Category: Financial Institutions and Banking

Categories
Financial Institutions and Banking

Bank Wire

Crypto-assets: Handle with care

In January 2023, the federal banking agencies published “Joint Statement on Crypto-Asset Risks to Banking Organizations.” The statement cautions banks to be aware of — and, if applicable, mitigate — the risks associated with crypto-assets. According to the statement, these risks include:

  • Fraud and scams,
  • Legal uncertainties regarding custody practices, redemptions and ownership rights,
  • Inaccurate or misleading representations or disclosures, including misrepresentations regarding FDIC coverage,
  • Significant volatility, including potential impacts on deposit flows,
  • Stablecoins’ susceptibility to run risk,
  • Contagion risk resulting from interconnections among crypto-asset participants,
  • Lack of mature, robust risk management and governance practices in the crypto-asset sector, and
  • Heightened risks associated with open, public or decentralized networks (for example, lack of governance mechanisms, absence of contracts, or standards to clearly establish roles, responsibilities and liabilities).

The statement instructs banks to “ensure that crypto-asset-related activities can be performed in a safe and sound manner, are legally permissible, and comply with applicable laws and regulations,” including consumer protection laws. Notably, the statement opines that “issuing or holding as principal crypto-assets that are issued, stored, or transferred on an open, public, and/or decentralized network, or similar system is highly likely to be inconsistent with safe and sound banking practices.”

Be prepared to report computer security incidents

As concerns over cybersecurity intensify, banks should be prepared to report computer security incidents to federal regulators quickly. Under a rule that took effect last spring, banks must report computer security incidents that rise to the level of a “notification incident” within 36 hours. The rule defines “computer security incident” as an “occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.” These incidents aren’t limited to cyberattacks — they also can result from hardware or software failures, human error or other nonmalicious causes.

A computer security incident is deemed to be a notification incident if it’s reasonably likely to materially disrupt or degrade a bank’s 1) ability to carry out banking operations, activities or processes, or deliver products and services to customers, 2) business lines whose failure would result in a material loss of revenue, profit or franchise value, or 3) operations whose failure would pose a threat to U.S. financial stability. All banks should have procedures in place for identifying notification incidents and reporting them to their primary regulators on a timely basis.

© 2023

Categories
Financial Institutions and Banking

Strengthen Your Defenses: Preparing for ransomware attacks

In October 2021, a California community bank was victimized by a ransomware attack. The hackers obtained sensitive information from the bank’s systems, including loan application forms, tax returns, W-2 information, payroll records, names, addresses and Social Security numbers. They threatened to release this information if the bank failed to negotiate.

The bank incurred significant financial costs and reputational damage associated with the attack. It also offered free credit monitoring and identity theft protection services to affected customers. This is just one of many examples of community banks that have been targeted by ransomware attacks in recent years.

Double trouble

There was a time when smaller banks reasonably believed that cybercriminals would leave them alone, because larger institutions offered a bigger payoff. Recently, however, the trend has reversed. Cybercriminals are now targeting small banks, which they believe lack the wherewithal to protect against these attacks and have less robust internal controls than larger institutions.

A new ransomware scheme involves so-called “double extortion” attacks. In a traditional ransomware attack, the cybercriminal sends a phishing email to a bank employee or other user of the bank’s systems. If the recipient clicks on the link in the email, it introduces malware that infects the bank’s system, encrypting its data. The cybercriminal demands a ransom payment in exchange for the decryption key.

In some cases, however, victims were able to quickly restore their systems from unaffected backups and thus refused to pay the ransom. To avoid this result, a double extortion attack involves stealing sensitive data and threatening to release it if the ransom isn’t paid.

Protective measures

To minimize the risks associated with ransomware attacks, community banks should follow industry practices recommended by the Federal Financial Institutions Examination Council (FFIEC) and other federal banking agencies. These include:

  • Regularly assessing the bank’s exposure to ransomware risks and patching any vulnerabilities,
  • Educating employees about the risks of ransomware and training them on identifying and reporting potential attacks,
  • Inventorying hardware, software, connections and data, with programs in place that identify vulnerabilities,
  • Implementing backup systems designed to protect data from cybercriminals,
  • Segmenting networks to limit a cybercriminal’s access within the system if a breach occurs,
  • Managing third-party risks that expose the bank to ransomware attacks,
  • Implementing email filtering processes that identify malicious messages and prevent them from reaching end users, and
  • Restricting the use of employees’ personal devices on the bank’s network.

