC’s and OFR’s effectiveness. FSOC and OFR have made some progress in implementing these recommendations but additional attention on them is needed.

Banking regulators also have taken steps to establish or enhance their internal capabilities for monitoring the financial system for emerging risks to banks.

In 2010, the Federal Reserve established the Office of Financial Stability Policy and Research, to coordinate and support the Federal Reserve’s work on financial stability. Working with other divisions, the office identifies and analyzes potential threats to financial stability; monitors financial markets, institutions, and structures; and assesses and recommends policy alternatives to address these threats. Federal Reserve staff explained that this office is focused on thinking about risk to the financial system as a whole, including the shadow banking system, and identifying which features of the financial system are weak. When issues surface that are centered on the banking system, they said this office coordinates with the Division of Banking Supervision and Regulation to address them. If the issues are not centered on the U.S. banking system, they work with FSOC or other appropriate groups.

OCC conducts agency-wide risk assessments through its National Risk Committee, which was formed in late 1990s to, among other things, monitor the condition of the federal banking system and emerging threats to the system’s safety and soundness. Members include senior agency officials who supervise banks of all sizes, and officials from the law, policy, and economics departments. The Committee meets biweekly to assess emerging risks and to evaluate and make recommendations on appropriate supervisory responses to address those risks The National Risk Committee also issues quarterly guidance to examiners that provides perspective on industry trends and highlights issues requiring supervisory attention. In response to the financial crisis, OCC staff said the National Risk Committee began publishing a public Semiannual Risk Perspectives Report to provide bankers and other market participants with OCC’s views on emerging risks facing the industry and OCC’s supervisory priorities. Also in response to the financial crisis, the National Risk Committee has developed various analytical tools as part of its monitoring efforts, including early warning metrics designed to identify early trends in financial markets, credit underwriting, credit performance, and bank performance. In response to the 2013 international peer review report recommendations, OCC staff said OCC established a pilot team in January 2015 to further develop and enhance OCC’s supervisory risk analysis functions.

In response to the 2007-2009 financial crisis, FDIC broadened its institutional approach to the identification and management of risk. In 2011, the Board of Directors created the new position of Chief Risk Officer, and approved the creation of a new Enterprise Risk Committee. That committee includes division and office directors and meets at least monthly to review external and internal risks to FDIC. In 2014, the Enterprise Risk Committee established the External Risk Forum and the Management Risk Roundtable to focus specially on external risks. The Management Risk Roundtable serves as an interdivisional forum for coordinating risk analysis, while the External Risk Forum meets at least eight times per year to discuss external risk topics proposed by the Management Risk Roundtable. To further support the External Risk Forum, FDIC staff said FDIC continues to convene Regional Risk Committees semi-annually in each of the six FDIC supervisory regions. FDIC established these committees in 2003 to review and evaluate regional and economic banking trends and risks.

The Federal Reserve, OCC, and FDIC also have established or enhanced programs to supervise the largest, most complex, and systemically important institutions, both in response to Dodd-Frank Act requirements and internal initiatives.

Under the Dodd-Frank Act, the Federal Reserve has the responsibility for the supervision of systemically important financial institutions (SIFIs), including large bank holding companies, the U.S. operations of certain foreign banking organizations, and nonbank financial companies that are designated by FSOC for supervision by the Federal Reserve. The act also requires the Federal Reserve to impose a variety of regulatory reforms on SIFIs, including enhanced risk-based capital, leverage, and liquidity requirements. The Federal Reserve issued its final rule establishing enhanced prudential standards for bank holding companies in March 2014. To fulfill this mandate and to reorient its supervisory program in response to the supervisory lessons learned from the financial crisis, the Federal Reserve created the Large Institution Supervision Coordinating Committee, which is tasked with overseeing the supervision of the largest, most systemically important financial institutions in the United States. Federal Reserve staff said the committee was developed to provide strategic and policy direction for supervisory activities across the Federal Reserve System, improve the consistency and quality of supervision, incorporate systemic risk considerations, and monitor the execution of the resulting supervisory program. Federal Reserve staff noted that the committee takes a macroprudential perspective by considering information gleaned from its Quantitative Surveillance group, which is charged to identify systemic and firm-specific risks through macroeconomic scenarios and loss forecasts, financial market vulnerabilities, and measures of interconnectedness among firms.

