All depository institutions that have federal deposit insurance have a federal prudential regulator, which generally may issue regulations and take enforcement actions against institutions within its jurisdiction (see table 1). The securities and futures markets are regulated under a combination of self-regulation (subject to oversight by the appropriate federal regulator) and direct oversight by the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC), respectively. SEC regulates the securities markets, including participants such as corporate issuers, securities exchanges, broker-dealers, investment companies, and certain investment advisers and municipal advisors. SEC’s mission is to protect investors; maintain fair, orderly, and efficient markets; and facilitate capital formation. SEC also oversees self-regulatory organizations—including securities exchanges, clearing agencies, and the Financial Industry Regulatory Authority—that have responsibility for overseeing securities markets and their members; establishing standards under which their members conduct business; monitoring business conduct; and bringing disciplinary actions against members for violating applicable federal statutes, SEC’s rules, and their own rules. CFTC is the primary regulator for futures markets, including futures exchanges and intermediaries, such as futures commission merchants. CFTC’s mission is to protect market users and the public from fraud, manipulation, abusive practices, and systemic risk related to derivatives subject to the Commodity Exchange Act, and to foster open, transparent, competitive, and financially sound futures markets. CFTC oversees the registration of intermediaries and relies on self-regulatory organizations, including the futures exchanges and the National Futures Association, to establish and enforce rules governing member behavior. CFTC and SEC jointly regulate security futures (generally, futures on single securities and narrow-based security indexes). CFTC and SEC serve as primary regulators for certain designated financial market utilities. In addition, Title VII of the Dodd-Frank Act expands regulatory responsibilities for CFTC and SEC by establishing a new regulatory framework for swaps. The act authorizes CFTC to regulate swaps and SEC to regulate security-based swaps with the goals of reducing risk, increasing transparency, and promoting market integrity in the financial system. CFTC and SEC share authority over mixed swaps—that is, security-based swaps that have a commodity component. The Dodd-Frank Act transferred consumer financial protection oversight and other authorities over certain consumer financial protection laws from multiple federal regulators to the Consumer Financial Protection Bureau (CFPB). The Dodd-Frank Act charged CFPB with responsibilities that include the following: ensuring that consumers are provided with timely and understandable information to make responsible decisions about financial transactions; ensuring that consumers are protected from unfair, deceptive, or abusive acts and practices and from discrimination; monitoring compliance with federal consumer financial law and taking appropriate enforcement action to address violations; identifying and addressing outdated, unnecessary, or unduly burdensome regulations; ensuring that federal consumer financial law is enforced consistently, in order to promote fair competition; ensuring that markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation; and conducting financial education programs. Furthermore, the Dodd-Frank Act gave CFPB supervisory authority over certain nondepository institutions, including certain kinds of mortgage market participants, private student loan lenders, and payday lenders. The uniform application of new or revised regulations can have a comparatively greater impact on smaller entities than on larger entities because the smaller entities have small staffs with which to face expanded demands and a smaller asset and income base with which to absorb increases in compliance costs. RFA was enacted in 1980 in part to address this disparity. The act requires that federal agencies, including the financial regulators, engaged in substantive rulemaking analyze the impact of proposed and final regulations on small entities and, when there may be a significant economic impact on a substantial number of small entities, to consider any significant regulatory alternatives that will achieve statutory objectives while minimizing any significant economic impact on small entities. RFA defines “small entity” to include small businesses, small governmental jurisdictions, and certain small not-for-profit organizations. RFA does not seek preferential treatment for small entities, require agencies to adopt regulations that impose the least burden on small entities, or mandate exemptions for small entities. Rather, it requires agencies to examine public policy issues using an analytical process that identifies, among other things, barriers to small business competitiveness and seeks a level playing field for small entities, not an unfair advantage. Unless the head of the agency certifies that the proposed regulation would not have a significant economic impact upon a substantial number of small entities, RFA requires regulators to prepare an initial regulatory flexibility analysis for each draft rule that requires a notice of proposed rulemaking. These analyses must contain an assessment of the rule’s potential impact on small entities and describe any significant alternatives to the rule that would reduce its burden on small entities while achieving statutory objectives (see table 2 for more information). RFA requires that regulators publish in the Federal Register their initial regulatory flexibility analysis, or a summary, with the proposed rule. Following a public comment period, RFA requires regulators to conduct a similar analysis when they promulgate the final rule—the final regulatory flexibility analysis. This analysis must address any comments received on the initial regulatory flexibility analysis and include a description of the steps the agency took to minimize the rule’s significant economic impact on small entities, consistent with statutory objectives. Agencies then must publish the final analysis, or a summary, with the final rule. If the head of the agency certifies in the Federal Register that the rule would not have a significant economic impact on a substantial number of small entities, agencies do not have to conduct the initial or final analysis. Certifications must include a statement providing a factual basis for the certification. Agencies may make a certification in lieu of the initial or final analysis, and can choose to certify at both points. Figure 1 illustrates the decision process that agencies must follow to comply with RFA. Section 610 of RFA requires agencies to review, within 10 years of a final rule’s publication, those rules assessed as having a significant economic impact on a substantial number of small entities to determine if they should be continued without change, amended, or rescinded (consistent with statutory objectives) to minimize any significant economic impact on small entities. Section 610 requires that agencies publish in the Federal Register a list of the rules that have a significant economic impact on a substantial number of small entities and are to be reviewed pursuant to section 610 during the upcoming year. These notices alert the public to the upcoming review and permit interested parties to submit their comments on the rule’s impact on small entities. The Dodd-Frank Act, which established CFPB, amended RFA to impose additional rulemaking requirements for CFPB for certain proposed rules. Specifically, when CFPB conducts rulemakings it expects will have a significant economic impact on a substantial number of small entities it must convene Small Business Review Panels, comprising employees from CFPB, the Small Business Administration’s Chief Counsel for Advocacy, and Office of Management and Budget’s (OMB) Office of Information and Regulatory Affairs. The panels must seek direct input from a representative group of small entities that would be affected by CFPB’s rulemakings. The panels must be conducted before publication of an initial regulatory flexibility analysis (in effect, before the proposed rule is issued for public comment). RFA designates certain responsibilities to the Small Business Administration’s Chief Counsel for Advocacy, including monitoring agency compliance with RFA and reviewing federal rules for their impact on small businesses. Executive Order 13272 requires the Office of Advocacy to provide notifications about RFA requirements and training to all agencies on complying with RFA. The Office of Advocacy published guidance on complying with RFA in 2003 (updated in 2012 and August 2017), which was designed to be a step-by-step guide for agency officials. The Small Business Administration publishes size standards to determine eligibility for classification as a small entity. Generally, to qualify as a small entity the annual asset threshold for banks is $550 million in assets; for financial investment and related activities, the annual revenues threshold is $38.5 million. Most agencies rely on these size standards; however, RFA also sets forth a procedure that permits agencies to formulate their own definitions of small entities. Rules that do not have a proposed rule are not subject to RFA requirements, such as analyzing the rule’s effects on small entities and considering alternatives. Financial regulators promulgated 520 rules (483 final and 37 interim final) during calendar years 2010–2016. Of those, RFA requirements were not applicable in 39 percent (204 rules) because the regulators did not publish a proposed rule. The regulators published a proposed rule for the other 316 final rules. This result is consistent with our prior analysis of rulemaking government wide. In December 2012, we found that about 35 percent of major rules and about 44 percent of nonmajor rules published during calendar years 2003–2010 did not have a proposed rule. The percentage of rules finalized without a proposed rule and therefore not subject to RFA requirements varied by regulator. As shown in figure 2, CFPB had the largest percentage (53 percent) of rules not subject to RFA requirements and CFTC the smallest percentage (16 percent). In their rulemakings, the regulators gave several reasons for not publishing a proposed rule. The Administrative Procedure Act (APA), which outlines the process for informal rulemaking, includes six broad categorical exceptions to publishing a proposed rule (for example, rules dealing with agency organization and procedure). Additionally, APA provides that an agency may forgo a notice of proposed rulemaking when it finds for “good cause” that such notice is “impractical, unnecessary, or contrary to the public interest.” We found that the regulators used such exceptions for a number of the rules we reviewed. For example, in December 2015, the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Federal Reserve), and the Federal Deposit Insurance Corporation (FDIC) used the good- cause exception to publish a joint rule to adjust the asset-size thresholds for small and intermediate banks and savings associations related to performance standards under the Community Reinvestment Act without a proposed rule. According to the Federal Register notice, the agencies had no discretion on the computation or timing of the changes, which were based on a regulation that previously had been published for public comment before being finalized. In another rule published in October 2013, SEC made changes to the filer manual for its Electronic Data Gathering, Analysis, and Retrieval System based on updates to the system and did not publish a proposed rule because the rule changes related solely to agency procedures or practice. According to CFPB officials, the majority of final CFPB rules issued during this time period without a proposed rule involved technical—and in many cases non- discretionary—adjustments of statutory or regulatory thresholds to account for inflation. While RFA requirements do not apply when an agency does not publish a proposed rule, all the financial regulators (except OCC) occasionally performed some RFA evaluation in rules without a proposed rule. For example, each agency, except for OCC, certified that at least one of the final rules they promulgated without publishing a proposed rule (within our time frame) would not have a significant economic impact on a substantial number of small entities. The Federal Reserve most frequently performed some RFA analyses in these rules, although such analyses were not required. Of 51 rules without a proposed rule, the Federal Reserve certified in 7 rules and performed an initial or final regulatory flexibility analysis in 10 rules. For the 316 rules subject to RFA requirements from 2010 through 2016, regulators certified that most would not have a significant economic impact on a substantial number of small entities, although the frequency with which individual regulators certified varied. Such certifications may be made at either the proposed rule or final rule stage, and a certification in a final rule may be preceded by an initial regulatory flexibility analysis in the proposed rule. When certifying, the regulators most often made such certifications in both the proposed and final rules (63 percent of analyses in rules subject to RFA requirements) and did not perform regulatory flexibility analyses. Certifications of final rules made after performing an initial regulatory flexibility analysis accounted for another 4 percent. As shown in figure 3, CFPB, CFTC, FDIC, and OCC certified most-to-nearly- all of their final rules that were subject to RFA requirements, while the Federal Reserve