Be aware that payment of ransomware may result in sanctions if the cybercriminal is listed by the Office of Foreign Assets Control (OFAC) as a known or suspected terrorist or terrorist organization. Reporting ransomware demands promptly to the federal authorities can help mitigate these sanctions. Banks also may need to file Suspicious Activity Reports (SARs) in connection with ransomware payments.

Another critical tool for defending your bank against cyberattacks is a program of regular system vulnerability assessments and penetration tests. Vulnerability assessments involve scanning all internal and external networks to identify security flaws or weaknesses. Penetration testing — a form of “ethical hacking” — involves the intentional launching of simulated cyberattacks to identify any vulnerabilities that can be exploited to compromise the bank’s systems or data. It can also be used to test the bank’s security policies, employees’ security awareness, and the bank’s ability to flag and respond to security issues as they happen.

Typically, vulnerability assessments should be conducted twice a year and penetration testing should be done annually. But the appropriate frequency of testing depends on your bank’s circumstances and resources.

Have a plan

As cyber risks continue to mount, your bank needs a comprehensive cybersecurity plan that reduces risks and minimizes damages should they occur. It should include an incident response protocol for containing an incident, coordinating with law enforcement and third parties, restoring systems, preserving data and evidence, providing customer assistance, and reporting the incident to the relevant federal banking regulator within 36 hours.

© 2023

Categories
Financial Institutions and Banking

How To Assess and Deal With BSA/AML Risks

Over the past few years, many people have turned to electronic banking (e-banking), whether for individual or business purposes. While e-banking may be convenient, it also may increase the possibility of hidden criminal behavior. In addition, compliance with Bank Secrecy Act/Anti-Money Laundering (BSA/AML) laws and regulations is increasingly scrutinized by banking regulators. This puts banks in the middle of a potentially difficult — even dangerous — situation, unless they develop strategies to both assess and handle any related risks.

Get with the program

To help combat money laundering and terrorist financing, banks must develop and implement comprehensive BSA/AML programs. These programs ensure banks know their customers, monitor transactions, identify suspicious activity, and share information with the government and other financial institutions.

Federal regulators emphasize a risk-based approach to BSA/AML compliance. In other words, a bank is expected to conduct a thorough risk assessment and develop policies, procedures and processes that are adequate for its size, location, customer base, products and services.

Determine the impact

E-banking — including online account opening, ATM transactions, Internet banking transactions, remote deposit capture (RDC), telephone banking and mobile banking apps — can increase a bank’s BSA/AML risks. The lack of face-to-face contact in e-banking transactions introduces a heightened level of risk to institutions by making them vulnerable to unauthorized users accessing customer accounts. As your bank introduces new e-banking products and services, it’s imperative to evaluate their impact on your BSA/AML program.

For example, online account opening without face-to-face contact may heighten your risk because:

  • Verifying the customer’s identity is more difficult,
  • The customer may be outside the bank’s targeted geographic area,
  • The customer may perceive these transactions as less transparent, and
  • A front company or unknown third party may use the account.

To mitigate these risks, banks should ensure that their BSA/AML monitoring, identification and reporting systems are properly equipped to flag unusual and suspicious activities conducted electronically. Useful tools include ATM activity reports, funds-transfer reports, new-account-activity reports and change-of-Internet-address reports. Reports that identify related or linked accounts are particularly effective in an e-banking context. These reports reveal accounts with common addresses, phone numbers, email addresses and taxpayer identification numbers.

Additional risk-mitigating controls may include imposing limits on 1) the types and sizes of transactions that can be conducted through e-banking platforms, 2) the volume and frequency of online-initiated transactions, if allowed, and 3) online accounts to ensure they’re offered only to established customers. Banks need to develop effective and reliable methods for authenticating customers’ identities when they open accounts online (such as “out of wallet” questions that only that person can answer).