OCC supervises its largest and most complex banks through its Large Bank Supervision Program. The 2013 international peer review report recommended that OCC enhance risk identification by expanding the role of lead experts in its examinations. OCC announced in May 2014 that it would take steps to address the report’s findings and recommendations, for example, by expanding the responsibilities of its Large Bank Supervision lead expert program to improve analysis, systemic risk identification, quality control and assurance, and resource prioritization. The lead experts provide additional guidance during horizontal reviews into the strategy planning process for each large bank portfolio.Supervision program has also established and implemented its Large Bank Risk Committee, whose purpose includes discussing material portfolio risks, including emerging risks, and determining appropriate supervisory responses.

According to OCC staff, OCC’s Large Bank

FDIC was given significant new responsibilities under the Dodd-Frank Act to resolve failing systemically important financial companies. Specifically, FDIC obtained Orderly Liquidation Authority to resolve the largest and most complex bank holding companies and non-bank financial institutions, and the authority to review the resolution plans submitted by covered financial companies. In late 2010, FDIC established the Office of Complex Financial Institutions to carry out three core functions: (1) monitor risk within and across these large, complex firms from the standpoint of resolution; (2) conduct resolution planning and the development of strategies to respond to potential crises; and (3) coordinate with regulators overseas on the significant challenges associated with cross-border resolution. In 2011, the office established its complex financial institution monitoring program that is intended to engage in continuous review, analysis, examination, and assessment of key risks and control issues at institutions with assets over $100 billion. FDIC staff said that the office’s risk monitoring responsibilities were transferred to the FDIC’s Division of Risk Management and Supervision–Complex Financial Institutions group in early 2013. This group handles all institutions that are designated as systemically important, not by a specific asset size.

As reported in our July 2012 report, the Federal Reserve and FDIC have taken certain regulatory actions mandated by the Dodd-Frank Act authorities toward facilitating orderly resolution, including efforts that could contribute to cross-border coordination. Specifically, certain large financial companies must provide the Federal Reserve and FDIC with periodic reports of their plans for rapid and orderly resolution in the event of material financial distress or failure under the Bankruptcy Code. For example, bank holding companies with $50 billion or more in total consolidated assets and nonbank financial companies designated for Federal Reserve supervision are to submit resolution plans on an annual basis. The resolution plans or living wills are to demonstrate how a company could be resolved in a rapid manner under the Bankruptcy Code. In 2014, FDIC and the Federal Reserve sent letters to a number of large financial companies identifying specific shortcomings with the resolution plans that those firms will need to address in their 2015 submissions, due on or before July 1, 2015, for the first group of filers.

Framework for Monitoring Regulatory Efforts Could Identify Issues Requiring Additional Attention

Ongoing monitoring of banking regulators’ efforts to identify and respond to emerging threats to the banking system can provide a starting point for identifying opportunities for more targeted and frequent assessments of these efforts. We have previously stated that identifying risks to U.S. financial stability and responding to emerging threats to stability are inherently challenging. It is important for oversight bodies such as IGs and the international auditing community to understand how the banking system could be vulnerable to such potential threats, so as to be better prepared to consider whether regulators are alert to and responsive to the buildup of risks in various markets and the threat of such risks to the broader banking system. As regulators implement a forward-looking approach to identify and respond to emerging risks to the banking system, a near real time assessment of regulators’ efforts could provide opportunities to identify weaknesses and provide timely suggestions to enhance their effectiveness. As such, we have developed a framework for oversight bodies and others to use to monitor regulatory efforts. Our framework has two objectives: (1) to monitor known emerging risks to the safety and soundness of the banking system; and (2) to monitor regulatory responses to these risks, including detecting trends in regulatory responses that might signal a weakening of regulatory oversight. We have developed a monitoring program around each of these objectives, described below.

Monitoring Emerging Risks

The first part of the framework focuses on monitoring emerging risks to the banking system. Emerging risks are vulnerabilities in the banking system which, given a shock or series of shocks outside the system, can cause the failure of a systemically important bank or multiple banks. Examples of vulnerabilities include a credit or asset price bubble, lax loan underwriting standards, insufficient bank capital or liquidity buffers to absorb losses or withdrawals, and risk exposure through a maturity mismatch between assets and liabilities. A triggering event or shock could be political or economic—such as turmoil in a region, the collapse of a market—or even result from a natural disaster. The first part of the framework centers around three key areas in the financial system in which risks to banks can emerge: (1) bank financial condition and performance, (2) asset markets in which banks have direct or indirect exposure, (3) and overall economic conditions.