rarely certified final rules, and SEC certified almost half. According to Federal Reserve officials, the agency generally performed a full regulatory flexibility analysis for almost all rulemakings regardless of the rule’s impact on small entities. This pattern was generally consistent across our time period (see fig. 4). The Federal Reserve usually performed an initial and final regulatory flexibility analysis, while the other agencies, except SEC, rarely did. SEC’s RFA analyses were the most variable over our time period. The spikes in analyses were generally due to the small number of rules promulgated each year. For example, in 2013, OCC promulgated three rules subject to RFA requirements, performing an initial and final regulatory flexibility analysis in one (33 percent) and certifying in two (67 percent). SEC published seven rules in 2013, completing an initial and final regulatory flexibility analysis in all of them. While the Federal Reserve usually performed initial and final regulatory flexibility analyses, it concluded that almost all of its rules would not significantly affect small entities. In 86 percent of its analyses (54 of 63), the Federal Reserve concluded that the rule would not have a significant economic impact on a substantial number of small entities (see fig. 5). In addition, FDIC concluded that almost all of its rules (5 of 6) in which it performed a final regulatory flexibility analysis would not significantly affect small entities, although as previously mentioned, FDIC certified almost all its final rules subject to RFA requirements. (We discuss the Federal Reserve’s and FDIC’s RFA analyses in more detail later in this report.) SEC, CFPB, and CFTC also concluded that at least one of their rules would not significantly affect small entities after performing a final regulatory flexibility analysis. For the CFPB rule, the Federal Reserve first proposed the rule and performed the initial regulatory flexibility analysis before certain rulemaking authorities were transferred to CFPB for the final rule. We reviewed Federal Register notices and the regulators’ internal workpapers for all certifications made in the final rule (66 certifications) in calendar year 2015 and 2016 to determine the basis for the certifications and the extent to which the analyses were consistent with RFA requirements and Office of Advocacy’s guidance and other best practices. As previously discussed, RFA requires that agencies provide the factual basis for their certifications in the Federal Register. In most certifications, the agencies provided a factual basis and concluded the rule would not apply to small entities or have any economic impact. In others, the agencies found the rule would have some economic impact on small entities, but concluded that the impact would not be significant for a substantial number of small entities. In those instances, we found that the factual basis provided for most certifications across all regulators lacked key components recommended by the Office of Advocacy for understanding the analyses regulators used to support their conclusion. We also found that while most agencies relied on the Small Business Administration’s definitions of small entities for use in their RFA analyses, two agencies relied on alternative definitions of small entities, some of which have not been updated in more than 35 years. In almost half of the certifications (31 of 66) we reviewed, regulators concluded the rule would apply to no or few small entities (see table 3). According to the regulators, these rules generally regulated activities in which small entities do not engage, pertained to the internal processes of the agency, or applied only to entities that were not small as defined by the Small Business Administration or the agency. For example, in a rule on recovery planning, OCC determined that the rule did not have an impact on small entities because it applied only to banks with $50 billion or more in assets, which are not small entities based on the Small Business Administration’s definition. In 12 certifications, the agencies concluded the rules would have no economic impact regardless of whether small entities were affected and therefore did not require regulatory flexibility analyses. According to the regulators, most of these certifications applied to rules that did not create new regulatory requirements, eliminated duplicative rules, or established optional specifications. For example, FDIC published a rule in October 2015 that consolidated into a single part Fair Credit Reporting regulations for all institutions FDIC regulates. According to the Federal Register notice, the rule eliminated redundant requirements and aligned FDIC’s definitions with CFPB rules that were substantively similar. Regulators generally used the current state of regulations as the baseline for these determinations. For example, when analyzing the economic effects of a new rule that consolidated duplicative regulations, the regulator compared the compliance costs of the new rule with the costs small entities already incurred to comply with the duplicative regulations. Additionally, regulators concluded in 5 of 66 certifications that the rule would have a beneficial impact on small entities. For these rules, agencies concluded they reduced regulatory burden, eliminated regulations, or exempted certain entities. In almost a third (18 of 66) of the certifications, the agencies found that the rule would have some economic impact on small entities, but determined that the impact would not be significant for a substantial number of small entities. For example, in a rule that required specified entities to become members of an association, CFTC identified as an economic impact the costs of membership dues and attorney fees related to completing registration filings and preparing for required audits. But it determined that the costs were not significant for a substantial number of the specified small entities. In the seven joint rules we reviewed, we determined regulators conducted their own certification analysis independent of other agencies, although they generally reached the same conclusion to certify (except for the Federal Reserve, which generally treated RFA analysis differently, as discussed later). As previously noted, the Federal Reserve, FDIC, and OCC rely on the Small Business Administration’s definition of small banks for RFA purposes. CFPB also relies on the Small Business Administration’s definitions of small entities; for example, a business engaged in automobile financing is considered small if its revenues are $38.5 million or less. In contrast, CFTC and SEC previously established alternative definitions of small entities for the purposes of RFA that the agencies used to conclude that most of their rules (10 of 15 for CFTC and 9 of 12 for SEC) would not apply to small entities. But some of these small entity definitions have not been updated in more than 35 years. In a 1982 policy statement, CFTC published its first set of RFA definitions, which covered designated contract markets, futures commission merchants, and commodity pool operators, among others. In subsequent years, CFTC modified its definitions of small entities to exclude several other groups of entities that it regulates, such as eligible contract participants and major swap participants. SEC originally established definitions for small entities through a rule published in the Federal Register in 1982 after consulting with the Office of Advocacy. The agency subsequently updated some of its definitions in 1986 and 1998, although others have not been updated at all. In an October 2017 report to the President, the Department of the Treasury recommended CFTC and SEC review and update their small entity definitions for RFA purposes to ensure their RFA analyses appropriately consider small entities. According to CFTC officials, the agency has been reviewing its small entity definitions since April 2017 as part of its working group to update the agency’s RFA practices. SEC staff told us they had no comment on Treasury’s recommendation. For the 18 certifications in which regulators determined rules would have some economic impact on small entities, they conducted additional analyses to determine that the impact was not significant for a substantial number of small entities. We found that the factual basis provided for many of these certifications lacked key information (discussions of data sources or methodologies and of broader economic impacts, or definitions for key criteria) for understanding the analyses regulators used to support their conclusion. The Office of Advocacy interprets RFA’s factual basis requirement to mean that a certification should include, at a minimum, why the number of entities or the size of the economic impact justifies the certification. In its RFA guide, the Office of Advocacy details the components regulators should include in their certification discussion to obtain meaningful public comment and information on the rule’s impact on small entities. These components include a description and estimate of the economic impact, criteria for “significant economic impact” and “substantial number,” and a description of any uncertainties in the analysis, including sensitivity analysis when appropriate. The Office of Advocacy guidance states that agencies’ reasoning and assumptions underlying the analyses used to support their certifications, including data sources, should be explicit in the Federal Register notices. Additionally, when estimating significant economic impact, the guidance states agencies should not view impact in absolute terms, but relative to the size of the business, the size of the competitor’s business, and the impact on larger competitors. According to the Office of Advocacy, broader economic impacts (such as a disparity in impact on small entities that affects their ability to compete) could be significant. Data sources or methodologies. In most of these certifications (15 of 18), regulators did not describe or did not fully describe their methodology or data sources for their conclusions. In addition to the Office of Advocacy’s RFA guide, OMB guidance on regulatory analysis—regulatory agencies’ evaluation of the likely consequences of rules—states that agencies should clearly set out the basic assumptions, methods, and data underlying the analysis and discuss the uncertainties associated with the estimates. While independent regulatory agencies, including those in our review, are not required to follow the OMB guidance, it provides a strong set of analytical practices relevant to agency rulemakings. For these certifications, regulators generally provided partial sources and methodology for their conclusions. Examples of incomplete discussions include the following: In its rule requiring specified entities to become members of an association, CFTC detailed its source and methodology for estimating the hourly labor costs of retaining a lawyer, as mentioned above, but did not provide the reasoning for its estimate of the number of hours that a lawyer would spend counseling entities with respect to the rule’s requirements. In a joint rule related to homeowner flood insurance, OCC provided the source for the estimated number of affected small entities, but provided no source or methodology for its estimated economic impact of $6,000. In a rule amending reporting requirements for the dissemination of security-based swap information, SEC said that it partially relied on its “own information” without explanation for declaring that small entities do not participate in security-based swap markets. In a joint rule implementing the minimum requirements in the registration and supervision of appraisal management companies, the Federal Reserve estimated a range of small entities that might be affected but did not provide the source or methodology for how it approximated the number. CFPB fully discussed sources and methodology in some of its certifications but not others. In three of five certifications that required additional analysis, CFPB provided thorough descriptions of its methodology and data sources for its conclusions. The agency detailed its assumptions and uncertainties in these rules and performed a sensitivity analysis to ensure the rules would not significantly affect small entities. However, in the other two certifications, CFPB did not discuss all of the data sources on which it relied. Broader economic impacts. The regulators’ certifications generally did not address broader economic impacts such as cumulative effects, competitive disadvantage, or disproportionality of effects and focused most of the analysis on specific compliance costs. In addition to the Office of Advocacy’s guidance on analyzing broader economic impacts, Executive Order 13563 requires agencies to consider the cumulative economic impacts of regulations during the rulemaking process, which reinforces the agencies’ obligations under RFA. While this executive order is not binding on independent regulatory agencies, such as those in our review, it represents a best practice for rulemaking. Of the 18 certifications that contain additional analysis, agencies discussed some aspect of broader economic impacts in 3. CFPB considered future changes in market share for small entities because of new requirements in one rule and whether the regulation placed small entities at a competitive disadvantage in another rule. OCC also examined a rule’s impact on small entities’ competitiveness and profitability in one certification. None of the regulators discussed cumulative effects in their certifications. Defining key criteria. Regulators generally did not define the criteria they used for “substantial number” and “significant economic impact” in their certifications. RFA does not define these terms. The Office of Advocacy has left it up to agencies to determine