Reduce RDC risks

While RDC provides obvious benefits to customers, it exposes banks to money laundering, fraud and information security risks. For example, fraudulent, sequentially numbered or physically altered checks may be harder to detect when they’re submitted via RDC. Plus, it’s difficult for banks to control or locate RDC equipment, particularly when foreign correspondents and foreign money service businesses increasingly rely on RDC.

Inadequate controls can result in altered deposit data, duplicate deposits and other problems. Also, customers or service providers typically retain original checks or other deposit items, which may create recordkeeping, data safety and integrity issues.

Potential risk mitigation steps include:

  • Performing a comprehensive RDC risk assessment before implementation,
  • Conducting appropriate customer due diligence and enhanced due diligence,
  • Establishing risk-based parameters for RDC customer suitability, such as lists of acceptable industries and standardized underwriting criteria,
  • Comparing an RDC customer’s expected account activity to actual activity,
  • Establishing RDC transaction limits, and
  • Ensuring that RDC customers receive adequate training.

Contracts should clearly set out the relative roles, responsibilities and liabilities of the bank and its customers with respect to RDC transactions. This includes procedures for handling and disposing of original documents.

Being vigilant

Make sure your bank remains watchful for ongoing BSA/AML issues and other potential risks resulting from e-banking. There’s no going back — e-banking is here to stay. The best strategy is to ensure your bank remains fully compliant, with all appropriate processes and procedures in place.

© 2023

Categories
Financial Institutions and Banking

Should You Outsource The Internal Audit Function?

A solid internal audit program is one of the most effective tools a bank has to inspire confidence — among directors, investors, regulators, and other stakeholders — in its financial processes and reporting practices. Many banks outsource the internal audit function, in whole or in part, to take advantage of external auditors’ special skills and independence, address internal staffing shortages, and control costs. Here are some factors to consider when deciding whether to outsource this function.

Advantages of outsourcing

First and foremost, by outsourcing the internal audit, a community bank can tap a level of skill and expertise — critical in the highly regulated banking industry — that may be difficult to find or too expensive to maintain in-house. Access to this expertise is particularly beneficial for banks in smaller communities and those that want to expand their product or service offerings or enter new markets. External auditors may also have access to more sophisticated software or other audit tools that would otherwise be cost-prohibitive for a community bank.

Second, in the wake of the COVID-19 pandemic, many businesses, including banks, are facing severe labor shortages. Outsourcing the internal audit function allows them to focus on filling core positions.

Third, outsourcing can help a bank control costs. It allows the bank to set an internal audit budget that meets its needs and design a program that has more flexibility. The bank avoids the fixed labor and overhead costs associated with an internal audit staff, and it can adjust the use of outside consultants as its internal audit needs fluctuate or special projects arise.

Finally, outsourcing can help enhance auditor independence. In-house auditors who develop relationships with other bank staff may lose some objectivity — or at least the appearance of objectivity. Outsourcing also facilitates the rotation of internal auditors, something that’s difficult to do in-house.

Disadvantages of outsourcing

One potential downside is that outside consultants generally lack an insider’s in-depth knowledge about the bank’s operations, particularly when outsourced auditors are rotated frequently. The resulting learning curve may reduce the cost-effectiveness of an outsourced audit. To overcome this obstacle, some community banks outsource the internal audit function to their external auditors. Although doing so is permissible under specific circumstances, a bank should consider the potential impact on the external auditor’s independence before taking this approach.

Also, outsourcing arrangements require meticulous planning and monitoring, including a comprehensive engagement letter and regular communication. It’s critical to ensure that the parties are on the same page regarding the auditing firm’s activities, the scope of the audit and the advice provided by the auditor.

Outsourcing vs. co-sourcing

Co-sourcing can be an attractive alternative to fully outsourcing the internal audit function. As the name suggests, it involves splitting internal audit activities between internal and external auditors. This approach can take many forms, depending on the bank’s needs. A short-staffed bank might use outside auditors to supplement its staff and share various auditing tasks and responsibilities.