The framework identifies both qualitative and quantitative sources of information to help users identify and monitor known emerging risks to the banking system. Qualitative sources of publicly available information on emerging risks include regulatory, market, and academic reports and studies. For example, OCC semiannually publishes a report identifying emerging risks to its regulated institutions, and the Federal Reserve and OCC publish periodic surveys on underwriting practices at their regulated institutions, which can provide insights into potential emerging risks from the three key areas. Qualitative monitoring can also help identify financial innovations and new banking products and services that could pose risks to the banking system. FSOC and OFR annual reports, which identify potential systemic risks that can include risks to the banking system, are another source of information. In addition, market analyses, including those by trade publications, policy or research organizations, and the financial press often highlight industry trends, some involving risky bank behavior. Academics also may produce work discussing emerging trends in the banking industry including their potential impacts on bank capital, liquidity, or borrowers.

To complement this review, the framework also identifies a set of financial indicators commonly used by regulators and market professionals that facilitate the monitoring of trends in banks’ financial condition, asset markets, and general economic conditions. Regularly reviewing financial data will allow oversight bodies to independently stay current with these trends, track known risks to the banking system as the risks evolve, and better understand the context for regulatory responses to these risks, as we discuss below. Such a review also promotes continuity to monitoring efforts, as qualitative information sources on emerging risks tend to provide new or updated information on a periodic basis.

Bank Financial Condition

The framework includes financial indicators that reflect bank condition and performance that can provide insight into emerging risks at banks (and bank holding companies, in the case of the largest SIFIs), such as credit risk, liquidity risk, and market risk. For example, users can monitor capital levels and leverage, asset quality, ear nings trends, funding liquidity, and sector loan concentrations. As a result, they may be able to identify risk buildups or deteriorating credit trends. For example, rapid increases in the price of particular kinds of assets and concentrations relative to historical norms or increases in specific types of funding sources could indicate high levels of credit or maturity mismatches. These are all early warning indicators of bank vulnerabilities or buildup of risk that could lead to failure if not addressed effectively and in a timely manner. In the lead up to the most recent crisis, for example, house prices rose rapidly, and when the real estate bubble burst, banks with a significant concentration in commercial and residential real estate suffered heavy losses that wiped out their capital and ultimately led to their failures.

Asset Markets

The framework also includes indicators that detect changes in asset markets, such as sharp increases in asset prices or deviations from historical trends. In general, rapid growth in asset prices that leads to overvalued assets can create vulnerability in the financial system, including the banking sector, because the collapse of high prices can be destabilizing—especially if the assets are widely held and the values are supported by excessive leverage, maturity mismatch, or mispricing of risk. For example, the former Federal Reserve Chairman noted in a May 2013 speech that the collapse of housing prices and related mortgage losses during the recent crisis were concentrated in critical parts of the financial system, and amplified through various financial instruments, resulting in panic that led to asset fire sales and the collapse of the credit markets.Conversely, he said, the bursting of the tech bubble—the rapid decline of overvalued technology stocks in the equity markets in 2000 through 2001—did not result in systemic risk because the stock investments were not funded with excessive leverage and maturity mismatch.

Commodities markets are very broad and they include soft commodities like agricultural products such as wheat, coffee, and sugar, or hard commodities such as oil, gold, and rubber. Risks to the banking sector may emerge from exposure to these markets. For example, some banks might have lending exposures on their balance sheets that could be impacted by falling oil prices. Should these loans become nonperforming or default, the banks would have to incur some losses unless they successfully hedged the risk. ability to obtain new credit from banks as any additional debt could put a strain on their repayment capacity. Similarly, volatility tends to be negatively correlated with market performance. That is, volatility tends to decline as the stock market rises and increase as the stock market falls. When volatility increases, risk increases and expected returns decrease and this in turn could negatively impact access and the availability of credits to businesses and households.

