RFA requires that federal agencies, including financial regulators, engaged in substantive rulemaking analyze the impact of proposed and final regulations on small entities. If a rule might have a significant economic impact on a substantial number of small entities, regulators are to consider any significant regulatory alternatives that will achieve statutory objectives while minimizing any significant economic impact on small entities. RFA defines “small entity” to include small businesses, small governmental jurisdictions, and certain small not-for-profit organizations. RFA does not seek preferential treatment for small entities. Rather, it requires agencies to use an analytical process that includes identifying barriers to small business competitiveness and seeks a level playing field for small entities. For each draft rule that requires a notice of proposed rulemaking, RFA requires regulators to prepare an initial regulatory flexibility analysis that contains an assessment of the rule’s potential impact on small entities and describes any significant alternatives to reduce the rule’s significant economic impact on small entities while achieving statutory objectives. Following a public comment period, RFA requires regulators to conduct a similar analysis when they promulgate the final rule. If the head of the agency certifies in the Federal Register that the rule would not have a significant economic impact on a substantial number of small entities, agencies do not have to conduct the initial or final analysis. Certifications must include a statement providing a factual basis for the certification. Section 610 of RFA requires agencies to review, within 10 years of a final rule’s publication, those rules assessed as having a significant economic impact on a substantial number of small entities to determine if they should be continued without change, amended, or rescinded (consistent with statutory objectives) to minimize any significant economic impact on small entities. RFA designates certain responsibilities to the Small Business Administration’s Chief Counsel for Advocacy, including monitoring agency compliance with RFA and reviewing federal rules for their impact on small businesses. Executive Order 13272 requires the Small Business Administration’s Office of Advocacy (Office of Advocacy) to provide notifications and training about RFA requirements. The Office of Advocacy published guidance on RFA compliance in 2003 (updated in 2012 and August 2017). For example, the guidance details components regulators should include in their certifications to obtain meaningful public comments, such as a description and estimate of the economic impact. Under EGRPRA, the Federal Reserve, FDIC, and OCC are to categorize their regulations by type and provide notice and solicit public comment on all regulations for which they have regulatory authority to identify areas of the regulations that are outdated, unnecessary, or unduly burdensome. The act also includes requirements on how the regulators should conduct the reviews, including reporting results to Congress. The first EGRPRA review was completed in 2007. The second began in 2014, and the report summarizing its results was submitted to Congress in March 2017. While NCUA is not required to participate in the EGRPRA review, NCUA has been participating voluntarily. NCUA’s assessment of its regulations appears in separate sections of the 2007 and 2017 reports to Congress. Community bank and credit union representatives we interviewed identified three areas of regulations as most burdensome to their institutions: 1. Data reporting requirements related to loan applicants and loan terms under the Home Mortgage Disclosure Act of 1975 (HMDA). 2. Transaction reporting and customer due diligence requirements as part of the Bank Secrecy Act and related anti-money laundering regulations (collectively, BSA/AML). 3. Disclosures of mortgage loan fees and terms to consumers under the Truth in Lending Act and the Real Estate Settlement Procedures Act of 1974 Integrated Disclosure (TRID) regulation. Institution representatives told us they found these regulations were time- consuming and costly to comply with because the requirements were complex, required individual reports that had to be reviewed for accuracy, or mandated actions within specific timeframes. For example, among the 28 community banks and credit unions whose representatives commented on HMDA-required reporting in our focus groups, 61 percent noted having to conduct additional HMDA-related training. Representatives in most of our focus groups said that they had to purchase or upgrade software systems to comply with BSA/AML requirements, which can be expensive, and some representatives said they have to hire third parties to comply with BSA/AML regulations. Representatives in all of our focus groups and many of our interviews said that the TRID regulations have increased the time their staff spend on compliance, increased the cost of providing mortgage lending services, and delayed the completion of mortgages for customers. However, federal regulators and consumer advocacy groups’ representatives said that benefits from these regulations were significant, such as collecting HMDA data that has helped address discriminatory practices. Staff from Financial Crimes Enforcement Network (FinCEN), which has delegated authority from the Secretary of the Treasury to implement anti-money laundering regulations, told us