Co-sourcing also can be a good strategy if a bank’s internal audit staff lacks certain specialized skills. For example, if in-house staff isn’t equipped to perform specialized audits — such as information technology or Bank Secrecy Act/Anti-Money Laundering (BSA/AML) audits — the bank might engage an outside auditor to conduct those audits while its internal staff focuses on areas within its skill set.

A powerful tool

A well-designed internal audit program can be a powerful tool for evaluating a bank’s internal controls, processes, and procedures. Internal auditors also can recommend improvements and share their findings with the bank’s board of directors and other stakeholders. Whether conducted in-house, outsourced or co-sourced, an internal audit provides an opportunity for a fresh look at a bank’s operations by auditors who are independent from management.

Sidebar: Managing third-party risk

For banks that outsource or co-source the internal audit function, it’s important to recognize that doing so doesn’t absolve the bank’s board or management from responsibility for the internal audit. This function also doesn’t relieve the bank from liability for compliance or consumer protection issues associated with outsourced activities.

Before you enter an outsourcing relationship, review the federal banking regulators’ guidance on managing third-party risk, including the Office of the Comptroller of the Currency’s “Interagency Policy Statement on the Internal Audit Function and its Outsourcing.” Failure to properly manage this risk can result in financial loss and regulatory action. It can also jeopardize your bank’s reputation.

Among other things, a bank should:

  • Conduct a risk assessment to weigh the benefits and risks, including service provider risk, of outsourcing the internal audit.
  • Exercise due diligence in vetting the provider — including an examination of its background, reputation, financial condition, internal controls, disaster recovery plans, and business continuity plans.
  • Be sure that the contract or engagement letter clearly spells out each party’s rights and responsibilities. (For example, it should provide details on performance benchmarks, information sharing, audit rights, compliance, confidentiality, and indemnification.)
  • Monitor the provider’s performance and compliance with contract terms throughout the life of the arrangement.
  • Have a contingency plan in place in the event there are any disruptions in service.

© 2023

Categories
Financial Institutions and Banking

Bank Wire

FDIC offers guidance on multiple NSF fees

Recently, the FDIC issued guidance to address consumer compliance risks associated with assessing multiple nonsufficient funds (NSF) fees arising from re-presentment of the same unpaid transaction. This issue often comes up when transactions are presented for payment that can’t be covered by a customer’s balance, the bank charges NSF fees and the merchant subsequently resubmits the transaction for payment.

According to the FDIC, if the bank charges additional NSF fees for the same transaction, there’s “an elevated risk of violations of law and harm to consumers.” This risk may arise, for example, because disclosures didn’t fully or clearly describe the bank’s re-presentment policy by explaining that the same unpaid transaction might result in multiple NSF fees. As a result, there may be a heightened risk of violating the Federal Trade Commission Act’s unfair or deceptive acts or practices (UDAP) provisions.

The guidance encourages banks to review their practices and disclosures regarding NSF fees for re-presented transactions and to adjust them if necessary. If violations are noted, the FDIC expects banks to make restitution.

Complying with the updated FTC Safeguards Rule

In December 2021, the Federal Trade Commission (FTC) updated its Standards for Safeguarding Customer Information (Safeguards Rule). It’s generally applicable as of January 10, 2022, with some requirements taking effect December 9, 2022. According to the FTC, the amended rule preserves the flexibility of the original while providing more concrete guidance. “It reflects core data security principles that all covered companies need to implement,” the FTC explains. Some institutions are exempt, including those that maintain customer information concerning fewer than 5,000 consumers.

Financial institutions — including mortgage lenders, collection agencies, tax preparation firms, and non-federally insured credit unions — should review their information security programs to ensure that they comply with the latest standards. A good place to start is the FTC’s publication, “FTC Safeguards Rule: What Your Business Needs to Know,” which you can find at https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know.

Failure to safeguard data may violate consumer protection laws

In a recent circular, the Consumer Financial Protection Bureau (CFPB) confirmed that banks and other financial companies that fail to safeguard consumer data may violate federal consumer financial protection laws. The circular warns companies they risk violating the Consumer Financial Protection Act if they fail to have adequate measures to protect against data security incidents. It also provides examples of data security measures that, if not implemented, may trigger liability. These include multifactor authentication, adequate password management, and timely software updates.