Broader Economy

Finally, our framework includes indicators that monitor the overall health of the broader economy. Interconnectedness and risk exposures among the financial sector and broader economy can magnify systemic risks. For example, the former Federal Reserve Chairman said that highly leveraged households and businesses are less able to withstand adverse changes in income and wealth, such as when financially stressed firms are forced to lay off workers who, lacking financial reserves, sharply cut their own spending. Such stress in the nonfinancial sector can adversely affect banks, as borrowers begin to default on mortgages and other types of consumer and business credit. As happened in the 2007- 2009 financial crisis, this can create a cycle where housing market instability becomes self-reinforcing as banks reduce lending and shed assets to conserve capital, thereby further weakening the financial positions of households and firms. Thus, in monitoring for information on emerging risks to banks’ safety and soundness, it is important to pay attention to trends in the broader economy that could amplify these risks (such as trends in household income and debt, unemployment and gross domestic product) and their potential impact.

Monitoring Regulatory Responses

The second half of the framework focuses on monitoring corresponding regulatory responses to emerging risks with the goal of flagging issues for further review where the response may not be clear or questions have arisen as to whether these measures have mitigated the risk. The review of regulatory responses builds on the financial monitoring efforts previously discussed, coupling efforts to better understand current financial conditions and emerging risks with an enhanced understanding of the regulatory efforts under way to address such conditions and risks. Thus, the monitoring of regulatory responses includes the analysis of regulatory actions taken to address emerging risks.

Regulators can respond to emerging risks in the banking sector with a variety of supervisory tools. These include microprudential tools, which traditionally have focused on the safety and soundness of individual financial institutions, and macroprudential tools, which can be used to address vulnerabilities across the banking system and broader financial system. Microprudential tools include examinations and capital regulation for individual institutions; macroprudential policy tools include underwriting standards and countercyclical capital buffers. Supervisory tools intended to address emerging risks can also be structural or cyclical. Structural tools are intended to build resiliency of regulated institutions to vulnerabilities, while cyclical tools are intended to limit vulnerabilities by restraining financial institutions from excesses. Capital regulation is an example of a structural tool because requiring banks to hold more and higher quality capital improves the ability of regulated financial institutions to withstand losses and maintain lending after a bubble has burst. Countercyclical capital buffers, on the other hand, are an example of a cyclical tool because they are intended to counter excessive credit growth that can fuel asset bubbles. Supervisory stress tests are tools that include both structural and cyclical aspects.

In monitoring regulatory responses to emerging risks, it is important to identify the full range of tools regulators might employ to address such risks, the goals of these tools, and their potential tradeoffs. For example, a 2013 Federal Reserve Bank of New York staff report noted that microprudential tools have largely been developed and evaluated on the basis of the safety and soundness of individual institutions, not with respect to the effects on financial stability of practices that are common to many institutions, and it will be important to continue to evaluate their effectiveness in this context. Further, while microprudential and macroprudential policy tools can be complementary, these two approaches might also conflict with each other. Moreover, as a former Federal Reserve Board member noted, regulatory tools that aim to increase the resilience of regulated institutions and limit potential asset bubbles by restraining the growth of lending by such institutions can be circumvented when financial activities migrate into less regulated parts of the financial system such as the shadow banking sector. As such, she said that credit extension and associated vulnerabilities can increase outside the heavily regulated banking system. To mitigate the risks that may emerge as a result, effective and timely coordination among the banking and other relevant financial regulators is essential. These analyses could provide information on regulators’ willingness and ability to take prompt and forceful actions to mitigate problematic behavior at banks. They could also signal potential procyclical effects of regulation; that is, when regulation may not adequately discourage overly risky behavior during economic upswings or may inhibit bank lending during downturns, as banks may need to meet requirements during times when it is more difficult to do so.

A leveraged loan is a loan where the obligor’s post financing leverage as measured by debt-to-assets, debt-to-equity, cash flow-to-total debt, or other such standards unique to particular industries significantly exceeds industry norms for leverage. Leveraged borrowers typically have a diminished ability to adjust to unexpected events and changes in business conditions because of their higher ratio of total liabilities to capital. These loans are usually structured, arranged, and administered by one or several commercial or investment banks known as arrangers. They are then sold, (or syndicated) to other banks or institutional investors. lending volumes, leveraged lending loan losses, and reports on underwriting standards. Where questions exist on regulators’ efforts to mitigate emerging risks, including the propensity for such a risk to migrate to a less regulated sector of the market, framework users can prioritize those issues for further internal discussion and reach out to the regulators to obtain clarification if necessary.