that the transaction reporting required and due-diligence programs required in BSA/AML rules are critical to safeguarding the U.S. financial sector from illicit activity, including illegal narcotic trafficking proceeds and terrorist financing activities. The Consumer Financial Protection Bureau (CFPB) has taken steps to reduce the burdens for community banks and credit unions associated with the HMDA and TRID regulations. Also, FinCEN has developed several efforts in reducing the reporting requirements from BSA/AML regulations to reduce regulatory burden, such as a continuous evaluation process to look for ways to reduce burden associated with BSA reporting requirements, soliciting feedback through an interagency working group about potential burden, and expanding the ability of institutions to seek a Currency Transaction Report filing exemption when possible. To reduce institutions’ misunderstanding of the TRID regulation, CFPB has published a Small Entity Compliance Guide and a Guide to the Loan Estimate and Closing Disclosure Forms. However, CFPB officials acknowledged that some community banks and credit unions may be misinterpreting the regulation’s requirements. We found that CFPB had not directly assessed the effectiveness of the guidance it provided to community banks and credit unions. Until the guidance is assessed for effectiveness, CFPB may not be able to respond to the risk that small institutions have implemented TRID incorrectly. We recommended that CFPB should assess the effectiveness of TRID guidance to determine the extent to which TRID’s requirements are accurately understood and take steps to address any issues as necessary. CFPB agreed with the recommendations and intends to solicit public input on how it can improve its regulatory guidance and implementation support. One of the ways that financial regulators attempt to address the burden of regulations is during the rulemaking process. For example, staff from the Federal Reserve, FDIC, and OCC all noted that when promulgating rules, their staff seek input from institutions and others throughout the process to design requirements that achieve the goals of the regulation at the most reasonable cost and effort for regulated entities. Once a rule has been drafted, the regulators publish it in the Federal Register for public comment. The staff noted that regulators often make revisions in response to the comments received to try to reduce compliance burdens in the final regulation. Under RFA, financial regulators conduct analyses during the rulemaking process that are intended to minimize economic impact on small entities. However, we found several weaknesses with the RFA analyses, policies, and procedures of six financial regulators— Federal Reserve, OCC, FDIC, Securities and Exchange Commission (SEC), Commodity Futures Trading Commission (CFTC), and CFPB— that could undermine the goal of RFA and limit transparency and public accountability. In reviewing 66 certifications by the six regulators, we found that in most (43 of 66) the regulators provided a factual basis and concluded the rule would not apply to small entities or have any economic impact. According to the regulators, these rules included activities in which small entities do not engage, pertained to the regulator’s internal processes, did not create new regulatory requirements, or eliminated duplicative rules. Additionally, regulators concluded in 5 of 66 certifications that the rule would have a beneficial impact on small entities. Other certifications lacked information that would help explain the determination. Specifically, in 18 of 66 certifications, the regulators found the rule would have some economic impact on small entities, but concluded the impact would not be significant for a substantial number of small entities. But the factual basis provided for most of the 18 certifications (across all six regulators) lacked key components the Office of Advocacy and the Office of Management and Budget (OMB) recommended for understanding the analyses regulators used to support their conclusion. Examples include the following: Data sources or methodologies. In 15 of 18 certifications regulators did not describe or did not fully describe their methodology or data sources for their conclusions. Broader economic impacts. The certifications generally did not address broader economic impacts such as cumulative effects, competitive disadvantage, or disproportionality of effects and focused most of the analysis on specific compliance costs. Defining key criteria. Regulators generally did not define the criteria they used for “substantial number” and “significant economic impact” in their certifications. Limited information. Three certifications included none of the Office of Advocacy’s suggested components, such as the number of affected entities, the size of the economic impacts, or the justification for the certification. While many of the regulators’ certification determinations incorporated key components, the weaknesses and inconsistencies we found could undermine the act’s goal. For example, incomplete disclosure of methodology and data sources could limit the public and affected entities’ ability to offer informed comments in response to regulators’ certification assessments in proposed rules. Our review of recent rules in which the agency performed an initial and final regulatory flexibility analysis found that the evaluation of key components—potential economic effects and