© 2022

Categories
Financial Institutions and Banking

Should Community Banks Think About ESG Initiatives?

An increasing number of organizations — including many banks — are embracing environmental, social, and governance (ESG) initiatives. Although being a good corporate citizen may be its own reward, there’s evidence that responsible ESG practices may produce ample financial benefits.

What is ESG?

ESG generally refers to:

  • Environmental practices, including your bank’s use of energy, production of waste, and consumption of resources,
  • Social practices, including fair labor practices, worker health and safety, diversity and inclusivity, and other aspects of your bank’s relationships with people, institutions, and the community, and
  • Governance practices, including business ethics, integrity, openness, transparency, legal compliance, executive compensation, data protection, and product quality and safety.

Simply put, ESG means recognizing your bank’s impact on the environment and the people and institutions it interacts with.

Why should you care?

In recent years, pressure has been increasing on all businesses, including banks, to adopt responsible ESG practices. This pressure has been coming from a variety of stakeholders. For example, customers are increasingly considering ESG issues — such as product safety, environmental impact, and fair labor practices — when deciding which organizations to do business with. And many investors are making ESG a priority when deciding where to invest their capital.

Consider this: The U.S. Forum for Sustainable and Responsible Investment reported that from 2018 to 2020, the value of U.S. assets managed according to ESG principles increased from $12 trillion to $17 trillion. This represents one-third of all assets under management.

Another reason to adopt ESG practices is its potential impact on financial performance. A number of studies have shown that embracing ESG can lead to higher sales, reduced costs (including energy and compliance costs), and increased access to capital. Consulting firm McKinsey reviewed more than 2,000 academic studies of ESG and found around 70% report a positive relationship between ESG scores and financial returns, whether measured by returns on equity, profitability, or valuation multiples.

ESG also may improve a bank’s ability to attract and motivate talented employees — a significant benefit given the ongoing shortage of qualified workers. According to McKinsey, “A strong ESG proposition can help companies attract and retain quality employees, enhance employee motivation by instilling a sense of purpose, and increase productivity overall.”

Will ESG initiatives be mandated?

To date, ESG initiatives have been voluntary, but that could change as federal financial regulators are starting to pay more attention to ESG issues. For example, the FDIC and Office of the Comptroller of the Currency (OCC) have issued draft principles for managing exposures to climate-related financial risks. Although the proposals target larger banks, regulators have indicated that they expect community and midsize banks to develop climate-related financial risk management practices. The Securities and Exchange Commission has also proposed ESG disclosure requirements for companies it regulates. And the Federal Housing Finance Agency (FHFA) has added “resiliency to climate risk” to its list of institution assessment criteria.

Finally, although not yet required, an increasing number of companies are incorporating ESG information into their financial reports, combining nonfinancial and financial information into an integrated report. Many experts believe that these reports provide a more accurate picture of a company’s long-term value-creation potential. Banks should consider whether they should prepare this type of report or ask their customers to do so.

Can ESG initiatives benefit your bank?

Adopting ESG initiatives is viewed by many as a best practice, but it may very well be required — or at least strongly encouraged — by regulators in the future. Banks might benefit from evaluating the ESG impact of their activities and considering ways to incorporate ESG practices and initiatives into their operations.

© 2022

Categories
Financial Institutions and Banking

True or False? Assess Borrowers’ Financial Restatements

Businesses need to assess their financial status periodically in light of changing economic or industry conditions. This includes examining their financial statements to ensure the statements continue to be adequate, accurate and complete. Occasionally, business owners or financial officers may determine that the financial statements need to be revised or corrected. When your borrowers provide you with corrected or restated financial statements, be vigilant and double-check the numbers. It may be that the restatements simply correct an honest mistake. Alternatively, there may be fraud involved.

When a mistake becomes intentional

When Tom took over his aunt’s marketing company, the lender quickly discovered that Tom’s accounting skills hadn’t kept pace with his marketing abilities. The company engaged in various types of related-party transactions, including seller financing and a leasing arrangement with the previous owner. Tom also seemed unsure when to capitalize or expense supplies and equipment.