In applying the framework, there may be instances where users identify issues that regulators may not consider to be emerging risks, but others do, such as market participants or market researchers. Users of the framework may also identify potential issues through their independent review of source material. Such discrepancies may raise questions about regulatory processes for monitoring and identifying emerging risks and warrant additional follow up with regulators. Some issues may not represent an emerging risk to the banking system, but may raise questions about regulatory oversight over banks or banking activities. As users apply the framework, it is essential they develop processes to systematically evaluate the information gathered and identify and prioritize those issues which merit continued monitoring and an assessment of regulatory responses. In many cases, as illustrated earlier, users of the framework can identify potential issues and assess regulatory responses to them, determining to conduct additional follow up with regulators only where this initial review reveals significant concerns that a particular risk might not be effectively mitigated.

Trends in Examination Data

Trends in examination data, such as CAMELS ratings, can provide information on regulators’ identification of and response to concerns of banking safety and soundness. Our framework uses CAMELS ratings to monitor regulatory activity in two ways: (1) trend analysis of composite and component CAMELS ratings for insights into emerging risks regulators have identified and (2) an econometric model that identifies shifts in regulators’ assignment of CAMELS ratings relevant to bank financial data.

Regulators formulate the CAMELS composite ratings using the individual component ratings, but the rating is not a mathematical average of the components. Individual component ratings may be lower or higher compared with the overall composite rating assigned. As discussed earlier, banking regulators generally consider banks with a composite rating of 1 or 2 to be healthy, while banks receiving an unsatisfactory examination warrant a composite rating of 3 or above. Monitoring trends in CAMELS ratings could provide insights into risks that are emerging in the banking system and prompt further review into the actions regulators are taking to respond to those risks. To illustrate, in our June 2011 report on PCA, we found that increases in CAMELS composite or component ratings can serve as warning signals of distress in banks. While most banks that failed degraded from a CAMELS composite rating of 2 to a 4 in one quarter, they generally had at least one component rating of a 3 prior to failure. Specifically, among the 292 failed banks we reviewed (across all regulators) as part of our study, most (76 percent) received at least one individual component CAMELS rating of a 3 before failure. At the same time, most (65 percent) also moved past the composite CAMELS 3 rating in a single quarter (e.g., moving from a 2 to 4) before failure, as the CAMELS composite ratings generally deteriorated precipitously.

As we discussed earlier, CAMELS ratings have not always reflected long- term risk factors, particularly with respect to poor management practices. While trend analysis of CAMELS data is useful for spotting affirmative regulatory actions—decisions to downgrade (or upgrade) ratings in response to examination findings—such analysis is limited in that it does not provide information when regulators are not changing CAMELS ratings in response to observed bank conditions. Ideally, in applying our framework, users could identify any issues or challenges regulators are facing in mitigating emerging risks at banks before problems manifest themselves on the balance sheets.

To better observe changes in regulatory behavior as banking and economic conditions change, we are exploring the potential of using econometric models to monitor for shifts in regulatory behavior, which may help identify periods where regulators are having difficulty reigning in risky behavior or are changing the levels of regulatory discretion they apply to their supervision activities. Such models could also assist in placing into context issues that arise during reviews of banking regulators and prompt further follow up with regulators to understand more fully the reasons behind the changes.

Monitoring Trends in Enforcement Activity

Trends in enforcement activity also can provide information on regulatory responses to emerging risks. For example, 2005-2007 was a period of strong earnings growth and profitability in the banking industry (see fig. 1).

During this time, three banks failed (all in 2007) and 76 intuitions or fewer were on the problem bank list. This period of growth and profitability was largely fueled by aggressive growth in higher risk mortgage-related loans and funded by more volatile sources such as brokered funds and wholesale short-term borrowing. However, enforcement activity was From 2005 to 2007, the three regulators relatively low (see fig. 2).issued a total of 740 informal enforcement actions and 392 formal actions, an average of 247 informal actions and 131 formal actions per year during that time frame.

Once the crisis began, and banks began suffering losses, the level of informal and formal enforcement actions surged as did the number of problem banks and failed banks. For example, from 2008 to 2010, the three regulators issued a total of 2,513 informal actions and 1,871 formal enforcement actions. This averaged about 838 informal actions and 624 formal actions per year. Since 2010, as the crisis and its effects began to abate, both informal and formal actions steadily declined.

