The federal financial regulators are responsible for examining and monitoring the safety and soundness of approximately 22,000 financial institutions, which, together, manage more than $6 trillion in assets and hold over $3 trillion in deposits. Specifically, The Federal Reserve System supervises about 992 state-chartered, member banks and bank holding companies, which are responsible for $1.2 trillion in assets. The Office of the Comptroller of the Currency (OCC) supervises approximately 2,600 federally-chartered, national banks, which comprise about $2.9 trillion in assets—about 58 percent of the total $5 trillion assets of the FDIC-insured commercial banks. OCC also supervises federal branches and agencies of foreign banks. FDIC supervises about 6,200 state-chartered, nonmember banks, which are responsible for $1 trillion in assets. It is also the deposit insurer of approximately 11,000 banks and savings institutions that have insured deposits totaling upwards of $2.7 trillion. OTS oversees about 1,200 savings and loan associations (thrifts), which primarily emphasize residential mortgage lending and are an important source of housing credit. These institutions hold approximately $770 billion in assets. NCUA supervises and insures more than 11,000 federally- and state-chartered credit unions whose assets total about $345 billion. Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services. As part of their goal of maintaining safety and soundness, these regulators are responsible for assessing whether the institutions they supervise are adequately mitigating the risks associated with the century date change. To ensure consistent and uniform supervision on Year 2000 issues, the five regulators are coordinating their supervisory efforts through FFIEC. For example, they jointly prepared and issued Year 2000-related guidance and letters to banks, thrifts, and credit unions. They also worked together to develop and issue, in May 1997, Year 2000 examination procedures and guidance for all examiners to use in performing their work at the institutions. Additionally, the regulators—under the auspices of FFIEC—are jointly examining the major data service providers and software vendors that support the financial institutions. According to the regulators, virtually every insured financial institution relies on computers—either their own or those of a third-party contractor—to provide for processing and updating of records and a variety of other functions. Because computers are essential to their survival, the regulators believe that all institutions are vulnerable to the problems associated with the year 2000. Failure to address Year 2000 computer issues could lead, for example, to errors in calculating interest and amortization schedules. Moreover, automated teller machines may malfunction, performing erroneous transactions or refusing to process transactions. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and loss of customer confidence. Other supporting systems critical to the day-to-day business of financial institutions may be affected as well. For example, telephone systems, vaults, and security and alarm systems could malfunction. In addressing the Year 2000 problem, financial institutions must also consider the computer systems that interface with, or connect to, their own systems. These systems may belong to payment system partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because these systems are also vulnerable to the Year 2000 problem, they can introduce errors into bank, thrift, and credit union systems. In addition to these computer system risks, many financial institutions also face business risks from the Year 2000: exposure from their corporate customers’ inability to manage their own Year 2000 compliance efforts successfully. Consequently, in addition to correcting their computer systems, these institutions have to periodically assess the Year 2000 efforts of large corporate customers to determine whether they are sufficient to avoid significant disruptions to operations. FFIEC established a working group to develop guidance on assessing the risk corporate customers pose to financial institutions and the group issued guidance on March 17, 1998. The Year 2000 efforts of the five regulators began in June 1996, when, through FFIEC, they formally alerted banks, thrifts, and credit unions to the potential dangers of the Year 2000 problem by issuing an awareness letter to chief executive officers. This letter described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. It also called on institutions to perform a risk assessment of how systems are affected and develop a detailed action plan to fix them. In May 1997, the regulators issued a second, more detailed awareness letter that described the five-phase approach to planning and managing an effective Year 2000 program and highlighted external issues requiring management attention, such as reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers. The letter also related regulatory plans to facilitate Year 2000 evaluations by using uniform examination procedures. It directed institutions to inventory their core computer functions and set priorities for Year 2000 goals by September 30, 1997. It also directed them to complete programming changes and to have testing of mission-critical systems underway by December 31, 1998. As regulators alerted institutions to the Year 2000 problem, they began assessing whether banks, thrifts, and credit unions had established a structured process for correcting the problem; estimated the costs of remediation; prioritized systems for correction; and determined the Year 2000 impact on other internal systems important to day-to-day operations, such as vaults, security and alarm systems, elevators, and telephones. This initial assessment was completed during November and December 1997. Among other things, it revealed that most institutions were aware of Year 2000 and taking actions to correct their systems. However, the three regulators we reviewed reported—based on the initial assessment—that in total, over 5,000 institutions were not adequately addressing the problem. For example, OTS designated about 170 thrifts as being at high risk due to poor performance in conducting awareness and assessment phase activities. Additionally, FDIC identified over 200 banks that were not adequately addressing Year 2000 risks and 500 banks that were very reliant on third-party servicers and software providers but had not followed up with them to determine their Year 2000 readiness. Furthermore, NCUA reported that it had formal agreements for corrective action with 4,862 credit unions deemed not to be making sufficient progress in at least one awareness or assessment phase activity. The regulators are now conducting a more detailed assessment of Year 2000 readiness. This assessment will involve on-site examinations of institutions and their major data processing services and software vendors. These visits are expected to be completed by the end of June 1998. The results of the servicer assessments will be provided to the banks, thrifts, and credit unions that use these services. Once the on-site assessments are completed, the regulators expect to have a better idea of where the industry stands, which institutions need close attention, and, thus, where to focus supervisory efforts. As noted in our summary, the regulators must successfully address a number of problems to provide adequate assurance that financial institutions will meet the Year 2000 challenge. First, all were behind in assessing individual institution’s readiness due to the fact that they got a late start. For example, the regulators did not complete their initial institution assessments until November and December 1997. According to OMB guidance and GAO’s Assessment Guide, these activities should have occurred by the summer of 1997. Because the regulators are behind the recommended timelines, the time available for assessing institutions’ progress during renovation, validation, and implementation phases and for taking needed corrective actions is compressed. Second, we also found that the FFIEC-developed examination work program and guidance for the initial and follow-on assessments were not designed to collect all the data needed to determine where (i.e., in which phase) the institutions are in the Year 2000 correction process. For example, the guidance for the work program does not contain questions that ask whether specific phases have been completed. In addition, the work program used to perform the on-site assessments is not organized by the 5 phases of the Year 2000 correction process. Furthermore, the terms used in the guidance to describe progress are vague. For example, it notes that banks should be well into assessment by the end of the third quarter of 1997, that renovation for mission-critical systems should largely be completed, and testing should be well underway by December 31, 1998. Without defining any of these terms, it would be very hard to deliver uniform assessments on the status of institutions’ Year 2000 efforts. At the time of our reviews, OTS had issued additional examination guidance and procedures to supplement those of FFIEC. This supplemental guidance, if implemented correctly, will address the FFIEC examination procedure’s shortcomings. However, although we reviewed FDIC and NCUA earlier in the process, we found that both were using or planning to use the FFIEC guidance for their initial and follow-on assessments. We were concerned at the time that by using the FFIEC guidance, FDIC and NCUA would not be able to develop an accurate picture of their institutions’ Year 2000 readiness. In the case of FDIC, this problem was compounded by the fact that the tracking questionnaire FDIC examiners were to complete after their on-site assessment also did not ask enough questions to determine whether the bank had fully addressed the phases. Since our work, FDIC and NCUA have responded to our findings by providing examiners with supplemental guidance, which we think is a positive development. FDIC officials told us that they are also in the process of going back to institutions and asking more detailed questions to provide added assurance that the corporation can tell precisely where each bank is in the Year 2000 correction process. Third, FFIEC is still developing key Year 2000 guidance.