their own criteria, which it recommends that agencies discuss in their certifications. None of the regulators defined what would constitute a substantial number of small entities for the rule in the Federal Register notices. OCC was the one agency to define its criteria for a significant economic impact in its rulemaking, although it did not include this definition in all of its certifications. The other agencies did not define significant economic impact for the rule in the Federal Register notices. While CFPB did not disclose its criteria in the Federal Register notices, it defined these criteria in its internal workpapers for two certifications. Additionally, many of the analyses (13 of 18) did not discuss the significance of the rule’s costs relative to the size of the business, such as profits, revenues, or labor costs. Limited information. In addition, three of the certifications we reviewed included none of the Office of Advocacy’s suggested components. The factual basis provided for these certifications did not include a description of the number of affected entities, the size of the economic impacts, or the justification for the certification. Two FDIC rules related to revisions of the treatment of financial assets transferred in connection with a securitization provided no additional information beyond the declarative statement that the agency certified that the rule would not have a significant economic impact on a substantial number of small entities. Additionally, an OCC certification in a joint rule that formalized the calculation method for mortgage loans exempted from certain requirements provided little information, although an internal agency workpaper detailed the number of small entities affected and the estimated economic impact that supported the certification. OCC officials said that the agency will comply with instructions from its rulemaking procedure guide, which was updated in August 2016. According to the guide, certifications should include additional information beyond the certification statement, such as number of affected small entities, size of the economic impact, and reason for the certification. The regulators’ guidance for complying with RFA generally does not include policies and procedures for helping to ensure consistent and complete RFA analyses. (We discuss the regulators’ guidance later in this report.) Without policies and procedures that would help ensure that key components were incorporated in certification assessments—including disclosing the methodology and data sources of economic analyses and considering potential broad economic impacts—regulators may be limiting the effectiveness of their reviews. In turn, such reviews hinder the achievement of RFA’s goal. For example, incomplete disclosure of methodology and data sources could limit the public and affected entities’ ability to offer informed comments in response to regulators’ certification assessments in proposed rules. In many recent regulatory flexibility analyses, the evaluation of key components—potential economic effects and alternative regulatory approaches—was limited. Many final rules described changes to limit burden, and few regulatory flexibility analyses concluded rules would have a significant impact on small entities. For most rules we reviewed, regulators were unable to provide documentation supporting their regulatory flexibility analyses. Our review of recent regulatory flexibility analyses found that in many cases, the evaluation of key components—potential economic effects and alternative regulatory approaches—was limited, although the extent varied by regulator. RFA requires the initial and final analyses to include information to assist the agency, regulated entities, and the public in evaluating the potential impact of rules on small entities (see sidebars). The most important components include the assessment of a rule’s potential economic effects on small entities—such as compliance costs— and the identification and evaluation of alternative regulatory approaches that may minimize significant economic effects while achieving statutory objectives. The Office of Advocacy’s guide on RFA compliance explains that an agency principally should address these components in an initial regulatory flexibility analysis. feasible—of the number of small entities to which the rule will apply. Description of the projected reporting, recordkeeping, and other compliance requirements of the rule, including the type of necessary professional skills. Identification—to the extent practicable— of all relevant federal rules that may duplicate, overlap, or conflict with the proposed rule. goal of RFA. See appendixes V–XII for a summary of findings for each of the six regulators. We reviewed regulatory flexibility analyses for recent rulemakings to assess the extent to which they included these and other elements and to examine the outcome of the analyses. For each regulator, we selected all final rules published in 2015 and 2016 for which the agency performed an initial and final regulatory flexibility analysis. For regulators with fewer than three such rules, we included rules published in prior years (on a full- year basis) until we reached three rules or 2013. See table 4 for the number of rules selected for each regulator. For each rule, we reviewed Federal Register notices for the proposed and final rules and supporting documentation on the initial and final regulatory flexibility analyses. small entities to which the rule will apply or explanation of why no such estimate is available. the significant economic impact on small entities consistent with statutory objectives, including the reasons for selecting the alternative adopted in the final rule and why each of the other alternatives was rejected. In meeting the requirements, agencies may provide either a quantifiable or numerical description of the rule’s effects or alternatives or more general descriptive statements if quantification is not practicable or reliable. Many of the Federal Reserve’s regulatory flexibility analyses lacked some required components and contained limited information and analysis. As previously discussed, the Federal Reserve generally performed regulatory flexibility analyses for its rulemakings regardless of the rule’s potential impact on small entities. The majority (11 of 17) of the Federal Reserve’s analyses stated that the rules either did not apply to small entities or lacked compliance requirements. Nevertheless, the Federal Reserve conducted regulatory flexibility analyses in which nearly all of the initial (14 of 17) and final analyses (15 of 17) concluded that the rule would not have a significant economic impact on small entities, which generally is a basis for certification. Examples included rules on capital and liquidity requirements applicable only to large banking organizations and rules that amended official regulatory interpretations or repealed regulations. None of the regulatory flexibility analyses performed by other regulators indicated that a rule did not apply to small entities or lacked compliance requirements. For additional information, see appendix V. More specifically, the regulatory flexibility analyses for the 11 rules that did not apply to small entities or impose compliance requirements were minimal. The analyses did not describe or estimate compliance costs, identify alternatives, or include other items. In the case of alternatives, the analyses either stated that there were no alternatives that would further minimize economic impact on small entities or requested comments on any alternatives. The analyses did not include some other information that could be available and relevant such as the reasons or need for the rule. Because the purpose of a regulatory flexibility analysis is to evaluate a rule’s potential effects on small entities, key components of the analysis may not be relevant or meaningful in such cases. For example, there may be no compliance costs to estimate, alternatives to consider, necessary professional skills to describe, or actions that could minimize impact on small entities. With their focus largely on explaining why the rule would not affect small entities rather than examining effects of compliance requirements and potential alternatives to limit such effects, such cases resemble certifications more than regulatory flexibility analyses. See appendix V for further information on the Federal Reserve’s regulatory flexibility analyses. The Federal Reserve’s regulatory flexibility analyses for six rules that might impose compliance requirements on small entities also had limitations. Specifically, most of the analyses (both initial and final) contained limited evaluation of the potential economic impact on small entities and lacked other components. RFA directs agencies to provide a quantifiable or numerical description of the effects of a proposed rule and allows a qualitative description in lieu of a numerical evaluation in instances when quantification is not practicable or reliable. Most of the analyses for rules that might impose compliance requirements on small entities did not include a description of potential compliance costs. Nearly all (five of six) did not quantify compliance costs in either the initial or final analyses or explain why such assessments were not possible. For two rules, the Federal Reserve’s assessments of economic effects and compliance costs generally consisted of descriptive statements on the rule’s provisions and coverage. For example, the final analysis for a rule on margin and capital requirements for participants in financial swap transactions stated that, among other things, all financial end users would be subject to the variation margin requirements and documentation requirements of the rule but that the Federal Reserve believes such treatment is consistent with current market practice and should not represent a significant burden on small financial end users. Although containing minimal information, analyses in three of the six rules indicated that the rules would have a largely beneficial impact for small entities by reducing burden or offering positive economic effects. These analyses generally lacked clear descriptions of any compliance requirements that would apply to small entities. For example, the initial and final analyses for a rule involving the Federal Reserve’s emergency lending authority stated that participants at a minimum likely would be required to pay interest on loans extended to them and to keep records, but that the positive economic impact of receiving a loan likely would outweigh any economic burden. The initial analysis for another rule stated that the projected reporting, recordkeeping, and other compliance requirements were expected to be minimal but did not describe the requirements or any associated costs. Alternatives. Few of the Federal Reserve’s initial regulatory flexibility analyses identified alternatives to the proposed rule and some did not explain why there were no alternatives. Although most of the rules’ analyses (10 of 17) described alternatives, all but 2 stated that there were no alternatives that would have less economic impact on small entities. Of the 6 rules that might impose compliance requirements on small entities, 2 included such a statement, 1 had no mention of alternatives, and another solicited comments on any significant alternatives that would reduce burden associated with the proposed rule. Analyses for the other two rules described alternative approaches included in the proposed rule to limit economic impact on small entities. For example, one of the rules incorporated an applicability threshold for certain compliance requirements and the other exempted small entities from some of the rule’s provisions and applied a longer transition period. Other Components. Several of the final regulatory flexibility analyses also lacked other RFA-required components. In particular, only three of the six rules described steps taken to minimize economic impact on small entities and reasons for selecting the alternative adopted in the final rule. The other three rules did not include either component. The reasons cited for selecting the approach in the final rule generally reflected the actions taken by the agency to mitigate the rule’s economic impact on small entities. For the other financial regulators (FDIC, CFPB, CFTC, OCC, and SEC), most of the regulatory flexibility analyses we reviewed included the components required by RFA, but the extent of the analyses varied among regulators, with some lacking required information or having other limitations. For the majority (three of four) of FDIC’s analyses, the agency indicated that the rules were not subject to RFA but that it voluntarily undertook the analyses to help solicit public comments on the rules’ effects on small entities. For these three rules, FDIC’s analyses described and quantified each of the rule’s compliance costs and concluded that each rule would not have a significant economic impact on small entities, but other components were missing. For example, these rules’ analyses focused on illustrating how the rule would not have an economic impact on small entities and did not include other required components including a description and assessment of regulatory alternatives. The initial and final analyses for each of the rules were nearly identical and did not include statements about alternatives, any issues raised in public comments, or steps to minimize impact on small entities, among other missing components. In that regard, FDIC’s analyses for these rules—similar to many of the Federal Reserve’s analyses—resembled a certification. The regulatory flexibility analyses for the fourth FDIC rule that we reviewed included all required components. CFPB’s regulatory flexibility analyses generally included all required components. However, for