Monitoring trends in enforcement activity can provide oversight bodies insight into identified risks and regulatory responses to those risks. When evaluating trends in enforcement actions, it is important to understand the underlying deficiencies in bank practice and performance, as enforcement actions are taken for many reasons. Understanding trends in enforcement activity in relation to identified risks could allow auditors to observe the rigorousness of regulatory responses to such risks. In doing so, it is important to also consider available information on other regulatory responses to identified risks. For example, reviewing trends in MRA, particularly those outstanding or repeat, could provide additional insights about regulators’ efforts to take effective action to promptly address problems at banks.

As with trend analysis of CAMELS ratings, trend analysis of MRA and other informal and formal enforcement actions might be useful for spotting changes in affirmative regulatory decisions to act on examination findings—that is, an increase in the number of MRA related to credit administration would indicate that examiners were concerned about risk management practices at banks and were flagging these issues for banks to address. While regulators have committed to using MRA more aggressively, determining whether they have done so requires an in depth review of examination findings and regulators’ actions to address them in accordance with their policies and procedures. Such a review could be conducted on a regular basis, or used as a more tailored mechanism in response to findings from other monitoring activities.

Monitoring the Issuance of Agency Guidance and Regulation

Our framework also recognizes that regulators can respond to emerging problems through regulation or guidance for the industry. Tracking the issuance of agency guidance and regulations in response to emerging issues will allow users of the framework to better understand how regulators deal with a particular risk and also allow them to flag potential issues in the efficiency and effectiveness of interagency coordination in response to risks that affect the banking system. For guidance and regulation to be effective, they must be issued in a timely manner. As noted earlier, although banking regulators were concerned about the rapid buildup of risky CRE concentrations across the banking system, staff from one regulator said they acted too late in drafting and issuing interagency guidance for the industry. Losses on these higher risk loans were a primary factor in bank failures resulting from the financial crisis. The 2013 OCC peer review noted that delays in the issuance of guidance or regulation to address emerging risks can be demoralizing for examiners who may perceive that agency management has not acted on their risk identification and warnings.guidance or regulation, users of the framework would monitor quantitative and qualitative sources for trend information on the identified problem area for evidence that risk was increasing, flagging potentially harmful delays in regulatory action for further follow up.

To monitor the timeliness of For guidance and regulation to be effective, they also must serve to mitigate the emerging risk. For that reason, we plan to review quantitative and qualitative sources for information on the effectiveness of guidance or regulation in addressing the problem identified. For example, in April 2013, Federal Reserve and OCC staff issued a study analyzing the impact of the 2006 CRE guidance. was underway, banks responded to market conditions and the guidance by shrinking their holdings of CRE loans, particularly for higher-risk ADC. Should CRE lending show strong growth in the future, it will be important to continue to monitor the effectiveness of the guidance for curbing excessive risks in CRE lending while institutions are still profitable.

The study found that once the crisis Banking regulators’ primary objective is the promotion of safety and soundness of banks and the banking system. Effective regulation and supervision can, in turn, provide an important safeguard against future financial crises and provide an important source of confidence to the market about the general health and resiliency of the banking sector. Lessons learned from past banking-related crises identified the need for federal banking regulators to respond proactively to problems developing in the banking system. Building on these lessons, we plan to implement our framework to monitor regulatory responses to emerging risks to the banking system. We intend to refine our framework over time by incorporating new sources of qualitative and quantitative information on emerging risks and by developing additional models as new analytical tools to aid in the monitoring and evaluating of regulatory responses to these risks become available.

Friend, Keith; and Glenos, Harry (OCC), and Nichols, Joseph B. (Federal Reserve), An Analysis of the Impact of the Commercial Real Estate Guidance (Washington, D.C.: April 2013).

Agency Comments

We are not making recommendations in this report. We provided a copy of this draft report to the Federal Reserve, FDIC, OCC for review and comment. The agencies did not offer formal comments but each agency provided technical comments, which we have incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional committees and members and other interested parties. This report will also be available at no charge on our website at http://www.gao.gov. Should you or your staff have questions concerning this report, please contact me at (202) 512-8678 or evansl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II.

Appendix I: Objective, Scope, and Methodology

The thrift and commercial bank crises that emerged in the 1980s and the 2007-2009 financial crisis raised questions on our part about federal banking regulators’ efforts to learn from past weaknesses in regulatory oversight over insured banks and apply the appropriate lessons learned. Such regulatory lessons learned also may offer potential insights for Congress, the auditing community, and other “watchdog” entities in more proactively assessing federal banking regulators’ efforts to identify and respond to potential emerging risks to insured banks. This report (1) examines regulatory lessons learned from the 1980s thrift and commercial bank crises and the 2007-2009 financial crisis, focusing on the efforts of federal banking regulators to identify and address emerging risks to the solvency of insured banks before the onset of these crises; and (2) offers a strategy that we and other oversight bodies, such as inspectors general (IGs) and the international auditing community (hereafter, oversight bodies) can use to provide continuous future oversight of regulatory responses to emerging risks.