After two years of sloppy, delayed financial reporting, Tom’s lender recommended hiring an accountant for financial reporting and tax expertise. Shortly thereafter, the lender received an unwelcome surprise: The company needed to reissue its financial statements for the past three years.

Ultimately, the restatements revealed that Tom had overstated profits by more than $3 million over the last three years. When confronted with the news, he confessed that he’d been intentionally padding profits, because he didn’t want to disappoint his aunt.

The lender called the company’s $4 million line of credit. Tom was forced to confess his mismanagement to his aunt, who eventually left retirement to turn around the business.

When complex rules invite misinterpretation

Not all restatements result from misleading or unethical management. Often owners and managers just aren’t on top of today’s increasingly complex accounting rules — and honest mistakes or misinterpretations cause a restatement.

Restatements typically occur when the company’s financial statements are subjected to a higher level of scrutiny. For example, restatements may happen when a borrower converts from compiled financial statements to audited financial statements or decides to file for an initial public offering. They also may be needed when the borrower brings in additional internal (or external) accounting expertise, such as a new controller or audit firm.

The restatement process can be time-consuming and costly. Regular communication with interested parties — including lenders and shareholders — can help overcome the negative stigma associated with restatements. Management also needs to reassure employees, customers and suppliers that the company is in sound financial shape to ensure their continued support.

When errors become significant

Errors are a common cause of financial restatements. For example, borrowers sometimes make mistakes when accounting for leases or reporting compensation expense from backdated stock options.

Income statement and balance sheet misclassifications also cause a large number of restatements. For instance, a borrower may need to shift cash flows among investing, financing and operating on the statement of cash flows. Other leading causes of restatements are equity transaction errors, such as improper accounting for business combinations and convertible securities, and valuation errors related to common stock issuances. Preferred stock errors and the complex rules related to acquisitions, investments, revenue recognition and tax accounting also can cause restatements.

You can minimize your dependence on bad numbers by requiring independent audits for private borrowers. You also may request cost-effective internal control testing procedures for prospective and high-risk borrowers, such as those that engage in hedge accounting, issue stock options, use special purpose or variable interest entities, or consolidate financial statements with related parties.

Mistakes happen

Even the most well-managed business may slip up and make financial statement mistakes that need to be corrected. But some restatements are a warning flag — not just of potential fraud but of mismanagement or carelessness. When a borrower presents you with financial restatements, investigate the underlying cause to stay ahead of any potential problems.

© 2022

Categories
Financial Institutions and Banking

Monitoring and Managing Interest Rate Risk

For community banks, interest rate risk is a part of doing business, so it’s critical for banks to monitor that risk and take steps to control it. The “right” level of risk depends on several factors, including the size and complexity of a bank’s operations, as well as the sufficiency of its capital and liquidity to withstand the potential adverse impact of interest rate fluctuations.

Managing interest rate risk is particularly important in light of recent rate increases. The Office of the Comptroller of the Currency (OCC), in its Fiscal Year 2023 Bank Supervision Operating Plan, instructed examiners to determine whether banks appropriately manage interest rate risk through “effective asset and liability risk management practices,” noting that “rising rates may negatively affect asset values, deposit stability, liquidity, and earnings.”

Types of interest rate risk

In simple terms, interest rate risk means risk to a bank’s financial condition or resilience (that is, its ability to withstand periods of stress) caused by movements in interest rates. There are several types of interest rate risk, including:

Repricing risk. Banks experience this risk when their assets and liabilities reprice or mature at different times. Suppose, for example, that a bank makes a five-year, fixed-rate loan at 7% that’s funded by a six-month certificate of deposit (CD) at 3%. Every six months, when the CD renews, the bank is exposed to repricing risk. If the CD rate increases to 4% after six months, then the bank’s net interest income drops from 4% to 3%. Conversely, if the CD rate declines, the bank’s net interest income increases.

To gauge repricing risk, banks can compare their volume of assets and liabilities that mature or reprice over a given time period. The potential impact of fluctuating interest rates will depend in part on whether a bank is asset- or liability-sensitive. If it’s asset-sensitive — meaning assets reprice more quickly than liabilities — then its earnings generally increase when interest rates rise and decrease when they fall. If it’s liability-sensitive — meaning liabilities reprice more quickly than assets — then its earnings generally increase when interest rates fall and decrease when they rise. Some banks are neutral — that is, their assets and liabilities reprice at the same time.

