The federal financial regulators are responsible for examining and monitoring the safety and soundness of approximately 22,000 financial institutions, which, together, manage more than $13 trillion in assets and hold over $7 trillion in deposits. Specifically: The Federal Reserve System is responsible for overseeing the Year 2000 activities of 1,618 entities, including 990 state member banks, 349 bank holding companies, 221 foreign bank offices, and 9 Edge Act corporations. According to FRS, these organizations have assets totaling over $7.7 trillion and hold deposits of about $3.6 trillion. FRS’ oversight responsibilities also include 49 service providers, software vendors, and data centers. The Office of the Comptroller of the Currency supervises about 2,600 federally-chartered, national banks and federal branches and agencies of foreign banks, which comprise about $3.5 trillion in assets. OCC is also responsible for monitoring the Year 2000 activities of 109 service providers, software vendors, and data centers. The Federal Deposit Insurance Corporation supervises about 6,000 state-chartered, nonmember banks, which are responsible for about $1 trillion in assets. It is also the deposit insurer of approximately 11,000 banks and savings institutions that have insured deposits totaling upwards of $3.8 trillion. FDIC also oversees 146 service providers, software vendors, and data centers. The Office of Thrift Supervision oversees about 1,200 savings and loan associations (thrifts), which primarily emphasize residential mortgage lending and are an important source of housing credit. These institutions hold approximately $737 billion in assets. The National Credit Union Administration supervises about 7,000 federally-chartered credit unions. It is also the deposit insurer of more than 11,000 federally- and state-chartered credit unions whose assets total about $371 billion. Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services. As part of their goal of maintaining safety and soundness, these regulators are responsible for assessing whether the institutions they supervise are adequately mitigating the risks associated with the century date change. To ensure consistent and uniform supervision on the Year 2000 issue, the five regulators are coordinating their supervisory efforts through FFIEC. Additionally, under the auspices of the FFIEC, the regulators are jointly examining 28 major data service providers and software vendors that support the financial institutions. Each of the regulators, except NCUA, is responsible for a specified number of these joint examinations. Addressing the Year 2000 problem in time has been, and will continue to be, a tremendous challenge for financial institutions and their regulators. Virtually every insured financial institution relies on computers—either their own or those of a contractor—to process and update records and for a variety of other functions. To complicate matters, most institutions have computer systems that interface with systems belonging to payment systems partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine (ATM) networks, electronic data interchange systems, and electronic benefits transfer systems. Because of these interdependencies, financial institutions systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems that are not Year 2000 compliant. In addition, financial institutions depend on public infrastructure, such as telecommunications and power networks, to carry out critical business operations, such as making electronic fund transfers, verifying credit card transactions, and making ATM transactions. However, these networks are also susceptible to Year 2000 problems. Thus, financial institutions must also assess the Year 2000 readiness efforts of their local utilities and telecommunications providers. Financial institutions and their regulators cannot afford to neglect any of these issues. If they do, the impact of Year 2000 failures could be potentially disruptive to vital bank operations and harmful to customers. For example, loan systems could make errors in calculating interest and amortization schedules. In turn, these miscalculations may expose institutions and data centers to financial liability and loss of customer confidence. Moreover, ATMs may malfunction, performing erroneous transactions or refusing to process transactions. Other supporting systems critical to the day-to-day business of financial institutions may be affected as well. For example, telephone systems, vaults, and security and alarm systems could malfunction. Since June 1996, when their Year 2000 oversight efforts began, the five financial institution regulators have taken a number of important steps to alert financial institutions of the risks associated with the Year 2000 problem and to assess what these institutions are doing to mitigate the risks. To raise awareness, the regulators issued letters to financial institutions that described the Year 2000 problem and special risks facing financial institutions and recommended approaches to planning and managing effective Year 2000 programs. In addition, the regulators provided extensive guidance to assist financial institutions in critical Year 2000 tasks, including guidance on (1) contingency planning, (2) mitigating risks associated with critical bank customers (e.g., large borrowers and capital providers), (3) mitigating risks of using data processing servicers and software vendors to perform financial institution operations, (4) testing to demonstrate Year 2000 compliance, (5) establishing effective Year 2000 customer awareness