To identify regulatory lessons learned from the crises we reviewed and analyzed studies by GAO, federal banking regulator IGs, the federal banking regulators, and academics. To identify relevant academic studies, we performed the literature search using the following databases: ProQuest (which included SSRN, EconLit, and ABI/INFORM Global), JSTOR, and NBER, using the following keywords or combinations of them: financial crisis, savings and loan, thrift, lessons learned, regulatory action, banking, and great recession. We performed these searches for the period between January 1980 (the commencement of the 1980s thrift and banking crises) and August 2013 and identified 24 studies. We reviewed each study to identify those lessons learned that pertained specifically to regulatory efforts to identify and address emerging risks to the banking system in the years leading up to the crises. We did not identify many studies on relevant lessons learned from this search. As such, we determined to rely largely on our own prior work in the area. We also interviewed the federal banking regulators—the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the Board of Governors of the Federal Reserve System (Federal Reserve)—and two of their IGs for their perspective on regulatory lessons learned and regulatory actions taken to address these lessons learned. We analyzed the information we gathered to identify common and unique challenges regulators faced across the crises in identifying emerging risks and responding to them effectively.

To incorporate the regulatory lessons learned into a strategy that oversight bodies and others can use to monitor regulatory responses to emerging risks, we established a framework for monitoring (1) known emerging risks to the safety and soundness of the banking system, and (2) regulatory responses to these risks, including detecting trends in regulatory responses that might signal a weakening of regulatory oversight. To develop the first part of our framework—monitoring known emerging risks to the safety and soundness of the banking system—we first reviewed frameworks or programs for monitoring domestic and global financial systems that included banking systems. We sought to identify relevant frameworks developed by federal banking regulators and federal agencies through our interviews with the regulators and prior audit work. We identified relevant frameworks developed by the Federal Reserve, OCC, and the Office of Financial Research (OFR), as well as a banking profile published quarterly by FDIC. We also sought to identify relevant frameworks developed by foreign banking regulators and international organizations that focus on global finance or banking issues. Through our review, we identified relevant frameworks and monitoring programs developed by the following entities: the European Central Bank, the Financial Stability Board, the International Monetary Fund, and the Bank for International Settlements. We analyzed these domestic and global frameworks and programs to identify key areas where risks to the banking system could arise and identified three: bank condition and financial performance, asset markets in which banks may have direct or indirect exposure, and overall economic conditions.

First, potential sources of risk can emerge from within the banking sector, such as banks’ business models, size, scope of operations, and organizational complexity, among other things. Other risks that can arise from bank condition are driven by risk management practices, loan portfolio composition, and underwriting standards. Second, risk emanating from banks could spread and spillover to other industry sectors. Risks to the banking system can originate from other areas of the financial system, particularly asset markets in which banks participate either directly or indirectly. Developments in these asset markets such as rapid asset price growth or decline can have a direct impact on bank portfolios and their capacity to access funding in a cost-effective way. The third area we identified through our analysis as a potential area where risk to banks could stem from was the broader economy, in that economic conditions generally impact asset markets and the profitability of banks and bank customers and counterparties. A growing economy with low unemployment tends to have a more favorable impact on banks and markets than a recessionary economy with high unemployed workers.