Basis risk. This risk arises when there’s a shift in the relationship between rates in different markets or on different financial instruments. Suppose, for example, that an asset and a related liability are tied to the prime rate and the one-year U.S. Treasury rate, respectively. If the spread between those two rates widens or narrows, it will affect the bank’s net interest margins.

Yield curve risk. This risk arises from changes in the relationships among yields from similar instruments with different maturities. Suppose, for example, that a bank funds long-term loans with short-term deposits. A typical yield curve reflects rates that rise as maturities increase. However, if market conditions cause the yield curve to flatten or even slope downward, the bank’s net interest margins can shrink or even turn negative.

Options risk. Bank assets and liabilities often contain embedded options, such as the right to pay off a loan or withdraw deposits early with little or no penalty. The bank is compensated for offering customers this flexibility (typically in the form of higher interest rates on loans or lower interest rates on deposits). But granting these options creates interest rate risk. For example, if interest rates go up, deposit holders will have an incentive to move their funds into investments that enjoy higher returns. If rates go down, many borrowers will pay off their loans so they can refinance at a lower rate.

Another risk associated with rising interest rates is an increased risk of default by borrowers with variable rate loans.

Managing the risk

Banks can apply financial modeling techniques to measure and monitor their interest rate risk. If your interest rate risk is unacceptably high, consider strategies for mitigating it, such as:

  • Adjusting your bank’s mix of assets and liabilities to reduce interest rate risk,
  • Increasing capital to help the bank absorb the impact of fluctuating interest rates,
  • Reducing options risk by controlling the terms of loans and deposits, or
  • Using interest rate swaps or other techniques to hedge against interest rate risk.

Keep in mind that a key component of interest rate risk management is stress testing. (See “Stressing out about interest rate risk” below.)

Look at the big picture

This article focuses on interest rate risk, but it’s important to keep in mind that many of the risks banks face are interrelated. Thus, management of interest rate risk should be incorporated into a bank-wide risk management system.

Sidebar: Stressing out about interest rate risk

The Office of the Comptroller of the Currency (OCC) provides guidance on managing interest rate risk. The guidance urges banks to conduct periodic stress tests that include both scenario analysis and sensitivity analysis. Stress testing can help a bank manage risk by evaluating the possible impact of various adverse external events on a bank’s earnings, capital adequacy, and other financial measures.

Scenario testing examines the potential impact of various hypothetical or historical scenarios — such as rising or falling interest rates — on the bank’s financial performance. Sensitivity analysis estimates the impact of changes in certain assumptions or inputs into a financial model. It helps the bank determine which assumptions have the greatest influence on outcomes and fine-tune its assumptions accordingly.

© 2022

Categories
Financial Institutions and Banking

Bank Wire

New ACH rules issued for “micro-entries”

Earlier this year, the National Automated Clearing House Association (Nacha) adopted rule changes regarding micro-entries — the small ACH credits and debits originators or third-party senders use to validate customer account information. The changes are designed to standardize practices and formatting of micro-entries in order to improve the effectiveness of micro-entries as a means of account validation; better enable identification and monitoring of micro-entries; and improve ACH Network quality.

Effective September 16, 2022, micro-entries are defined as ACH credits of less than one dollar — and any offsetting debits — used for account validation. Credit amounts must equal or exceed debit amounts, and credits and debits must be transmitted to settle at the same time. Originators must use “ACCTVERIFY” in the company entry description field. In addition, the company name must be easily recognizable and similar to the name used in subsequent entries.

Effective March 17, 2023, originators must use commercially reasonable fraud detection, including monitoring micro-entry forward and return volumes.