three of the seven rules neither the initial nor final analyses estimated compliance costs for small entities. In some cases, the analyses stated that costs likely would be minimal or described difficulties in estimating costs such as a lack of information about the current practices of subject entities. Of the analyses that included cost estimates, several did not quantify all identified costs or explain why such estimates were not available. Unlike other regulators we reviewed, CFPB is required to seek input from small entities during the rulemaking process (through Small Business Review Panels) when proposed rules are expected to have a significant economic impact on a substantial number of small entities. CFPB’s regulatory flexibility analyses often incorporated information received from these panels in its assessment of potential economic effects and regulatory alternatives. For example, several analyses that estimated compliance costs relied on information from small entities that participated in the panel process as well as data from other sources. The description of regulatory alternatives often reflected comments received from small-entity representatives. Although each of CFPB’s initial analyses described alternatives, in some cases, it was not clear whether CFPB had identified alternatives of its own. CFTC performed initial and final analyses for one rule during the period we reviewed and the analyses had limited evaluation of potential effects on small entities. The analyses did not estimate the number of affected entities or compliance costs, but indicated that the rule’s compliance requirements would be minimal while concluding the rule likely would have a beneficial impact on small entities. The discussion of compliance requirements in the final analysis stated only that the rule would relieve affected entities from certain compliance requirements, although the initial analysis stated that the proposed rule would impose a new requirement on certain entities—which could include small entities—to annually provide CFTC with a notice about certain trading activity. In other sections of the final rule, CFTC discussed its decision to address concerns raised in public comments by not adopting the notice requirement. OCC also had one rule with initial and final regulatory flexibility analyses, and it included nearly all required components. The rule revised capital requirements for banking organizations and was issued jointly with the Federal Reserve. The initial analysis described multiple alternative approaches that it stated were included in the proposed rule to incorporate flexibility and reduce burden for small entities. However, other than listing the alternatives and requesting comment, the analysis does not discuss or evaluate how the options minimize economic impact on small entities. The regulatory flexibility analysis in the final rule notes that the Small Business Administration’s Chief Counsel for Advocacy submitted a comment letter in which it encouraged the agencies to provide more detailed discussion of the alternatives and the potential burden reductions associated with them. SEC’s regulatory flexibility analyses also included most components, but some rules’ assessment of compliance costs and alternatives had limitations. Specifically, although all of the rules described compliance requirements, some did not describe (four of nine) or estimate (five of nine) the costs they might impose on subject entities. For example, in December 2015, SEC published a proposed rule requiring resource extraction issuers to disclose certain payments. The proposed rule’s initial regulatory flexibility analysis described requirements for the disclosures. However, the regulatory flexibility analysis did not discuss or evaluate potential compliance costs and concluded with statements on alternatives and a request for comments. Many of the SEC rules we reviewed focused on reasons why alternatives were not appropriate and did not discuss specific options for minimizing economic impact on small entities. As part of describing any significant alternatives to the proposed rule which accomplish statutory objectives while minimizing any significant economic impact on small entities, RFA requires that initial regulatory flexibility analyses discuss alternatives such as the establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; the clarification, consolidation, or simplification of compliance and reporting requirements under the rule for such small entities; the use of performance rather than design standards; and an exemption from coverage of the rule, or any part thereof, for such small entities. For five of the nine rules, the initial analysis discussed the general types of alternatives listed in RFA but did not describe specific options for implementing them in the proposed rule. For example, the initial regulatory flexibility analyses did not identify how compliance or reporting requirements might be altered for small entities or in what ways requirements could be simplified. One of the rules involved changes to SEC’s requirements for the reporting and disclosure of information by registered investment companies. The initial analysis stated that the agency had considered (1) establishing different reporting requirements or frequency to account for resources available to small entities, (2) using performance rather than design standards, and (3) exempting small entities from all or part of the proposal. However, the analysis lacked details about what different reporting requirements, frequencies, performance standards, or partial exemptions it considered for small entities. In addition, for seven of the rules—including the five rules considering only the general alternative types—the discussion was limited to describing the reasons why regulatory alternatives were not appropriate. The reasons cited typically included that the different regulatory approaches would not be consistent with the agency’s goals or statutory objectives. For example, the analysis for SEC’s rule on reporting and disclosure by registered investment companies concluded that the agency believed that establishing different reporting requirements or frequency for small entities would not be consistent with SEC’s goal of industry oversight and investor protection. However, for this and the other proposed rules, the analyses generally did not examine the extent to which the considered alternatives could limit the rule’s economic impact on small entities. In another case, a rule’s final analysis stated that one public commenter raised concerns that the initial analysis did not identify significant alternatives, including that it only considered alternatives related to exempting small business from the proposed rules. Several of the commenters suggested additional alternatives for reducing burden. The lack of specific details about potential alternatives may limit the usefulness of public comments on SEC’s regulatory flexibility analyses and its ability to identify alternatives that could reduce economic impacts on small entities while achieving a rule’s objectives. Most regulators (five of six) did not disclose the data sources or methodologies used for estimating the number of subject small entities or compliance costs for the regulatory flexibility analyses we reviewed. OMB guidance on regulatory analysis—regulatory agencies’ anticipation and evaluation of the likely consequences of rules—states that agencies should clearly set out the basic assumptions, methods, and data underlying the analysis and discuss the uncertainties associated with the estimates. While independent regulatory agencies, such as those in our review, are not required to follow the OMB guidance, it provides a strong set of analytical practices relevant to agency rulemakings that serves as best practices for all agencies. Many initial analyses (11 of 23) and final analyses (11 of 24) that estimated the number of subject small entities did not describe the data source used for the estimate. Each of the regulators except for CFPB (which included data sources) and CFTC (whose only rule did not include an estimate) had at least one rule that did not disclose the data source for the estimate of subject small entities. Furthermore, many analyses that estimated a rule’s compliance costs (5 of 12 initial and 5 of 14 final) did not describe the information sources used to calculate the projections. The analyses for several additional rules included data sources for some but not all cost estimates. Except for CFPB, each of the regulators that estimated compliance costs had at least one rule that lacked information on data sources for some estimates. For example, the regulatory flexibility analyses for a joint OCC and Federal Reserve rule discussed how the agencies estimated costs of implementing new capital requirements but did not disclose the data sources or methodology used to calculate the costs of creditworthiness measurement activities. A lack of information necessary to understand how an agency evaluated a rule’s economic impact on small entities may limit the extent to which the public and other interested parties can meaningfully comment on the analyses. Although a regulatory flexibility analysis is required only for rules that may have a significant economic impact on a substantial number of small entities, few final analyses concluded that the rules would have such an impact. Specifically, the final analysis for only 4 of 39 rules that we reviewed stated that the rule likely would have a significant economic impact. Final analyses for the majority of rules (20 of 39) concluded there would be no significant impact and the remainder did not have a clear conclusion. The Federal Reserve accounted for 15 of those 20 analyses. As discussed previously, nearly all of the Federal Reserve’s regulatory flexibility analyses concluded a rule would not have a significant impact on small entities. About half of the regulatory flexibility analyses we reviewed (18 of 39) described changes to the proposed rule to limit economic impact on small entities and most were by regulators other than the Federal Reserve. Several rules (12 of 39) described changes attributable to comments on the regulatory flexibility analyses. Specifically, for regulators other than the Federal Reserve, the final analyses for about half of the rules (11 of 22) noted receiving public comments on the initial analysis and nearly all of those described changes resulting from the comments. A smaller number of rules described changes related to comments on the initial analysis received from the Office of Advocacy. Some rules also described other changes to the proposed rule, including changes in response to general public comments and the adoption of alternatives. For rules that identified alternatives to a proposed rule in the initial analysis, about half of the final analyses (10 of 21) described reasons for rejecting all the alternatives. An additional 2 rules noted reasons for rejecting some of the alternatives. For further information on the results of regulators’ regulatory flexibility analyses, see appendix XII. Regulators described taking various steps to minimize impact on small entities, although they did not all result from changes to the proposed rule and were not all clearly attributable to the agency’s consideration of alternatives. For example, some analyses described provisions that had been included as part of the proposed rule. For rules that disclosed actions to minimize effects on small entities, most regulators noted multiple actions that included reducing compliance requirements such as for reporting and disclosure, exempting small entities from certain requirements, increasing applicability or exemption thresholds, providing for flexibility in meeting compliance requirements, clarifying and simplifying compliance requirements, not adopting certain provisions of the proposed rule, and providing for delayed or gradual implementation of compliance requirements. Although some actions were specific to small entities, many applied more broadly, such as to all subject firms. For most rules we reviewed, regulators (five of six) were unable to provide documentation supporting their regulatory flexibility analyses or certification decisions, although the extent of documentation varied by regulator (see table 5). We requested supporting documentation for the 39 rules we reviewed for which the agency performed initial and final regulatory flexibility analyses and the 66 rules for which the agency made a certification determination. Staff from two regulators—CFPB and OCC—provided documentation for all or nearly all of the rules we reviewed. Many of these documents were formal analysis or decision memorandums on assessing a rule’s potential economic impact on small entities. For CFPB rules that had regulatory flexibility analyses, documentation included RFA-required reports summarizing the results of Small Business Review Panels. Staff from the other regulators produced documentation for fewer or no rules and the documents they provided were largely limited and informal. For example, other than for CFPB and OCC, RFA-related documentation generally consisted of emails between agency staff and data queries and output files on the number of affected entities and potential economic effects. OMB guidance on regulatory analysis states that agencies should prepare documentation of their economic analysis so that a qualified third party reading the analysis can understand the basic elements and the way in which the agency developed its estimates. The guidance also states that agencies are expected to document all the alternatives considered as part of their regulatory analysis and which alternatives were selected for emphasis in the main analysis. As previously discussed, independent regulatory agencies are not