As part of our framework, we also identified financial indicators that will assist users of the framework in monitoring potential risks to the banking industry emerging from the focus areas. For example, a number of our indicators for bank condition and safety and soundness are derived from the Uniform Financial Institutions Rating System, commonly known as CAMELS. Regulators use this ratings system to, among other things, assess the soundness of banks on a uniform basis, identify those institutions requiring special supervisory attention, monitor aggregate trends in overall soundness of financial institutions, and assess their exposure to risks. The ratings reflect a bank’s condition in six categories or CAMELS’ components: capital adequacy, asset quality, management, earnings, liquidity and sensitivity to market risk. For each CAMELS component other than management, there are a number of financial ratios that can be calculated based on Reports of Condition and Income (Call Report) data that assist in the evaluation of how well or poorly a bank is performing in that category. We selected those ratios that could be determined quantitatively based on Call Report data. For example, the management component of the CAMELS does not lend itself to the same computation as that used for ratios based on capital or earnings. It requires more qualitative assessment by examiners and therefore it is more discretionary and more subjective than the other CAMELS components. Also, all the ratios that pertain to a component need not be included to show a trend. For example, in asset quality, we may choose to illustrate loans that are 90 days or more past due rather than showing also those that are 30 days past due and 60 days past due because the implications of loans 90 days or more past due are more severe. From the monitoring frameworks we reviewed, we identified indicators that track asset price growth in key markets—including the residential and commercial real estate markets, equity market, Treasury market, corporate bond market, and the commodities market. In addition, we include indicators that track leverage and volatility that could impact the banking system. We also identified indicators that track the overall health of the broader economy from the monitoring frameworks we reviewed, such as household income and debt, unemployment, and gross domestic product. In addition to financial indicators, our framework also incorporates publicly available qualitative information on emerging risks to the banking sector from banking regulators, and other entities that might have a unique or varying perspective on emerging risks, such as investors, rating agencies, trade associations, and academics. Our framework does not prescribe specific entities or sources to review, rather, we recommend incorporating a wide range of available analyses and perspectives.

In developing the second part of our framework, we identified the range of supervisory tools that banking regulators have available to them to respond to emerging issues in banks and the banking system, including both microprudential and macroprudential tools. From our prior work, we identified microprudential tools, which traditionally have focused on the safety and soundness of individual financial institutions. From the monitoring frameworks we reviewed, we identified examples of macroprudential policy tools, which can be used to address risk emerging across the banking system and broader financial system. We also identified those supervisory tools that can be observed and analyzed over time to monitor for changes in regulatory behavior and that could signal potential weaknesses in regulatory oversight—such as examinations and enforcement actions. We did this by reviewing our prior work in assessing regulatory responses to risks as they emerged in the lead up to the 1980s bank and thrift crises and the 2007-2009 financial crisis. To supplement this effort, we interviewed a judgmental sample of financial market specialists for their views on those regulatory activities that could be effectively monitored to detect meaningful changes in regulatory behavior. Because the information and type of analysis we were interested in required the knowledge of both regulatory activities and financial trends, we interviewed a purposive or non-generalizable sample of seven financial market specialists on their views of regulatory activities that could be effectively monitored to detect meaningful changes in regulatory behavior. To ensure the financial market specialists represented a broad range of views and professional experience, we recruited participants from government, academia, and business who had in-depth knowledge of the 1980s thrift and commercial bank crises or the 2007-2009 financial crisis as evidenced by holding key leadership positions in government or industry or having published relevant academic research on the regulation of financial services. We identified these financial market specialists through prior GAO studies, academic publications, and from recommendations by other financial market specialists.

To illustrate trends in enforcement activity across various economic cycles, we obtained data on the number and type of enforcement actions taken against financial institutions supervised by OCC, FDIC, and the Federal Reserve, published in their annual reports dated 2005 through 2014. We have assessed the reliability of federal banking regulators’ enforcement action data as part of previous studies and found the data to be reliable for the purposes of our review, which is to illustrate trends in informal and formal enforcement actions. We also obtained Call Report data from SNL Financial database on the yields on earnings assets of financial institutions from 2005 to 2014 for four bank size groups. These bank size groups include (1) banks with over $50 billion in assets, (2) banks with assets between $10 billion and $50 billion, (3) banks with more than $1 billion but less than $10 billion in assets, and (4) banks with $1 billion or less in assets. We assessed the reliability of the SNL Financial data by reviewing existing information about the data and the system that produced them. In addition, we have assessed the reliability of SNL Financial data as part of previous studies. As such, we found the data to be reliable for the purposes of our review, which was to illustrate trends bank profitability over time.

We conducted this performance audit from February 2013 to June 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, A. Nicole Clowers (Managing Director), Karen Tremba (Assistant Director), Stefanie Jonkman (Assistant Director/Analyst-in-Charge), Abigail Brown, William Cordrey, Janet Eackloff, M’Baye Diagne, Bethany Benitez, Pamela Davidson, Rachel DeMarcus, Maksim Glikman, Michael Hansen, Risto Laboski, Marc Molino, Robert Pollard, and Barbara Roesmann made key contributions to this report.