basis, whether or not they happen to be affiliated with a bank. to minimize regulatory burden and avoid duplication, the twotiered framework of umbrella supervision of financial holding companies and functional regulation of their subsidiaries requires enhanced cooperation and coordination among federal and state supervisory authorities. efforts are well underway among the relevant federal and state financial services authorities to establish agreements and procedures to effectively implement congress ’ mandate. before moving on, i want to address the topic of community reinvestment in the context of grammleach - bliley. as you may be aware, over the course of debating and negotiating the details of the act, some members of congress wanted to strengthen cra requirements, while others wanted them rolled back. in the end, of course, the two sides compromised. some have argued that those desiring to weaken cra prevailed because, among other things, the act extends the interval between compliance examinations for highly rated institutions. i disagree with this perspective. under the new law, bank holding companies cannot become financial holding companies or engage in any financial activities newly authorized by the act unless all of their depository institutions have cra ratings of satisfactory or better. and should any depository institution subsidiary of an approved fhc subsequently fail to maintain a satisfactory cra rating, the fhc would be prohibited from commencing any new financial activities. in this way, the act extends the ramifications of poor cra performance to potential nonbank activities. it also provides powerful incentives for expansionminded companies to achieve and maintain at least satisfactory cra ratings. in my view, this amounts to a reaffirmation of the key principles of the community reinvestment act. revision of the 1988 basel accord let me move on to the basel committee ’ s major initiative to revise the capital accord. the primary tool of capital regulation currently is the set of minimum ratios that were devised in 1988 by the basel committee on banking supervision, which i have the honor to chair. without question, the accord was a milestone achievement - for the first time, supervisors in g - 10 countries were able to use a common yardstick for assessing banks ’ capital adequacy. but the accord has a number of serious shortcomings. it does not adequately differentiate among degrees of credit risk and, as a result, banks have had incentives to take on higher risk exposures within broad risk categories. banks have also tended to engage in transactions that lower regulatory capital requirements without reducing economic risk. for example, through asset sec

fmi to endeavor to return to normal operations prior to assurance of complete confidence in and sanitization of a production environment? to put it plainly : could the 2 - hour rto unwittingly exacerbate rather than assuage the impact of a severe 2 / 5 bis central bankers'speeches disruption and / or impede prospects for recovery? reflecting upon these important questions, allow me to offer the following practitioner ’ s interpretation, which i hope maximizes the value of the intent of the 2 - hour rto while minimizing the downside risks of its mis - application. rather than spending valuable time and industry resources re - litigating established supervisory guidance, we should consider the 2 - hour rto as a vital organizing objective for planning purposes in peacetime, an aspiration to mobilize our best critical thinking to achieve, rather than an inviolable requirement that must be met in all circumstances recognizing the fog of war. a common understanding of this nuance across policy makers, supervisors, and operators strikes me as an important step forward both to focus our resiliency preparations in advance of an extreme event and to promote sound decision making in its remediation. provocative question number 2 : to what extent does the proliferation of risk management and information security frameworks to which fmis must comply risk creating a “ check the box ” mentality to security and resilience that diverts resources and management attention from other critical initiatives? in framing this question, i asked my team to identify the cascading elements of supervisory guidance, oversight requirements, compliance regimes, and maturity frameworks with which we must contend related to risk management and information security. their list in reply included 17 elements, admittedly some of which are self - induced and at different states of maturity and implementation. all are well intended, all are well designed, and all seek to address different and meaningful dimensions of the control environment. at the same time, compliance across this waterfront has become a consuming pre - occupation, and arguably one that if we are not careful can intrude upon the more tangible actions, and commitments, to increase the resiliency of our infrastructures and enhance the security of our networks. make no mistake : some form of risk management and control framework and corresponding policy and oversight guidance is absolutely essential to ensure a necessary discipline and accountability. this is not a call for a collective policy / supervisory / industry confab to craft a consolidated and harmonized uber - framework