required to follow the OMB guidance, but it provides a strong set of analytical practices relevant to agency rulemakings. A lack of documentation of the analysis supporting regulators’ RFA implementation limits transparency and accountability. Most regulators (five of six) have established written guidelines that restate the statutory requirements for certification and for preparing the regulatory flexibility analyses and provide some additional guidance for staff conducting the analyses, as shown in table 6. However, they generally have not developed comprehensive policies and procedures to assist staff in complying with RFA, which may contribute to the weaknesses we identified in some certifications and regulatory flexibility analyses. The guidelines for FDIC, OCC, CFPB, and SEC discuss regulatory flexibility analyses as part of their general rulemaking guidance for staff. At a minimum, each of these regulators’ guidance describes the statutory requirements under RFA for certifications and for preparing the initial and final analyses, and, for CFPB, agency-specific RFA requirements. These four agencies also provide some additional information intended to be useful in complying with RFA requirements, such as excerpts from the Office of Advocacy’s RFA compliance guide. For example, some of the incorporated Office of Advocacy guidance covers considerations for determining whether a rule would have a significant economic impact on a substantial number of small entities. In addition, some regulators’ RFA guidelines include organizational information for coordinating with certain agency departments (such as offices responsible for economic analysis or legal review) and identifying staff responsible for completing RFA analyses. Until recently, CFTC and the Federal Reserve had not established any policies, procedures, or guidance for conducting regulatory flexibility analyses, except for a policy statement CFTC issued in 1982 that defines small entities and an informal Federal Reserve document listing RFA requirements. Since we started our review, CFTC announced a working group intended to enhance compliance with RFA. According to CFTC staff, the group began its work in April 2017 with a focus on updating CFTC’s small-entity definitions. Staff said that the group’s next task would be to formulate RFA policies and procedures with a goal of adopting them in spring 2018. Also during the course of our review, the Federal Reserve finalized a handbook covering guidelines and policies for RFA and small- entity compliance guides that it provided to us in November 2017. Previously, the Federal Reserve’s RFA guidance consisted of an informal resource document identifying RFA requirements that it made available to rulemaking staff. While the financial regulators’ guidance discusses RFA requirements for regulatory flexibility analyses and includes some information on how to approach these analyses, it generally does not address how each agency helps ensure that its rulemakings consistently and completely comply with RFA requirements. Federal internal control standards state the importance for agency management to establish through policies and procedures the actions needed to achieve objectives. In addition, Executive Order 13272 required agencies to establish policies and procedures to promote compliance with RFA. While this executive order is not binding on independent regulatory agencies, it represents a best practice for rulemaking. We found that the regulators’ guidance lacks specific details on the procedures by which the agency expects rulemaking staff to implement RFA requirements. Other than restating RFA requirements and identifying organizational responsibilities, regulators’ guidance documents largely are limited to offering suggestions for rulemaking staff to consider while preparing RFA sections of the rule. For example, in many cases, the guidance documents include recommendations and excerpts from the Office of Advocacy’s RFA compliance manual such as factors to consider about what constitutes a significant economic impact and a substantial number of small entities. In another case, guidance suggests staff refer to RFA statements included in previously issued rules to use as examples. In addition, some guidance documents described agency policies on certain RFA elements. For example, one regulator’s guidance states a preference for completing an initial regulatory flexibility analysis, rather than making a certification determination. Yet, while these types of guidance may be instructive and allow for necessary flexibility, they do not represent specific and comprehensive procedures for implementing RFA requirements. As illustrated in table 7, the extent to which regulators’ guidance includes policies and procedures varies but generally does not include policies or procedures for identifying definitions or criteria for assessing whether a rule will have a significant economic impact on a substantial number of small entities; evaluating a rule’s potential economic impact on small entities, including compliance costs and broad effects such as cumulative effects, competitive advantage, and disproportionality; identifying and assessing regulatory alternatives that could minimize impact on small entities while accomplishing statutory objectives; disclosing analytical methodology and data sources; and creating and maintaining documentation that supports analytical findings. Some regulators’ guidance, including CFPB and OCC, includes policies and procedures for certain elements—such as disclosing methodology and sources—but not for others, such as defining what constitutes significant economic impact or a substantial number of small entities. FDIC’s rule development guide includes guidance for certification determinations (largely from Office of Advocacy’s compliance guide) but not for initial and final regulatory flexibility analyses for which the guide restates RFA requirements. SEC’s handbook describes some policies and procedures on alternatives but it focuses on having RFA statements acknowledge consideration of each RFA alternative type even if unsuitable. It also includes some policies and procedures for assessing economic impact. However, the handbook was last revised in 1999, so it does not incorporate recommendations from the Office of Advocacy’s compliance guide, and two SEC divisions have developed their own manuals, which generally restate RFA requirements. As previously described, we found inconsistencies and weaknesses in financial regulators’ certifications and regulatory flexibility analyses that we reviewed, including for the key elements discussed in this section. The shortcomings are attributable in part to the regulators’ lack of comprehensive policies and procedures for RFA requirements. Our prior work on RFA implementation by federal agencies found that uncertainties about RFA’s requirements and varying interpretations of those requirements by federal agencies limited the act’s application and effectiveness. However, the Office of Advocacy subsequently published guidance on complying with RFA requirements that includes information to help agencies interpret and implement RFA requirements. Such guidance could help regulators develop comprehensive and specific policies and procedures. Without such policies and procedures, regulators’ ability to consistently and effectively meet RFA objectives may be limited. As previously discussed, section 610 of RFA requires agencies to review, within 10 years of adoption, those rules assessed as having a significant economic impact on a substantial number of small entities to determine if they should be continued without change, amended, or rescinded to minimize any significant economic impact on small entities. During the last 10 years, the three federal banking regulators (Federal Reserve, FDIC, and OCC) used other retrospective reviews that they said fulfilled RFA requirements. Specifically, the banking regulators said that the retrospective reviews required under the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) also satisfied RFA section 610 requirements. EGRPRA requires the federal banking regulators to identify outdated or otherwise unnecessary regulatory requirements imposed on insured depository institutions every 10 years. We compared EGRPRA requirements for retrospective reviews to those of section 610 and found they do not fully align (see table 8). For example, the EGRPRA review process relies on public comments to identify rules that may be outdated, unnecessary, or unduly burdensome. The comments are solicited through public notices in the Federal Register and through public outreach meetings held across the country. In contrast, public comments are only one component of section 610 reviews. Following a public notice and comment period, section 610 requires agencies to evaluate rules found to have a significant economic impact on a substantial number of small entities to identify opportunities to reduce unnecessary burden. The section 610 reviews are to consider five specific factors, such as the degree to which technology and economic conditions have changed in the area affected by the rule. Section 610 reviews focus specifically on reducing unnecessary regulatory burden on small entities; EGRPRA reviews focus more broadly on reducing regulatory burden on all insured depository institutions. We reviewed the 2007 and 2017 EGRPRA reports, along with their preceding Federal Register notices, and found that the regulators solicited comment from the public on the burden of regulations on community banks and other smaller, insured depository institutions. However, we found that the final reports primarily focus on the issues identified through public comments and generally did not include independent agency consideration of the impact of regulations on small entities, as required by section 610. The public notice requirements for RFA section 610 and EGRPRA also differed. RFA requires agencies to publish in the Federal Register a list of the rules that have a significant economic impact on a substantial number of small entities and that are to be reviewed pursuant to section 610 during the upcoming year. This list must include a brief description of each rule and the need for and legal basis of each rule. The notices alert the public to specific rules that may affect small entities and request public comment on these rules. EGRPRA public notice requirements do not require agencies to specifically identify rules that have an impact on small entities. Rather, agencies must at regular intervals provide notice and solicit public comment on a particular category or categories of rules (such as consumer protection, safety and soundness) governing all insured depository institutions. The notices request commenters to identify areas of the regulations that are outdated, unnecessary, or unduly burdensome. Our searches of the Federal Register turned up no notices of section 610 reviews posted by the regulators in the last 10 years. In its RFA guide, the Small Business Administration’s Office of Advocacy stated that agencies may satisfy section 610 requirements through other retrospective reviews if these other reviews meet the criteria of section 610. To obtain credit for a section 610 review through another review process, the Office of Advocacy recommends that agencies adequately communicate with stakeholders and the Office of Advocacy. According to an official from the Office of Advocacy, the office has not yet made a determination on whether the EGRPRA review process satisfies the requirements of section 610. Although the agencies stated that they fulfill RFA requirements through EGRPRA, without confirming this with the Office of Advocacy, it is possible that they are not meeting the RFA section 610 requirements and therefore may not be achieving the small- entity burden reduction that the statute seeks to ensure. We found that the regulators lack policies and procedures for how to conduct section 610 reviews or provide rationale for meeting the section 610 review requirements through other retrospective review processes. Our review of SEC’s section 610 reviews found that they were conducted late and were not fully consistent with RFA requirements or the Office of Advocacy’s guidance for such reviews. Although SEC staff have a process for tracking which rules are due for section 610 reviews, SEC conducted all but one of its reviews 12 years after the rules were published. According to RFA requirements, rules must be reviewed within 10 years of their publication as final rules. SEC staff told us that SEC conducted a broader review than required by RFA and recommended by the Office of Advocacy. Moreover, staff said that SEC conducted section 610 reviews for all rules previously published for notice and comment to assess the continued utility of the rules. Agency officials stated that when they prepare the agency’s annual Federal Register notice of rules to be reviewed during the succeeding 12 months, they consult a chronological list of final rules adopted by the agency to determine which rules are due for a section 610 review. However, when we reviewed documentation of 46 section 610 reviews SEC staff conducted in 2015 and 2016, we found that each of the reviews was conducted for a rule adopted in 2003 or 2004, with 45 rule reviews being conducted 12 years after their publication as final rules. By not conducting section 610 reviews within the time frame established by RFA, SEC may delay taking timely action to minimize significant economic impact of rules on small entities. In general, SEC did not follow Office of Advocacy’s guidance for conducting section 610 reviews. The Office of Advocacy recommends that to evaluate and minimize any significant economic impact of a rule on a substantial number of small entities, agencies may want to use an economic analysis