Proposal would modernize Community Reinvestment Act

Under the Community Reinvestment Act (CRA), federal banking agencies periodically evaluate community banks’ records in meeting their communities’ needs and make those evaluations available to the public. They also consider a bank’s CRA rating when reviewing requests to approve mergers or acquisitions, charters, branch openings, and deposit facilities. Recently, the agencies issued a proposal to modernize their CRA regulations. Among other things, the proposed regulations would: 1) promote expanded access to credit, investment, and basic banking services in low- and moderate-income communities, 2) update CRA assessment areas to include activities associated with online and mobile banking, branchless banking, and hybrid models, and 3) provide greater clarity and consistency by adopting a metrics-based approach to CRA evaluations of retail lending and community development financing.

Black box credit models don’t excuse ECOA non-compliance

The Consumer Financial Protection Bureau (CFPB) has issued a warning to banks and other lenders that use complex algorithms (popularly known as “black box” models) to make credit decisions. A recent CFPB circular warned that the use of these models doesn’t allow lenders to avoid their obligations under the Equal Credit Opportunity Act (ECOA). The act requires lenders to provide applicants with specific reasons for the denial of credit or other adverse actions. The circular makes clear that a lender isn’t relieved of this obligation, even if a black box model prevents it from accurately identifying the specific reasons for an adverse action. According to the circular, “A creditor’s lack of understanding of its own methods is … not a cognizable defense against liability for violating ECOA.”

Contact one of our experts if you have any questions about the new ACH rules, the Community Reinvestment Act, or the Equal Credit Opportunity Act.

Categories
Financial Institutions and Banking

Is Blockchain the Future of Banking?

Blockchain, the technology behind Bitcoin and other cryptocurrencies, has been in the news a great deal in recent months. Headlines about the volatility of cryptocurrencies and their relative lack of regulatory oversight have generated widespread skepticism about the technology. But the uses of blockchain go well beyond cryptocurrency. And its potential benefits for banks have led many to believe that blockchain is poised to transform the industry.

What is blockchain?

The technology that powers blockchain is complex. But the concept is relatively simple: A blockchain is a distributed database (or “ledger”) that’s shared among thousands or even millions of computers or servers, called “nodes,” maintained by independent third parties (individuals or organizations).

The lack of centralized storage or control makes it extremely difficult for someone to tamper with the ledger. It can accept new transactions only if they’re verified by these third parties through established consensus protocols. As a result, the ledger is highly resistant to errors or fraud. In addition, the technology uses encryption and digital signatures to protect participants’ identities.

How can it be used in banking?

Blockchain generates validated, immutable records that are readily available to all parties. This helps establish trust while minimizing the need for intermediaries to authenticate or certify transactions. It’s well suited, therefore, for a variety of banking functions. Here are a few examples:

Processing payments and transfers. Payments and bank transfers, especially international transactions, can be costly and time-consuming. A simple bank transfer must wind its way through a complex system of correspondent banks, custodians, and other intermediaries to reach its destination, adding time and fees to the process. Blockchain makes it possible to clear and settle these transactions almost instantly, often outside traditional banking hours, without the need for multiple intermediaries. Most blockchain-based payments and transfers are made using stablecoins — cryptocurrencies that are tied to the value of a fiat currency, such as the U.S. dollar, thereby limiting volatility.

Verifying customers’ identities. “Know your customer” requirements can make it costly and cumbersome for banks to verify their customers’ identities. By storing customer information on a blockchain, the process can be streamlined. It allows various financial institutions, as well as business units within those institutions, to access and verify customer information while protecting customer privacy.

Processing mortgages and other loans. Blockchain has the potential to streamline loan processing. Using “smart contract” technology to create, store and execute documents, blockchain avoids confusion and errors by ensuring that everyone is working off of the same version of a document. It also prevents anyone from modifying it without alerting others. And if a change or correction is required, it’s added to the blockchain, together with supporting documentation, creating a permanent audit trail.

Blockchain also can greatly speed up the transaction process by automating some tasks. For example, funds can automatically be released from escrow upon verification of specific preconditions, such as title clearances or loan approvals.

Ready for prime time?

These examples are just a few potential uses of blockchain in the banking industry. The technology is still relatively new and might not be quite ready for prime time, especially for community banks. But given the potential benefits — in terms of efficiency, security, and cost savings — it’s definitely worth exploring further.

Contact one of our experts if you have questions about blockchain.