alternative regulatory approaches—was limited in many cases, although the extent varied by regulator. RFA requires initial and final analyses to include information to assist the regulator, regulated entities, and the public in evaluating the potential impact of rules on small entities. The most important components include the assessment of a rule’s potential economic effects on small entities—such as compliance costs—and the identification and evaluation of alternative regulatory approaches that may minimize significant economic effects while achieving statutory objectives. The evaluations for some rules of economic impact on small entities did not describe or estimate compliance costs. Analyses we reviewed also generally did not evaluate differences in estimated compliance costs for identified alternatives. Five of six regulators did not consistently disclose the data sources or methodologies used for estimating the number of subject small entities or compliance costs. By not fully assessing potential economic effects or alternatives, regulators may not be fully realizing the opportunity to minimize unnecessary burdens on small entities, which is the primary goal of RFA. Five of six regulators have written guidelines that restate statutory requirements for certifications and preparing regulatory flexibility analyses and provide some additional guidance for staff. However, the regulators generally have not developed comprehensive policies and procedures to assist staff in complying with RFA, which may contribute to the weaknesses we identified in some certifications and regulatory flexibility analyses. Federal internal control standards state the importance for agency management to establish through policies and procedures the actions needed to achieve objectives. The extent to which regulators’ guidance included policies and procedures varied. But the guidance generally did not include procedures for evaluating a rule’s potential economic impact on small entities; identifying and assessing regulatory alternatives that could minimize economic impact on small entities; disclosing methodology and data sources; and creating and maintaining documentation that supports findings. By developing policies and procedures that provide specific direction to rulemaking staff, the regulators could better ensure consistent and complete implementation of RFA requirements and more fully realize the RFA goal of appropriately considering and minimizing impacts on small entities during and after agency rulemakings. In our January 2018 report, we recommended that each of the regulators develop and implement specific policies and procedures for consistently complying with RFA requirements and related guidance for conducting RFA analyses. Five agencies generally agreed with this recommendation and one did not provide written comments. Regulators took some actions to reduce burden as part of EGRPRA reviews, but we also identified opportunities to improve analyses and reporting. To conduct the most recent EGRPRA review, the Federal Reserve, FDIC, and OCC sought comments from banks and others and held public meetings to obtain views on the regulations they administer. In the report they issued in March 2017, the regulators identified six significant areas in which commenters raised concerns: (1) capital rules, (2) Call Reports, (3) appraisal requirements, (4) examination frequency, (5) Community Reinvestment Act, and (6) BSA/AML regulations. In the report, these regulators described various actions that could address some of the concerns that commenters raised including: On September 27, 2017, the regulators proposed several revisions to capital requirements that would apply to banks with less than $250 billion in assets and less than $10 billion in total foreign exposure. For example, the revisions simplify capital treatment for certain commercial real estate loans and would change the treatment of mortgage servicing assets. The regulators developed a new Call Report form for banks with assets of less than $1 billion and domestic offices only. In June 2017 and November 2017, the regulators issued additional proposed revisions, effective June 2018, to the three Call Report forms that banks are required to complete. For example, community banks would report certain assets (nonperforming loans not generating their stated interest rate) less frequently—semi-annually instead of quarterly. The regulators proposed raising the threshold for commercial real estate loans requiring an appraisal from $250,000 to $400,000. They also recently issued guidance on how institutions could obtain waivers or otherwise expand the pool of persons eligible to prepare appraisals if suitable appraisers are unavailable. The three regulators also issued a final rule in 2016 making qualifying depository institutions with less than $1 billion in total assets eligible for an 18-month examination cycle rather than a 12-month cycle. Although NCUA is not required to participate in the EGRPRA process, the 2017 EGRPRA report also includes a section in which NCUA describes actions it has taken to address regulatory burdens on credit unions. In the report, NCUA identified five significant areas raised by commenters relating to credit union regulation, including: (1) field of membership and chartering; (2) member business lending; (3) federal credit union ownership of fixed assets; (4) expansion of national credit union share insurance coverage; and (5) expanded