similar to the initial regulatory flexibility analysis. Additionally, OMB guidance on regulatory analysis states that agencies should provide documentation that analysis is based on the best reasonably obtainable scientific, technical, and economic information available. As previously discussed, independent regulatory agencies are not required to follow the OMB guidance, but it provides a strong set of analytical practices relevant to agency rulemakings. To facilitate its section 610 reviews, SEC staff used a template that prompts staff to consider each of the five RFA-required section 610 considerations and to document the conclusion of the review (if the rule should be continued without change, amended, or rescinded). We reviewed the templates for all 46 reviews conducted between 2015 and 2016 and found that SEC staff consistently followed this template to document their conclusions. However, the reviews generally lacked substantive analysis and no rules were amended as a direct result of their section 610 review. Overall, of the 46 reviews, 7 identified comments or complaints from the public, 4 identified changes in technology, economic conditions, or other factors in the area affected by the rule, and 4 identified instances of overlap, conflict or duplication. The reviews generally provided no evidence of empirical analysis and no data to support the conclusions of the reviews, as recommended by the Office of Advocacy and OMB. Furthermore, in most cases, the reviews lacked a description of whether, or to what extent, the rule was affecting small entities. For example, when addressing the first RFA-required consideration, describing and evaluating the continuing need for a rule, most SEC section 610 reviews included language from the final rule as a description and included SEC’s conclusion that the rule continues to be necessary. The Office of Advocacy also suggests that useful section 610 reviews should evaluate potential improvements to the rule by going beyond obvious measures and evaluating factors such as the unintended market effects and distortions and widespread noncompliance with reporting and other paperwork requirements. We found no evidence that these factors were considered. The Office of Advocacy further recommends that agencies pay particular attention to changes in the cumulative burden faced by regulated entities. We did not find evidence that SEC considered the cumulative burden faced by regulated agencies in the reviews we examined. By not including these best practice elements as part of its section 610 reviews, SEC may not fully achieve RFA’s purpose of minimizing significant economic impact of rules on small entities. SEC does not have written policies or procedures for completing rule reviews pursuant to RFA section 610, potentially contributing to the weaknesses we identified on the timing of the reviews, and the lack of data and analysis to support the review findings. As previously mentioned, federal internal control standards state the importance for agency management to establish policies and procedures needed to achieve objectives. In addition, Executive Order 13272 requires agencies to establish policies and procedures to promote compliance with RFA. While this executive order is not binding on independent regulatory agencies, including SEC, it represents a best practice for rulemaking. SEC also does not publicly disclose the findings or conclusions of its section 610 reviews. Although RFA does not require that agencies publish the results of their 610 reviews, the Office of Advocacy recommends that to enhance transparency, agencies should communicate with interested entities about the status of ongoing as well as completed section 610 reviews. Several executive orders also highlight the importance of public disclosure of retrospective reviews. For example, Executive Order 13563 recommends that retrospective analyses, including supporting data, should be released online whenever possible. Executive Order 13610 reiterated this recommendation, stating that public disclosure promotes an open exchange of information. While these executive orders are not binding on independent regulatory agencies, we consider them a best practice for rulemaking. OMB guidance on regulatory analysis states that to provide greater access to regulatory analysis, agencies should post their analysis, along with supporting documents, on the Internet so the public can review the findings. Staff from SEC confirmed that they do not publish the results or summaries of their section 610 reviews, stating that they are not required to do so by law. Lack of public disclosure limits the transparency of section 610 reviews, hindering the public’s ability to hold agencies accountable for the quality and conclusions of their reviews. The other two regulators we reviewed, CFTC and CFPB, plan to put procedures in place for section 610 reviews. According to CFTC officials, the agency has not conducted any section 610 reviews in at least the last 10 years. CFTC officials confirmed that the agency currently has no policies or procedures in place to track which rules require reviews or to conduct the reviews. Furthermore, agency officials were unable to identify any final rules published by the agency from 1997 through 2007 that were found to have a significant economic impact on a substantial number of small entities and therefore would have required a section 610 review. According to CFTC officials, an agency working group has a goal to develop a process and criteria for conducting section 610 reviews. Additionally, agency officials stated an interest in establishing an automated system to develop a schedule for tracking which rules require section 610 reviews. CFPB has not yet been required to conduct any section 610 reviews. Section 610 reviews are required within 10 years of a rule’s adoption as a final rule; to date, none of the rules issued by CFPB, which was created in 2010, have met this deadline. CFPB officials confirmed that CFPB has conducted no section 610 reviews and stated that the agency currently has no formal plan or procedure in place to begin conducting these reviews. However, officials further stated that CFPB has had initial planning discussions about the section 610 review requirements and their role in a comprehensive regulatory review program. RFA aims to have agencies tailor regulatory requirements to the scale of regulated entities in a manner consistent with the objectives of the rule and applicable statutes. To achieve this goal, RFA requires agencies to assess the impact of proposed rules on small entities, solicit and consider flexible regulatory proposals, and explain the rationale for their actions. While many of the regulators’ certification determinations and regulatory flexibility analyses incorporated RFA-required components, the weaknesses and inconsistencies we found—in the analyses and in documentation—could undermine the act’s goal. Some certification determinations lacked important information recommended by the Office of Advocacy and OMB, including data sources and methodologies, definitions, and consideration of broad economic impacts. Many evaluations of key components—potential economic effects and alternative regulatory approaches—in the regulatory flexibility analyses were limited. For most rules we reviewed, regulators were unable to provide documentation supporting the economic analysis underlying their regulatory flexibility analyses—including their certification decision. Moreover, regulators generally lacked comprehensive policies and procedures for RFA implementation, a potential contributing factor for many of the weaknesses we identified. By developing policies and procedures that provide specific direction to rulemaking staff, the regulators could better ensure consistent and complete implementation of RFA requirements and more fully realize the RFA goal of appropriately considering and minimizing impacts on small entities during and after agency rulemakings. The issues we identified with section 610 reviews included the use of a substitute review process as well as gaps or weaknesses in analysis and documentation. To fulfill section 610 requirements, the Federal Reserve, FDIC, and OCC used other retrospective reviews required under EGRPRA that do not fully align with requirements under section 610. SEC’s section 610 reviews are not fully consistent with RFA requirements and Office of Advocacy and OMB guidance (for example, not within the 10-year time frame, no evidence of empirical analysis, and no data to support the conclusions of the reviews). CFTC has not recently completed section 610 reviews and CFPB has not yet been required to do so. These regulators have begun or will soon begin developing policies and procedures for conducting the reviews. By meeting section 610 review requirements and using best practices, regulators will be in a better position to minimize any significant economic impact of a rule on small entities that the statute seeks to ensure. Additionally, for regulators that have not publicly issued their finding or for those that have yet to undertake the reviews, it will be important to adopt best practices for transparency and accountability. We are making a total of 10 recommendations among the six financial regulators we reviewed: FDIC should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following three elements: processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for assessing significant economic impact and substantial number of small entities—and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities. (Recommendation 1) FDIC should coordinate with the Office of Advocacy to determine whether the EGRPRA review process satisfies the requirements of section 610 and, if not, what steps should be taken to align the process with section 610 requirements. If additional actions are needed, FDIC should develop and implement specific policies and procedures for performing section 610 reviews, including processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, and maintaining documentation supporting the analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results as part of the EGRPRA report, in the Federal Register, or on the agency’s website. (Recommendation 2) OCC should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following three elements: processes for creating and maintaining documentation sufficient to support analysis of alternatives that could minimize impact on small entities; processes for disclosing the methodology—including criteria for assessing significant economic impact and a substantial number of small entities—and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities. (Recommendation 3) OCC should coordinate with the Office of Advocacy to determine whether the EGRPRA review process satisfies the requirements of section 610 and, if not, what steps should be taken to align the process with section 610 requirements. If additional actions are needed, OCC should develop and implement specific policies and procedures for performing section 610 reviews, including processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, and maintaining documentation supporting the analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results as part of the EGRPRA report, in the Federal Register, or on the agency’s website. (Recommendation 4) The Federal Reserve should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following three elements: processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for assessing significant economic impact and a substantial number of small entities—and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; and processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities. (Recommendation 5) The Federal Reserve should coordinate with the Office of Advocacy to determine whether the EGRPRA review process satisfies the requirements of section 610 and, if not, what steps should be taken to align the process with section 610 requirements. If additional actions are needed, the Federal Reserve should develop and implement specific policies and procedures for performing section 610 reviews, including processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, and maintaining documentation supporting the analysis and conclusions of RFA-required considerations; and publicly disclose the reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results as part of the EGRPRA report, in the Federal Register, or on the agency’s website. (Recommendation 6) CFPB should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following three elements: processes for creating and maintaining documentation sufficient to support analysis of alternatives that could minimize the impact on small entities; processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities; and in developing policies and procedures for section 610 reviews, include processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, maintaining documentation supporting the analysis and conclusions of RFA- required considerations, and establishing procedures for publicly disclosing the review or summaries (such as in the Federal Register or on the agency’s website). (Recommendation 7) CFTC should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following four elements: processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for assessing significant economic impact and a substantial number of small entities—and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize impact on small entities; and in developing policies and procedures for section 610 reviews, include processes for determining which rules require review, posting notices of upcoming reviews in the Federal Register, maintaining documentation supporting the analysis and conclusions of RFA- required considerations, and establishing procedures for publicly disclosing