programs, and (6) addressing Year 2000 risks associated with fiduciary services. The regulators have also undertaken extensive outreach efforts—such as establishing Internet sites and conducting seminars nationwide—to raise the Year 2000 awareness of banking industry personnel and the public. To assess what institutions are doing to mitigate Year 2000 risks, the regulators performed a high-level and detailed assessment of bank, thrift, and credit union efforts. The high-level assessment consisted primarily of administering FFIEC’s Year 2000 questionnaire via telephone and on-site visits and was completed during November and December 1997. During this assessment, the regulators examined whether institutions had established a structured process for correcting the problem; estimated the costs of remediation; prioritized systems for correction; and determined the Year 2000 impact on other internal systems important to day-to-day operations, such as vaults, security and alarm systems, elevators, and telephones. The more detailed Year 2000 assessment involved on-site visits to the institutions and was completed in June 1998. These examinations focused on whether institutions were appropriately planning for the Year 2000 effort and addressing risks posed by service providers, software vendors, and large customers. They also began to assess whether institutions had effective customer awareness programs. These exams found the majority of financial institutions are doing an adequate job in addressing the Year 2000 issue. Specifically, according to the regulators, they found that of the over 22,000 institutions with examinations completed by June 30, 1998, almost 93 percent were doing a satisfactory job of addressing their Year 2000 problems, about 7 percent needed improvement, and 0.3 percent were performing unsatisfactorily. The regulators plan to follow up with additional on-site visits that will address the unique—and more difficult—challenges that the testing and implementation phases will present. These exams, which the regulators plan to complete by March 31, 1999, are expected to identify institutions that are experiencing difficulties completing their testing and implementation programs or have not developed sufficient contingency plans. In addition to overseeing the efforts of financial institutions to address the Year 2000 problem, the federal regulators must also ensure that their internal computer systems are Year 2000 compliant. This is especially critical for FRS which operates systems on which the financial institutions heavily rely. For example, according to FRS, the Fedwire system was used by financial institutions in 1997 to make about 89 million funds transfers valued at $288 trillion. While systems belonging to the other regulators are not critical to the day-to-day operation of the banking industry, they support the essential business functions of the regulators, such as personnel management, accounting, budget, travel, and program tracking. As noted earlier, we are currently reviewing FRS’ efforts to remediate its internal systems and plan to report the results of our review separately. However, we have reviewed the efforts of the four other regulators to remediate their systems and found that they have taken many actions that are crucial to successfully dealing with the Year 2000 problem. For example, they have established a good foundation for managing their remediation efforts by developing Year 2000 strategies, designating Year 2000 program managers, inventorying systems, and developing tracking systems to monitor progress and prepare status reports. They are acting or have acted to ensure that core business operations are not disrupted by identifying core business operations, assessing the potential impact of Year 2000-induced failures (including public infrastructure failures) on those operations, prioritizing conversion efforts, and developing contingency plans. The regulators also have identified their data exchanges and are working with their data exchange partners to prevent noncompliant systems from introducing Year 2000 errors into compliant systems. Finally, to ensure that their systems are adequately tested, the regulators have developed Year 2000 testing guidance and have begun or are well underway in testing their systems. In September 1998, each of the regulators reported to the Congress that they are on schedule to meet the Office of Management and Budget’s March 1999 implementation date for their mission-critical systems. Their data indicate that, with continued good management, the regulators should be able to meet this milestone. While the regulators have been working hard to achieve industrywide compliance and remediate their own systems, we have identified concerns and problems with their efforts during the course of our reviews. Specifically, we found that all the regulators were late in initiating their Year 2000 oversight of institutions and in issuing key guidance on business continuity and contingency planning, corporate borrowers, and service providers and software vendors. We also found that the regulators had not assessed whether they had enough information system examiners to adequately oversee the Year 2000 efforts of the institutions they supervise. In addition to these general concerns, we also found problems specific to each agency. However, the regulators have been quick to respond to our recommendations and to implement corrective actions. For example, in October 1997, we made recommendations to NCUA to help it ensure that credit unions were adequately mitigating Year 2000 risks.