powers for credit unions. In response, NCUA took various actions. For example, NCUA modified and updated its field of credit union membership by revising the definition of a local community, rural district, and underserved area, which provided greater flexibility to federal credit unions seeking to add a rural district to their field of membership. NCUA also lessened some restrictions on member lending to small business and raised some asset thresholds for what would be defined as a small credit union so that fewer requirements would apply to these credit unions. One of the limitations in the EGRPRA process is that the statute mandating the process does not include CFPB and thus the significant mortgage-related regulations and other regulations that it administers— regulations that banks and credit unions generally must follow—were not included in the most recent EGRPRA review. The depository institution regulators cannot address these mortgage regulation-related burdens because they no longer have rulemaking authority for certain consumer financial statutes. However, CFPB does have its own processes to assess the burden of regulations it has implemented. For example, section 1022(d) of the Dodd-Frank Wall Street Reform and Consumer Protection Act requires CFPB to conduct a one-time assessment of each significant rule it adopts under federal consumer financial law within 5 years of the rule’s effective date. But CFPB staff told us that they have not yet determined whether certain other regulations that apply to banks and credit unions, such as the revisions to requirements, will be designated as significant and thus subjected to the one-time assessments. During 2017, CFPB launched an internal task force to coordinate and bolster its continuing efforts to identify and relieve regulatory burdens for small businesses, such as community banks, that potentially will address any regulation the agency has under its jurisdiction. However, CFPB has not provided public information on the extent to which it intends to review regulations applicable to community banks and credit unions or provided information on the timing and frequency of the reviews. In addition, it has not indicated the extent to which it will coordinate the reviews with depository institution regulators as part of EGRPRA reviews. Until CFPB publicly provides additional information indicating its commitment to periodically review the burden of all its regulations, community banks, credit unions, and other depository institutions may face diminished opportunities for regulatory relief. In our February 2018 report, we recommended that CFPB issue public information on its plans for reviewing regulations, including information on the scope of regulations, timing and frequency of reviews, and the extent to which the reviews will be coordinated with the other regulators as part of the EGRPRA reviews. CFPB agreed with the recommendation and committed to developing additional plans for reviews of key regulations and publicly releasing such information. In the interim, CFPB stated it intends to solicit public input on how it should approach reviewing regulations. Another limitation in the EGRPRA process conducted by the Federal Reserve, FDIC, OCC, and NCUA was that these regulators did not conduct or report on quantitative analyses during the EGRPRA process to help them determine if changes to regulations would be warranted. Our analysis of the 2017 EGRPRA report indicated that in responses to comments in which the regulators did not take any action, the regulators generally provided only their arguments against taking actions and did not cite analysis or data to support their narrative. EGRPRA does not require the regulators to collect and report on any quantitative data they collected or analyzed as part of assessing the potential burden of regulations. In contrast, executive branch agencies tasked under executive orders to conduct retrospective reviews of regulations generally must collect and analyze quantitative data as part of assessing the costs and benefits of changing existing regulations. Conducting quantitative analysis for retrospective reviews could serve as a best practice for the depository institution regulators. By not performing and reporting quantitative analyses where appropriate in the EGRPRA review, the regulators may be missing opportunities to better assess regulatory impacts, (including identifying the need for any changes or identifying benefits) and making their analyses more transparent to stakeholders. In our February 2018 report, we recommended that the four depository institution regulators develop plans for their regulatory analyses describing how they will conduct and report on quantitative analysis whenever feasible to strengthen the rigor and transparency of the EGRPRA process. The regulators agreed with the recommendation. For example, the Federal Reserve plans to coordinate with FDIC and OCC to identify opportunities to conduct quantitative analyses where feasible during future EGRPRA reviews. NCUA also said it should improve its quantitative analysis. An additional limitation in the EGRPRA process we identified was that the depository institution regulators had not assessed the ways in which the cumulative burden of the regulations they administer may have created overlapping or duplicative requirements. Under the current process, the regulators have responded to issues raised about individual regulations based