the review or summaries (such as in the Federal Register or on the agency’s website). (Recommendation 8) SEC should develop and implement specific policies and procedures for how it will consistently comply with RFA requirements and key aspects of Office of Advocacy and OMB guidance that include the following four elements: processes for creating and maintaining documentation sufficient to support analysis of economic impact and alternatives; processes for disclosing the methodology—including criteria for assessing significant economic impact and a substantial number of small entities—and data sources of economic analysis supporting certification determinations and regulatory flexibility analyses; processes for considering to the extent practicable a rule’s potential economic impacts on small entities, including for evaluating broad economic impacts of regulations in certification determinations and assessing alternatives that could minimize the impact on small entities; and processes for performing section 610 reviews, including determining which rules require review, posting notices of upcoming reviews in the Federal Register, and maintaining documentation supporting the analysis and conclusions of RFA-required considerations. (Recommendation 9) SEC should publicly disclose its section 610 reviews, or summaries of the reviews, with the basis for any conclusions. Such disclosure could include publishing results in the Federal Register or on the agency’s website. (Recommendation 10) We provided a draft of this report to CFPB, CFTC, the Federal Reserve, FDIC, OCC, Office of Advocacy, and SEC for review and comment. CFPB, CFTC, the Federal Reserve, FDIC, and SEC provided written comments that we have reprinted in appendixes XIII–XVII, respectively. CFTC, the Federal Reserve, and FDIC also provided technical comments, which we have incorporated, as appropriate. We received technical comments from OCC too late to be incorporated in the final product. Although the comments were not incorporated, they do not significantly affect the facts or conclusions we presented. In their written comments, CFPB, CFTC, the Federal Reserve, FDIC, and SEC generally agreed with the report’s recommendations. CFPB recognized the importance of having specific policies and procedures to consistently comply with RFA requirements. CFPB noted the existence of formal guidance instructing staff on conducting and documenting analyses for substantive rulemakings, including following RFA, and stated its commitment to updating its policies and procedures—and developing them for section 610 reviews—to ensure it will consistently comply with RFA requirements. In written comments provided by CFTC, the agency stated its commitment to fully complying with RFA and described the formation and progress of its interdivisional working group for enhancing RFA implementation. CFTC noted that our recommendations are largely consistent with the planned efforts of the working group and that the group will use the recommendations as a guide in completing its work. CFTC also explained that while not a clear requirement of RFA, it will carefully consider making the public aware of the results of section 610 reviews in cases in which the review does not lead to proposed changes to a rule. In its written comments, the Federal Reserve noted that it strives for consistent and complete compliance with RFA requirements. Regarding our recommendation to develop and implement specific policies and procedures for complying with RFA requirements and key aspects of Office of Advocacy and OMB guidance, the Federal Reserve stated it plans to review existing policies and procedures to develop and implement, as appropriate, additional processes with respect to documentation, disclosing methodology and data sources, and considering a rule’s potential economic impact on small entities. Regarding our recommendation to coordinate with the Office of Advocacy and take steps to align the EGRPRA review process with section 610 requirements, the Federal Reserve stated that it will coordinate with the Office of Advocacy and noted that it also plans to conduct a broader review of processes for section 610 reviews to ensure they are comprehensive and transparent. In its written comments, FDIC stated it will consider our recommendations as it continues to enhance its policies and procedures for performing regulatory analyses, in particular compliance with RFA. Regarding our recommendation to develop and implement specific policies and procedures for complying with RFA requirements and key aspects of Office of Advocacy and OMB guidance, FDIC noted that although independent agencies are not required to follow certain guidance used as criteria in the report, it will continue to incorporate provisions from Office of Advocacy and OMB guidance where feasible. FDIC noted that GAO limited its review to analysis specifically included in the RFA sections of a rule and did not consider analysis published elsewhere in the preamble, as permitted by RFA. FDIC stated that it continues to look for ways to make its regulatory analysis more transparent. However, while RFA allows agencies to perform regulatory flexibility analyses as part of other required analysis if such other analysis satisfies RFA requirements, RFA also calls for initial and final regulatory flexibility analyses to contain or describe the required components. Including these components elsewhere in a rule’s preamble without referencing or describing them in the RFA section does not help promote transparency for the public or small entities the rule might affect. As the Office of Advocacy’s guidance notes, agencies can coordinate preparation of regulatory flexibility analyses with any other analyses accompanying a rule. But in doing so, agencies should ensure that such analyses describe explicitly how RFA requirements were satisfied. Otherwise, it may be unclear to small entities and others if relevant analysis appears elsewhere in a rule’s preamble, which could limit transparency and the ability of small entities to review and respond to relevant analyses. Regarding documentation supporting regulatory flexibility analyses and certification determinations, FDIC noted that it will ensure staff considers our recommendation. Regarding our recommendation to coordinate with the Office of Advocacy and take steps to align the EGRPRA review process with section 610 requirements, FDIC stated that it will consider the recommendation. FDIC noted that before this year, the last section 610 review for FDIC was part of the 2007 EGRPRA review process, and notices of that review were provided at that time. Since then, FDIC said that it issued one rule in 2014 that requires a section 610 review, which must be completed by 2024. In written comments, SEC’s chairman stated that he asked staff to identify additional ways to improve the quality of SEC’s rulemaking analysis and procedures. SEC noted that as an independent regulatory agency, it is not subject to the specific requirements for regulatory analysis in Executive Orders 12866 and 13563 and OMB Circular A-4, but that it will continue to strive to incorporate the principles and best practices in those documents into internal practices, where appropriate. SEC also noted that as part of its rulemaking, it engages in economic analyses of the likely costs and benefits of proposed and final rules along with other anticipated effects. SEC further explained that as permitted by RFA, relevant RFA analyses in SEC rulemaking releases often are found across several sections of the releases, and that it would therefore consider potential improvements to better communicate to the public about other analyses relevant to the RFA analyses. As we previously stated, although RFA allows agencies to perform regulatory flexibility analyses as part of other required analysis, it also requires the initial and final analyses to include or describe the required components. Including these components in different parts of a rule release without explicitly referencing or describing them in the RFA section may limit transparency and the ability of small entities to review and respond to relevant analyses. We are sending copies of this report to the appropriate congressional committees and members and financial regulators. This report will also be available at no charge on our website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or EvansL@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix XVIII. The objectives of this report were to (1) analyze the trends in financial regulators’ application of Regulatory Flexibility Act (RFA) requirements in their recent rulemakings; (2) examine the extent to which financial regulators performed analyses for rules they certified would not have a significant economic impact on a substantial number of small entities; (3) examine the extent to which financial regulators performed regulatory flexibility analyses and the analyses’ effects on their rulemakings; (4) examine the extent to which financial regulators established policies, procedures, and criteria for complying with RFA requirements; and (5) examine the extent to which financial regulators performed retrospective reviews required by RFA. For the purposes of this report, financial regulators are the Consumer Financial Protection Bureau (CFPB), the Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), Commodity Futures Trading Commission (CFTC), and the Securities and Exchange Commission (SEC). To analyze the trends in financial regulators’ application of RFA requirements in their recent rulemakings, we reviewed all final rules published in the Federal Register from January 2010 through December 2016. Using the document search on the official Federal Register website, we downloaded all actions published in the Rules and Regulations section of the Federal Register for the financial regulators during our time period. The downloaded file had 744 actions and included a website link to each notice on the Government Printing Office’s website. We then reviewed each notice to remove actions that were not final rules, such as corrections, orders, and statements of policies. We also removed obvious duplicate rules, using the rule’s Regulation Identifier Number that we recorded from the notice or the title for rules without such an identification number. We considered rules to be duplicates if they were (1) a final rule confirming an interim rule or (2) an extension of the compliance date that did not make changes to the Code of Federal Regulations. We removed 181 actions that were not final rules and 43 duplicates, leaving 520 final rules promulgated by the financial regulators from 2010 through 2016. We then analyzed the Federal Register notices for these final rules, using a spreadsheet-based data collection instrument, to quantify how many rules (1) did not include a proposed rule, (2) included an initial regulatory flexibility analysis, (3) included a final regulatory flexibility analysis, (4) certified that RFA analyses were not required, and (5) had other characteristics, such as those rules that performed a final regulatory flexibility analysis but also certified that it was not required. In cases in which the RFA analysis performed in the proposed rule was not clear or present in the final rule, we used the Regulation Identifier Number or citations listed in the final rule to locate the proposed rule to make the determination. To examine the extent to which financial regulators performed analyses for rules they certified would not have a significant economic impact on a substantial number of small entities, we used the results from the trend review to select all final rules published in the Federal Register from January 2015 through December 2016 for which an agency published a notice of proposed rulemaking and certified in the final rule that the rule would not have such an economic impact. We identified a total of 66 final rules that included certifications. More specifically, CFPB had 11 rules that included certifications, CFTC had 15, FDIC had 18, the Federal Reserve had 1, OCC had 9, and SEC had 12. For these rules, we collected and reviewed internal workpapers from the financial regulators on their decisions to certify that regulatory flexibility analyses were not required because the rule would not have a significant economic impact on a substantial number of small entities (certifications). We then assessed the regulators’ certifications in Federal Register publications to determine the extent to which they reflected RFA requirements, guidance from the Small Business Administration’s Office of Advocacy on complying with RFA, and other best practices for rulemaking, specifically Office of Management and Budget (OMB) guidance on regulatory analysis and Executive Order 13563. Our analysis did not include an evaluation of other aspects of agency rulemaking, including regulatory analyses for purposes other than RFA, such as analyses for the Paperwork Reduction Act and other economic analyses in the preamble. We based our evaluation on the RFA sections of each Federal Register notice for proposed and final rules and did not review other rule sections unless the RFA section explicitly referenced them. We also reviewed the workpapers and notices of joint rules for coordination on the certification analysis or decisions between regulators. To examine the financial regulators’ initial and final regulatory flexibility analyses and the analyses’ effects on their rulemakings, we used the results from the trend review to select all final rules published in the Federal Register from January 2015 through December 2016 for which the agency performed an initial regulatory flexibility analysis in the proposed rule and a final regulatory flexibility analysis in the final rule. For any regulator that had fewer than three rules meeting these criteria, we selected all rules published in the prior year for which the agency performed an initial and final regulatory flexibility analysis until we reached three rules or a publication date of January 2013. For rules issued jointly by multiple financial regulators in our scope, we included the rule for each regulator that prepared an initial and final regulatory flexibility analysis. We included such rules even if they would not otherwise have been selected using the outlined criteria. This resulted in the inclusion of one additional rule for the Federal Reserve (a 2013 rule issued jointly with OCC). We selected a total of 39 final rules for which the agency performed an initial and final regulatory flexibility analysis. More specifically, we selected 7 CFPB rules, 1 CFTC rule, 4 FDIC rules, 17 Federal Reserve rules, 1 OCC rule, and 9 SEC rules. For these rules, we obtained and reviewed internal workpapers from the financial regulators related to the initial and final regulatory analyses. We assessed the regulators’ regulatory flexibility analyses contained in the RFA summary in the notices of proposed and final rules published in the Federal Register to determine the extent to which they reflected RFA requirements, the Office of Advocacy’s guidance on complying with RFA, and OMB guidance on regulatory analysis. Our analysis did not include an evaluation of other aspects of agency rulemaking, including regulatory analyses for purposes other than RFA. We based our evaluation on the RFA sections of each rule and did not review other rule sections unless the RFA section explicitly referenced them. We also analyzed the workpapers, notices, and interviews to identify the extent to which regulators revised draft and proposed rules as a result of regulatory flexibility analyses, the source of the changes, and the types and characteristics of changes that regulators made to draft and proposed rules as a result of regulatory flexibility analyses. We also reviewed the workpapers and notices of joint rules for coordination on the analyses. To examine financial regulators’ policies, procedures, and criteria for complying with RFA requirements, we obtained and reviewed internal agency policies, procedures, and guidance for conducting initial and final regulatory flexibility analyses or certifying that such analyses were not required. We then assessed the documents received to determine the extent to which they reflected RFA requirements and Office of Advocacy’s guidance on complying with RFA. We also assessed the extent to which the documents included comprehensive policies and procedures to assist staff in complying with RFA in accordance with best practices outlined in Executive Order 13272 and federal internal control standards. To examine the extent to which financial regulators performed retrospective reviews required by RFA, we searched the Federal Register for notices of upcoming section 610 reviews as well as results of section 610 reviews. We also obtained and reviewed documentation from the financial regulators of section 610 reviews performed from calendar year 2006 through 2016. We assessed the section 610 reviews we received against RFA requirements and other best practices for rulemaking, specifically OMB guidance on regulatory analysis and Executive Orders 13563 and 13610. For agencies that conducted other retrospective reviews in lieu of section 610 reviews, we compared the other retrospective review processes to RFA requirements for section 610 reviews to determine the extent to which they aligned. We also interviewed staff from each of the financial regulators to understand the process and analysis supporting their certification decisions, regulatory flexibility analyses, and retrospective reviews. We conducted this performance audit from January 2017 to January 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In the seven joint rules we reviewed with a certification, financial regulators conducted their own certification analyses independently of the other agencies responsible for the rule. The Regulatory Flexibility Act (RFA) allows agencies to coordinate on their RFA analyses but does not require it. The Small Business Administration’s Office of Advocacy does not make any recommendation on coordination in its RFA guide. Because agencies regulate different small entities that could be affected differently by a rule, coordination would not necessarily result in efficiencies or other benefits. In joint rules, the regulators (except for the Board of Governors of the Federal Reserve System (Federal Reserve), which generally treated regulatory flexibility analyses differently) reached the same conclusion to certify, although their analyses sometimes differed. For example, in one joint rule, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) concluded that the rule mainly imposes requirements on states and therefore affected no small entities. The Consumer Financial Protection Bureau agreed that the rule pertained mainly to states, but performed an analysis to assess the indirect impact on small entities, concluding that even indirectly the rule would not have a significant economic impact on a substantial number of small entities. The Federal Reserve found that some entities would be federally regulated but that the number was uncertain but not substantial (less than five). In another joint rule, FDIC concluded that the rule would not have a significant economic impact on a substantial number of small entities because banks with less than $1 billion in assets were exempted. The Small Business Administration defines a small bank as one with assets of $550 million or less; therefore, no small entities would be affected. However, OCC assumed that every bank subject to the rule would be required to comply regardless of the exemption and performed its analysis with that assumption. Under this premise, OCC found that a substantial number of small entities would be affected by the rule but that the economic impact would not be significant. Of the seven joint rules that we reviewed with initial and final regulatory flexibility analyses, the analyses for two rules indicated that regulators collaborated in preparing the analysis. For one rule, the Federal Reserve, FDIC, and OCC published a joint initial analysis but FDIC and OCC made a certification determination in the final rule. For the other rule, the Federal Reserve and OCC prepared separate initial analyses but published a joint final analysis that included separate sections evaluating the potential economic impact of the final rule. The remaining five joint rules included separate regulatory flexibility analyses for each regulator and all but the Federal Reserve reached a certification determination. None of the rules we reviewed with initial and final flexibility analyses that were issued by individual regulators indicated that the regulator had coordinated with other agencies. The following table details the entities regulated by the Commodity Futures Trading Commission (CFTC) that the agency determined were not small entities for the purposes of the Regulatory Flexibility Act (RFA). RFA allows agencies to establish alternative definitions of small entities when appropriate by publishing the definition in the Federal Register and, in the case of small businesses, in consultation with the Small Business Administration’s Office of Advocacy. We reviewed CFTC’s small-entity definitions to assess the extent to which they met these requirements. We reviewed the Federal Register notices for the definition of those entities included in final rules in calendar years 2015 and 2016 where the agency certified that the rule would not have a significant economic impact on a substantial number of small entities. The following table compares the Securities and Exchange Commission’s definitions of small entities for the purposes of the Regulatory Flexibility Act (RFA) with the Small Business Administration’s size standards that RFA uses to define small entities. The Board of Governors of the Federal Reserve System (Federal Reserve) generally performed regulatory flexibility analyses for its rulemakings regardless of the rule’s potential impact on small entities. As shown in table 11, nearly all of the Federal Reserve’s initial and final regulatory flexibility analyses concluded that the rule would not have a significant economic impact on a substantial number of small entities, which generally is a basis for certification. Furthermore, the majority of the Federal Reserve’s analyses stated that the rules either did not apply to small entities or lacked compliance requirements. Table 12 summarizes our findings on the Federal Reserve’s initial and final regulatory flexibility analyses for the 17 rules we reviewed. Table 13 summarizes our findings for the six rules we reviewed for which the Federal Reserve’s regulatory flexibility analysis indicated the rule might impose compliance requirements on small entities. Lawrance L. Evans, Jr., (202) 512-8678, EvansL@gao.gov. In addition to the contact named above, Stefanie Jonkman (Assistant Director), Kevin Averyt (Analyst in Charge), Bethany Benitez, Katherine Carter, Andrew Emmons, Marc Molino, Lauren Mosteller, and Barbara Roesmann made key contributions to this report. Other assistance was provided by Farrah Graham, Courtney LaFountain, and Tim Bober.

Summary: Since the 2007–2009 financial crisis, federal financial regulators have issued hundreds of rules to implement reforms intended to strengthen the financial services industry. Financial regulators must comply with rulemaking requirements such as RFA when drafting and implementing regulations. Congress included a provision in statute for GAO to study these financial services regulations annually. This annual report examines the extent to which and how financial regulators performed required RFA analyses and established policies and procedures for complying with RFA requirements, among other objectives. GAO reviewed the RFA section of financial regulators' Federal Register notices of rulemaking, related internal workpapers, and policies and procedures for conducting RFA analyses. GAO also determined the extent to which regulators' analyses reflected RFA requirements, guidance issued by the Office of Advocacy, and OMB guidance on regulatory analysis. GAO's review covered certifications in 66 final rules and regulatory flexibility analyses in 39 proposed and final rules. To comply with the Regulatory Flexibility Act (RFA), agencies generally must assess the rule's potential impact on small entities and consider alternatives that may minimize any significant economic impact of the rule (regulatory flexibility analyses). Alternatively, agencies may certify that a rule would not have a significant economic impact on a substantial number of small entities. GAO found several weaknesses with the analyses of six financial regulators (Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Securities and Exchange Commission, Commodity Futures Trading Commission, and Consumer Financial Protection Bureau) that could undermine the goal of RFA and limit transparency and public accountability, as shown in the following examples. Certifications. In certifications for rules that regulators determined may affect small entities, regulators conducted analyses to support their conclusions. GAO found many analyses across all regulators lacked key information the Small Business Administration's Office of Advocacy and the Office of Management and Budget (OMB) recommend. Missing information included discussions of data sources or methodologies, consideration of broader economic impacts of the rulemaking (such as cumulative economic impacts of regulations), and definitions of the criteria regulators used for “substantial number” and “significant economic impact.” Regulatory flexibility analyses. In many of the initial and final regulatory flexibility analyses that GAO reviewed, financial regulators' evaluation of key components required by RFA—potential economic effects and alternative regulatory approaches—was limited. Most regulators (five of six) also did not disclose data sources or methodologies used for their analyses, as OMB recommends. For most rules GAO reviewed, regulators (five of six) were unable to provide documentation supporting their regulatory flexibility analyses, as OMB recommends, including analyses supporting certification decisions. However, the extent of documentation varied by regulator. Federal internal control standards state the importance for agency management to establish policies and procedures to achieve objectives. All but one of the financial regulators have guidelines that restate RFA requirements for certification and for preparing regulatory flexibility analyses and provide some information on how to approach these analyses. However, these regulators generally have not developed specific policies and procedures to assist staff in complying with RFA, which may contribute to the weaknesses GAO identified in the analyses. For example, regulators' guidance generally did not include procedures for evaluating a rule's potential economic impact; identifying and assessing regulatory alternatives that could minimize impact on small entities; disclosing methodology and data sources; and creating and maintaining documentation that supports findings. By not developing and implementing comprehensive policies and procedures for RFA analyses, regulators' ability to consistently and effectively meet RFA objectives may be limited. GAO is making a total of 10 recommendations among the six financial regulators reviewed, including that regulators develop and implement specific policies and procedures for consistently complying with RFA requirements and related guidance for conducting RFA analyses. Five agencies generally agreed with the recommendations and one did not provide written comments.