on comments they have received, not on bodies of regulations. However, congressional intent in tasking regulators with EGRPRA reviews was to ensure they considered the cumulative effect of financial regulations. A 1995 Senate Committee on Banking, Housing, and Urban Affairs report stated while no one regulation can be singled out as being the most burdensome, and most have meritorious goals, the aggregate burden of banking regulations ultimately affects a bank’s operations, its profitability, and the cost of credit to customers. In our February 2018 report, we recommended to the Federal Reserve, FDIC, NCUA, and OCC that as part of their EGRPRA review they develop plans for conducting evaluations that would identify opportunities to streamline bodies of regulation. The regulators generally agreed with the recommendation and said they would work together to identify ways and opportunities to decrease the regulatory burden created by bodies of regulation. In addition, FDIC stated it would continue to monitor the cumulative effects of regulation; for example, through a review of community and quarterly banking studies and community bank Call Report data. Financial regulators took varying approaches to performing retrospective reviews for RFA; additionally, some regulators had not yet developed policies and procedures for conducting and reporting reviews. We assessed section 610 reviews and found that the Federal Reserve, FDIC, and OCC conducted retrospective reviews that did not fully align with RFA’s requirements. Officials at each of the agencies stated that they satisfy the requirements to perform section 610 reviews through the EGRPRA review process. But the requirements of the EGRPRA reviews differ from those of the RFA-required section 610 reviews. For example, the EGRPRA review process relies on public comments to identify rules that may be outdated, unnecessary, or unduly burdensome, while public comments are only one component of section 610 reviews. The Office of Advocacy stated that agencies may satisfy section 610 requirements through other retrospective reviews if these other reviews meet the criteria of section 610. According to an official from the Office of Advocacy, the office has not yet made a determination on whether the EGRPRA review process satisfies those requirements. Although the agencies stated that they fulfill RFA requirements through EGRPRA, without confirming this with the Office of Advocacy, it is possible that they are not meeting RFA section 610 requirements and therefore may not be achieving the small-entity burden reduction that the statute seeks to ensure. In our January 2018 report, we recommended that the Federal Reserve, FDIC, and OCC coordinate with the Office of Advocacy to determine whether the EGRPRA review process satisfies the requirements of section 610 and, if not, what steps should be taken to align the process with section 610 requirements. The Federal Reserve and FDIC generally agreed with this recommendation, and OCC did not provide written comments. Our review of 46 SEC section 610 reviews found that they were conducted late and were not fully consistent with RFA requirements or the Office of Advocacy’s guidance for such reviews. RFA requires rules to be reviewed within 10 years of their publication as final rules, but SEC conducted all but one of its reviews 12 years after the rules were published. The reviews generally lacked substantive analysis, and no rules were amended as a direct result of their section 610 review. The reviews generally provided no evidence of empirical analysis and no data to support the conclusions of the reviews, as recommended by the Office of Advocacy and OMB. In most cases, the reviews lacked a description of whether, or to what extent, the rule was affecting small entities. SEC does not have written policies or procedures for completing rule reviews pursuant to RFA section 610, potentially contributing to the weaknesses we identified (timing and lack of data and analysis to support findings). Therefore, in our January 2018 report, we recommended that SEC develop and implement specific policies and procedures for performing section 610 reviews. SEC generally agreed with the recommendation. SEC also does not publicly disclose the findings or conclusions of its section 610 reviews. Although RFA does not require that agencies publish the results of 610 reviews, the Office of Advocacy recommends that to enhance transparency, agencies should communicate with interested entities about the reviews. Executive orders also highlight public disclosure of retrospective reviews. Lack of public disclosure limits the transparency of the reviews, hindering the public’s ability to hold agencies accountable for the quality and conclusions of their reviews. In our January 2018 report, we recommended that SEC publicly disclose its section 610 reviews, or summaries, with the basis for any conclusions. SEC generally agreed with the recommendation. CFTC and CFPB plan to put procedures in place for section 610 reviews. According to CFTC officials, the agency has not conducted any section 610 reviews in at least the last 10 years. CFPB has not yet been required to conduct any section 610 reviews. Section 610 reviews are required within 10 years of a rule’s publication as a final rule; to date, none of the rules issued by CFPB, which was created in 2010, have met this deadline. In our January 2018 report, we recommended that CFTC and CFPB develop policies and procedures for section 610 reviews that would include documenting analyses and public reporting of results. CFTC and CFPB generally agreed with the recommendation. Chairman Chabot, Ranking Member Velázquez, and members of the Committee, this concludes my statement. I would be pleased to respond to any questions you may have. If you or your staff have any questions about this testimony, please contact Michael E. Clements, Director, Financial Markets and Community Investment, at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Cody Goebel (Assistant Director), Stefanie Jonkman (Assistant Director), Katherine Carter (Analyst in Charge), Kevin Averyt, Bethany Benitez, Jeremy A. Conley, Pamela R. Davidson, Nancy Eibeck, Andrew Emmons, Courtney L. LaFountain, William V. Lamping, Marc Molino, Lauren Mosteller, Barbara Roesmann, and Jena Y. Sinkfield. Other assistance was provided by Farrah Graham and Tim Bober. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Federal financial regulators must comply with various rulemaking and review requirements, including those in RFA and EGRPRA. These statutes require analyses relating to regulatory burden, small entities, or both. RFA requires analyses of a rule's impact on small entities and alternatives that may minimize any significant economic impact. It also requires agencies to review rules (within 10 years) to determine if the rules should be amended or rescinded. EGRPRA directs specified regulators to review regulations at least every 10 years and identify areas that are outdated, unnecessary, or unduly burdensome on insured depository institutions. This statement is based on findings from GAO's January 2018 report on RFA implementation ( GAO-18-256 ) and February 2018 report on regulatory burden on community banks and credit unions ( GAO-18-213 ). GAO discusses regulatory burdens and how financial regulators address regulatory burdens through the rulemaking process and retrospective reviews. For those reports, GAO's work included reviewing Federal Register notices; regulators' workpapers, policies and procedures; and reports to Congress on EGRPRA reviews. GAO also interviewed more than 60 community banks and credit unions. More than 60 smaller depository institutions told GAO that regulations for reporting mortgage characteristics; reviewing transactions for potentially illicit activity; and disclosing fees, conditions, and mortgage terms to consumers were the most burdensome. Institution representatives said these regulations were time-consuming and costly because the requirements were complex and required reporting that had to be reviewed for accuracy. Financial regulators and others noted these regulations provide various benefits as well, such as preventing lending discrimination or use of the banking system for illicit activity. The Regulatory Flexibility Act (RFA) requires federal agencies to analyze the impact of their regulations on small entities. GAO found several weaknesses with the analyses of six financial regulators—Board of Governors of the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Securities and Exchange Commission, Commodity Futures Trading Commission, and Consumer Financial Protection Bureau (CFPB)—that could undermine the goal of RFA and limit transparency and public accountability. For example, some analyses lacked important information, such as data sources, methodologies, and consideration of broad economic impacts. Evaluations of potential economic effects and alternative regulatory approaches also were limited. Finally, regulators generally lacked comprehensive policies and procedures for RFA implementation. By not developing such policies and procedures, regulators' ability to consistently and effectively meet RFA objectives may be limited. The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) and RFA require regulators to conduct retrospective reviews, and GAO found weaknesses. EGRPRA. GAO found limitations in activities regulators undertook for retrospective reviews under EGRPRA. CFPB, which has regulatory authority for a number of consumer financial laws, was not included in the most recent review process. Moreover, as part of their EGRPRA reviews, the Federal Reserve, OCC, FDIC, and the National Credit Union Administration had not conducted and reported analyses of quantitative data nor had these regulators assessed the cumulative effect of regulations. Addressing these limitations in the EGRPRA processes likely would make the analyses they perform more transparent, and potentially result in additional burden reduction. RFA. The issues GAO identified with RFA retrospective reviews (section 610 reviews) included some regulators using the EGRPRA process to fulfill RFA requirements and gaps or weaknesses in analysis and documentation. But EGRPRA requirements do not fully align with RFA's, and it is not clear if the EGRPRA process satisfies the requirements of section 610. Also, regulators generally have not developed policies and procedures for section 610 reviews. By meeting section 610 review requirements, regulators will be in a better position to minimize any significant economic impact of a rule on a substantial number of small entities, as the statute seeks to ensure. GAO made a total of 20 recommendations to the financial regulators in the two reports to improve their policies and procedures and analysis under RFA and in retrospective reviews. The regulators generally agreed with the recommendations.